Skip to content

Commit

Permalink
Interim solution for Ansible scan not working as documented (#457)
Browse files Browse the repository at this point in the history
* Add app auth to cnquery

* image links

* adjust sidebar nav order

* Interim fix for ansible scan not working

* remove other mention of insecure
  • Loading branch information
misterpantz authored Nov 13, 2024
1 parent 8b88b04 commit 5602090
Show file tree
Hide file tree
Showing 3 changed files with 30 additions and 39 deletions.
6 changes: 0 additions & 6 deletions docs/cnspec/cli/cnspec_scan.md
Original file line number Diff line number Diff line change
Expand Up @@ -177,12 +177,6 @@ cnspec scan vagrant HOST
cnspec scan --inventory-file FILENAME
```

#### Scan an Ansible inventory file

```bash
ansible-inventory -i hosts.ini --list | cnspec scan --inventory-format-ansible --inventory-file -
```

### Options

```
Expand Down
29 changes: 29 additions & 0 deletions docs/platform/infra/opsys/automation/_ansible-hide.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
THIS IS A TEMPORARY, HIDDEN FILE

Docusaurus doesn't compile this. No user will ever see it.

I've taken the pipe method out of the Ansible doc until we can figure out how to make it work. I removed the --insecure flag. But Patrick still doesn't scan successfully.


#### Step 2: Scan the Ansible inventory

The method for scanning an Ansible inventory depends on whether your shell supports `|`.

##### Option A: Pipe the Ansible inventory to cnspec scan

The first option if you are using a shell such as `bash` or `zsh` that supports `|` redirects is to pipe the output of the `ansible-inventory -i hosts.ini --list` command to `cnspec scan --inventory-format-ansible`. For `FILENAME`, substitute the name of the inventory file.

```bash title="Pipe the contents of an Ansible inventory to the cnspec scan command"
ansible-inventory -i hosts.ini --list | cnspec scan --inventory-format-ansible
```

##### Option B: Scan Ansible inventory hosts.json

If your shell does not support pipes, you can generate a `hosts.json` from the `ansible-inventory` command and then pass that file to `cnspec scan` using the `--inventory-file` flag.

```bash title="Generate hosts.json and scan with cnspec scan command"
ansible-inventory -i hosts.ini --list > hosts.json

cnspec scan --inventory-file hosts.json --inventory-format-ansible

```
34 changes: 1 addition & 33 deletions docs/platform/infra/opsys/automation/ansible.md
Original file line number Diff line number Diff line change
Expand Up @@ -232,29 +232,7 @@ instance1 | SUCCESS => {
#### Step 2: Scan the Ansible inventory
The method for scanning an Ansible inventory depends on whether your shell supports `|`.
##### Option A: Pipe the Ansible inventory to cnspec scan
The first option if you are using a shell such as `bash` or `zsh` that supports `|` redirects is to pipe the output of the `ansible-inventory -i hosts.ini --list` command to `cnspec scan --inventory-format-ansible`. For `FILENAME`, substitute the name of the inventory file.
```bash title="Pipe the contents of an Ansible inventory to the cnspec scan command"
ansible-inventory -i hosts.ini --list | cnspec scan --inventory-format-ansible --insecure
```

:::info

Use the `--insecure` flag for:

- Hosts that have not been added to `~/.ssh/known_hosts`

- Windows WinRM using self-signed certificates

:::

##### Option B: Scan Ansible inventory hosts.json

If your shell does not support pipes, you can generate a `hosts.json` from the `ansible-inventory` command and then pass that file to `cnspec scan` using the `--inventory-file` flag.
Generate a `hosts.json` file from the `ansible-inventory` command and then pass that file to `cnspec scan` using the `--inventory-file` flag.
```bash title="Generate hosts.json and scan with cnspec scan command"
ansible-inventory -i hosts.ini --list > hosts.json
Expand Down Expand Up @@ -483,16 +461,6 @@ Run the playbook with this command:
ansible-playbook -i hosts.ini playbook.yml
```

:::info

Use the `--insecure` flag for:

- Hosts that have not been added to `~/.ssh/known_hosts`

- Windows WinRM using self-signed certificates

:::

#### Step 4: View scan reports in the Mondoo Console

Once Ansible completes, scan results are sent to Mondoo Platform so you can view asset scores and reports for all assets scanned in the Mondoo Console.
Expand Down

0 comments on commit 5602090

Please sign in to comment.