search

jas- / jaks-post-config

%post configuration toolkit for jaks (Just Another KickstartScript)
MIT License
0 stars 1 forks source link

Maybe all of these scripts could be replaced by Ansible playbooks? #1

Open q2dg opened 4 years ago

q2dg commented 4 years ago

It's only an idea...

jas- commented 4 years ago

The minimal dependencies of a shell and the OS tools make them portable. Besides ansible allows for playbooks to run scripts...

- name: jaks-post-config to assist with hardening post build
  script: /path/to/jaks-post-config -vca <author>

While these scripts might still be somewhat relevant, I think you might prefer something a little more modern like RHEL kickstarts using OSCAP

Example of a kickstart script to use OSCAP.

%addon org_fedora_oscap
       content-type = scap-security-guide
       profile = pci-dss
%end

Or for a YAML Ansible playbook;

- name: OSCAP playbook
  command: oscap xccdf eval --report pci-dss-anaconda-report.html --profile xccdf_org.ssgproject.content_profile_pci-dss /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml

I do not actively maintain this set of tools but they shouldn't really need updates unless you get into the requirements for output from ifconfig and netstat which were replaces in RHEL 7 as ip and ss.