Question on Ansible fixes: Might it be possible (and preferable per the DRY principle) to have Ansible fixes invoke the Bash fixes which tend to be more complete?
Simple case in point: there are 6 bash/aide* fixes and only 2 ansible/aide* fixes. Not to mention it's easier (at least for me) to build and test a bash "fix" script than an Ansible one.
Related: When you provision a new instance, to harden do you run the bash fixes (more complete) or the Ansible ones? I'm provisioning with Ansible so guidance as to how best to harden it would be helpful.
Bonus question: How best to generate fixes? Should I run them all on a new server, or can I run just those that match failing tests?
Thanks, =Fen
(apologies to list moderator - I initially sent this from an unsubscribed email address)