# Os-security-patch-management-automation-with-ansible

Ansible playbook that automates security audits using Lynis on one or multiple Ubuntu hosts. The playbook scans for vulnerabilities and generates actionable remediation steps, which can then be automated using another playbook.

# **Patch Management with Ansible**

![Patch Management](https://camo.githubusercontent.com/dfccf0cdc59cf22fb4e6a6f14733de569de1339e7b5442dbe0a329b18340237c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f50617463682532304d616e6167656d656e742d4175746f6d6174696f6e2d626c7565 align="left")

In enterprise environments, vulnerability management typically follows this workflow:

* A vulnerability scanner (Tenable, Qualys, Rapid7, OpenVAS) performs scans on infrastructure.
    
* The results are collected in an Excel format (usually a template proposed by the CISO) where findings are organized by severity level, CVSS score, plugin, and other relevant factors.
    
* Prioritization is then carried out from critical to less critical vulnerabilities, enabling teams to apply patches accordingly using tools like Microsoft WSUS or other enterprise-level solutions.
    

To streamline this process, I have implemented an **Ansible playbook** that automates security audits using Lynis on one or multiple Ubuntu hosts. The playbook scans for vulnerabilities at the OS mainly at the kernel level and generates actionable remediation steps, which can then be automated using another playbook.

### SCRIPTS/PLAYBOOKS I’ve write to use for the demonstration

vul\_scan\_automation.yml : Here is the playbook which have been write to automate secutity weaknesses discovery at the OS level, you can assess it here —> [PATCH-MANAGEMENT-AUTOMATION-WITH-ANSIBLE/automatelynis.yml at main · yvesstan/PATCH-MANAGEMENT-AUTOMATION-WITH-ANSIBLE](https://github.com/yvesstan/PATCH-MANAGEMENT-AUTOMATION-WITH-ANSIBLE/blob/main/automatelynis.yml) |

[Scan results:](https://github.com/yvesstan/PATCH-MANAGEMENT-AUTOMATION-WITH-ANSIBLE/blob/main/automatelynis.yml) Here is the result that have been obtained from the scan performed by the discovery playbook, you can access it here —> [PATCH-MANAGEMENT-AUTOMATION-WITH-ANSIBLE/scan\_results.txt at main · yvesstan/PATCH-MANAGEMENT-AUTOMAT](https://github.com/yvesstan/PATCH-MANAGEMENT-AUTOMATION-WITH-ANSIBLE/blob/main/automatelynis.yml)[ION-WITH-ANSIBLE](https://github.com/yvesstan/PATCH-MANAGEMENT-AUTOMATION-WITH-ANSIBLE/blob/main/scan_results.txt) |

ossec.yml —> You ou have to install ossec to fix the error encounter at the section “Install Ossec“ of the discovery playbook, you can access it here —> [PATCH-MANAGEMENT-AUTOMATION-WITH-ANSIBLE/ossec.yml at main · yvesstan/PATCH-MANAGEMENT-AUTOMATION-WITH-ANSIBLE](https://github.com/yvesstan/PATCH-MANAGEMENT-AUTOMATION-WITH-ANSIBLE/blob/main/ossec.yml)

automatelynis.yml —> Here is the final playbook which main goal is to patch all the security weaknesses that have been discovered at the OS level, you can access it here —> [PATCH-MANAGEMENT-AUTOMATION-WITH-ANSIBLE/automatelynis.yml at main · yvesstan/PATCH-MANAGEMENT-AUTOMATION-WITH-ANSIBLE](https://github.com/yvesstan/PATCH-MANAGEMENT-AUTOMATION-WITH-ANSIBLE/blob/main/automatelynis.yml)

## [**Step 1: Security Audit Scan Playbook**](https://github.com/yvesstan/PATCH-MANAGEMENT-AUTOMATION-WITH-ANSIBLE/blob/main/automatelynis.yml)

[The first step involves creating an **Ansible playbook** to automate **CVE discovery**](https://github.com/yvesstan/PATCH-MANAGEMENT-AUTOMATION-WITH-ANSIBLE/blob/main/automatelynis.yml) [on a L](https://github.com/yvesstan/PATCH-MANAGEMENT-AUTOMATION-WITH-ANSIBLE/blob/main/vul_scan_automation.yml)inux system using the **Lynis tool**. This playbook is designed for enterprise environments, ensuring professionalism and efficiency.

### **📜 Playbook:** `vul_scan_automation.yml`

### **🔄 Workflow:**

1. **Update the package list**: Ensures all repositories and packages are up to date.
    
2. **Install required packages**: Installs Lynis and other necessary tools for CVE scanning.
    
3. **Run vulnerabilities scan using Lynis**: Executes a system scan with Lynis and captures the results.
    
4. **Save vulnerabilities scan results to a file**: Logs scan results for later review.
    
5. **Notify the administrator**: Sends an email notification with scan completion details and log file location *(not yet implemented)*.
    
6. **Clean up unused packages**: Removes unnecessary packages and dependencies.
    
7. **Reboot the system if required**: Applies updates and reboots the system if necessary.
    

This playbook ensures automated security weaknesses discovery at the OS Kernel level and logs results for administrators to review and take the appropriate actions.

### **📂 Log File Location**

In my setup, scan results are stored at:

```plaintext
/home/master/lynis_cve_scan.log
```

on both the Ansible master and slave nodes.

## **Viewing Scan Results**

To review the CVE scan results, you can use various methods:

### **Terminal Commands:**

* **Using** `cat`:
    
    ```plaintext
    cat /home/master/lynis_cve_scan.log
    ```
    
* **Using** `less`:
    
    ```plaintext
    less /home/master/lynis_cve_scan.log
    ```
    
    (Use arrow keys to navigate, press `q` to quit.)
    
* **Using a text editor**:
    
    ```plaintext
    nano /home/master/lynis_cve_scan.log
    ```
    
    or
    
    ```plaintext
    vim /home/master/lynis_cve_scan.log
    ```
    
* ### **Remote Access:**
    
    * **Using** `scp` to transfer the file to your local machine:
        
    
    ```plaintext
    scp user@remote_host:/home/master/lynis_cve_scan.log /path/to/local/directory
    ```
    
* **Viewing in a web browser**:
    

```plaintext
sudo mv /home/master/lynis_cve_scan.log /var/www/html/
```

Then access: [`http://your_server_ip/lynis_cve_scan.log`](http://your_server_ip/lynis_cve_scan.log)

**Converting Scan Results to HTML**

If you prefer an HTML format, install `aha` (ANSI-to-HTML converter):

```plaintext
sudo apt-get install aha
```

Convert the scan results:

```plaintext
cat /home/master/lynis_cve_scan.log | aha > /home/master/lynis_cve_scan.html
```

![](https://github.com/yvesstan/Cloud-Projects/raw/main/LabPic/videoframe_9645.png align="left")

## **Step 2: Automating Security Remediation**

Once vulnerabilities are identified, we can automate the remediation process by writing another playbook.

### **📜 Playbook:** `automatelynis.yml`

Check the contents of this file in the repository for the remediation steps implemented.

![](https://github.com/yvesstan/Cloud-Projects/raw/main/LabPic/automatelynis.png align="left")

### **Possible Errors & Fixes**

If you encounter an error in the task `Install OSSEC`, you will find a separate playbook named `ossec.yml` that resolves this issue.

![](https://github.com/yvesstan/Cloud-Projects/raw/main/LabPic/ossec.png align="left")

## **Conclusion**

This project demonstrates how **Ansible** can be leveraged to **automate security audits and vulnerability remediation** in an enterprise environment. By integrating these playbooks into your security workflow, you can enhance **efficiency, consistency, and response time** in patch management.

Feel free to **contribute, suggest improvements, or reach out** for discussions!