ASIMP :: Security Platform
ANSIBLE SYSTEM INTEGRITY MANAGEMENT PLATFORM // baselines & hardening
MODE:

Documentation

Home Gitbook & dsom summary index Asimp for ai agents: deep state of mind (dsom) protocol integration Ansible best practices & fqcn standards Ansible playbook and document architecture map Architecture & design Configuration & variables Review & adoption of dsom ansible configuration guide (v3.6.2) Diátaxis documentation framework Deep state of mind (dsom) governance framework System architecture & security posture Operational recipes index Execute tool workflows Legal notice & disclaimer Asimp local testing matrix & telemetry spec Lynis auditing & playbook analysis Openscap integration & playbook analysis Rootless podman 5+ & quadlet orchestration Asimp standard footer patcher reference Google okf frontmatter patcher reference Ansible config parameters reference Component & tool index Sovereign feedback collector reference Llm xml context compiler reference Role lynis ansible reference Mock scanning utility reference Openwiki emulator specification Sovereign os role patcher reference System core playbooks reference Jekyll pre processor reference Role reporting asimp reference Suse/sled sysctl hardening role reference Role update ubuntu asimp reference Sitemap & link integrity validator reference Local knowledge first & metadata discovery Troubleshooting & fallback behaviors Quickstart onboarding guide

Reports & SPA

Output of ASIMP Output of Lynis Output of OpenSCAP SPA Requirement Checklist

About ASIMP

ASIMP is an automated framework built with Ansible to assess host compliance, configure OS parameters, secure SSH, and verify integrity.

Configuration & Variables

Ansible >= 9.0.0 OpenSCAP: CIS L2 Lynis: Enabled debsums: Enabled

Configuration & Variables

ASIMP is highly customizable. Many aspects of the system-level hardening, audits, and operating system packages can be configured through Ansible variables.

⚙️ Core Variables

The main variables are declared in play.yml (or play-localhost.yml) and roles defaults.

1. Global / Common Variables

Variable Default Value Description
security_enable_firewalld false Controls whether firewalld is installed and enabled during hardening.
security_rhel7_initialize_aide true Initializes the AIDE (Advanced Intrusion Detection Environment) database on RHEL/CentOS systems.
security_contrib_enabled true Allows using community-contributed hardening components.
security_ntp_servers ["ntp1.sirim.my", "ntp2.sirim.my"] Custom NTP servers to set on hardened nodes.

2. update-ubuntu-ASIMP Role Variables

These variables are defined in roles/update-ubuntu-ASIMP/defaults/main.yml:

Variable Default Value Description
upgrade_ubuntu_check no If enabled (yes), runs apt upgrade on all packages to the latest versions.
dist_upgrade_ubuntu_check no If enabled (yes), runs apt-get dist-upgrade to handle changing dependencies.
safe_upgrade_ubuntu_check yes Standard safe package upgrade behavior (avoids removing packages).
debsums_ubuntu_check yes Installs debsums and executes an asynchronous file integrity audit.

3. lynis-ansible Role Variables

These variables customize the Lynis auditing execution:

Variable Default Value Description
lynis_use_packages true Standardizes package installation for Lynis instead of running from source tarballs.
lynis_audit_system_linux true Enables automatic audit scanning for Linux systems.

📂 Multi-Node Inventory Configuration

To run ASIMP across multiple enterprise servers, construct an inventory file (e.g., hosts.ini):

[webservers]
web1.internal.corp ansible_host=10.0.1.15
web2.internal.corp ansible_host=10.0.1.16

[dbservers]
db1.internal.corp ansible_host=10.0.2.20

[hardened:children]
webservers
dbservers

Execute ASIMP against the inventory with elevated privileges:

ansible-playbook -i hosts.ini -b -K play.yml