Playbook #2
/home/zuul/src/opendev.org/openstack/openstack-ansible/playbooks/setup-hosts.yml
Execution
Date 14 Dec 2025 10:04:43 +0000
Duration 00:10:10.66
Controller aio1.openstack.local
User root
Versions
Ansible 2.18.6
ara 1.7.4 / 1.7.4
Python 3.13.5
Summary
15 Hosts
603 Tasks
2357 Results
18 Plays
157 Files
0 Records
check:False tags:all

Host facts: aio1
Processor
Storage
/
/dev/vda1 (ext4)
22.6% used
57.7 GB free
/mnt/config
/dev/sr0 (iso9660)
100.0% used
0 bytes free
/var/lib/lxc
/dev/vdb2 (ext4)
25.0% used
28.1 GB free
/var/lib/nova/instances
/dev/loop0 (xfs)
1.9% used
1004.2 GB free
/var/lib/machines
/dev/loop1 (ext4)
9.4% used
9.7 GB free
/openstack
/dev/vdb1 (ext4)
5.7% used
23.6 GB free
All Host Facts
Fact Value
ansible_mounts 
[
    {
        "block_available": 15113204,
        "block_size": 4096,
        "block_total": 19520835,
        "block_used": 4407631,
        "device": "/dev/vda1",
        "dump": 0,
        "fstype": "ext4",
        "inode_available": 20123813,
        "inode_total": 20858880,
        "inode_used": 735067,
        "mount": "/",
        "options": "rw,relatime",
        "passno": 0,
        "size_available": 61903683584,
        "size_total": 79957340160,
        "uuid": "2c8347a5-aa05-419f-9dc6-138cbe98436c"
    },
    {
        "block_available": 0,
        "block_size": 2048,
        "block_total": 329,
        "block_used": 329,
        "device": "/dev/sr0",
        "dump": 0,
        "fstype": "iso9660",
        "inode_available": 0,
        "inode_total": 0,
        "inode_used": 0,
        "mount": "/mnt/config",
        "options": "ro,relatime,nojoliet,check=s,map=n,blocksize=2048,fmode=700,iocharset=utf8",
        "passno": 0,
        "size_available": 0,
        "size_total": 673792,
        "uuid": "2025-12-14-09-58-32-00"
    },
    {
        "block_available": 7370991,
        "block_size": 4096,
        "block_total": 9830276,
        "block_used": 2459285,
        "device": "/dev/vdb2",
        "dump": 0,
        "fstype": "ext4",
        "inode_available": 2305945,
        "inode_total": 2518208,
        "inode_used": 212263,
        "mount": "/var/lib/lxc",
        "options": "rw,noatime,nobarrier,data=writeback",
        "passno": 0,
        "size_available": 30191579136,
        "size_total": 40264810496,
        "uuid": "a5a9514b-ebff-43ea-9d82-67cee34c3802"
    },
    {
        "block_available": 263253996,
        "block_size": 4096,
        "block_total": 268402688,
        "block_used": 5148692,
        "device": "/dev/loop0",
        "dump": 0,
        "fstype": "xfs",
        "inode_available": 107374141,
        "inode_total": 107374144,
        "inode_used": 3,
        "mount": "/var/lib/nova/instances",
        "options": "rw,noatime,nodiratime,attr2,inode64,logbufs=8,logbsize=256k,noquota",
        "passno": 0,
        "size_available": 1078288367616,
        "size_total": 1099377410048,
        "uuid": "bae14e7d-1022-488f-ba5d-41fb74a42978"
    },
    {
        "block_available": 2547034,
        "block_size": 4096,
        "block_total": 2811698,
        "block_used": 264664,
        "device": "/dev/loop1",
        "dump": 0,
        "fstype": "ext4",
        "inode_available": 706126,
        "inode_total": 720896,
        "inode_used": 14770,
        "mount": "/var/lib/machines",
        "options": "rw,relatime",
        "passno": 0,
        "size_available": 10432651264,
        "size_total": 11516715008,
        "uuid": "89806c61-ed72-4cde-88f2-ab9bad056e80"
    },
    {
        "block_available": 6187246,
        "block_size": 4096,
        "block_total": 6561071,
        "block_used": 373825,
        "device": "/dev/vdb1",
        "dump": 0,
        "fstype": "ext4",
        "inode_available": 1679231,
        "inode_total": 1679360,
        "inode_used": 129,
        "mount": "/openstack",
        "options": "rw,noatime,nobarrier,data=writeback",
        "passno": 0,
        "size_available": 25342959616,
        "size_total": 26874146816,
        "uuid": "e2bb02b1-b010-4626-aca2-f232e1396a55"
    }
]


252 OK 104 CHANGED 145 SKIPPED





Reset
Report Status Date Date Duration Host Action Task Tags Notes
OK 14 Dec 2025 10:14:52 +0000 00:00:00.16 aio1 ansible.builtin.command ansible-hardening : Generate auditd rules 1
CHANGED 14 Dec 2025 10:14:52 +0000 00:00:00.31 aio1 ansible.builtin.service ansible-hardening : Restart ssh 1
OK 14 Dec 2025 10:14:51 +0000 00:00:00.14 aio1 ansible.builtin.file ansible-hardening : Remove the temporary directory 2
CHANGED 14 Dec 2025 10:14:51 +0000 00:00:00.21 aio1 ansible.builtin.replace ansible-hardening : Manage motd in pam.d 1
OK 14 Dec 2025 10:14:50 +0000 00:00:00.40 aio1 ansible.builtin.file ansible-hardening : Private host key files must have mode 0600 or less 4
OK 14 Dec 2025 10:14:50 +0000 00:00:00.14 aio1 ansible.builtin.shell ansible-hardening : Determine existing private ssh host keys 2
OK 14 Dec 2025 10:14:50 +0000 00:00:00.41 aio1 ansible.builtin.file ansible-hardening : Public host key files must have mode 0644 or less 4
OK 14 Dec 2025 10:14:49 +0000 00:00:00.15 aio1 ansible.builtin.shell ansible-hardening : Determine existing public ssh host keys 2
OK 14 Dec 2025 10:14:49 +0000 00:00:00.27 aio1 ansible.builtin.service ansible-hardening : Ensure sshd is enabled at boot time 4
CHANGED 14 Dec 2025 10:14:49 +0000 00:00:00.16 aio1 ansible.builtin.blockinfile ansible-hardening : Adjust ssh server configuration based on STIG requirements 21
CHANGED 14 Dec 2025 10:14:46 +0000 00:00:02.42 aio1 ansible.builtin.lineinfile ansible-hardening : Drop options from SSH config that we manage 21
CHANGED 14 Dec 2025 10:14:46 +0000 00:00:00.33 aio1 ansible.builtin.copy ansible-hardening : Copy login warning banner 5
OK 14 Dec 2025 10:14:45 +0000 00:00:00.14 aio1 ansible.builtin.command ansible-hardening : Check to see if snmpd config contains public/private 2
OK 14 Dec 2025 10:14:44 +0000 00:00:00.14 aio1 ansible.builtin.stat ansible-hardening : Check for TFTP server configuration file 2
OK 14 Dec 2025 10:14:44 +0000 00:00:00.14 aio1 ansible.builtin.stat ansible-hardening : Check for postfix configuration file 2
OK 14 Dec 2025 10:14:44 +0000 00:00:00.14 aio1 ansible.builtin.shell ansible-hardening : Check for interfaces in promiscuous mode 2
OK 14 Dec 2025 10:14:43 +0000 00:00:00.02 aio1 ansible.builtin.debug ansible-hardening : V-72281 - For systems using DNS resolution, at least two name servers must be configured. 4
OK 14 Dec 2025 10:14:43 +0000 00:00:00.14 aio1 command ansible-hardening : Count nameserver entries in /etc/resolv.conf 3
OK 14 Dec 2025 10:14:43 +0000 00:00:00.16 aio1 ansible.builtin.command ansible-hardening : Check firewalld status 2
OK 14 Dec 2025 10:14:42 +0000 00:00:00.16 aio1 ansible.builtin.stat ansible-hardening : Check if chrony configuration file exists 2
CHANGED 14 Dec 2025 10:14:42 +0000 00:00:00.14 aio1 ansible.builtin.blockinfile ansible-hardening : V-72223 - Set 10 minute timeout on communication sessions 4
OK 14 Dec 2025 10:14:41 +0000 00:00:00.16 aio1 ansible.builtin.shell ansible-hardening : Check if ClamAV update process is already running 2
OK 14 Dec 2025 10:14:40 +0000 00:00:00.14 aio1 ansible.builtin.stat ansible-hardening : Check if ClamAV is installed 2
OK 14 Dec 2025 10:14:40 +0000 00:00:00.02 aio1 ansible.builtin.debug ansible-hardening : V-72209 - The system must send rsyslog output to a log aggregation server. 4
OK 14 Dec 2025 10:14:40 +0000 00:00:00.14 aio1 ansible.builtin.command ansible-hardening : Check if syslog output is being sent to another server 2
OK 14 Dec 2025 10:14:39 +0000 00:00:00.02 aio1 ansible.builtin.debug ansible-hardening : Check for /tmp on mounted filesystem 4
OK 14 Dec 2025 10:14:39 +0000 00:00:00.02 aio1 ansible.builtin.debug ansible-hardening : Check for /var/log/audit on mounted filesystem 4
OK 14 Dec 2025 10:14:39 +0000 00:00:00.02 aio1 ansible.builtin.debug ansible-hardening : Check for /var on mounted filesystem 4
OK 14 Dec 2025 10:14:39 +0000 00:00:00.02 aio1 ansible.builtin.debug ansible-hardening : Check for /home on mounted filesystem 4
CHANGED 14 Dec 2025 10:14:37 +0000 00:00:01.83 aio1 ansible.builtin.systemd ansible-hardening : V-71993 - The x86 Ctrl-Alt-Delete key sequence must be disabled 4
OK 14 Dec 2025 10:14:37 +0000 00:00:00.27 aio1 ansible.builtin.systemd ansible-hardening : V-71993 - The x86 Ctrl-Alt-Delete key sequence must be disabled 4
OK 14 Dec 2025 10:14:36 +0000 00:00:00.15 aio1 ansible.builtin.command ansible-hardening : Check autofs service 2
OK 14 Dec 2025 10:14:35 +0000 00:00:00.25 aio1 ansible.builtin.service ansible-hardening : Ensure AppArmor is running 3
OK 14 Dec 2025 10:14:35 +0000 00:00:00.28 aio1 ansible.builtin.service ansible-hardening : Ensure AppArmor is enabled at boot time 3
OK 14 Dec 2025 10:14:34 +0000 00:00:00.16 aio1 ansible.builtin.command ansible-hardening : Check if apparmor is running 3
OK 14 Dec 2025 10:14:34 +0000 00:00:00.16 aio1 ansible.builtin.command ansible-hardening : Check apparmor_status output 3
CHANGED 14 Dec 2025 10:14:34 +0000 00:00:00.33 aio1 ansible.builtin.copy ansible-hardening : V-77821 - Datagram Congestion Control Protocol (DCCP) kernel module must be disabled 4
OK 14 Dec 2025 10:14:33 +0000 00:00:00.15 aio1 ansible.builtin.command ansible-hardening : Check kdump service 4
CHANGED 14 Dec 2025 10:14:30 +0000 00:00:02.15 aio1 ansible.posix.sysctl ansible-hardening : Set sysctl configurations 13
CHANGED 14 Dec 2025 10:14:30 +0000 00:00:00.14 aio1 ansible.builtin.lineinfile ansible-hardening : V-71983 - USB mass storage must be disabled. 4
OK 14 Dec 2025 10:14:29 +0000 00:00:00.15 aio1 ansible.builtin.stat ansible-hardening : Check for dconf profiles 2
OK 14 Dec 2025 10:14:28 +0000 00:00:00.14 aio1 ansible.builtin.stat ansible-hardening : Check if gdm is installed and configured 1
OK 14 Dec 2025 10:14:28 +0000 00:00:00.14 aio1 ansible.builtin.stat ansible-hardening : Check if /etc/cron.allow exists 2
OK 14 Dec 2025 10:14:26 +0000 00:00:00.02 aio1 ansible.builtin.debug ansible-hardening : V-72275 - Display date/time of last logon after logon 4
OK 14 Dec 2025 10:14:25 +0000 00:00:00.15 aio1 ansible.builtin.command ansible-hardening : Check for pam_lastlog in PAM configuration 2
OK 14 Dec 2025 10:14:24 +0000 00:00:00.16 aio1 ansible.builtin.stat ansible-hardening : Check if GRUB2 custom file exists 2
OK 14 Dec 2025 10:14:24 +0000 00:00:00.14 aio1 ansible.builtin.stat ansible-hardening : Check if sssd.conf exists 2
OK 14 Dec 2025 10:14:24 +0000 00:00:00.14 aio1 ansible.builtin.shell ansible-hardening : Check for '!authenticate' in sudoers files 4
OK 14 Dec 2025 10:14:24 +0000 00:00:00.02 aio1 debug ansible-hardening : V-71947 - Users must provide a password for privilege escalation 5
OK 14 Dec 2025 10:14:23 +0000 00:00:00.15 aio1 ansible.builtin.shell ansible-hardening : Check for 'nopasswd' in sudoers files 4
OK 14 Dec 2025 10:14:23 +0000 00:00:00.14 aio1 ansible.builtin.lineinfile ansible-hardening : Prevent users with blank or null passwords from authenticating (Debian/Ubuntu) 4
CHANGED 14 Dec 2025 10:14:22 +0000 00:00:00.15 aio1 ansible.builtin.lineinfile ansible-hardening : Set pam_faildelay configuration on Ubuntu 4
OK 14 Dec 2025 10:14:22 +0000 00:00:00.28 aio1 ansible.builtin.service ansible-hardening : Ensure auditd is running and enabled at boot time 4
CHANGED 14 Dec 2025 10:14:21 +0000 00:00:00.37 aio1 ansible.builtin.template ansible-hardening : Deploy rules for auditd based on STIG requirements 56
CHANGED 14 Dec 2025 10:14:21 +0000 00:00:00.14 aio1 ansible.builtin.file ansible-hardening : Remove system default audit.rules file 2
OK 14 Dec 2025 10:14:21 +0000 00:00:00.02 aio1 ansible.builtin.set_fact ansible-hardening : Get valid system architectures for audit rules 2
OK 14 Dec 2025 10:14:20 +0000 00:00:00.14 aio1 ansible.builtin.stat ansible-hardening : Verify that audisp-remote.conf exists 2
OK 14 Dec 2025 10:14:20 +0000 00:00:00.16 aio1 ansible.builtin.stat ansible-hardening : Verify that auditd.conf exists 2
OK 14 Dec 2025 10:14:20 +0000 00:00:00.14 aio1 ansible.builtin.stat ansible-hardening : Check to see if AIDE database is already in place 2
CHANGED 14 Dec 2025 10:14:19 +0000 00:00:00.14 aio1 ansible.builtin.blockinfile ansible-hardening : Configure AIDE to verify additional properties (Ubuntu) 6
CHANGED 14 Dec 2025 10:14:19 +0000 00:00:00.33 aio1 ansible.builtin.template ansible-hardening : Exclude certain directories from AIDE 4
OK 14 Dec 2025 10:14:18 +0000 00:00:00.29 aio1 ansible.builtin.stat ansible-hardening : Verify that AIDE configuration directory exists 2
OK 14 Dec 2025 10:14:18 +0000 00:00:00.03 aio1 ansible.builtin.debug ansible-hardening : Print warning for users with an assigned home directory that does not exist 4
OK 14 Dec 2025 10:14:14 +0000 00:00:04.03 aio1 ansible.builtin.stat ansible-hardening : Check each user to see if its home directory exists on the filesystem 4
OK 14 Dec 2025 10:14:13 +0000 00:00:00.14 aio1 shell ansible-hardening : Get all accounts with UID 0 5
CHANGED 14 Dec 2025 10:14:13 +0000 00:00:00.29 aio1 ansible.builtin.lineinfile ansible-hardening : Apply shadow-utils configurations 9
OK 14 Dec 2025 10:14:12 +0000 00:00:00.02 aio1 ansible.builtin.debug ansible-hardening : Print warning if PAM is not using SHA512 for password storage 4
OK 14 Dec 2025 10:14:11 +0000 00:00:00.14 aio1 ansible.builtin.command ansible-hardening : Check for SHA512 password storage in PAM 2
CHANGED 14 Dec 2025 10:14:11 +0000 00:00:00.19 aio1 ansible.builtin.blockinfile ansible-hardening : Set password quality requirements 12
OK 14 Dec 2025 10:14:11 +0000 00:00:00.15 aio1 ansible.builtin.stat ansible-hardening : Check if /etc/security/pwquality.conf exists 2
CHANGED 14 Dec 2025 10:14:10 +0000 00:00:00.14 aio1 ansible.builtin.lineinfile ansible-hardening : V-71979 - Package management tool must verify authenticity of locally-installed packages 3
OK 14 Dec 2025 10:14:10 +0000 00:00:00.02 aio1 ansible.builtin.debug ansible-hardening : V-71977 - Package management tool must verify authenticity of packages 3
OK 14 Dec 2025 10:14:10 +0000 00:00:00.14 aio1 ansible.builtin.command ansible-hardening : Search for AllowUnauthenticated in /etc/apt/apt.conf.d/ 1
OK 14 Dec 2025 10:14:09 +0000 00:00:00.01 aio1 ansible.builtin.include_tasks ansible-hardening : Including OS-specific tasks 1
OK 14 Dec 2025 10:14:08 +0000 00:00:00.35 aio1 ansible.builtin.package ansible-hardening : Remove packages based on STIG requirements 17
CHANGED 14 Dec 2025 10:13:43 +0000 00:00:24.93 aio1 ansible.builtin.package ansible-hardening : Add packages based on STIG requirements 17
OK 14 Dec 2025 10:13:43 +0000 00:00:00.15 aio1 get_users ansible-hardening : Get user data for all interactive users on the system 2
OK 14 Dec 2025 10:13:42 +0000 00:00:00.23 aio1 get_users ansible-hardening : Get user data for all users on the system 2
OK 14 Dec 2025 10:13:42 +0000 00:00:00.01 aio1 ansible.builtin.set_fact ansible-hardening : Set a fact for the temporary directory 2
CHANGED 14 Dec 2025 10:13:41 +0000 00:00:00.20 aio1 ansible.builtin.tempfile ansible-hardening : Create temporary directory to hold any temporary files 2
OK 14 Dec 2025 10:13:41 +0000 00:00:00.15 aio1 ansible.builtin.stat ansible-hardening : Check if grub is present on the remote node 2
OK 14 Dec 2025 10:13:41 +0000 00:00:00.02 aio1 ansible.builtin.set_fact ansible-hardening : Set facts 2
OK 14 Dec 2025 10:13:41 +0000 00:00:00.02 aio1 ansible.builtin.set_fact ansible-hardening : Check to see if we are booting with EFI or UEFI 2
OK 14 Dec 2025 10:13:40 +0000 00:00:00.14 aio1 ansible.builtin.command ansible-hardening : Check for check/audit mode 2
OK 14 Dec 2025 10:13:40 +0000 00:00:00.03 aio1 ansible.builtin.include_vars ansible-hardening : Gather variables for each operating system 2
OK 14 Dec 2025 10:13:40 +0000 00:00:00.01 aio1 ansible.builtin.include_role Include security hardening role 1
OK 14 Dec 2025 10:13:38 +0000 00:00:01.72 aio1 ansible.builtin.setup openstack.osa.gather_extra_facts : Gather additional facts 1
OK 14 Dec 2025 10:13:38 +0000 00:00:00.01 aio1 ansible.builtin.include_role Gather additional facts 1
OK 14 Dec 2025 10:09:06 +0000 00:00:00.27 aio1 gather_facts Gathering Facts 1
CHANGED 14 Dec 2025 10:09:00 +0000 00:00:01.89 aio1 community.general.lxc_container lxc_hosts : Create base container to use for containers with dir 1
CHANGED 14 Dec 2025 10:09:00 +0000 00:00:00.30 aio1 ansible.builtin.copy lxc_hosts : Set build ID 1
CHANGED 14 Dec 2025 10:08:59 +0000 00:00:00.33 aio1 ansible.builtin.copy lxc_hosts : Set expiry 1
CHANGED 14 Dec 2025 10:08:57 +0000 00:00:01.50 aio1 ansible.builtin.template lxc_hosts : Drop container meta-data 1
CHANGED 14 Dec 2025 10:08:52 +0000 00:00:05.33 aio1 ansible.builtin.shell lxc_hosts : Create lxc image 2
OK 14 Dec 2025 10:08:52 +0000 00:00:00.14 aio1 ansible.builtin.file lxc_hosts : Remove existing cache archive 1
CHANGED 14 Dec 2025 10:08:51 +0000 00:00:00.14 aio1 ansible.builtin.file lxc_hosts : Create LXC cache dir 1
OK 14 Dec 2025 10:08:51 +0000 00:00:00.01 aio1 ansible.builtin.include_tasks lxc_hosts : Including lxc_cache_create tasks 2
CHANGED 14 Dec 2025 10:08:30 +0000 00:00:20.45 aio1 ansible.builtin.async_status lxc_hosts : Ensure that the LXC cache has been prepared 1
OK 14 Dec 2025 10:08:30 +0000 00:00:00.22 aio1 ansible.builtin.shell lxc_hosts : Prepare cached image setup commands 1
CHANGED 14 Dec 2025 10:08:30 +0000 00:00:00.34 aio1 ansible.builtin.template lxc_hosts : Cached image preparation script 1