From rsyslog to jornald

fix for 3.3.7
Removed unneded 4.2.1.x

defaults/main.yml

@@ -523,7 +523,8 @@ rhel9cis_auditd_extra_conf: {}
 ## Preferred method of logging
 ## Whether rsyslog or journald preferred method for local logging
 ## Affects rsyslog cis 4.2.1.3 and journald cis 4.2.2.5
-rhel9cis_syslog: rsyslog
+#rhel9cis_syslog: rsyslog
+rhel9cis_syslog: journald
 rhel9cis_rsyslog_ansiblemanaged: true
 
 #### 4.2.1.6 remote and destation log server name
@@ -536,6 +537,7 @@ rhel9cis_remote_log_queuesize: 1000
 
 #### 4.2.1.7
 rhel9cis_system_is_log_server: false
+#rhel9cis_system_is_log_server: true
 
 # 4.2.2.1.2
 # rhel9cis_journal_upload_url is the ip address to upload the journal entries to

tasks/post.yml

@@ -26,6 +26,24 @@
       - not system_is_container
       - "'procps-ng' in ansible_facts.packages"
 
+- name: POST | Update usr sysctl
+  block:
+     - name: POST | Set default.rp_filter
+       ansible.builtin.lineinfile:
+        path: /usr/lib/sysctl.d/50-default.conf
+        regexp: '^net.ipv4.conf.default.rp_filter'
+        line: net.ipv4.conf.default.rp_filter = 1
+
+     - name: POST | Set ALL rp_filter
+       ansible.builtin.lineinfile:
+        path: /usr/lib/sysctl.d/50-default.conf
+        regexp: '^net.ipv4.conf.*.rp_filter'
+        line: net.ipv4.conf.*.rp_filter = 1
+  when:
+      - rhel9cis_sysctl_update
+      - not system_is_container
+      - "'procps-ng' in ansible_facts.packages"
+
 - name: Flush handlers
   ansible.builtin.meta: flush_handlers
 

tasks/section_3/cis_3.3.x.yml

@@ -145,6 +145,11 @@
       - name: "3.3.7 | PATCH | Ensure Reverse Path Filtering is enabled"
         ansible.builtin.debug:
             msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
+
+      - name: "3.3.7 | PATCH | Ensure Reverse Path Filtering is enabled in "
+        ansible.builtin.debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
+      
   when:
       - rhel9cis_rule_3_3_7
   tags:

tasks/section_4/cis_4.2.1.x.yml

@@ -214,19 +214,4 @@
       - patch
       - rsyslog
       - rule_4.2.1.7
-- name: "4.2.2.3/4 | PATCH | Ensure journald is configured to compress large log files into persistent storage."
-  ansible.builtin.template:
-      src: "etc/systemd/{{ item }}.j2"
-      dest: "/etc/systemd/{{ item }}"
-      owner: root
-      group: root
-      mode: '0644'
-  register: sysctl_updated
-  notify: Reload sysctl
-  loop:
-      - journald.conf
-  when:
-      - rhel9cis_sysctl_update
-      - not system_is_container
-      - "'procps-ng' in ansible_facts.packages"