mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-25 14:43:06 +00:00
219 lines
8.2 KiB
YAML
219 lines
8.2 KiB
YAML
---
|
|
|
|
- name: "4.2.1.1 | PATCH | Ensure rsyslog installed"
|
|
ansible.builtin.package:
|
|
name: rsyslog
|
|
state: present
|
|
when:
|
|
- "'rsyslog' not in ansible_facts.packages"
|
|
- rhel9cis_rule_4_2_1_1
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- rsyslog
|
|
- rule_4.2.1.1
|
|
|
|
- name: "4.2.1.2 | PATCH | Ensure rsyslog Service is enabled"
|
|
ansible.builtin.systemd:
|
|
name: rsyslog
|
|
enabled: true
|
|
when:
|
|
- rhel9cis_rule_4_2_1_2
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- rsyslog
|
|
- rule_4.2.1.2
|
|
|
|
- name: "4.2.1.3 | PATCH | Ensure journald is configured to send logs to rsyslog"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/systemd/journald.conf
|
|
regexp: "^#ForwardToSyslog=|^ForwardToSyslog="
|
|
line: ForwardToSyslog=yes
|
|
notify: restart rsyslog
|
|
when:
|
|
- rhel9cis_rule_4_2_1_3
|
|
- rhel9cis_preferred_log_capture == "rsyslog"
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- rule_4.2.1.3
|
|
|
|
- name: "4.2.1.4 | PATCH | Ensure rsyslog default file permissions configured"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/rsyslog.conf
|
|
regexp: '^\$FileCreateMode'
|
|
line: '$FileCreateMode 0640'
|
|
notify: restart rsyslog
|
|
when:
|
|
- rhel9cis_rule_4_2_1_4
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- rsyslog
|
|
- rule_4.2.1.4
|
|
|
|
- name: "4.2.1.5 | PATCH | Ensure logging is configured"
|
|
block:
|
|
- name: "4.2.1.5 | AUDIT | Ensure logging is configured | rsyslog current config message out"
|
|
ansible.builtin.command: cat /etc/rsyslog.conf
|
|
changed_when: false
|
|
failed_when: false
|
|
check_mode: false
|
|
register: rhel_08_4_2_1_5_audit
|
|
|
|
- name: "4.2.1.5 | AUDIT | Ensure logging is configured | rsyslog current config message out"
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "These are the current logging configurations for rsyslog, please review:"
|
|
- "{{ rhel_08_4_2_1_5_audit.stdout_lines }}"
|
|
|
|
- name: "4.2.1.5 | PATCH | Ensure logging is configured | mail.* log setting"
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/rsyslog.conf
|
|
state: present
|
|
marker: "# {mark} MAIL LOG SETTINGS (ANSIBLE MANAGED)"
|
|
block: |
|
|
# mail logging additions to meet CIS standards
|
|
mail.* -/var/log/mail
|
|
mail.info -/var/log/mail.info
|
|
mail.warning -/var/log/mail.warning
|
|
mail.err /var/log/mail.err
|
|
insertafter: '# Log all the mail messages in one place.'
|
|
notify: restart rsyslog
|
|
when: rhel9cis_rsyslog_ansiblemanaged
|
|
|
|
- name: "4.2.1.5 | PATCH | Ensure logging is configured | news.crit log setting"
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/rsyslog.conf
|
|
state: present
|
|
marker: "# {mark} NEWS LOG SETTINGS (ANSIBLE MANAGED)"
|
|
block: |
|
|
# news logging additions to meet CIS standards
|
|
news.crit -/var/log/news/news.crit
|
|
news.notice -/var/log/news/news.crit
|
|
insertafter: '# Save news errors of level crit and higher in a special file.'
|
|
notify: restart rsyslog
|
|
when: rhel9cis_rsyslog_ansiblemanaged
|
|
|
|
- name: "4.2.1.5 | PATCH | Ensure logging is configured | Misc. log setting"
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/rsyslog.conf
|
|
state: present
|
|
marker: "# {mark} MISC. LOG SETTINGS (ANSIBLE MANAGED)"
|
|
block: |
|
|
# misc. logging additions to meet CIS standards
|
|
*.=warning;*.=err -/var/log/warn
|
|
*.crit /var/log/warn
|
|
*.*;mail.none;news.none /var/log/messages
|
|
insertafter: '#### RULES ####'
|
|
notify: restart rsyslog
|
|
when: rhel9cis_rsyslog_ansiblemanaged
|
|
|
|
- name: "4.2.1.5 | PATCH | Ensure logging is configured | Local log settings"
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/rsyslog.conf
|
|
state: present
|
|
marker: "#{mark} LOCAL LOG SETTINGS (ANSIBLE MANAGED)"
|
|
block: |
|
|
# local log settings to meet CIS standards
|
|
local0,local1.* -/var/log/localmessages
|
|
local2,local3.* -/var/log/localmessages
|
|
local4,local5.* -/var/log/localmessages
|
|
local6,local7.* -/var/log/localmessages
|
|
*.emrg :omusrmsg:*
|
|
insertafter: '#### RULES ####'
|
|
notify: restart rsyslog
|
|
|
|
- name: "4.2.1.5 | PATCH | Ensure logging is configured | Auth Settings"
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/rsyslog.conf
|
|
state: present
|
|
marker: "#{mark} Auth SETTINGS (ANSIBLE MANAGED)"
|
|
block: |
|
|
# Private settings to meet CIS standards
|
|
auth,authpriv.* /var/log/secure
|
|
insertafter: '#### RULES ####'
|
|
notify: restart rsyslog
|
|
|
|
- name: "4.2.1.5 | PATCH | Ensure logging is configured | Cron Settings"
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/rsyslog.conf
|
|
state: present
|
|
marker: "#{mark} Cron SETTINGS (ANSIBLE MANAGED)"
|
|
block: |
|
|
# Cron settings to meet CIS standards
|
|
cron.* /var/log/cron
|
|
insertafter: '#### RULES ####'
|
|
notify: restart rsyslog
|
|
when:
|
|
- rhel9cis_rule_4_2_1_5
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- rsyslog
|
|
- rule_4.2.1.5
|
|
|
|
- name: "4.2.1.6 | PATCH | Ensure rsyslog is configured to send logs to a remote log host"
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/rsyslog.conf
|
|
state: present
|
|
block: |
|
|
# target can be IP or FQDN
|
|
*.* action(type="omfwd" target="{{ rhel9cis_remote_log_server }}" port="{{ rhel9cis_remote_log_port }}" protocol="{{ rhel9cis_remote_log_protocol }}" action.resumeRetryCount="{{ rhel9cis_remote_log_retrycount }}" queue.type="LinkedList" queue.size="{{ rhel9cis_remote_log_queuesize }}")
|
|
insertafter: EOF
|
|
register: result
|
|
failed_when:
|
|
- result is failed
|
|
- result.rc != 257
|
|
notify: restart rsyslog
|
|
when:
|
|
- rhel9cis_rule_4_2_1_6
|
|
- rhel9cis_remote_log_server
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- rsyslog
|
|
- rule_4.2.1.6
|
|
|
|
- name: "4.2.1.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client"
|
|
block:
|
|
- name: "4.2.1.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client. | When not log host"
|
|
ansible.builtin.replace:
|
|
path: /etc/rsyslog.conf
|
|
regexp: '{{ item }}'
|
|
replace: '#\1'
|
|
notify: restart rsyslog
|
|
with_items:
|
|
- '^\$ModLoad imtcp'
|
|
- '^\$InputTCPServerRun'
|
|
- '^module\(load="imtcp"\)'
|
|
- '^input\(type="imtcp" port=.*\)'
|
|
when: not rhel9cis_system_is_log_server
|
|
|
|
- name: "4.2.1.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote clients. | When log host"
|
|
ansible.builtin.replace:
|
|
path: /etc/rsyslog.conf
|
|
regexp: '^#(.*{{ item }}.*)'
|
|
replace: '\1'
|
|
notify: restart rsyslog
|
|
with_items:
|
|
- 'ModLoad imtcp'
|
|
- 'InputTCPServerRun'
|
|
- 'module\(load="imtcp"\)'
|
|
- 'input\(type="imtcp" port=".*")'
|
|
when: rhel9cis_system_is_log_server
|
|
when:
|
|
- rhel9cis_rule_4_2_1_7
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- rsyslog
|
|
- rule_4.2.1.7
|