Improved security check warning.

mikolak-net · Apr 7, 2015 · 3d62ad1 · 3d62ad1
1 parent a6cabef
commit 3d62ad1
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/tasks/security_check.yml b/tasks/security_check.yml
@@ -4,4 +4,10 @@
 - name: check for login
   command: sshpass -p {{raspi_config_auth_test_password}} ssh {{raspi_config_auth_test_username}}@localhost -o NoHostAuthenticationForLocalhost=yes "echo {{raspi_config_auth_test_string}}"
   register: auth_test
-  failed_when: "raspi_config_fail_on_auth_test and raspi_config_auth_test_string in auth_test.stdout"
+  changed_when: False
+  failed_when: False
+- name: optional warning
+  debug: msg="{{raspi_config_auth_test_fail_msg}}"
+  when: "raspi_config_auth_test_string == auth_test.stdout"
+  changed_when: "raspi_config_auth_test_string == auth_test.stdout" # for highlighting purposes
+  failed_when: raspi_config_fail_on_auth_test
diff --git a/vars/main.yml b/vars/main.yml
@@ -3,6 +3,7 @@ raspi_config_pi_cpu:
   Pi1: BCM2708
   Pi2: BCM2709
 raspi_config_min_camera_mem: 128
-raspi_config_auth_test_string: ABLE TO SSH IN WITH FACTORY CREDENTIALS - ASSUME PWNED IF SSH OPEN TO THE INTERNET
+raspi_config_auth_test_string: VULN
+raspi_config_auth_test_fail_msg: ABLE TO SSH IN WITH FACTORY CREDENTIALS - ASSUME PWNED IF SSH OPEN TO THE INTERNET
 raspi_config_auth_test_username: pi
 raspi_config_auth_test_password: raspberry