search

ansible-lockdown / UBUNTU22-CIS

Ansible role for Ubuntu22 CIS Baseline
https://ansible-lockdown.readthedocs.io/en/latest/
MIT License
160 stars 70 forks source link

setup_audit control doesnt install git as a prerequisite #136

Closed paulquevedojdrf closed 8 months ago

paulquevedojdrf commented 9 months ago

Describe the Issue Running the setup_audit and run_audit tags on the playbook fails if git is not pre-installed on the target machine.

Expected Behavior

Audit runs and reports the summary without having to manually install git ahead of time

Actual Behavior

Audit fails to setup

TASK [/home/pquevedo/dev/fw-deploy-snuc/UBUNTU22-CIS : Pre Audit Setup | Ensure /opt/UBUNTU22-CIS-Audit exists] ***************************************************************************************************
changed: [pquevedo-ideapad]

TASK [/home/pquevedo/dev/fw-deploy-snuc/UBUNTU22-CIS : Pre Audit Setup | Install git (rh8 python3)] ***************************************************************************************************************
skipping: [pquevedo-ideapad]

TASK [/home/pquevedo/dev/fw-deploy-snuc/UBUNTU22-CIS : Pre Audit Setup | Install git (rh7 python2)] ***************************************************************************************************************
skipping: [pquevedo-ideapad]

TASK [/home/pquevedo/dev/fw-deploy-snuc/UBUNTU22-CIS : Pre Audit Setup | retrieve audit content files from git] ***************************************************************************************************
fatal: [pquevedo-ideapad]: FAILED! => {"changed": false, "msg": "Failed to find required executable \"git\" in paths: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"}

Control(s) Affected

setup_audit

Environment (please complete the following information):

Additional Notes

Possible Solution

Modify the conditions in this step to run against .. or ansible_distribution == "Ubuntu" or add a separate step with that condition to install git. https://github.com/ansible-lockdown/UBUNTU22-CIS/blob/eed742b760d1305de81a5304c60e975f891e8aa2/tasks/pre_remediation_audit.yml#L17-L23