Jmespath audit

tasks/post_remediation_audit.yml

@@ -21,26 +21,24 @@
   when:
       - audit_format == "json"
   block:
-      - name: Post Audit | Capture data {{ post_audit_outfile }}
-        ansible.builtin.shell: "cat {{ post_audit_outfile }}"
-        register: discovered_post_audit
+      - name: Post Audit | Capture audit data if json format
+        ansible.builtin.shell: grep -E '"summary-line.*Count:.*Failed' "{{ post_audit_outfile }}" | cut -d'"' -f4
+        register: post_audit_summary
         changed_when: false
 
-      - name: Post Audit | Capture post-audit result
+      - name: Post Audit | Set Fact for audit summary
         ansible.builtin.set_fact:
-            post_audit_summary: "{{ discovered_post_audit.stdout | from_json | json_query(summary) }}"
-        vars:
-            summary: summary."summary-line"
+            post_audit_results: "{{ post_audit_summary.stdout }}"
 
 - name: Post Audit | Capture audit data if documentation format
   when:
       - audit_format == "documentation"
   block:
-      - name: Post Audit | Capture data {{ post_audit_outfile }}
-        ansible.builtin.shell: "tail -2 {{ post_audit_outfile }}"
-        register: discovered_post_audit
+      - name: Post Audit | Capture audit data if documentation format
+        ansible.builtin.shell: "tail -2 /opt/audit_ubuntu2204-CIS-UBUNTU22_1720624848.documentation"
+        register: post_audit_summary
         changed_when: false
 
-      - name: Post Audit | Capture post-audit result
+      - name: Post Audit | Set Fact for audit summary
         ansible.builtin.set_fact:
-            post_audit_summary: "{{ discovered_post_audit.stdout_lines }}"
+            post_audit_results: "{{ post_audit_summary.stdout }}"

tasks/pre_remediation_audit.yml

@@ -60,11 +60,12 @@
       - name: Pre Audit Setup | Check for goss file
         ansible.builtin.stat:
             path: "{{ audit_bin }}"
-        register: discovered_goss_available
+        register: goss_available
 
       - name: Pre Audit Setup | If audit ensure goss is available
+        when:
+            - not goss_available.stat.exists
         ansible.builtin.assert:
-            that: discovered_goss_available.stat.exists
             msg: "Audit has been selected: unable to find goss binary at {{ audit_bin }}"
 
 - name: Pre Audit Setup | Copy ansible default vars values to test audit
@@ -90,29 +91,27 @@
   when:
       - audit_format == "json"
   block:
-      - name: Pre Audit | Capture data {{ pre_audit_outfile }}
-        ansible.builtin.shell: "cat {{ pre_audit_outfile }}"
-        register: discovered_pre_audit
+      - name: Pre Audit | Capture audit data if json format
+        ansible.builtin.shell: grep -E '\"summary-line.*Count:.*Failed' "{{ pre_audit_outfile }}" | cut -d'"' -f4
+        register: pre_audit_summary
         changed_when: false
 
-      - name: Pre Audit | Capture pre-audit result
+      - name: Pre Audit | Set Fact for audit summary
         ansible.builtin.set_fact:
-            pre_audit_summary: "{{ discovered_pre_audit.stdout | from_json | json_query(summary) }}"
-        vars:
-            summary: summary."summary-line"
+            pre_audit_results: "{{ pre_audit_summary.stdout }}"
 
 - name: Pre Audit | Capture audit data if documentation format
   when:
       - audit_format == "documentation"
   block:
-      - name: Pre Audit | Capture data {{ pre_audit_outfile }} | documentation format
-        ansible.builtin.shell: "tail -2 {{ pre_audit_outfile }}"
-        register: discovered_pre_audit
+      - name: Pre Audit | Capture audit data if documentation format
+        ansible.builtin.shell: tail -2 "{{ pre_audit_outfile }}"  | tac | tr '\n' ' '
+        register: pre_audit_summary
         changed_when: false
 
-      - name: Pre Audit | Capture pre-audit result | documentation format
+      - name: Pre Audit | Set Fact for audit summary
         ansible.builtin.set_fact:
-            pre_audit_summary: "{{ discovered_pre_audit.stdout_lines }}"
+            pre_audit_results: "{{ pre_audit_summary.stdout }}"
 
 - name: Audit_Only | Run Audit Only
   when:

tasks/section_5/cis_5.1.4.yml

@@ -13,25 +13,28 @@
       - rule_5.1.4
   block:
       - name: "5.1.4 | AUDIT | Ensure permissions on all logfiles are configured | find files"
-        ansible.builtin.shell: find /var/log/ -type f -perm /g+wx,o+rwx -exec ls {} \;
+        ansible.builtin.shell: find /var/log/ -type f -exec ls {} \;
         changed_when: false
         failed_when: false
         register: discovered_logfiles
 
-      - name: "5.1.4 | AUDIT | Ensure permissions on all logfiles are configured | set_fact"
-        ansible.builtin.set_fact:
-            discovered_logfiles_flattened: "{{ discovered_logfiles | json_query('stdout_lines[*]') | flatten }}"  # noqa: jinja[invalid]
-        when:
-            - discovered_logfiles.stdout_lines | length > 0
-            - discovered_logfiles is defined
-
       - name: "5.1.4 | PATCH | Ensure permissions on all logfiles are configured | change permissions"
-        ansible.builtin.file:
-            path: "{{ item }}"
-            mode: '0640'
-        loop: "{{ discovered_logfiles_flattened }}"
         when:
-            - discovered_logfiles_flattened is defined
             - item != "/var/log/btmp"
             - item != "/var/log/utmp"
             - item != "/var/log/wtmp"
+            - item != "/var/log/lastlog"
+        ansible.builtin.file:
+            path: "{{ item }}"
+            mode: u-x,g-wx,o-rwx
+        loop: "{{ discovered_logfiles.stdout_lines }}"
+
+      - name: "5.1.4 | PATCH | Ensure permissions on all logfiles are configured | change permissions"
+        ansible.builtin.file:
+            path: "{{ item.name }}"
+            mode: ('ug-x,o-wx')
+        with_fileglob:
+            - /var/log/*tmp.*"
+            - /var/log/lastlog"
+            - /var/log/ssd*"
+            - /var/log/SSD*"

vars/audit.yml

@@ -34,7 +34,7 @@ audit_format: json
 
 audit_vars_path: "{{ audit_conf_dir }}/vars/{{ ansible_facts.hostname }}.yml"
 audit_results: |
-      The audit results are: {{ pre_audit_summary }}
-      {% if not audit_only %}The post remediation audit results are: {{ post_audit_summary }}{% endif %}
+      The{% if not audit_only %} pre remediation{% endif %} audit results are: {{ pre_audit_results}}
+      {% if not audit_only %}The post remediation audit results are: {{ post_audit_results }}{% endif %}
 
       Full breakdown can be found in {{ audit_log_dir }}