Encryption and major changes

ansible/roles/cis/tests/debug_facts.yml

@@ -0,0 +1,103 @@
+---
+- name: Install jmespath
+  ansible.builtin.pip:
+    name: jmespath
+    state: present
+  tags:
+    - debug
+
+- name: Debug "cpuinfo_rdrand handling, true"
+  ansible.builtin.debug:
+    msg: "cpuinfo_rdrand is {{ ansible_local.cpuinfo.rdrand }}, true"
+  when: ansible_local.cpuinfo.rdrand
+  tags:
+    - debug
+
+- name: Debug "cpuinfo_rdrand handling, false"
+  ansible.builtin.debug:
+    msg: "cpuinfo_rdrand is {{ ansible_local.cpuinfo.rdrand }}, false"
+  when: not ansible_local.cpuinfo.rdrand
+  tags:
+    - debug
+
+- name: Debug "ansible_local['cpuinfo']['rdrand'], true"
+  ansible.builtin.debug:
+    msg: "cpuinfo_rdrand is {{ ansible_local['cpuinfo']['rdrand'] }}, true"
+  when: ansible_local['cpuinfo']['rdrand']
+  tags:
+    - debug
+
+- name: Debug "ansible_local['cpuinfo']['rdrand'], false"
+  ansible.builtin.debug:
+    msg: "cpuinfo_rdrand is {{ ansible_local['cpuinfo']['rdrand'] }}, false"
+  when: not ansible_local['cpuinfo']['rdrand']
+  tags:
+    - debug
+
+- name: Debug "cpuinfo_rdrand handling, info"
+  ansible.builtin.debug:
+    msg: "cpuinfo_rdrand is {{ ansible_local.cpuinfo.rdrand }}"
+  tags:
+    - debug
+
+- name: Stat /var/run/reboot-required
+  ansible.builtin.stat:
+    path: /var/run/reboot-required
+  register: stat_reboot_required
+
+- name: Notify reboot handler
+  ansible.builtin.debug:
+    msg: "reboot_required is {{ stat_reboot_required.stat.exists }}"
+  when:
+    - ansible_distribution == "Ubuntu"
+    - stat_reboot_required.stat.exists
+
+- name: Debug "systemd_version handling, <= 100"
+  ansible.builtin.debug:
+    msg: "systemd version is {{ ansible_local.systemd.version }}, <= 100"
+  when: ansible_local.systemd.version <= 100
+  tags:
+    - debug
+
+- name: Debug "systemd_version handling, >= 100"
+  ansible.builtin.debug:
+    msg: "systemd version is {{ ansible_local.systemd.version }}, >= 100"
+  when: ansible_local.systemd.version >= 100
+  tags:
+    - debug
+
+- name: Debug "systemd_version handling, info"
+  ansible.builtin.debug:
+    msg: "systemd version is {{ ansible_local.systemd.version }}"
+  tags:
+    - debug
+
+- name: Get DSA keys
+  ansible.builtin.debug:
+    msg: "{{ item }}"
+  with_items:
+    - "{{ ansible_local['sshkeys'] | json_query('keys.*') }}"
+  when: item.type == "DSA"
+  tags:
+    - debug
+
+- name: Get short RSA keys
+  ansible.builtin.debug:
+    msg: "{{ item }}"
+  with_items:
+    - "{{ ansible_local['sshkeys'] | json_query('keys.*') }}"
+  when: (item.type == "RSA" and item.size <= 2048)
+  tags:
+    - debug
+
+- name: Get owner of old keys
+  vars:
+    - old_key: "{{ ansible_date_time.epoch | int - 3600 }}"
+  ansible.builtin.debug:
+    msg: "{{ item.user_name }}: {{ item.file }} - {{ item.modified_human }}"
+  with_items:
+    - "{{ ansible_local['sshkeys'] | json_query('keys.*') }}"
+  when: item.modified_epoch | int <= old_key | int and item.user_id >= 1000
+  tags:
+    - debug
+...

ansible/roles/cis/tests/inventory

@@ -0,0 +1 @@
+localhost

ansible/roles/cis/tests/test.yml

@@ -0,0 +1,12 @@
+---
+- hosts: all
+  any_errors_fatal: true
+  tasks:
+    - ansible.builtin.include_role:
+        name: konstruktoid.hardening
+
+- hosts: all
+  any_errors_fatal: true
+  tasks:
+    - ansible.builtin.include_tasks: debug_facts.yml
+...