137 lines
4.9 KiB
INI
137 lines
4.9 KiB
INI
# inventory.ini — Target hosts for IEC 62443-3-3 SL2 compliance validation
|
|
#
|
|
# Each platform type has its own group with the connection variables
|
|
# required by the matching example playbook in playbooks/examples/.
|
|
#
|
|
# Store secrets in Ansible Vault:
|
|
# ansible-vault encrypt_string 'MyP@ss' --name ansible_password
|
|
#
|
|
# Run a specific platform:
|
|
# ansible-playbook -i inventory.ini playbooks/examples/windows_server.yml
|
|
# ansible-playbook -i inventory.ini playbooks/examples/cisco_switch.yml
|
|
#
|
|
# Run all Linux assets:
|
|
# ansible-playbook -i inventory.ini playbooks/site.yml --limit linux_vms -K
|
|
|
|
# ── Local control-node self-test ─────────────────────────────────────────────
|
|
[all]
|
|
localhost ansible_connection=local
|
|
|
|
# ── Linux VMs / Servers (SSH — native Ansible) ───────────────────────────────
|
|
# Example: playbooks/examples/linux_vm.yml
|
|
[linux_vms]
|
|
# linux-vm-01.example.com ansible_user=auditor
|
|
# linux-vm-02.example.com ansible_user=auditor ansible_become=yes
|
|
|
|
# ── Windows Servers (WinRM) ───────────────────────────────────────────────────
|
|
# Example: playbooks/examples/windows_server.yml
|
|
# Preferred transport: kerberos (domain) or ntlm (workgroup/local admin)
|
|
[windows_servers]
|
|
# win-srv-01.example.com
|
|
# win-srv-02.example.com
|
|
|
|
[windows_servers:vars]
|
|
ansible_connection=winrm
|
|
ansible_winrm_transport=ntlm
|
|
ansible_winrm_server_cert_validation=ignore
|
|
ansible_port=5985
|
|
# ansible_user=DOMAIN\auditor
|
|
# ansible_password="{{ vault_win_password }}"
|
|
|
|
# ── Windows Clients / Workstations (WinRM) ────────────────────────────────────
|
|
# Example: playbooks/examples/windows_client.yml
|
|
[windows_clients]
|
|
# win-ws-01.example.com
|
|
# win-ws-02.example.com
|
|
|
|
[windows_clients:vars]
|
|
ansible_connection=winrm
|
|
ansible_winrm_transport=ntlm
|
|
ansible_winrm_server_cert_validation=ignore
|
|
ansible_port=5985
|
|
# ansible_user=DOMAIN\auditor
|
|
# ansible_password="{{ vault_win_password }}"
|
|
|
|
# ── MS SQL Servers (WinRM to Windows host; SQL queried via PowerShell) ────────
|
|
# Example: playbooks/examples/mssql_server.yml
|
|
[mssql_servers]
|
|
# sql-srv-01.example.com mssql_instance=MSSQLSERVER
|
|
# sql-srv-02.example.com mssql_instance=NAMED_INSTANCE
|
|
|
|
[mssql_servers:vars]
|
|
ansible_connection=winrm
|
|
ansible_winrm_transport=ntlm
|
|
ansible_winrm_server_cert_validation=ignore
|
|
ansible_port=5985
|
|
# ansible_user=DOMAIN\auditor
|
|
# ansible_password="{{ vault_win_password }}"
|
|
|
|
# ── VMware vSphere ESXi Hosts (vSphere API via vCenter — no SSH) ──────────────
|
|
# Example: playbooks/examples/vmware_vsphere.yml
|
|
# The inventory host IS the ESXi hostname. Connection goes via vCenter API.
|
|
[vmware_esxi]
|
|
# esxi-01.example.com
|
|
# esxi-02.example.com
|
|
|
|
[vmware_esxi:vars]
|
|
ansible_connection=local
|
|
vcenter_hostname=vcenter.example.com
|
|
vcenter_username=audit@vsphere.local
|
|
# vcenter_password="{{ vault_vcenter_password }}"
|
|
vmware_validate_certs=false
|
|
|
|
# ── Hyper-V Clusters (WinRM to cluster node) ──────────────────────────────────
|
|
# Example: playbooks/examples/hyperv_cluster.yml
|
|
[hyperv_hosts]
|
|
# hv-node-01.example.com
|
|
# hv-node-02.example.com
|
|
|
|
[hyperv_hosts:vars]
|
|
ansible_connection=winrm
|
|
ansible_winrm_transport=ntlm
|
|
ansible_winrm_server_cert_validation=ignore
|
|
ansible_port=5985
|
|
# ansible_user=DOMAIN\auditor
|
|
# ansible_password="{{ vault_win_password }}"
|
|
|
|
# ── Cisco Switches (IOS / IOS-XE — SSH via network_cli) ──────────────────────
|
|
# Example: playbooks/examples/cisco_switch.yml
|
|
[cisco_switches]
|
|
# sw-core-01.example.com
|
|
# sw-acc-01.example.com
|
|
|
|
[cisco_switches:vars]
|
|
ansible_connection=ansible.netcommon.network_cli
|
|
ansible_network_os=cisco.ios.ios
|
|
ansible_become=yes
|
|
ansible_become_method=enable
|
|
# ansible_user=audit
|
|
# ansible_password="{{ vault_ios_password }}"
|
|
# ansible_become_password="{{ vault_ios_enable }}"
|
|
|
|
# ── Cisco Firewalls (ASA — SSH via network_cli) ───────────────────────────────
|
|
# Example: playbooks/examples/cisco_firewall.yml
|
|
[cisco_firewalls]
|
|
# asa-fw-01.example.com
|
|
# asa-fw-02.example.com
|
|
|
|
[cisco_firewalls:vars]
|
|
ansible_connection=ansible.netcommon.network_cli
|
|
ansible_network_os=cisco.asa.asa
|
|
ansible_become=yes
|
|
ansible_become_method=enable
|
|
# ansible_user=audit
|
|
# ansible_password="{{ vault_asa_password }}"
|
|
# ansible_become_password="{{ vault_asa_enable }}"
|
|
|
|
# ── Convenience group: all ICS/OT assets (excludes localhost) ────────────────
|
|
[ics_assets:children]
|
|
linux_vms
|
|
windows_servers
|
|
windows_clients
|
|
mssql_servers
|
|
vmware_esxi
|
|
hyperv_hosts
|
|
cisco_switches
|
|
cisco_firewalls
|