-
Notifications
You must be signed in to change notification settings - Fork 68
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'ansible-lockdown:devel' into devel
- Loading branch information
Showing
17 changed files
with
261 additions
and
201 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,22 +1,34 @@ | ||
| --- | ||
|
|
||
| - name: Pre Audit Setup | Set audit package name | ||
| block: | ||
| - name: Pre Audit Setup | Set audit package name | 64bit | ||
| ansible.builtin.set_fact: | ||
| audit_pkg_arch_name: AMD64 | ||
| when: ansible_facts.machine == "x86_64" | ||
|
|
||
| - name: Pre Audit Setup | Set audit package name | ARM64 | ||
| ansible.builtin.set_fact: | ||
| audit_pkg_arch_name: ARM64 | ||
| when: ansible_facts.machine == "arm64" | ||
|
|
||
| - name: Pre Audit Setup | Download audit binary | ||
| ansible.builtin.get_url: | ||
| url: "{{ audit_bin_url }}" | ||
| url: "{{ audit_bin_url }}{{ audit_pkg_arch_name }}" | ||
| dest: "{{ audit_bin }}" | ||
| owner: root | ||
| group: root | ||
| checksum: "{{ audit_bin_version.checksum }}" | ||
| checksum: "{{ audit_bin_version[audit_pkg_arch_name + '_checksum'] }}" | ||
| mode: '0555' | ||
| when: | ||
| - get_audit_binary_method == 'download' | ||
|
|
||
| - name: Pre Audit Setup | copy audit binary | ||
| - name: Pre Audit Setup | Copy audit binary | ||
| ansible.builtin.copy: | ||
| src: "{{ audit_bin_copy_location }}" | ||
| dest: "{{ audit_bin }}" | ||
| mode: '0555' | ||
| owner: root | ||
| group: root | ||
| mode: '0555' | ||
| when: | ||
| - get_audit_binary_method == 'copy' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| --- | ||
|
|
||
| - name: Audit_Only | Create local Directories for hosts | ||
| ansible.builtin.file: | ||
| mode: '0755' | ||
| path: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}" | ||
| recurse: true | ||
| state: directory | ||
| when: fetch_audit_files | ||
| delegate_to: localhost | ||
| become: false | ||
|
|
||
| - name: Audit_only | Get audits from systems and put in group dir | ||
| ansible.builtin.fetch: | ||
| dest: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}/" | ||
| flat: true | ||
| mode: '0644' | ||
| src: "{{ pre_audit_outfile }}" | ||
| when: fetch_audit_files | ||
|
|
||
| - name: Audit_only | Show Audit Summary | ||
| when: | ||
| - audit_only | ||
| ansible.builtin.debug: | ||
| msg: "The Audit results are: {{ pre_audit_summary }}." | ||
|
|
||
| - name: Audit_only | Stop Playbook Audit Only selected | ||
| when: | ||
| - audit_only | ||
| ansible.builtin.meta: end_play |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,56 +1,46 @@ | ||
| --- | ||
|
|
||
| - name: Post Audit | Run post_remediation {{ benchmark }} audit | ||
| ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -o {{ post_audit_outfile }} -g {{ group_names }}" | ||
| changed_when: true | ||
| environment: | ||
| AUDIT_BIN: "{{ audit_bin }}" | ||
| AUDIT_CONTENT_LOCATION: "{{ audit_out_dir }}" | ||
| AUDIT_FILE: goss.yml | ||
|
|
||
| - name: Post Audit | ensure audit files readable by users | ||
| ansible.builtin.file: | ||
| path: "{{ item }}" | ||
| mode: '0644' | ||
| state: file | ||
| loop: | ||
| - "{{ post_audit_outfile }}" | ||
| - "{{ pre_audit_outfile }}" | ||
|
|
||
| - name: Post Audit | Capture audit data if json format | ||
| when: | ||
| - audit_format == "json" | ||
| block: | ||
|
|
||
| - name: "Post Audit | Run post_remediation {{ benchmark }} audit" | ||
| ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -o {{ post_audit_outfile }} -g {{ group_names }}" | ||
| changed_when: true | ||
| environment: | ||
| AUDIT_BIN: "{{ audit_bin }}" | ||
| AUDIT_CONTENT_LOCATION: "{{ audit_out_dir }}" | ||
| AUDIT_FILE: "goss.yml" | ||
|
|
||
| - name: "Capture data {{ post_audit_outfile }}" | ||
| ansible.builtin.shell: "cat {{ post_audit_outfile }}" | ||
| - name: capture data {{ post_audit_outfile }} | ||
| ansible.builtin.shell: cat {{ post_audit_outfile }} | ||
| register: post_audit | ||
| changed_when: false | ||
|
|
||
| - name: Capture post-audit result | ||
| ansible.builtin.set_fact: | ||
| post_audit_summary: "{{ post_audit.stdout | from_json | json_query(summary) }}" | ||
| vars: | ||
| summary: 'summary."summary-line"' | ||
| when: | ||
| - audit_format == "json" | ||
| summary: summary."summary-line" | ||
|
|
||
| - name: Post Audit | Capture audit data if documentation format | ||
| when: | ||
| - audit_format == "documentation" | ||
| block: | ||
|
|
||
| - name: "Post Audit | Run post_remediation {{ benchmark }} audit" | ||
| ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -o {{ post_audit_outfile }} -g {{ group_names }} -f documentation" | ||
| changed_when: true | ||
| environment: | ||
| AUDIT_BIN: "{{ audit_bin }}" | ||
| AUDIT_CONTENT_LOCATION: "{{ audit_out_dir }}" | ||
| AUDIT_FILE: "goss.yml" | ||
|
|
||
| - name: "Post Audit | Capture data {{ post_audit_outfile }}" | ||
| ansible.builtin.shell: "tail -2 {{ post_audit_outfile }}" | ||
| - name: Post Audit | capture data {{ post_audit_outfile }} | ||
| ansible.builtin.shell: tail -2 {{ post_audit_outfile }} | ||
| register: post_audit | ||
| changed_when: false | ||
|
|
||
| - name: Post Audit | Capture post-audit result | ||
| ansible.builtin.set_fact: | ||
| post_audit_summary: "{{ post_audit.stdout_lines }}" | ||
| when: | ||
| - audit_format == "documentation" | ||
|
|
||
| - name: Post Audit | Ensure audit files readable by users | ||
| ansible.builtin.file: | ||
| path: "{{ item }}" | ||
| mode: '0644' | ||
| state: file | ||
| loop: | ||
| - "{{ post_audit_outfile }}" | ||
| - "{{ pre_audit_outfile }}" |
Oops, something went wrong.