RHEL9-CIS/tasks/section_6/cis_6.1.x.yml

---

- name: "6.1.1 | PATCH | Ensure AIDE is installed"
  when:
    - rhel9cis_config_aide
    - rhel9cis_rule_6_1_1
  tags:
    - level1-server
    - level1-workstation
    - aide
    - patch
    - rule_6.1.1
    - NIST800-53R5_AU-2
  block:
    - name: "6.1.1 | PATCH | Ensure AIDE is installed"
      ansible.builtin.package:
        name: "{{ aide_packages }}"
        state: present
        update_cache: true
      register: discovered_aide_pkg_added

    - name: "6.1.1 | PATCH | Ensure AIDE is installed | Recapture packages"
      when: discovered_aide_pkg_added.skipped is not defined
      ansible.builtin.package_facts:
        manager: auto

    - name: "6.1.1 | AUDIT | Ensure AIDE is installed | Check file exists"
      ansible.builtin.stat:
        path: "{{ rhel9cis_aide_db_file }}"
      register: discovered_aide_db_file

    - name: "6.1.1 | AUDIT | Ensure AIDE is installed | Check current db file age"
      when: discovered_aide_db_file.stat.exists
      ansible.builtin.find:
        path: "{{ rhel9cis_aide_db_file | dirname }}"
        pattern: "{{ rhel9cis_aide_db_file | basename }}"
        age: "{{ rhel9cis_aide_db_file_age }}"
      register: discovered_aide_db_age

    - name: "6.1.1 | PATCH | Ensure AIDE is installed | Configure AIDE"
      when:
        - not ansible_check_mode
        - not discovered_aide_db_file.stat.exists or
          (discovered_aide_db_age.files | length > 0) or
          rhel9cis_aide_db_recreate
      block:
        - name: "6.1.1 | PATCH | Ensure AIDE is installed | Build AIDE DB"
          ansible.builtin.command: "{{ aide_initiate_command }}"
          changed_when: true

        - name: "6.1.1 | PATCH | Ensure AIDE is installed | Build AIDE DB | Wait for file before continuing"
          ansible.builtin.wait_for:
            path: /var/lib/aide/aide.db.new.gz

        - name: "6.1.1 | PATCH | Ensure AIDE is installed | Build AIDE DB |copy AIDE DB"
          ansible.builtin.copy:
            src: /var/lib/aide/aide.db.new.gz
            dest: /var/lib/aide/aide.db.gz
            remote_src: true
            mode: 'ug-wx,o-rwx'
          register: aide_db_cp
          failed_when:
            - not ansible_check_mode
            - aide_db_cp.failed

- name: "6.1.2 | PATCH | Ensure filesystem integrity is regularly checked"
  when:
    - rhel9cis_rule_6_1_2
    - not system_is_ec2
  tags:
    - level1-server
    - level1-workstation
    - aide
    - file_integrity
    - patch
    - rule_6.1.2
    - NIST800-53R5_AU-2
  block:
    - name: "6.1.2 | PATCH | Ensure filesystem integrity is regularly checked"
      when: rhel9cis_aide_scan == "cron"
      ansible.builtin.cron:
        name: Run AIDE integrity check
        cron_file: "{{ rhel9cis_aide_cron['cron_file'] }}"
        user: "{{ rhel9cis_aide_cron['cron_user'] }}"
        minute: "{{ rhel9cis_aide_cron['aide_minute'] | default('0') }}"
        hour: "{{ rhel9cis_aide_cron['aide_hour'] | default('5') }}"
        day: "{{ rhel9cis_aide_cron['aide_day'] | default('*') }}"
        month: "{{ rhel9cis_aide_cron['aide_month'] | default('*') }}"
        weekday: "{{ rhel9cis_aide_cron['aide_weekday'] | default('*') }}"
        job: "{{ rhel9cis_aide_cron['aide_job'] }}"

    - name: "6.1.2 | PATCH | Ensure filesystem integrity is regularly checked | aide service"
      when: rhel9cis_aide_scan == "timer"
      ansible.builtin.systemd:
        name: aidecheck.service
        enabled: true

    - name: "6.1.2 | PATCH | Ensure filesystem integrity is regularly checked | aide service"
      when: rhel9cis_aide_scan == "timer"
      ansible.builtin.systemd:
        name: aidecheck.timer
        state: started
        enabled: true

- name: "6.1.3 | PATCH | Ensure cryptographic mechanisms are used to protect the integrity of audit tools"
  when:
    - rhel9cis_rule_6_1_3
    - not system_is_ec2
  tags:
    - level1-server
    - level1-workstation
    - aide
    - file_integrity
    - patch
    - rule_6.1.3
  ansible.builtin.blockinfile:
    path: /etc/aide.conf
    marker: "# {mark} Audit tools - CIS benchmark - Ansible-lockdown"
    block: |
      /usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
      /usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
      /usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512
      /usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
      /usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
      /usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512
  register: aide_file_integrity_check
  failed_when:
    - not ansible_check_mode
    - aide_file_integrity_check.failed