Learn Ansible

Generating the remediation bash script

To remediate the remaining issues, we should generate and execute the bash script:

$ ansible-galaxy init roles/fix-bash

As this is a nice-to-have, I am not going to go into any detail about the ins and outs of what we are adding here. The contents of roles/fix-bash/defaults/main.yml are similar to those in the fix-ansible role:

bash_file:  remote: "/tmp/{{ inventory_hostname }}_bash.sh"  log: "generated/{{ inventory_hostname }}_bash.log"bash_fix_command: >  oscap xccdf generate fix    --profile {{ oscap.profile }}    --output {{ bash_file.remote }}    {{ report.results }}

The tasks in roles/fix-bash/tasks/main.yml are also similar and shouldn't need any explanation:

- name: do we already have the bash script? stat: ...