# Plabook for Ansible to scan for CVE-2021-44228 / log4shell

# second JAVA-Scanner

# This playbook must be started from the main folder to access the dynamic data-dir inventory.
# start with:
# ansible-playbook playbooks/CVE-2021-44228/main-JAVA.yml --diff --limit [whatever_you_find_appropriate]


- name: scan CVE-2021-44228 log4j log4shell JAVA
  gather_facts: no
  hosts: all
  ignore_unreachable: yes
  # Hosts at Peter Lacke will be handled one by one with a pause in-between
  serial: 4

  tasks:

  - name: copy scanfile to client
    tags: copyfile
    #become: true # must be run as unpriv
    ansible.builtin.copy:
      src: log4j-detector-2021.12.13.jar
      dest: /home/perfact/log4j-detector-2021.12.13.jar
      mode: '0755'

  - name: execute scanfile
    tags: executescanfile
    #become: true # must run as unpriv
    # shell: '/home/perfact/local-log4j-vuln-scanner / | grep -v -E "permission denied|no such file or directory|operation not permitted"'
    shell: 'java -jar log4j-detector-2021.12.13.jar /var/lib /lib /lib64 /usr /opt'
    args:
      chdir: /home/perfact
      #creates: nothing - formerly /home/perfact/protect_tstimeline_file_delete.out
    register: scanfile_output

  # output stdout
  - debug:
      msg: "{{ scanfile_output.stdout.split('\n') }}"
    tags: executescanfile

  - name: remove binary
    tags: removebinary
    #become: true # run ans unpriv
    ansible.builtin.file:
      path: /home/perfact/log4j-detector-2021.12.13.jar
      state: absent

#  - pause:
#      prompt: "Wait in-between playbook execution at Peterlacke to avoid issues with the firewall"
#      seconds: 20
#
