security_scans.yml

---
- hosts: archlaptop
  remote_user: eternaltyro
  become: yes

  tasks:
    - name: Install Fangfrisch
      ansible.builtin.command:
        argv:
          - /usr/bin/yay
          - --answerclean
          - y
          - python-fangfrisch

    - name: Initialise Fangfrisch DB
      ansible.builtin.command: /usr/bin/fangfrisch --conf /etc/fangfrisch/fangfrisch.conf initdb
      become: yes
      become_user: clamav
      args:
        creates: /var/lib/fangfrisch/db.sqlite

    - name: Enable Fangfrisch scheduled runs
      ansible.builtin.systemd:
        name: fangfrisch.timer
        state: started
        enabled: true

    - name: Run RKHUNTER property update
      ansible.builtin.command: rkhunter --propupd
      become: yes
      tags: never

    - name: Run RKHUNTER checks
      ansible.builtin.command: rkhunter --check --skip-keypress --report-warnings-only
      become: yes
      tags: never

    - name: Run chkrootkit checks
      ansible.builtin.command: chkrootkit --quiet
      become: yes
      tags: never

    - name: Run Lynis system audit
      ansible.builtin.command: lynis audit system
      become: yes
      tags: never

    - name: Run tiger checks
      ansible.builtin.command: /usr/bin/tiger -q
      become: yes
      tags: never

...