ASIMP :: Security Platform
ANSIBLE SYSTEM INTEGRITY MANAGEMENT PLATFORM // baselines & hardening
MODE:

Documentation

Home Gitbook & dsom summary index Asimp for ai agents: deep state of mind (dsom) protocol integration Ansible best practices & fqcn standards Ansible playbook and document architecture map Architecture & design Configuration & variables Review & adoption of dsom ansible configuration guide (v3.6.2) Diátaxis documentation framework Deep state of mind (dsom) governance framework System architecture & security posture Operational recipes index Execute tool workflows Legal notice & disclaimer Asimp local testing matrix & telemetry spec Lynis auditing & playbook analysis Openscap integration & playbook analysis Rootless podman 5+ & quadlet orchestration Asimp standard footer patcher reference Google okf frontmatter patcher reference Ansible config parameters reference Component & tool index Sovereign feedback collector reference Llm xml context compiler reference Role lynis ansible reference Mock scanning utility reference Openwiki emulator specification Sovereign os role patcher reference System core playbooks reference Jekyll pre processor reference Role reporting asimp reference Suse/sled sysctl hardening role reference Role update ubuntu asimp reference Sitemap & link integrity validator reference Local knowledge first & metadata discovery Troubleshooting & fallback behaviors Quickstart onboarding guide

Reports & SPA

Output of ASIMP Output of Lynis Output of OpenSCAP SPA Requirement Checklist

About ASIMP

ASIMP is an automated framework built with Ansible to assess host compliance, configure OS parameters, secure SSH, and verify integrity.

Architecture & Design

Ansible >= 9.0.0 OpenSCAP: CIS L2 Lynis: Enabled debsums: Enabled

Architecture & Design

ASIMP (Ansible System Integrity Management Platform) is designed around a three-phase security pipeline. Unlike standard configuration management playbooks which focus purely on applying states, ASIMP emphasizes continuous observability and self-reporting.

🏛️ System Component Flow

The core workflow of ASIMP consists of:

[Phase 1: Auditing Baseline]
          |
          +---> Run OpenSCAP Baseline scan (CIS Linux L2 profile)
          +---> Run Lynis Baseline audit (--quick mode)
          +---> Save initial compliance metrics to: `/var/log/asimp-baseline-scores.json`
          |
[Phase 2: Hardening & System Remediation]
          |
          +---> update-ubuntu-ASIMP (Applies safety updates & runs debsums check)
          +---> ansible-hardening (OpenStack security recommendations)
          +---> dev-sec.ssh-hardening (Secures SSH Server & Client configurations)
          +---> lynis-ansible (Remediates localized audit exceptions)
          |
[Phase 3: Verification & Reporting]
          |
          +---> Run OpenSCAP Post-Hardening scan
          +---> Run Lynis Post-Hardening audit
          +---> Slurp baseline scores from `/var/log/asimp-baseline-scores.json`
          +---> Parse and match results using `/usr/local/bin/parse_openscap_score.py`
          +---> Output terminal scorecard & generate complete HTML/DAT audit reports

🔍 The Auditing Engines

1. OpenSCAP (Security Content Automation Protocol)

OpenSCAP is a NIST-certified tool for verifying compliance against defined benchmarks. ASIMP automatically installs the required packages (openscap-scanner, ssg-debian, ssg-debderived, or scap-security-guide) on target systems, detects the operating system version, and locates the correct XML DataStream.

The primary scanning target profile is:

  • Profile: xccdf_org.ssgproject.content_profile_cis_level2_server (Center for Internet Security - Level 2 Server)

If the profile or OS data stream is not present, ASIMP automatically performs a graceful fallback to available baselines.

2. Lynis Auditing Engine

Lynis is a host-based, open-source security auditing tool. It scans system configurations, file permissions, kernel parameters, and services. In Phase 1, ASIMP executes lynis audit system --quick and extracts the hardening_index from /var/log/lynis-report.dat. Post-hardening, a second audit is run, and the two indexes are compared side-by-side to measure exact security enhancement.

🛠️ Integrity Verification with debsums

The package integrity check is performed using debsums, which verifies MD5 hashes of all installed package files against original registry hashes. This helps detect:

  • System binary modifications or tampering.
  • Filesystem corruption.
  • Unauthorized or manually modified library files.

The check runs asynchronously in the background so as not to stall playbook execution, with its output saved under /var/log/debsums.output.