ASIMP :: Security Platform
ANSIBLE SYSTEM INTEGRITY MANAGEMENT PLATFORM // baselines & hardening
MODE:

Documentation

Home Gitbook & dsom summary index Asimp for ai agents: deep state of mind (dsom) protocol integration Ansible best practices & fqcn standards Ansible playbook and document architecture map Architecture & design Configuration & variables Review & adoption of dsom ansible configuration guide (v3.6.2) Diátaxis documentation framework Deep state of mind (dsom) governance framework System architecture & security posture Operational recipes index Execute tool workflows Legal notice & disclaimer Asimp local testing matrix & telemetry spec Lynis auditing & playbook analysis Openscap integration & playbook analysis Rootless podman 5+ & quadlet orchestration Asimp standard footer patcher reference Google okf frontmatter patcher reference Ansible config parameters reference Component & tool index Sovereign feedback collector reference Llm xml context compiler reference Role lynis ansible reference Mock scanning utility reference Openwiki emulator specification Sovereign os role patcher reference System core playbooks reference Jekyll pre processor reference Role reporting asimp reference Suse/sled sysctl hardening role reference Role update ubuntu asimp reference Sitemap & link integrity validator reference Local knowledge first & metadata discovery Troubleshooting & fallback behaviors Quickstart onboarding guide

Reports & SPA

Output of ASIMP Output of Lynis Output of OpenSCAP SPA Requirement Checklist

About ASIMP

ASIMP is an automated framework built with Ansible to assess host compliance, configure OS parameters, secure SSH, and verify integrity.

Troubleshooting & Fallback Behaviors

Ansible >= 9.0.0 OpenSCAP: CIS L2 Lynis: Enabled debsums: Enabled

Troubleshooting & Fallback Behaviors

This guide covers common issues, warning states, and standard troubleshooting strategies when using the ASIMP security framework.

🛠️ OpenSCAP File and Profile Resolution

Problem: Dynamic DataStream Not Found

  • Symptom: On specialized, custom, or newer Linux distributions, OpenSCAP might fail to find the exact version-matched XML DataStream (e.g. ssg-ubuntu2404-ds.xml on a beta release).
  • ASIMP Mitigation: The reporting-ASIMP role dynamically resolves OS-version-specific datastreams:
    1. It performs an ansible.builtin.find search in the standard directory /usr/share/xml/scap/ssg/content/.
    2. It constructs the appropriate datastream path based on detected OS distribution and version.
    3. If no OS-version-compatible datastream is found, the scan is considered unsupported for that platform (the role should not proceed with an arbitrary or incompatible datastream file).

Verification Steps:

Check if the SCAP files exist on your machine:

ls -la /usr/share/xml/scap/ssg/content/

If empty, verify internet access or manual package repositories so that scap-security-guide or ssg-debian can install correctly.

⏳ Slow Playbook Runs (Timeouts)

Problem: Repository Upgrades or Debsums Takes Too Long

  • Symptom: When upgrading thousands of outdated packages or hashing files via debsums, standard Ansible connections can timeout or stall.
  • ASIMP Mitigation: ASIMP executes heavy tasks asynchronously (async: 361 with standard polling loops). This allows the task to run independently and provides status polling up to 360 retries.
  • Troubleshooting: If a timeout is reached, check the local logs directly on the target host:
    • Repository cache / upgrade log: /var/log/dpkg.log or /var/log/apt/history.log
    • Debsums check logs: /var/log/debsums.output and /var/log/debsums.err

🖥️ Sudo / Elevation Failures

Problem: Become password required

  • Symptom: Missing sudo password or Permission denied when executing playbooks.
  • Reason: ASIMP modifies system-level configurations, installs packages, and runs audits, which requires root/administrator privileges.
  • Solution: Always execute with become parameters (-b -K or --become --ask-become-pass): 
    ansible-playbook -b -K play.yml

    For localhost operations:

    ansible-playbook --connection=local -b -K play-localhost.yml

    (The playbook requires privilege escalation. Make sure your current user has sudo capabilities.)