About ASIMP (Ansible System Integrity Management Platform)

Welcome to the official documentation and info portal for ASIMP.

ASIMP is an automated, host-based security hardening, compliance auditing, and integrity monitoring framework. Powered entirely by Ansible, ASIMP is designed to secure modern enterprise Linux environments against standard security baselines.

The platform implements a strict “Measure, Harden, Re-Measure” paradigm, offering instant visibility into system compliance posture before and after security configurations are applied.

🚀 Key Security Pillars

1. Dual-Engine Security Auditing:
   • OpenSCAP: Scans systems against the CIS (Center for Internet Security) Level 2 Security Profile.
   • Lynis: Performs a thorough check of system settings, kernel parameters, file permissions, and vulnerable endpoints.
2. Standardized OS Hardening:
   • Integrates secure default baselines using OpenStack’s ansible-hardening recommendations.
   • Applies robust, production-grade SSH security using Dev-Sec’s SSH-hardening suite.
3. Integrity Validation with debsums:
   • Compares installed package files against locally stored MD5 checksums to detect local changes or corruption.
4. Self-Observing Comparative Scorecard:
   • Automatically computes exact “before” vs. “after” audit scores and saves details locally, outputting a clear visual comparison directly to the console or log files.

📁 Technical Documentation Index

Explore the different sections of our system design, setup guides, and troubleshooting:

• Installation & Module Guide: Comprehensive guide for module installation using Python uv, Ansible playbooks, and bash scripting.
• Architecture & Design: Learn about the internal components, dual auditing flow, three-phase security pipeline, and our package integrity monitoring engines.
• AI Agents & DSOM Integration: Learn how ASIMP integrates with autonomous AI agents following the Deep State Of Mind (DSOM) For My AI Protocol, using spatial, procedural, and conceptual memory.
• OpenSCAP Integration & Playbooks: Detailed overview of how ASIMP manages OpenSCAP packages, selects dynamic datastreams, parses compliance scores, and handles USN OVAL reviews.
• OpenSCAP Operational Guide: Comprehensive manual for automated vulnerability auditing (OVAL), baseline compliance (XCCDF), and air-gapped remediation across enterprise Linux distributions.
• Knowledge Sharing Portal OpenSCAP Audit Report: Pre-remediation comparative audit report analyzing OpenSCAP OVAL vs. Operator VA scan findings across the testbed lab fleet.
• Lynis Auditing & Playbooks: Detailed analysis of how ASIMP conducts host audits, extracts the Hardening Index, and integrates with the lynis-ansible hardening role.
• Configuration & Variables: Discover customizable variables for our roles (reporting-ASIMP, update-ubuntu-ASIMP, lynis-ansible) and sample inventories.
• Troubleshooting & Fallbacks: Read detailed instructions on addressing DataStream resolution errors, connection elevation failures, and timeout behaviors.
• Review & Adoption of DSOM Guide: Structural alignment review of the DSOM Ansible Configuration Guide v3.6.2.
• Rootless Podman 5+ & Quadlet Orchestration: Overview of rootless orchestration, systemd Quadlets, namespace mappings, and unprivileged container matrix testing.
• Ansible Best Practices & FQCN Standards: Guidelines for Fully Qualified Collection Names (FQCN), task idempotency checks, and privilege strategies.
• Ansible Playbook and Document Architecture Map: Architectural dictionary linking playbook files with their core roles and operational documents.
• Local Knowledge-First & Metadata Discovery: SOP guidelines for unprivileged and agentic spatial discovery and context preservation.
• Enterprise Linux CIS Level 2 Guide: Complete guide and playbooks for RHEL, AlmaLinux, Rocky Linux, and Oracle Linux 8, 9, 10.
• Ubuntu 24.04/26.04 LTS Guide: Hardening guide and standalone playbook for Ubuntu 24.04 LTS and 26.04 LTS.
• Debian Hardening Guide: Hardening guide and standalone playbook for Debian GNU/Linux 11, 12, and 13.
• openSUSE Hardening Guide: Hardening guide and standalone playbook for openSUSE (Leap, Tumbleweed, SLES, SLED) with dynamic sysctl tuning.
• Ansible EE & Sovereign Gitea Guide: Technical guide for Ansible Execution Environments built via ansible-builder + uv integrated with Sovereign Gitea on Rootless Podman Quadlets.

💻 Fast Setup & Playbook Execution

Get started with ASIMP inside a Python virtual environment:

# Setup Virtual Environment
python3 -m venv /tmp/venv
source /tmp/venv/bin/activate
pip install -r requirements.txt

# Install Ansible Galaxy Dependencies
ansible-galaxy install -r requirements.yml

# Execute Local Host Hardening
ansible-playbook --connection=local -b -K play-localhost.yml