dbernaci / cis-debian10-ansible Goto Github PK

Hi Denis,
I was trying to run the ansible playbook with dry run option, it failing for following checks.

ansible-playbook -i localhost -C CIS-Debian10-runbook.yml

TASK [/etc/ansible/CIS-Debian10-Ansible : 1.1.6 Ensure separate partition exists for /var] *****************************************************************************************************************
fatal: [localhost]: FAILED! => {"msg": "The conditional check 'ansible_mounts | byattr('mount', '/var') | list | length > 0' failed. The error was: error while evaluating conditional (ansible_mounts | byattr('mount', '/var') | list | length > 0): 'ansible_mounts' is undefined"}

$ df -h /var
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/template--vg-var 1.4G 330M 969M 26% /var

Even it failed for /tmp mount check. I am using ansible [core 2.11.6]

Is there anyway I can skip filesystem checks and run the playbook ?

In 1.7.1.2 Ensure AppArmor is enabled in the bootloader configuration the replace task uses the follow option which was dropped in ansible 2.5.

Option follow has been removed in Ansible 2.5, because this module modifies the contents of the file so follow=no doesn’t make sense. from Ansible Replace

Thanks for this great resource.

It appears at # 5.4 User Accounts and Environment:
Only 5.4.1 and 5.4.1.5 have their defaults defined in the role's /default/main.yml file:

debian10cis_rules_5_4_1: true
debian10cis_rules_5_4_1_5: true

these options highlighted below have no reference in the roles /default/main.yml file:

5.4.1.1 Ensure password expiration is days or less (Scored)
5.4.1.2 Ensure minimum days between password changes is configured (Scored)
5.4.1.3 Ensure password expiration warning days is 7 or more (Scored)
5.4.1.4 Ensure inactive password lock is 30 days or less (Scored)