2022-09-16 11:04:19 +01:00
|
|
|
---
|
|
|
|
|
|
2022-06-20 17:07:39 +01:00
|
|
|
- name: POST | AUDITD | Apply auditd template will for section 4.1.3 - only required rules will be added
|
2023-01-13 12:10:18 +00:00
|
|
|
ansible.builtin.template:
|
2022-06-20 17:07:39 +01:00
|
|
|
src: audit/99_auditd.rules.j2
|
|
|
|
|
dest: /etc/audit/rules.d/99_auditd.rules
|
|
|
|
|
owner: root
|
|
|
|
|
group: root
|
2023-01-24 10:23:11 +00:00
|
|
|
mode: 0640
|
2022-06-20 17:07:39 +01:00
|
|
|
register: audit_rules_updated
|
2022-09-16 11:04:19 +01:00
|
|
|
notify:
|
2023-01-25 09:41:32 +00:00
|
|
|
- Auditd immutable check
|
|
|
|
|
- Audit immutable fact
|
2023-01-13 12:10:18 +00:00
|
|
|
- Restart auditd
|
2022-06-20 17:07:39 +01:00
|
|
|
|
2022-07-25 14:53:05 +01:00
|
|
|
- name: POST | Set up auditd user logging exceptions
|
2023-01-13 12:10:18 +00:00
|
|
|
ansible.builtin.template:
|
2022-09-16 11:04:19 +01:00
|
|
|
src: audit/98_auditd_exception.rules.j2
|
|
|
|
|
dest: /etc/audit/rules.d/98_auditd_exceptions.rules
|
|
|
|
|
owner: root
|
|
|
|
|
group: root
|
|
|
|
|
mode: 0600
|
2023-01-13 12:10:18 +00:00
|
|
|
notify: Restart auditd
|
2022-07-25 15:25:39 +01:00
|
|
|
when:
|
|
|
|
|
- allow_auditd_uid_user_exclusions
|
|
|
|
|
- rhel9cis_auditd_uid_exclude | length > 0
|
