updated

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/audit_only.yml

@@ -1,28 +1,28 @@
 ---
 
 - name: Audit_Only | Create local Directories for hosts
+  when: fetch_audit_files
   ansible.builtin.file:
     mode: '0755'
     path: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}"
     recurse: true
     state: directory
-  when: fetch_audit_files
   delegate_to: localhost
   become: false
 
 - name: Audit_only | Get audits from systems and put in group dir
+  when: fetch_audit_files
   ansible.builtin.fetch:
     dest: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}/"
     flat: true
     mode: '0644'
     src: "{{ pre_audit_outfile }}"
-  when: fetch_audit_files
 
 - name: Audit_only | Show Audit Summary
   when:
     - audit_only
   ansible.builtin.debug:
-      msg: "The Audit results are: {{ pre_audit_summary }}."
+    msg: "{{ audit_results.split('\n') }}"
 
 - name: Audit_only | Stop Playbook Audit Only selected
   when:

tasks/pre_remediation_audit.yml

@@ -63,16 +63,17 @@
       register: goss_available
 
     - name: Pre Audit Setup | If audit ensure goss is available
+      when:
+        - not goss_available.stat.exists
       ansible.builtin.assert:
-        that: goss_available.stat.exists
         msg: "Audit has been selected: unable to find goss binary at {{ audit_bin }}"
 
 - name: Pre Audit Setup | Copy ansible default vars values to test audit
+  when:
+    - run_audit
   tags:
     - goss_template
     - run_audit
-  when:
-    - run_audit
   ansible.builtin.template:
     src: ansible_vars_goss.yml.j2
     dest: "{{ audit_vars_path }}"

vars/main.yml

@@ -12,9 +12,19 @@ rhel9cis_allowed_crypto_policies_modules:
   - 'AD-SUPPORT'
   - 'AD-SUPPORT-LEGACY'
   - 'NO-SHA1'
+  - 'NO-SSHCBC'
+  - 'NO-SSHETM'
+  - 'NO-SSHWEAKCIPHER'
+  - 'NO-SSHWEAKMAC'
+  - 'NO-WEAKMAC'
 
 # Used to control warning summary
 warn_control_list: ""
 warn_count: 0
 
 gpg_key_package: "{{ ansible_facts.distribution | lower }}-gpg-keys"
+
+## Control 6.3.3.x - Audit template
+# This variable governs if the auditd logic should be executed(if value is true).
+# NOTE: The current default value is likely to be overriden(via 'set_fact') by other further tasks(in sub-section 'Auditd rules').
+update_audit_template: false