Mateusz Suski
66 lines
2.1 KiB
YAML
66 lines
2.1 KiB
YAML
---
|
|
- name: Collect current AIX network tunables
|
|
ansible.builtin.command: no -a
|
|
changed_when: false
|
|
failed_when: false
|
|
check_mode: false
|
|
register: cis_aix_no_current
|
|
|
|
- name: Query configured AIX network tunables
|
|
ansible.builtin.command: "no -o {{ item.key }}"
|
|
changed_when: false
|
|
failed_when: false
|
|
check_mode: false
|
|
loop: "{{ cis_network_no_settings | dict2items }}"
|
|
register: cis_aix_no_query
|
|
|
|
- name: Apply configured AIX network tunables
|
|
ansible.builtin.command: "no -p -o {{ item.item.key }}={{ item.item.value }}"
|
|
changed_when: true
|
|
loop: "{{ cis_aix_no_query.results }}"
|
|
when:
|
|
- item.rc == 0
|
|
- item.stdout is not search('=\\s*' ~ (item.item.value | string) ~ '\\b')
|
|
|
|
- name: Warn about unsupported AIX network tunables
|
|
ansible.builtin.debug:
|
|
msg: "WARNING: AIX network tunable {{ item.item.key }} is not supported on this host."
|
|
loop: "{{ cis_aix_no_query.results }}"
|
|
when: item.rc != 0
|
|
|
|
- name: Check nfso availability
|
|
ansible.builtin.shell: "command -v nfso >/dev/null 2>&1 || whence nfso >/dev/null 2>&1"
|
|
args:
|
|
executable: /bin/ksh
|
|
changed_when: false
|
|
failed_when: false
|
|
check_mode: false
|
|
register: cis_aix_nfso_available
|
|
|
|
- name: Query configured AIX NFS tunables
|
|
ansible.builtin.command: "nfso -o {{ item.key }}"
|
|
changed_when: false
|
|
failed_when: false
|
|
check_mode: false
|
|
loop: "{{ cis_network_nfso_settings | dict2items }}"
|
|
register: cis_aix_nfso_query
|
|
when:
|
|
- cis_aix_nfso_available.rc == 0
|
|
- cis_network_nfso_settings | length > 0
|
|
|
|
- name: Apply configured AIX NFS tunables
|
|
ansible.builtin.command: "nfso -p -o {{ item.item.key }}={{ item.item.value }}"
|
|
changed_when: true
|
|
loop: "{{ cis_aix_nfso_query.results | default([]) }}"
|
|
when:
|
|
- item.rc == 0
|
|
- item.stdout is not search('=\\s*' ~ (item.item.value | string) ~ '\\b')
|
|
|
|
- name: Report network hardening status
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "OK: AIX network tunables were validated before changes."
|
|
- >-
|
|
{{ 'OK: nfso is available for optional NFS network tunables.'
|
|
if cis_aix_nfso_available.rc == 0 else 'WARNING: nfso was not found; NFS tunables were skipped.' }}
|