RHEL9-CIS/tasks/section_1/cis_1.3.x.yml

---

- name: "1.3.1 | PATCH | Ensure AIDE is installed"
  block:
      - name: "1.3.1 | PATCH | Ensure AIDE is installed | Install AIDE"
        ansible.builtin.package:
            name: aide
            state: present

      - name: "1.3.1 | PATCH | Ensure AIDE is installed | Build AIDE DB"
        ansible.builtin.shell: /usr/sbin/aide --init
        args:
            creates: /var/lib/aide/aide.db.new.gz
        when: not ansible_check_mode

      - name: "1.3.1 | PATCH | Ensure AIDE is installed | Wait for file before continuing"
        ansible.builtin.wait_for:
            path: /var/lib/aide/aide.db.new.gz

      - name: "1.3.1 | PATCH | Ensure AIDE is installed | copy AIDE DB"
        ansible.builtin.copy:
            src: /var/lib/aide/aide.db.new.gz
            dest: /var/lib/aide/aide.db.gz
            remote_src: true
  when:
      - rhel9cis_config_aide
      - rhel9cis_rule_1_3_1
  tags:
      - level1-server
      - level1-workstation
      - aide
      - patch
      - rule_1.3.1

- name: "1.3.2 | PATCH | Ensure filesystem integrity is regularly checked"
  ansible.builtin.cron:
      name: Run AIDE integrity check
      cron_file: "{{ rhel9cis_aide_cron['cron_file'] }}"
      user: "{{ rhel9cis_aide_cron['cron_user'] }}"
      minute: "{{ rhel9cis_aide_cron['aide_minute'] | default('0') }}"
      hour: "{{ rhel9cis_aide_cron['aide_hour'] | default('5') }}"
      day: "{{ rhel9cis_aide_cron['aide_day'] | default('*') }}"
      month: "{{ rhel9cis_aide_cron['aide_month'] | default('*') }}"
      weekday: "{{ rhel9cis_aide_cron['aide_weekday'] | default('*') }}"
      job: "{{ rhel9cis_aide_cron['aide_job'] }}"
  when:
      - rhel9cis_rule_1_3_2
      - not system_is_ec2
  tags:
      - level1-server
      - level1-workstation
      - aide
      - file_integrity
      - patch
      - rule_1.3.2

- name: "1.3.3 | PATCH | Ensure cryptographic mechanisms are used to protect the integrity of audit tools"
  ansible.builtin.blockinfile:
      path: /etc/aide.conf
      marker: "# {mark} Audit tools - CIS benchmark - Ansible-lockdown"
      block: |
        /usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
        /usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
        /usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512
        /usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
        /usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
        /usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512
      validate: aide -D --config %s
  when:
      - rhel9cis_rule_1_3_3
      - not system_is_ec2
  tags:
      - level1-server
      - level1-workstation
      - aide
      - file_integrity
      - patch
      - rule_1.3.3