Hello Chuck,
On 12/12/17 17:35, Chuck Atkins wrote:
There seems to be a mix of ansible and bash for fix-up scripts, in
that some rules only have bash fixes, others only have ansible fixes,
while most have both, and a few still have none. When applying
remediation during a scan, which ones get used?
When doing on-line remediation,
i.e. by option "--remediate", the bash
fixes are applied.
Is there a way to specify?
Unfortunately no, the default is to
use bash, and there is no way to
change it.
If I have ansible installed, will the ansible fixes automatically get
used? If the ansible ones are being used? Do the bash-only fixes get
run as well? What about rules that have both?
Ansible remediations are not applied
automatically, oscap can't consume
ansible fixes. They should be used by ansible to fix the machine.
Oscap can only generate a script fix based on one kind of remediation,
it doesn't know how to use mainly one type of fix, and fill the gaps
with other types of remediation, but this feature sounds interesting and
useful.
Thanks
----------
Chuck Atkins
Staff R&D Engineer, Scientific Computing
Kitware, Inc.
_______________________________________________
scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org
To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org
--
Watson Sato
Security Technologies | Red Hat, Inc