Question on Ansible fixes: Might it be possible (and preferable per the DRY
principle) to have Ansible fixes invoke the Bash fixes which tend to be
more complete?
Simple case in point: there are 6 bash/aide* fixes and only 2 ansible/aide*
fixes. Not to mention it's easier (at least for me) to build and test a
bash "fix" script than an Ansible one.
Related: When you provision a new instance, to harden do you run the bash
fixes (more complete) or the Ansible ones? I'm provisioning with Ansible so
guidance as to how best to harden it would be helpful.
Bonus question: How best to generate fixes? Should I run them all on a new
server, or can I run just those that match failing tests?
Thanks,
=Fen
(apologies to list moderator - I initially sent this from an unsubscribed
email address)
Show replies by thread