RHEL9-CIS/tasks/section_4/cis_4.2.1.x.yml

---

- name: "4.2.1.1 | L1 | PATCH | Ensure rsyslog installed"
  package:
      name: rsyslog
      state: present
  when:
      - "'rsyslog' not in ansible_facts.packages"
      - rhel9cis_rule_4_2_1_1
  tags:
      - level1-server
      - level1-workstation
      - patch
      - rule_4.2.1.1

- name: "4.2.1.2 | L1 | PATCH | Ensure rsyslog Service is enabled"
  service:
      name: rsyslog
      enabled: true
  when:
      - rhel9cis_rule_4_2_1_2
  tags:
      - level1-server
      - level1-workstation
      - patch
      - rsyslog
      - rule_4.2.1.2

- name: "4.2.1.3 | L1 | PATCH | Ensure rsyslog default file permissions configured"
  lineinfile:
      dest: /etc/rsyslog.conf
      regexp: '^\$FileCreateMode'
      line: '$FileCreateMode 0640'
  notify: restart rsyslog
  when:
      - rhel9cis_rule_4_2_1_3
  tags:
      - level1-server
      - level1-workstation
      - patch
      - rule_4.2.1.3

- name: "4.2.1.4 | L1 | PATCH | Ensure logging is configured"
  block:
      - name: "4.2.1.4 | L1 | AUDIT | Ensure logging is configured | rsyslog current config message out"
        shell: cat /etc/rsyslog.conf
        args:
            warn: false
        become: true
        changed_when: false
        failed_when: false
        check_mode: false
        register: rhel_09_4_2_1_4_audit

      - name: "4.2.1.4 | L1 | AUDIT | Ensure logging is configured | rsyslog current config message out"
        debug:
            msg:
                - "These are the current logging configurations for rsyslog, please review:"
                - "{{ rhel_09_4_2_1_4_audit.stdout_lines }}"

      - name: "4.2.1.4 | L1 | PATCH | Ensure logging is configured | mail.* log setting"
        blockinfile:
            path: /etc/rsyslog.conf
            state: present
            marker: "# {mark} MAIL LOG SETTINGS (ANSIBLE MANAGED)"
            block: |
              # mail logging additions to meet CIS standards
              mail.*                                                  -/var/log/mail
              mail.info                                               -/var/log/mail.info
              mail.warning                                            -/var/log/mail.warning
              mail.err                                                /var/log/mail.err
            insertafter: '# Log all the mail messages in one place.'
        notify: restart rsyslog
        when: rhel9cis_rsyslog_ansiblemanaged

      - name: "4.2.1.4 | L1 | PATCH | Ensure logging is configured | news.crit log setting"
        blockinfile:
            path: /etc/rsyslog.conf
            state: present
            marker: "# {mark} NEWS LOG SETTINGS (ANSIBLE MANAGED)"
            block: |
              # news logging additions to meet CIS standards
              news.crit                                               -/var/log/news/news.crit
              news.notice                                             -/var/log/news/news.crit
            insertafter: '# Save news errors of level crit and higher in a special file.'
        notify: restart rsyslog
        when: rhel9cis_rsyslog_ansiblemanaged

      - name: "4.2.1.4 | L1 | PATCH | Ensure logging is configured | Misc. log setting"
        blockinfile:
            path: /etc/rsyslog.conf
            state: present
            marker: "# {mark} MISC. LOG SETTINGS (ANSIBLE MANAGED)"
            block: |
              # misc. logging additions to meet CIS standards
              *.=warning;*.=err                                        -/var/log/warn
              *.crit                                                   /var/log/warn
              *.*;mail.none;news.none                                  /var/log/messages
            insertafter: '#### RULES ####'
        notify: restart rsyslog
        when: rhel9cis_rsyslog_ansiblemanaged

      - name: "4.2.1.4 | L1 | PATCH | Ensure logging is configured | Local log settings"
        blockinfile:
            path: /etc/rsyslog.conf
            state: present
            marker: "#{mark} LOCAL LOG SETTINGS (ANSIBLE MANAGED)"
            block: |
              # local log settings
              local0,local1.*                                          -/var/log/localmessages
              local2,local3.*                                          -/var/log/localmessages
              local4,local5.*                                          -/var/log/localmessages
              local6,local7.*                                          -/var/log/localmessages
              *.emrg                                                    :omusrmsg:*
            insertafter: '#### RULES ####'
        notify: restart rsyslog
  when:
      - rhel9cis_rule_4_2_1_4
  tags:
      - level1-server
      - level1-workstation
      - patch
      - rsyslog
      - rule_4.2.1.4

- name: "4.2.1.5 | L1 | PATCH | Ensure rsyslog is configured to send logs to a remote log host"
  blockinfile:
      path: /etc/rsyslog.conf
      state: present
      block: |
        # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
        *.* @@{{ rhel9cis_remote_log_server }}
      insertafter: EOF
  register: result
  failed_when:
      - result is failed
      - result.rc != 257
  notify: restart rsyslog
  when:
      - rhel9cis_rule_4_2_1_5
      - rhel9cis_remote_log_server is defined
  tags:
      - level1-server
      - level1-workstation
      - patch
      - rule_4.2.1.5
      - rsyslog

- name: "4.2.1.6 | L1 | PATCH | Ensure remote rsyslog messages are only accepted on designated log hosts."
  block:
      - name: "4.2.1.6 | L1 | PATCH | Ensure remote rsyslog messages are only accepted on designated log hosts. | When not log host"
        replace:
            path: /etc/rsyslog.conf
            regexp: '({{ item }})'
            replace: '#\1'
        notify: restart rsyslog
        with_items:
            - '^(\$ModLoad imtcp)'
            - '^(\$InputTCPServerRun)'
        when: not rhel9cis_system_is_log_server

      - name: "4.2.1.6 | L1 | PATCH | Ensure remote rsyslog messages are only accepted on designated log hosts. | When log host"
        replace:
            path: /etc/rsyslog.conf
            regexp: '^#(.*{{ item }}.*)'
            replace: '\1'
        notify: restart rsyslog
        with_items:
            - 'ModLoad imtcp'
            - 'InputTCPServerRun'
        when: rhel9cis_system_is_log_server
  when:
      - rhel9cis_rule_4_2_1_6
  tags:
      - level1-server
      - level1-workstation
      - patch
      - rule_4.2.1.6
      - rsyslog