We have a unique issue and we've spent some time understanding the problem but we are unsure with whether the approach we are taking is in fact correct. Our objective is to validate specific UNIX system files for example /etc/login.def
and their specific values.
For the purpose of our hardening requirements we would like to capture for example PASS_MAX_DAYS
within the logins.def
configuration file and report back its status as (Green Ok) or (Red or Yellow), meaning we need to check further. Our objective is not to make changes but to capture the state of such configuration files.
Here is a code snippet:
---
- name: My Machine
hosts: localhost
gather_facts: true
tasks:
- name: "PASS_MAX_DAYS - 90 Days - Validator"
become: yes
become_user: ansible
tags: PASS_MAX_DAYS
lineinfile:
path: /etc/login.defs
regex: '^PASS_MAX_DAYS\s+'
line: 'PASS_MAX_DAYS 90'
state: present
check_mode: yes
register: PASS_MAX_DAYS_output
The idea behind this is simple: Check the file if PASS_MAX_DAYS
is set to 90 days, and if so, report back as (Green OK) or Skip without issues. If the value deviates from the 90 day value proceed to flag it as an issue (Red or Orange) and capture the value (using register/debug), output a meaningful msg to the executor and capture the value to a file.
Note: We looked at when
conditions but weren't to sure if this would be possible to use. We always had issues with the state of the output being set to "changed" with the msg "line replaced".
Note: We need to keep the regex as generic as possible (why, you may ask) because some sys admins use single spaces, others use tabs and others use multiple spaces. So we would like to not care about how many spaces between each value because we would only like to match the values.