updated audit components

Signed-off-by: Mark Bolwell <[email protected]>

defaults/main.yml

@@ -51,42 +51,60 @@ rhel9stig_workaround_for_ssg_benchmark: true
 # system acts or requires router networking options
 rhel9stig_system_is_router: false
 
-##########################################
+###
+### Settings for associated Audit role using Goss
+###
+
+###########################################
 ### Goss is required on the remote host ###
-## Refer to vars/auditd.yml for any other settings ##
+### vars/auditd.yml for other settings  ###
 
 # Allow audit to setup the requirements including installing git (if option chosen and downloading and adding goss binary to system)
 setup_audit: false
 
 # enable audits to run - this runs the audit and get the latest content
 run_audit: false
+# Run heavy tests - some tests can have more impact on a system enabling these can have greater impact on a system
+audit_run_heavy_tests: true
 
-# Only run Audit do not remediate
+## Only run Audit do not remediate
 audit_only: false
-# As part of audit_only
-# This will enable files to be copied back to control node
+### As part of audit_only ###
+# This will enable files to be copied back to control node in audit_only mode
 fetch_audit_files: false
-# Path to copy the files to will create dir structure
+# Path to copy the files to will create dir structure in audit_only mode
 audit_capture_files_dir: /some/location to copy to on control node
+#############################
 
 # How to retrieve audit binary
 # Options are copy or download - detailed settings at the bottom of this file
 # you will need to access to either github or the file already dowmloaded
 get_audit_binary_method: download
 
+## if get_audit_binary_method - copy the following needs to be updated for your environment
+## it is expected that it will be copied from somewhere accessible to the control node
+## e.g copy from ansible control node to remote host
+audit_bin_copy_location: /some/accessible/path
+
 # how to get audit files onto host options
-# options are git/copy/get_url other e.g. if you wish to run from already downloaded conf
+# options are git/copy/archive/get_url other e.g. if you wish to run from already downloaded conf
 audit_content: git
 
-# Run heavy tests - some tests can have more impact on a system enabling these can have greater impact on a system
-audit_run_heavy_tests: true
+# If using either archive, copy, get_url:
+## Note will work with .tar files - zip will require extra configuration
+### If using get_url this is expecting github url in tar.gz format e.g.
+### https://github.com/ansible-lockdown/UBUNTU22-CIS-Audit/archive/refs/heads/benchmark-v1.0.0.tar.gz
+audit_conf_source: "some path or url to copy from"
+
+# Destination for the audit content to be placed on managed node
+# note may not need full path e.g. /opt with the directory being the {{ benchmark }}-Audit directory
+audit_conf_dest: "/opt"
 
-# This variable specifies the timeout (in ms) for audit commands that
-# take a very long time: if a command takes too long to complete,
-# it will be forcefully terminated after the specified duration.
-audit_cmd_timeout: 120000
+# Where the audit logs are stored
+audit_log_dir: '/opt'
 
-### End Goss enablements ####
+### Goss Settings ##
+####### END ########
 
 #### CAT 1
 rhel_09_211010: true

tasks/LE_audit_setup.yml

@@ -2,33 +2,33 @@
 
 - name: Pre Audit Setup | Set audit package name
   block:
-    - name: Pre Audit Setup | Set audit package name | 64bit
-      ansible.builtin.set_fact:
-        audit_pkg_arch_name: AMD64
-      when: ansible_machine == "x86_64"
+      - name: Pre Audit Setup | Set audit package name | 64bit
+        when: ansible_facts.machine == "x86_64"
+        ansible.builtin.set_fact:
+            audit_pkg_arch_name: AMD64
 
-    - name: Pre Audit Setup | Set audit package name | ARM64
-      ansible.builtin.set_fact:
-        audit_pkg_arch_name: ARM64
-      when: ansible_machine == "arm64"
+      - name: Pre Audit Setup | Set audit package name | ARM64
+        when: ansible_facts.machine == "arm64"
+        ansible.builtin.set_fact:
+            audit_pkg_arch_name: ARM64
 
 - name: Pre Audit Setup | Download audit binary
-  ansible.builtin.get_url:
-    url: "{{ audit_bin_url }}{{ audit_pkg_arch_name }}"
-    dest: "{{ audit_bin }}"
-    owner: root
-    group: root
-    checksum: "{{ audit_bin_version[audit_pkg_arch_name + '_checksum'] }}"
-    mode: '0555'
   when:
-    - get_audit_binary_method == 'download'
+      - get_audit_binary_method == 'download'
+  ansible.builtin.get_url:
+      url: "{{ audit_bin_url }}{{ audit_pkg_arch_name }}"
+      dest: "{{ audit_bin }}"
+      owner: root
+      group: root
+      checksum: "{{ audit_bin_version[audit_pkg_arch_name + '_checksum'] }}"
+      mode: '0555'
 
 - name: Pre Audit Setup | Copy audit binary
-  ansible.builtin.copy:
-    src: "{{ audit_bin_copy_location }}"
-    dest: "{{ audit_bin }}"
-    mode: '0555'
-    owner: root
-    group: root
   when:
-    - get_audit_binary_method == 'copy'
+      - get_audit_binary_method == 'copy'
+  ansible.builtin.copy:
+      src: "{{ audit_bin_copy_location }}"
+      dest: "{{ audit_bin }}"
+      mode: '0555'
+      owner: root
+      group: root

tasks/audit_only.yml

@@ -1,28 +1,28 @@
 ---
 
 - name: Audit_Only | Create local Directories for hosts
+  when: fetch_audit_files
   ansible.builtin.file:
     mode: '0755'
     path: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}"
     recurse: true
     state: directory
-  when: fetch_audit_files
   delegate_to: localhost
   become: false
 
 - name: Audit_only | Get audits from systems and put in group dir
+  when: fetch_audit_files
   ansible.builtin.fetch:
     dest: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}/"
     flat: true
     mode: '0644'
     src: "{{ pre_audit_outfile }}"
-  when: fetch_audit_files
 
 - name: Audit_only | Show Audit Summary
   when:
     - audit_only
   ansible.builtin.debug:
-    msg: "The Audit results are: {{ pre_audit_summary }}."
+    msg: "{{ audit_results.split('\n') }}"
 
 - name: Audit_only | Stop Playbook Audit Only selected
   when:

tasks/main.yml

@@ -95,25 +95,6 @@
   ansible.builtin.import_tasks:
     file: prelim.yml
 
-- name: Include audit specific variables
-  when:
-    - run_audit or audit_only
-    - setup_audit
-  tags:
-    - setup_audit
-    - run_audit
-  ansible.builtin.include_vars:
-    file: audit.yml
-
-- name: Include pre-remediation audit tasks
-  when:
-    - run_audit or audit_only
-    - setup_audit
-  tags:
-    - run_audit
-  ansible.builtin.import_tasks:
-    file: pre_remediation_audit.yml
-
 - name: Include CAT I patches
   when:
     - rhel9stig_cat1

tasks/post_remediation_audit.yml

@@ -1,14 +1,14 @@
 ---
 
 - name: Post Audit | Run post_remediation {{ benchmark }} audit
-  ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -o {{ post_audit_outfile }} -g {{ group_names }}"
+  ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -f {{ audit_format }} -o {{ post_audit_outfile }} -g \"{{ group_names }}\""
   changed_when: true
   environment:
     AUDIT_BIN: "{{ audit_bin }}"
-    AUDIT_CONTENT_LOCATION: "{{ audit_out_dir }}"
+    AUDIT_CONTENT_LOCATION: "{{ audit_conf_dest | default('/opt') }}"
     AUDIT_FILE: goss.yml
 
-- name: Post Audit | ensure audit files readable by users
+- name: Post Audit | Ensure audit files readable by users
   ansible.builtin.file:
     path: "{{ item }}"
     mode: '0644'
@@ -21,26 +21,26 @@
   when:
     - audit_format == "json"
   block:
-    - name: capture data {{ post_audit_outfile }}
-      ansible.builtin.shell: cat {{ post_audit_outfile }}
-      register: post_audit
+    - name: Post Audit | Capture data {{ post_audit_outfile }}
+      ansible.builtin.shell: "cat {{ post_audit_outfile }}"
+      register: discovered_post_audit
       changed_when: false
 
-    - name: Capture post-audit result
+    - name: Post Audit | Capture post-audit result
       ansible.builtin.set_fact:
-        post_audit_summary: "{{ post_audit.stdout | from_json | json_query(summary) }}"
+        post_audit_summary: "{{ discovered_post_audit.stdout | from_json | json_query(summary) }}"
       vars:
         summary: summary."summary-line"
 
 - name: Post Audit | Capture audit data if documentation format
   when:
     - audit_format == "documentation"
   block:
-    - name: Post Audit | capture data {{ post_audit_outfile }}
-      ansible.builtin.shell: tail -2 {{ post_audit_outfile }}
-      register: post_audit
+    - name: Post Audit | Capture data {{ post_audit_outfile }}
+      ansible.builtin.shell: "tail -2 {{ post_audit_outfile }}"
+      register: discovered_post_audit
       changed_when: false
 
     - name: Post Audit | Capture post-audit result
       ansible.builtin.set_fact:
-        post_audit_summary: "{{ post_audit.stdout_lines }}"
+        post_audit_summary: "{{ discovered_post_audit.stdout_lines }}"

tasks/pre_remediation_audit.yml

@@ -5,7 +5,8 @@
     - setup_audit
   tags:
     - setup_audit
-  ansible.builtin.include_tasks: LE_audit_setup.yml
+  ansible.builtin.include_tasks:
+    file: LE_audit_setup.yml
 
 - name: Pre Audit Setup | Ensure {{ audit_conf_dir }} exists
   ansible.builtin.file:
@@ -32,23 +33,25 @@
   when:
     - audit_content == 'copy'
   ansible.builtin.copy:
-    src: "{{ audit_local_copy }}"
+    src: "{{ audit_conf_source }}"
     dest: "{{ audit_conf_dest }}"
     mode: preserve
 
 - name: Pre Audit Setup | Unarchive audit content files on server
   when:
-    - audit_content == 'archived'
+    - audit_content == 'archive'
   ansible.builtin.unarchive:
-    src: "{{ audit_conf_copy  }}"
-    dest: "{{ audit_conf_dir }}"
+    src: "{{ audit_conf_source }}"
+    dest: "{{ audit_conf_dest }}"
 
 - name: Pre Audit Setup | Get audit content from url
   when:
     - audit_content == 'get_url'
-  ansible.builtin.get_url:
-    url: "{{ audit_files_url }}"
-    dest: "{{ audit_conf_dir }}"
+  ansible.builtin.unarchive:
+    src: "{{ audit_conf_source }}"
+    dest: "{{ audit_conf_dest }}/{{ benchmark }}-Audit"
+    remote_src: "{{ ( audit_conf_source is contains ('http'))| ternary(true, false ) }}"
+    extra_opts: "{{ (audit_conf_source is contains ('github')) | ternary('--strip-components=1', [] ) }}"
 
 - name: Pre Audit Setup | Check Goss is available
   when:
@@ -57,61 +60,62 @@
     - name: Pre Audit Setup | Check for goss file
       ansible.builtin.stat:
         path: "{{ audit_bin }}"
-      register: goss_available
+      register: discovered_goss_available
 
     - name: Pre Audit Setup | If audit ensure goss is available
       ansible.builtin.assert:
-        that: goss_available.stat.exists
+        that: discovered_goss_available.stat.exists
         msg: "Audit has been selected: unable to find goss binary at {{ audit_bin }}"
 
 - name: Pre Audit Setup | Copy ansible default vars values to test audit
+  when:
+    - run_audit
   tags:
     - goss_template
     - run_audit
-  when:
-    - run_audit
   ansible.builtin.template:
     src: ansible_vars_goss.yml.j2
     dest: "{{ audit_vars_path }}"
     mode: '0600'
 
 - name: Pre Audit | Run pre_remediation {{ benchmark }} audit
-  ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -o {{ pre_audit_outfile }} -g {{ group_names }}"
+  ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -f {{ audit_format }} -o {{ pre_audit_outfile }} -g \"{{ group_names }}\""
   changed_when: true
   environment:
     AUDIT_BIN: "{{ audit_bin }}"
-    AUDIT_CONTENT_LOCATION: "{{ audit_out_dir }}"
+    AUDIT_CONTENT_LOCATION: "{{ audit_conf_dest | default('/opt') }}"
     AUDIT_FILE: goss.yml
 
 - name: Pre Audit | Capture audit data if json format
   when:
     - audit_format == "json"
   block:
-    - name: capture data {{ pre_audit_outfile }}
-      ansible.builtin.shell: cat {{ pre_audit_outfile }}
-      register: pre_audit
+    - name: Pre Audit | Capture data {{ pre_audit_outfile }}
+      ansible.builtin.shell: "cat {{ pre_audit_outfile }}"
+      register: discovered_pre_audit
       changed_when: false
 
     - name: Pre Audit | Capture pre-audit result
       ansible.builtin.set_fact:
-        pre_audit_summary: "{{ pre_audit.stdout | from_json | json_query(summary) }}"
+        pre_audit_summary: "{{ discovered_pre_audit.stdout | from_json | json_query(summary) }}"
       vars:
         summary: summary."summary-line"
 
 - name: Pre Audit | Capture audit data if documentation format
   when:
     - audit_format == "documentation"
   block:
-    - name: Pre Audit | capture data {{ pre_audit_outfile }} | documentation format
-      ansible.builtin.shell: tail -2 {{ pre_audit_outfile }}
-      register: pre_audit
+    - name: Pre Audit | Capture data {{ pre_audit_outfile }} | documentation format
+      ansible.builtin.shell: "tail -2 {{ pre_audit_outfile }}"
+      register: discovered_pre_audit
       changed_when: false
 
     - name: Pre Audit | Capture pre-audit result | documentation format
       ansible.builtin.set_fact:
-        pre_audit_summary: "{{ pre_audit.stdout_lines }}"
+        pre_audit_summary: "{{ discovered_pre_audit.stdout_lines }}"
 
 - name: Audit_Only | Run Audit Only
   when:
     - audit_only
-  ansible.builtin.import_tasks: audit_only.yml
+  ansible.builtin.import_tasks:
+    file: audit_only.yml

tasks/prelim.yml

@@ -40,6 +40,25 @@
   tags:
     - always
 
+- name: Include audit specific variables
+  when:
+    - run_audit or audit_only
+    - setup_audit
+  tags:
+    - setup_audit
+    - run_audit
+  ansible.builtin.include_vars:
+    file: audit.yml
+
+- name: Include pre-remediation audit tasks
+  when:
+    - run_audit or audit_only
+    - setup_audit
+  tags:
+    - run_audit
+  ansible.builtin.import_tasks:
+    file: pre_remediation_audit.yml
+
 - name: PRELIM | Interactive User account home
   ansible.builtin.shell: 'cat /etc/passwd | grep -Ev "nologin|/sbin" | cut -d: -f6'
   changed_when: false