On 2/12/19 11:49 AM, Marek Haicman wrote:
we have currently stumbled upon situation, where Ansible remediation
snippet can either fix 3 different rules at once, or be very
convoluted. Technical details aside  - what is your view of such
* Is it ok when remediation does change more than the rule that
triggered it checks?
Current methodology ensures higher-level technologies can compose custom
security baselines (incl SCAP and remediation). Kind of like what SCAP
If we can't track one configuration item to specific
XCCDF/OVAL/remediation, all that falls apart.
* Do you prefer to have no remediation at all, to the remediation
does too much?
Would have to understand what "too much" means. Very
wouldn't be able to remediate single configuration checks. Worst case
use the shell capabilities and run whatever the bash snippet would be.
* Does answer to the questions above change between (--remediate)
which is applied automatically, and bash roles or ansible playbooks,
where you can check insides of the scripts and alter them before
If running --remediate, multiple CCEs are somehow grouped into a
ansible action, how do I troubleshoot that?