schurziandSebastian Gumprich
a75e2c028b
* change inclusion of os specific defaults we now include the os specific options into a separate variable and merge this with the default ansible namespace, when the corresponding keys do not already exist (eg. are defined by default oder by user) Signed-off-by: Martin Schurz <[email protected]> * simplify check for os specific variables Signed-off-by: Martin Schurz <[email protected]> * add test for variable override Signed-off-by: Martin Schurz <[email protected]> * move tests to verify stage Signed-off-by: Martin Schurz <[email protected]> * correct grep Signed-off-by: Martin Schurz <[email protected]> * linting Signed-off-by: Martin Schurz <[email protected]> * fix typo Signed-off-by: Martin Schurz <[email protected]> * Revert "Merge pull request #351 from sprat/fix-umask" This reverts commit9e8e0bc8fb, reversing changes made to98c7553016. Signed-off-by: Martin Schurz <[email protected]> * move immutable ssh vars to internal vars Signed-off-by: Martin Schurz <[email protected]> * move vars to OS files Signed-off-by: Martin Schurz <[email protected]> * change default handling for all roles Signed-off-by: Martin Schurz <[email protected]> * fix issues Signed-off-by: Martin Schurz <[email protected]> * add documentation Signed-off-by: Martin Schurz <[email protected]> * Update main.yml Co-authored-by: Sebastian Gumprich <[email protected]>
73 lines
2.0 KiB
YAML
73 lines
2.0 KiB
YAML
---
|
|
- name: Verify
|
|
hosts: all
|
|
become: true
|
|
roles:
|
|
- geerlingguy.git
|
|
tasks:
|
|
- name: install fake SuSE-release for cinc compatibility
|
|
copy:
|
|
content: |
|
|
openSUSE Faked Enterprise 2020 (x86_64)
|
|
VERSION = 2020
|
|
CODENAME = Faked Feature
|
|
dest: /etc/SuSE-release
|
|
owner: root
|
|
group: root
|
|
mode: '0444'
|
|
when: ansible_facts.os_family == 'Suse'
|
|
|
|
- name: install git for SuSE since geerlinguy.git does not support it
|
|
zypper:
|
|
name: git
|
|
state: present
|
|
when: ansible_facts.os_family == 'Suse'
|
|
|
|
- name: Run the equivalent of "apt-get update" as a separate step
|
|
apt:
|
|
update_cache: true
|
|
when: ansible_facts.os_family == 'Debian'
|
|
|
|
- name: install required tools on debian
|
|
apt:
|
|
name: procps
|
|
when: ansible_facts.os_family == 'Debian'
|
|
|
|
- name: download cinc-auditor
|
|
get_url:
|
|
url: https://omnitruck.cinc.sh/install.sh
|
|
dest: /tmp/install.sh
|
|
mode: '0775'
|
|
|
|
- name: install cinc-auditor
|
|
shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
|
|
|
|
- name: Execute cinc-auditor tests
|
|
command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline.git"
|
|
register: test_results
|
|
changed_when: false
|
|
ignore_errors: true
|
|
|
|
- name: Display details about the cinc-auditor results
|
|
debug:
|
|
msg: "{{ test_results.stdout_lines }}"
|
|
|
|
- name: Fail when tests fail
|
|
fail:
|
|
msg: "Inspec failed to validate"
|
|
when: test_results.rc != 0
|
|
|
|
# test if variable can be overridden
|
|
- name: workaround for https://github.com/ansible/ansible/issues/66304
|
|
set_fact:
|
|
ansible_virtualization_type: "docker"
|
|
os_env_umask: "027 #override"
|
|
|
|
- include_role:
|
|
name: os_hardening
|
|
|
|
- name: verify os_env_umask
|
|
shell:
|
|
cmd: "grep '027 #override' /etc/login.defs"
|
|
changed_when: false
|