mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-24 22:23:06 +00:00
April_24 updates (#201)
* Issue #170, PR #181 thanks to @ipruteanu-sie Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * issue #182, PR #183 thansk to @ipruteanu-sie Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * PR #180 thanks to @ipruteanu-sie and @raabf Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Addressed PR #165 thanks to @ipruteanu-sie Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * PT #184 addressed thansk to @ipruteanu-sie Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated credits Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * typo and ssh allow_deny comments Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * enable OS check Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * PR - #198 addressed thanks to @brakkio86 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Addressed issue #190 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Additional vars for issue #190 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated pre-commit version Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * consistent quotes around mode Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * moved audit added discoveries Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * removed unneeded vars Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * audit moved to prelim Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * tidy up Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * improved new variable usage Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * fixed logic 6.2.10 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * addressed #197 thanks to @mark-tomich Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updates for audit section Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * fixed naming Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * added prelim to includes Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> --------- Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
uk-bolly
GitHub
parent
e87d637eb2
commit
f8fcfe0e78
12 changed files with 250 additions and 195 deletions
|
|
@ -5,7 +5,8 @@
|
|||
- setup_audit
|
||||
tags:
|
||||
- setup_audit
|
||||
ansible.builtin.include_tasks: LE_audit_setup.yml
|
||||
ansible.builtin.include_tasks:
|
||||
file: LE_audit_setup.yml
|
||||
|
||||
- name: Pre Audit Setup | Ensure {{ audit_conf_dir }} exists
|
||||
ansible.builtin.file:
|
||||
|
|
@ -32,23 +33,25 @@
|
|||
when:
|
||||
- audit_content == 'copy'
|
||||
ansible.builtin.copy:
|
||||
src: "{{ audit_conf_copy }}"
|
||||
dest: "{{ audit_conf_dir }}"
|
||||
src: "{{ audit_conf_source }}"
|
||||
dest: "{{ audit_conf_dest }}"
|
||||
mode: preserve
|
||||
|
||||
- name: Pre Audit Setup | Unarchive audit content files on server
|
||||
when:
|
||||
- audit_content == 'archived'
|
||||
- audit_content == 'archive'
|
||||
ansible.builtin.unarchive:
|
||||
src: "{{ audit_conf_copy }}"
|
||||
dest: "{{ audit_conf_dir }}"
|
||||
src: "{{ audit_conf_source }}"
|
||||
dest: "{{ audit_conf_dest }}"
|
||||
|
||||
- name: Pre Audit Setup | Get audit content from url
|
||||
when:
|
||||
- audit_content == 'get_url'
|
||||
ansible.builtin.get_url:
|
||||
url: "{{ audit_files_url }}"
|
||||
dest: "{{ audit_conf_dir }}"
|
||||
ansible.builtin.unarchive:
|
||||
src: "{{ audit_conf_source }}"
|
||||
dest: "{{ audit_conf_dest }}/{{ benchmark }}-Audit"
|
||||
remote_src: "{{ ( audit_conf_source is contains ('http'))| ternary(true, false ) }}"
|
||||
extra_opts: "{{ (audit_conf_source is contains ('github')) | ternary('--strip-components=1', [] ) }}"
|
||||
|
||||
- name: Pre Audit Setup | Check Goss is available
|
||||
when:
|
||||
|
|
@ -77,25 +80,25 @@
|
|||
mode: '0600'
|
||||
|
||||
- name: Pre Audit | Run pre_remediation {{ benchmark }} audit
|
||||
ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -o {{ pre_audit_outfile }} -g {{ group_names }}"
|
||||
ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -f {{ audit_format }} -o {{ pre_audit_outfile }} -g \"{{ group_names }}\""
|
||||
changed_when: true
|
||||
environment:
|
||||
AUDIT_BIN: "{{ audit_bin }}"
|
||||
AUDIT_CONTENT_LOCATION: "{{ audit_out_dir }}"
|
||||
AUDIT_CONTENT_LOCATION: "{{ audit_conf_dest | default('/opt') }}"
|
||||
AUDIT_FILE: goss.yml
|
||||
|
||||
- name: Pre Audit | Capture audit data if json format
|
||||
when:
|
||||
- audit_format == "json"
|
||||
block:
|
||||
- name: capture data {{ pre_audit_outfile }}
|
||||
ansible.builtin.shell: cat {{ pre_audit_outfile }}
|
||||
- name: Pre Audit | Capture data {{ pre_audit_outfile }}
|
||||
ansible.builtin.shell: "cat {{ pre_audit_outfile }}"
|
||||
register: pre_audit
|
||||
changed_when: false
|
||||
|
||||
- name: Pre Audit | Capture pre-audit result
|
||||
ansible.builtin.set_fact:
|
||||
pre_audit_summary: "{{ pre_audit.stdout | from_json | community.general.json_query(summary) }}"
|
||||
pre_audit_summary: "{{ pre_audit.stdout | from_json | json_query(summary) }}"
|
||||
vars:
|
||||
summary: summary."summary-line"
|
||||
|
||||
|
|
@ -103,8 +106,8 @@
|
|||
when:
|
||||
- audit_format == "documentation"
|
||||
block:
|
||||
- name: Pre Audit | capture data {{ pre_audit_outfile }} | documentation format
|
||||
ansible.builtin.shell: tail -2 {{ pre_audit_outfile }}
|
||||
- name: Pre Audit | Capture data {{ pre_audit_outfile }} | documentation format
|
||||
ansible.builtin.shell: "tail -2 {{ pre_audit_outfile }}"
|
||||
register: pre_audit
|
||||
changed_when: false
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue