@@ -26,25 +26,46 @@ python2_bin: /bin/python2.7
2626benchmark : RHEL7-CIS
2727benchmark_version : v3.1.1
2828
29- # ### Basic external goss audit enablement settings ####
30- # ### Precise details - per setting can be found at the bottom of this file ####
29+ # #########################################
30+ # ## Goss is required on the remote host ###
31+ # # Refer to vars/auditd.yml for any other settings ##
3132
32- # ## Goss is required on the remote host
33+ # Allow audit to setup the requirements including installing git (if option chosen and downloading and adding goss binary to system)
3334setup_audit : false
34- # How to retrive goss
35+
36+ # enable audits to run - this runs the audit and get the latest content
37+ run_audit : false
38+
39+ # Only run Audit do not remediate
40+ audit_only : false
41+ # As part of audit_only
42+ # This will enable files to be copied back to control node
43+ fetch_audit_files : false
44+ # Path to copy the files to will create dir structure
45+ audit_capture_files_dir : /some/location to copy to on control node
46+
47+ # How to retrieve audit binary
3548# Options are copy or download - detailed settings at the bottom of this file
3649# you will need to access to either github or the file already dowmloaded
37- get_goss_file : download
50+ get_audit_binary_method : download
51+
52+ # # if get_audit_binary_method - copy the following needs to be updated for your environment
53+ # # it is expected that it will be copied from somewhere accessible to the control node
54+ # # e.g copy from ansible control node to remote host
55+ audit_bin_copy_location : /some/accessible/path
3856
3957# how to get audit files onto host options
40- # options are git/copy/get_url
58+ # options are git/copy/get_url other e.g. if you wish to run from already downloaded conf
4159audit_content : git
4260
43- # Timeout for those cmds that take longer to run where timeout set
44- audit_cmd_timeout : 30000
61+ # archive or copy:
62+ audit_conf_copy : " some path to copy from "
4563
46- # enable audits to run - this runs the audit and get the latest content
47- run_audit : false
64+ # get_url:
65+ audit_files_url : " some url maybe s3?"
66+
67+ # Run heavy tests - some tests can have more impact on a system enabling these can have greater impact on a system
68+ audit_run_heavy_tests : true
4869
4970# ## End Goss enablements ####
5071# ### Detailed settings found at the end of this document ####
@@ -379,7 +400,7 @@ rhel7cis_rhnsd_required: false
379400
380401# 1.4.2 Bootloader password
381402rhel7cis_set_boot_pass : false
382- rhel7cis_bootloader_password_hash : ' grub.pbkdf2.sha512.changethispart'
403+ rhel7cis_bootloader_password_hash : ' grub.pbkdf2.sha512.changethispart' # pragma: allowlist secret
383404
384405# System network parameters (host only OR host and router)
385406rhel7cis_is_router : false
@@ -565,55 +586,3 @@ rhel7cis_dotperm_ansiblemanaged: true
565586
566587# RHEL-07-6.2.18 Clear users from shadow group
567588rhel7cis_remove_shadow_grp_usrs : true
568-
569- # ### Goss Configuration Settings ####
570- audit_run_script_environment :
571- AUDIT_BIN : " {{ audit_bin }}"
572- AUDIT_FILE : ' goss.yml'
573- AUDIT_CONTENT_LOCATION : " {{ audit_out_dir }}"
574-
575- # ## Goss binary settings ###
576- goss_version :
577- release : v0.3.23
578- checksum : ' sha256:9e9f24e25f86d6adf2e669a9ffbe8c3d7b9b439f5f877500dea02ba837e10e4d'
579- audit_bin_path : /usr/local/bin/
580- audit_bin : " {{ audit_bin_path }}goss"
581- audit_format : json
582-
583- # if get_goss_file == download change accordingly
584- goss_url : " https://github.com/goss-org/goss/releases/download/{{ goss_version.release }}/goss-linux-amd64"
585-
586- # # if get_goss_file - copy the following needs to be updated for your environment
587- # # it is expected that it will be copied from somewhere accessible to the control node
588- # # e.g copy from ansible control node to remote host
589- copy_goss_from_path : /some/accessible/path
590-
591- # ## Goss Audit Benchmark file ###
592- # # managed by the control audit_content
593- # git
594- audit_file_git : " https://github.com/ansible-lockdown/{{ benchmark }}-Audit.git"
595- audit_git_version : " benchmark_{{ benchmark_version }}"
596-
597- # copy:
598- audit_local_copy : " some path to copy from"
599-
600- # get_url:
601- audit_files_url : " some url maybe s3?"
602-
603- # Where the goss audit configuration will be stored
604- audit_files : " /opt/{{ benchmark }}-Audit/"
605-
606- # # Goss configuration information
607- # Where the goss configs and outputs are stored
608- audit_out_dir : ' /opt'
609- audit_conf_dir : " {{ audit_out_dir }}/{{ benchmark }}-Audit/"
610- pre_audit_outfile : " {{ audit_out_dir }}/{{ ansible_hostname }}-{{ benchmark }}_pre_scan_{{ ansible_date_time.epoch }}.{{ audit_format }}"
611- post_audit_outfile : " {{ audit_out_dir }}/{{ ansible_hostname }}-{{ benchmark }}_post_scan_{{ ansible_date_time.epoch }}.{{ audit_format }}"
612-
613- # # The following should not need changing
614- goss_file : " {{ audit_conf_dir }}goss.yml"
615- audit_vars_path : " {{ audit_conf_dir }}/vars/{{ ansible_hostname }}.yml"
616- audit_results : |
617- The pre remediation results are: {{ pre_audit_summary }}.
618- The post remediation results are: {{ post_audit_summary }}.
619- Full breakdown can be found in {{ audit_out_dir }}
![pre-commit-ci[bot]](https://avatars.githubusercontent.com/in/68672?v=4&size=40){kind=avatar}
0 commit comments