mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-24 22:23:06 +00:00
lint and var renaming
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
parent
fa13b06b1f
commit
879d9c9a1b
18 changed files with 84 additions and 86 deletions
|
|
@ -16,10 +16,10 @@
|
|||
ansible.builtin.package:
|
||||
name: aide
|
||||
state: present
|
||||
register: aide_installed
|
||||
register: discovered_aide_installed
|
||||
|
||||
- name: "6.1.1 | PATCH | Ensure AIDE is installed| Build AIDE DB"
|
||||
when: aide_installed.changed # noqa: no-handler
|
||||
when: discovered_aide_installed.changed # noqa: no-handler
|
||||
block:
|
||||
- name: "6.1.1 | PATCH | Ensure AIDE is installed| Build AIDE DB"
|
||||
ansible.builtin.shell: /usr/sbin/aide --init
|
||||
|
|
|
|||
|
|
@ -32,26 +32,26 @@
|
|||
- name: "6.2.1.2 | AUDIT | Ensure journald log file access is configured | Check for override file"
|
||||
ansible.builtin.stat:
|
||||
path: /etc/tmpfiles.d/systemd.conf
|
||||
register: tmpfile_override
|
||||
register: discovered_tmpfile_override
|
||||
|
||||
- name: "6.2.1.2 | AUDIT | Ensure journald log file access is configured | If override file check for journal"
|
||||
when: tmpfile_override.stat.exists
|
||||
when: discovered_tmpfile_override.stat.exists
|
||||
ansible.builtin.shell: grep -E 'z /var/log/journal/%m/system.journal \d*' /usr/lib/tmpfiles.d/systemd.conf
|
||||
register: journald_fileperms_override
|
||||
register: discovered_journald_fileperms_override
|
||||
changed_when: false
|
||||
failed_when: journald_fileperms_override.rc not in [ 0, 1 ]
|
||||
failed_when: discovered_journald_fileperms_override.rc not in [ 0, 1 ]
|
||||
|
||||
- name: "6.2.1.2 | AUDIT | Ensure journald log file access is configured | Warning if override found"
|
||||
when:
|
||||
- tmpfile_override.stat.exists
|
||||
- journald_fileperms_override.stdout | length > 0
|
||||
- discovered_tmpfile_override.stat.exists
|
||||
- discovered_journald_fileperms_override.stdout | length > 0
|
||||
ansible.builtin.debug:
|
||||
msg: "Warning!! - tmpfiles override found /usr/lib/tmpfiles.d/systemd.conf affecting journald files please confirm matches site policy"
|
||||
|
||||
- name: "6.2.1.2 | AUDIT | Ensure journald log file access is configured | Warning if override found"
|
||||
when:
|
||||
- tmpfile_override.stat.exists
|
||||
- journald_fileperms_override.stdout | length > 0
|
||||
- discovered_tmpfile_override.stat.exists
|
||||
- discovered_journald_fileperms_override.stdout | length > 0
|
||||
ansible.builtin.import_tasks:
|
||||
file: warning_facts.yml
|
||||
vars:
|
||||
|
|
|
|||
|
|
@ -89,13 +89,13 @@
|
|||
changed_when: false
|
||||
failed_when: false
|
||||
check_mode: false
|
||||
register: rhel_09_6_2_3_5_audit
|
||||
register: discovered_configured_rsyslog
|
||||
|
||||
- name: "6.2.3.5 | AUDIT | Ensure logging is configured | rsyslog current config message out"
|
||||
ansible.builtin.debug:
|
||||
msg:
|
||||
- "These are the current logging configurations for rsyslog, please review:"
|
||||
- "{{ rhel_09_4_2_1_5_audit.stdout_lines }}"
|
||||
- "{{ discovered_configured_rsyslog.stdout_lines }}"
|
||||
|
||||
- name: "6.2.3.5 | PATCH | Ensure logging is configured | mail.* log setting"
|
||||
when: rhel9cis_rsyslog_ansiblemanaged
|
||||
|
|
@ -193,10 +193,10 @@
|
|||
# target can be IP or FQDN
|
||||
*.* action(type="omfwd" target="{{ rhel9cis_remote_log_host }}" port="{{ rhel9cis_remote_log_port }}" protocol="{{ rhel9cis_remote_log_protocol }}" action.resumeRetryCount="{{ rhel9cis_remote_log_retrycount }}" queue.type="LinkedList" queue.size="{{ rhel9cis_remote_log_queuesize }}")
|
||||
insertafter: EOF
|
||||
register: result
|
||||
failed_when:
|
||||
- result is failed
|
||||
- result.rc != 257
|
||||
- discovered_rsyslog_remote_host is failed
|
||||
- discovered_rsyslog_remote_host.rc != 257
|
||||
register: discovered_rsyslog_remote_host
|
||||
notify: Restart rsyslog
|
||||
|
||||
- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client"
|
||||
|
|
|
|||
|
|
@ -88,7 +88,7 @@
|
|||
changed_when: false
|
||||
failed_when: false
|
||||
check_mode: false
|
||||
register: priv_procs
|
||||
register: discovered_priv_procs
|
||||
|
||||
- name: "6.3.3.6 | PATCH | Ensure use of privileged commands is collected"
|
||||
ansible.builtin.set_fact:
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue