We have a unique issue and we've spent some time understanding the problem but we are unsure with whether the approach we are taking is in fact correct. Our objective is to validate specific UNIX system files for example
/etc/login.def and their specific values.
For the purpose of our hardening requirements we would like to capture for example
PASS_MAX_DAYS within the
logins.def configuration file and report back its status as (Green Ok) or (Red or Yellow), meaning we need to check further. Our objective is not to make changes but to capture the state of such configuration files.
Here is a code snippet:
--- - name: My Machine hosts: localhost gather_facts: true tasks: - name: "PASS_MAX_DAYS - 90 Days - Validator" become: yes become_user: ansible tags: PASS_MAX_DAYS lineinfile: path: /etc/login.defs regex: '^PASS_MAX_DAYS\s+' line: 'PASS_MAX_DAYS 90' state: present check_mode: yes register: PASS_MAX_DAYS_output
The idea behind this is simple: Check the file if
PASS_MAX_DAYS is set to 90 days, and if so, report back as (Green OK) or Skip without issues. If the value deviates from the 90 day value proceed to flag it as an issue (Red or Orange) and capture the value (using register/debug), output a meaningful msg to the executor and capture the value to a file.
Note: We looked at
when conditions but weren't to sure if this would be possible to use. We always had issues with the state of the output being set to "changed" with the msg "line replaced".
Note: We need to keep the regex as generic as possible (why, you may ask) because some sys admins use single spaces, others use tabs and others use multiple spaces. So we would like to not care about how many spaces between each value because we would only like to match the values.