spolinovskiy/cis_ansible_alt

Purpose and execution model

This is an Ansible automation project for CIS auditing and controlled remediation of ALT Linux hosts in offline industrial/OT environments. Audit-only is the default; remediation requires explicit enablement and chapter approval. Primary entry points are playbooks/precheck.yml, playbooks/audit.yml, playbooks/remediate.yml, and playbooks/report.yml; operator wrappers include scripts/run_audit_lab.sh and scripts/generate_report.sh.

Environment targeting and inputs

Ansible inventories separate lab and production targets: inventories/lab/hosts.yml and inventories/prod/hosts.yml. Control scope is data-driven from data/cis_linux_scope/controls_from_excel.yml (with JSON counterpart), while ALT Linux/version-specific command, package, service, path, and feature mappings are under data/os_map/. This boundary keeps benchmark scope and OS adaptations outside task implementation.

Pre-execution validation

The precheck stage is implemented by roles/cis_precheck/tasks/main.yml and invoked through playbooks/precheck.yml. It establishes whether a target/environment is suitable before audit or changes. Shared behavior is centralized in roles/cis_common/tasks/main.yml, providing a common role boundary for the operational playbooks.

CIS audit engine

playbooks/audit.yml runs roles/cis_audit/tasks/main.yml, which composes chapter-specific checks. Major CIS domains are independently organized, for example roles/cis_audit/tasks/bootloader.yml, roles/cis_audit/tasks/sshd.yml, and roles/cis_audit/tasks/filesystem.yml. This makes individual control areas addressable for evidence, review, and approved remediation rather than treating the benchmark as a monolithic run.

Controlled remediation and approvals

playbooks/remediate.yml delegates changes to roles/cis_remediate/tasks/main.yml. Approval artifacts are environment- and chapter-scoped, e.g. approvals/lab/Bootloader/approval.md and approvals/lab/SUDO/approval.md; production has a separate approval root at approvals/prod/. The intended control flow is audit findings → review/approval → explicitly enabled remediation, limiting unapproved configuration changes in OT systems.

Reporting, review, and evidence

playbooks/report.yml invokes roles/cis_report/tasks/main.yml, rendering structured outputs via roles/cis_report/templates/run_summary.md.j2, roles/cis_report/templates/checklist.md.j2, and roles/cis_report/templates/summary_flat.csv.j2. Generated chapter evidence is retained by environment under reports/lab/, while assessment results live separately in reviews/lab/ (for example reviews/lab/SSHD/review.md). This separates raw/reportable findings from human quality or approval decisions.

Sensitive data and operating constraints

The repository intentionally excludes real OT-sensitive values. Templates and examples reside in data/private_overlay/private_sensitive.example.yml and data/required_information/required_information_template.yml; real values are supplied from an untracked external/private overlay, optionally through Ansible Vault and CIS_PRIVATE_VARS_FILE. The material runtime is Ansible operating over managed ALT Linux hosts, designed for offline assumptions documented in docs/offline_assumptions.md; no external SaaS or web application dependency is indicated.