# Need help **URL:** \ **Category:** Ansible Project\ **Created:** [October 27, 2018, 5:44pm UTC](https://forum.ansible.com/t/need-help/28882 "2018-10-27T17:44:26Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Sathya\_Narayanan](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@Sathya\_Narayanan](https://forum.ansible.com/u/Sathya_Narayanan)\ **Post date:** [October 27, 2018, 5:44pm UTC](https://forum.ansible.com/t/need-help/28882/1 "2018-10-27T17:44:26Z")
Hi All, I am new to ansible and I would like to understand or get some ideas about how to use ansible to maintain standard operating system environment. For example : I would like to have ansible to check all my existing OS (Amazon Linux) to see if there are any additional package installed. The idea is to have a list of rpm names as standard packages, and ansible should monitor if all my systems are having only the list of approved rpms. In case of any extra rpms installed by any of the engineer, then ansible should automatically remove it. Not sure, if I have explained my ask clear, but the idea is to have ansible maintain software inventory (approved software) and any unauthorized software installed, then it should notify via email and remove that software. Regards, Sathya.R ---
**Author:** ![Sathya\_Narayanan](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@Sathya\_Narayanan](https://forum.ansible.com/u/Sathya_Narayanan)\ **Post date:** [October 28, 2018, 1:46pm UTC](https://forum.ansible.com/t/need-help/28882/2 "2018-10-28T13:46:34Z")
Any suggestions/ideas on the below ask? ---
**Author:** ![Michael\_M1](https://avatars.discourse-cdn.com/v4/letter/m/e274bd/32.png) [@Michael\_M1](https://forum.ansible.com/u/Michael_M1)\ **Post date:** [October 28, 2018, 3:36pm UTC](https://forum.ansible.com/t/need-help/28882/3 "2018-10-28T15:36:49Z")
Hi Sathya, You could get a list of current packages via ‘yum list’ or whatever package manager, then use that as the list of packages as the variable, and do something like the following. Maintaining and parsing that ‘master’ list however might be quite cumbersome. name: remove unwanted packages package: name: “{{ item }}” state: absent when item not in good\_packages Of course the simpler and saner way would be to just restrict people from installing packages in the first place. 😉 ---
**Author:** ![Jonathan\_Lozada\_De\_L](https://avatars.discourse-cdn.com/v4/letter/j/eb8c5e/32.png) [@Jonathan\_Lozada\_De\_L](https://forum.ansible.com/u/Jonathan_Lozada_De_L)\ **Post date:** [October 28, 2018, 4:34pm UTC](https://forum.ansible.com/t/need-help/28882/4 "2018-10-28T16:34:29Z")
I 2nd Michael’s comment. ---
**Author:** ![Frank\_Thommen](https://avatars.discourse-cdn.com/v4/letter/f/7feea3/32.png) [@Frank\_Thommen](https://forum.ansible.com/u/Frank_Thommen)\ **Post date:** [October 28, 2018, 5:15pm UTC](https://forum.ansible.com/t/need-help/28882/5 "2018-10-28T17:15:53Z")
Consider, that with this mechanism you will not detect packages which have been installed directly either by custom installer, the standard configure-make-make install or by directly copying binaries or scripts in some central location. Also keep in mind, that if you omit (or someone removes) an essential package (let's say "python" 🙂 from good\_packages, you risk to completely screw up your systems. I am normally extremely careful when it comes to /remove/ stuff through ansible. Also because of that you should absolutely consider Michael's comment. Additionally you might consider to implement some inventory/monitoring which allows you to monitor software changes. Cheers frank ---
**Author:** ![Sathya\_Narayanan](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@Sathya\_Narayanan](https://forum.ansible.com/u/Sathya_Narayanan)\ **Post date:** [October 28, 2018, 6:11pm UTC](https://forum.ansible.com/t/need-help/28882/6 "2018-10-28T18:11:29Z")
Thanks frank and micheal for your useful suggestion. The point is, the entire production system is handed over to some third party developers team with sudo privilages ( its is mistake from architecture team) and the client is so dependent on the developing team. The developers are so that, they install lot of packages which are vulnerable to the environment. We manage the infrasture and our CVE scores are getting hit because of those unwanted packages which development team install. Even after informing the team multiple times, they still run those software on the server which are not even upgraded. I know that this is something to do,restrict or to educate the team not to use system for such installation. As of now there is no mechanism to stop it and I was thinking about doing something with ansible . I am not sure if this is possible, any way where I can make ansible to report back to us, when there is new installation done on the system? ---
**Author:** ![Jonathan\_Lozada\_De\_L](https://avatars.discourse-cdn.com/v4/letter/j/eb8c5e/32.png) [@Jonathan\_Lozada\_De\_L](https://forum.ansible.com/u/Jonathan_Lozada_De_L)\ **Post date:** [October 28, 2018, 6:16pm UTC](https://forum.ansible.com/t/need-help/28882/7 "2018-10-28T18:16:10Z")
a quick solution might be to upgrade those packages that are vulnerable but, that varies by OS flavor and the applications been installed.