sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

updated checks to assertions

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2022-01-13 11:40:59 +00:00
parent 819c942d8f
commit e9a390c693
No known key found for this signature in database
GPG key ID: F734FDFC154B83FB
1 changed files with 13 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

22
tasks/main.yml
View file

@ -1,25 +1,29 @@
--- ---
# tasks file for RHEL9-CIS # tasks file for RHEL9-CIS
- name: Check OS version and family - name: Check OS version and family
fail: assert:
msg: "This role can only be run against RHEL 8 or 9. {{ ansible_distribution }} {{ ansible_distribution_major_version }} is not supported." that:
when: - ansible_os_family == 'RedHat'
- ansible_os_family == 'RedHat' - ansible_distribution_major_version |int >= 8
- ansible_distribution_major_version == 8 or fail_msg: "This role can only be run against RHEL 8 or 9. {{ ansible_distribution }} {{ ansible_distribution_major_version }} is not supported."
ansible_distribution_major_version == 9 success_msg: "Supported OS release and version"
tags: tags:
- always - always
- name: Check ansible version - name: Check ansible version
fail: assert:
msg: You must use ansible 2.9 or greater that:
when: not ansible_version.full is version_compare('2.9', '>=') - "ansible_version.full is version_compare ('2.9', '>=')"
fail_msg: "You must use ansible 2.9 or greater"
success_msg: "Supported ansible_version"
tags: tags:
- always - always
- name: Check crypto-policy input - name: Check crypto-policy input
assert: assert:
that: rhel9cis_crypto_policy in rhel9cis_allowed_crypto_policies that: rhel9cis_crypto_policy in rhel9cis_allowed_crypto_policies
fail_msg: "Crypto policy is not a permitted version"
success_msg: "Crypto policy is a permitted version"
- name: Check rhel9cis_bootloader_password_hash variable has been changed - name: Check rhel9cis_bootloader_password_hash variable has been changed
assert: assert: