-
Notifications
You must be signed in to change notification settings - Fork 93
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #120 from ansible-lockdown/audit_only
Audit only enhancement and goss update
- Loading branch information
Showing
9 changed files
with
175 additions
and
104 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| --- | ||
|
|
||
| - name: Audit_Only | Create local Directories for hosts | ||
| ansible.builtin.file: | ||
| mode: '0755' | ||
| path: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}" | ||
| recurse: true | ||
| state: directory | ||
| when: fetch_audit_files | ||
| delegate_to: localhost | ||
| become: false | ||
|
|
||
| - name: Audit_only | Get audits from systems and put in group dir | ||
| ansible.builtin.fetch: | ||
| dest: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}/" | ||
| flat: true | ||
| mode: '0644' | ||
| src: "{{ pre_audit_outfile }}" | ||
| when: fetch_audit_files | ||
|
|
||
| - name: Audit_only | Show Audit Summary | ||
| when: | ||
| - audit_only | ||
| ansible.builtin.debug: | ||
| msg: "The Audit results are: {{ pre_audit_summary }}." | ||
|
|
||
| - name: Audit_only | Stop Playbook Audit Only selected | ||
| when: | ||
| - audit_only | ||
| ansible.builtin.meta: end_play |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,113 +1,118 @@ | ||
| --- | ||
|
|
||
| - name: Pre Audit Binary Setup | Setup the LE audit | ||
| ansible.builtin.include_tasks: LE_audit_setup.yml | ||
| - name: Pre Audit Setup | Setup the LE audit | ||
| when: | ||
| - setup_audit | ||
| tags: | ||
| - setup_audit | ||
| ansible.builtin.include_tasks: LE_audit_setup.yml | ||
|
|
||
| - name: "Pre Audit Setup | Ensure {{ audit_conf_dir }} exists" | ||
| - name: Pre Audit Setup | Ensure {{ audit_conf_dir }} exists | ||
| ansible.builtin.file: | ||
| path: "{{ audit_conf_dir }}" | ||
| state: directory | ||
| mode: '0755' | ||
|
|
||
| - name: Pre Audit Setup | If using git for content set up | ||
| when: | ||
| - audit_content == 'git' | ||
| block: | ||
| - name: Pre Audit Setup | Install git | ||
| ansible.builtin.package: | ||
| name: git | ||
| state: present | ||
|
|
||
| - name: Pre Audit Setup | retrieve audit content files from git | ||
| - name: Pre Audit Setup | Retrieve audit content files from git | ||
| ansible.builtin.git: | ||
| repo: "{{ audit_file_git }}" | ||
| dest: "{{ audit_conf_dir }}" | ||
| version: "{{ audit_git_version }}" | ||
| when: | ||
| - audit_content == 'git' | ||
|
|
||
| - name: Pre Audit Setup | copy to audit content files to server | ||
| - name: Pre Audit Setup | Copy to audit content files to server | ||
| when: | ||
| - audit_content == 'copy' | ||
| ansible.builtin.copy: | ||
| src: "{{ audit_local_copy }}" | ||
| dest: "{{ audit_conf_dest }}" | ||
| mode: preserve | ||
| when: | ||
| - audit_content == 'copy' | ||
|
|
||
| - name: Pre Audit Setup | unarchive audit content files on server | ||
| - name: Pre Audit Setup | Unarchive audit content files on server | ||
| when: | ||
| - audit_content == 'archived' | ||
| ansible.builtin.unarchive: | ||
| src: "{{ audit_conf_copy }}" | ||
| dest: "{{ audit_conf_dir }}" | ||
| when: | ||
| - audit_content == 'archived' | ||
|
|
||
| - name: Pre Audit Setup | get audit content from url | ||
| - name: Pre Audit Setup | Get audit content from url | ||
| when: | ||
| - audit_content == 'get_url' | ||
| ansible.builtin.get_url: | ||
| url: "{{ audit_files_url }}" | ||
| dest: "{{ audit_conf_dir }}" | ||
| when: | ||
| - audit_content == 'get_url' | ||
|
|
||
| - name: Pre Audit Setup | Check Goss is available | ||
| when: | ||
| - run_audit | ||
| block: | ||
| - name: Pre Audit Setup | Check for goss file | ||
| ansible.builtin.stat: | ||
| path: "{{ audit_bin }}" | ||
| register: goss_available | ||
|
|
||
| - name: Pre Audit Setup | If audit ensure goss is available | ||
| ansible.builtin.assert: | ||
| msg: "Audit has been selected: unable to find goss binary at {{ audit_bin }}" | ||
| when: | ||
| - not goss_available.stat.exists | ||
| when: | ||
| - run_audit | ||
| ansible.builtin.assert: | ||
| msg: "Audit has been selected: unable to find goss binary at {{ audit_bin }}" | ||
|
|
||
| - name: Pre Audit Setup | Copy ansible default vars values to test audit | ||
| tags: | ||
| - goss_template | ||
| - run_audit | ||
| when: | ||
| - run_audit | ||
| ansible.builtin.template: | ||
| src: ansible_vars_goss.yml.j2 | ||
| dest: "{{ audit_vars_path }}" | ||
| mode: '0600' | ||
| when: | ||
| - run_audit | ||
| tags: | ||
| - goss_template | ||
| - always | ||
|
|
||
| - name: "Pre Audit | Run pre_remediation {{ benchmark }} audit" | ||
| - name: Pre Audit | Run pre_remediation {{ benchmark }} audit | ||
| ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -o {{ pre_audit_outfile }} -g {{ group_names }}" | ||
| changed_when: true | ||
| environment: | ||
| AUDIT_BIN: "{{ audit_bin }}" | ||
| AUDIT_CONTENT_LOCATION: "{{ audit_out_dir }}" | ||
| AUDIT_FILE: "goss.yml" | ||
| AUDIT_FILE: goss.yml | ||
|
|
||
| - name: Pre Audit | Capture audit data if json format | ||
| when: | ||
| - audit_format == "json" | ||
| block: | ||
| - name: "capture data {{ pre_audit_outfile }}" | ||
| ansible.builtin.shell: "cat {{ pre_audit_outfile }}" | ||
| - name: capture data {{ pre_audit_outfile }} | ||
| ansible.builtin.shell: cat {{ pre_audit_outfile }} | ||
| register: pre_audit | ||
| changed_when: false | ||
|
|
||
| - name: Pre Audit | Capture pre-audit result | ||
| ansible.builtin.set_fact: | ||
| pre_audit_summary: "{{ pre_audit.stdout | from_json | json_query(summary) }}" | ||
| vars: | ||
| summary: 'summary."summary-line"' | ||
| when: | ||
| - audit_format == "json" | ||
| summary: summary."summary-line" | ||
|
|
||
| - name: Pre Audit | Capture audit data if documentation format | ||
| when: | ||
| - audit_format == "documentation" | ||
| block: | ||
| - name: "Pre Audit | capture data {{ pre_audit_outfile }} | documentation format" | ||
| ansible.builtin.shell: "tail -2 {{ pre_audit_outfile }}" | ||
| - name: Pre Audit | capture data {{ pre_audit_outfile }} | documentation format | ||
| ansible.builtin.shell: tail -2 {{ pre_audit_outfile }} | ||
| register: pre_audit | ||
| changed_when: false | ||
|
|
||
| - name: Pre Audit | Capture pre-audit result | documentation format | ||
| ansible.builtin.set_fact: | ||
| pre_audit_summary: "{{ pre_audit.stdout_lines }}" | ||
|
|
||
| - name: Audit_Only | Run Audit Only | ||
| when: | ||
| - audit_format == "documentation" | ||
| - audit_only | ||
| ansible.builtin.import_tasks: audit_only.yml |
Oops, something went wrong.