Forum Discussion

Kevin_Nail's avatar
Kevin_Nail
Icon for Nimbostratus rankNimbostratus
Jul 12, 2021

need a way to get the DEFAULT cipher string via a yaml script

Im writing a yaml script to get the DEAULT cipher string being used.

Here is my speciic code section:

block:

    - name: check the default cipher

     bigip_command:

      commands:

      - tmm --clientciphers DEFAULT | grep -i {{ cipher_string}}

      provider: "{{ provider }}"

     delegate_to: localhost

     register: cipher_out

     ignore_errors: true

   when: software_version_out.stdout != '15.1.4.1'

 

This is the error I get:

TASK [check the default cipher] **************************************************************************************************************************************************************

[WARNING]: Using "write" commands is not idempotent. You should use a module that is specifically made for that. If such a module does not exist, then please file a bug. The command in

question is "tmm --clientciphers DEFAULT | grep -i de..."

 

Is there another way to get this information via tmsh?

15 Replies

  • Sanjay,

     

    If you dont mind me asking another related question. I have the code working but how do I handle codes? for example... if cipher abc show up in the list, I want debug to print one message like "Found abc" if cipher abc does not show up in the list, I want debug to print a different message like "No cipher found"

     

    This is what I have added (in bolc)

         bigip_command:

          commands:

           - tmsh list ltm profile client-ssl ciphers | grep -i -v -E '{{ ignore_cipher }}|{{ ignore_cipher2 }}' | grep -i -B1 {{ cipher_string }}

          provider: "{{ provider }}"

         delegate_to: localhost

         register: cipher_out

         ignore_errors: true

         register: client_cipher_out

         ignore_errors: true

        - debug:

          msg: "No Cipher Found in any Client profile"

         when: client_cipher_out.rc != 0

        - debug:

          msg: "{{ client_cipher_out.stdout_lines }}"

         when: client_cipher_out.rc == 0

     

    I suspect my logic is not correct because the exits status will still be 0, even if it does not find anything, however, I see this in the output:

     

    TASK [debug] ********************************************************************************************************************************************************************************

    fatal: [192.168.196.120]: FAILED! => {"msg": "The conditional check 'client_cipher_out.rc != 0' failed. The error was: error while evaluating conditional (client_cipher_out.rc != 0): 'dict object' has no attribute 'rc'\n\nThe error appears to be in '/home/knail/test-project/final.yaml': line 47, column 10, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n     ignore_errors: true\n    - debug:\n     ^ here\n"}

     

    Any ideas?