fix(cis): add pipefail to sshd version detection and define binary defaults

2026-02-20 22:24:14 +01:00
parent a1fbb7c21d
commit 65c5b1029b
2 changed files with 7 additions and 1 deletions
--- a/roles/cis/defaults/main.yml
+++ b/roles/cis/defaults/main.yml
@@ -1,4 +1,8 @@
 ---
+# Platform-specific binary names for CIS permission targets
+cis_fusermount_binary: "{{ 'fusermount3' if is_rhel | default(false) | bool else 'fusermount' }}"
+cis_write_binary: "{{ 'write' if is_rhel | default(false) | bool else 'wall' }}"
+
 cis_permission_targets:
  - { path: "/mnt/etc/ssh/sshd_config", mode: "0600" }
  - { path: "/mnt/etc/cron.hourly", mode: "0700" }