RHEL9-CIS/tasks/section_6/cis_6.2.3.x.yml

---

- name: "6.2.3.1 | PATCH | Ensure rsyslog installed"
  when:
    - "'rsyslog' not in ansible_facts.packages"
    - rhel9cis_rule_6_2_3_1
  tags:
    - level1-server
    - level1-workstation
    - patch
    - rsyslog
    - rule_6.2.3.1
    - NIST800-53R5_AU-2
    - NIST800-53R5_AU-3
    - NIST800-53R5_AU-12
  ansible.builtin.package:
    name: rsyslog
    state: present

- name: "6.2.3.2 | PATCH | Ensure rsyslog Service is enabled and active"
  when: rhel9cis_rule_6_2_3_2
  tags:
    - level1-server
    - level1-workstation
    - patch
    - rsyslog
    - rule_6.2.3.2
    - NIST800-53R5_AU-2
    - NIST800-53R5_AU-3
    - NIST800-53R5_AU-12
  ansible.builtin.systemd:
    name: rsyslog
    enabled: true
    state: started

- name: "6.2.3.3 | PATCH | Ensure journald is configured to send logs to rsyslog"
  when: rhel9cis_rule_6_2_3_3
  tags:
    - level1-server
    - level1-workstation
    - patch
    - rule_6.2.3.3
    - NIST800-53R5_AC-3
    - NIST800-53R5_AU-2
    - NIST800-53R5_AU-4
    - NIST800-53R5_AU-12
    - NIST800-53R5_MP-2
  ansible.builtin.lineinfile:
    path: /etc/systemd/journald.conf
    regexp: "^#ForwardToSyslog=|^ForwardToSyslog="
    line: ForwardToSyslog=yes
  notify: Restart rsyslog

- name: "6.2.3.4 | PATCH | Ensure rsyslog log file creation mode is configured"
  when: rhel9cis_rule_6_2_3_4
  tags:
    - level1-server
    - level1-workstation
    - patch
    - rsyslog
    - rule_6.2.3.4
    - NIST800-53R5_AC-3
    - NIST800-53R5_AC-6
    - NIST800-53R5_MP-2
  ansible.builtin.lineinfile:
    path: /etc/rsyslog.conf
    regexp: '^\$FileCreateMode'
    line: '$FileCreateMode 0640'
  notify: Restart rsyslog

- name: "6.2.3.5 | PATCH | Ensure logging is configured"
  when: rhel9cis_rule_6_2_3_5
  tags:
    - level1-server
    - level1-workstation
    - patch
    - rsyslog
    - rule_6.2.3.5
    - NIST800-53R5_AU-2
    - NIST800-53R5_AU-7
    - NIST800-53R5_AU-12
  block:
    - name: "6.2.3.5 | AUDIT | Ensure logging is configured | rsyslog current config message out"
      ansible.builtin.shell: cat /etc/rsyslog.conf | grep -Ev "^#|^$"
      changed_when: false
      failed_when: false
      check_mode: false
      register: discovered_configured_rsyslog

    - name: "6.2.3.5 | AUDIT | Ensure logging is configured | rsyslog current config message out"
      ansible.builtin.debug:
        msg:
          - "These are the current logging configurations for rsyslog, please review:"
          - "{{ discovered_configured_rsyslog.stdout_lines }}"

    - name: "6.2.3.5 | PATCH | Ensure logging is configured | mail.* log setting"
      when: rhel9cis_rsyslog_ansiblemanaged
      ansible.builtin.blockinfile:
        path: /etc/rsyslog.conf
        marker: "# {mark} MAIL LOG SETTINGS - CIS benchmark - Ansible-lockdown"
        block: |
          # mail logging additions to meet CIS standards
          mail.*                                                  -/var/log/mail
          mail.info                                               -/var/log/mail.info
          mail.warning                                            -/var/log/mail.warning
          mail.err                                                /var/log/mail.err
        insertafter: '# Log all the mail messages in one place.'
      notify: Restart rsyslog

    - name: "6.2.3.5 | PATCH | Ensure logging is configured | news.crit log setting"
      when: rhel9cis_rsyslog_ansiblemanaged
      ansible.builtin.blockinfile:
        path: /etc/rsyslog.conf
        state: present
        marker: "# {mark} NEWS LOG SETTINGS - CIS benchmark - Ansible-lockdown"
        block: |
          # news logging additions to meet CIS standards
          news.crit                                               -/var/log/news/news.crit
          news.notice                                             -/var/log/news/news.crit
        insertafter: '# Save news errors of level crit and higher in a special file.'
      notify: Restart rsyslog

    - name: "6.2.3.5 | PATCH | Ensure logging is configured | Misc. log setting"
      when: rhel9cis_rsyslog_ansiblemanaged
      ansible.builtin.blockinfile:
        path: /etc/rsyslog.conf
        state: present
        marker: "# {mark} MISC. LOG SETTINGS - CIS benchmark - Ansible-lockdown"
        block: |
          # misc. logging additions to meet CIS standards
          *.=warning;*.=err                                        -/var/log/warn
          *.crit                                                   /var/log/warn
          *.*;mail.none;news.none                                  /var/log/messages
        insertafter: '#### RULES ####'
      notify: Restart rsyslog

    - name: "6.2.3.5 | PATCH | Ensure logging is configured | Local log settings"
      ansible.builtin.blockinfile:
        path: /etc/rsyslog.conf
        state: present
        marker: "#{mark} LOCAL LOG SETTINGS - CIS benchmark - Ansible-lockdown"
        block: |
          # local log settings to meet CIS standards
          local0,local1.*                                          -/var/log/localmessages
          local2,local3.*                                          -/var/log/localmessages
          local4,local5.*                                          -/var/log/localmessages
          local6,local7.*                                          -/var/log/localmessages
          *.emerg                                                    :omusrmsg:*
        insertafter: '#### RULES ####'
      notify: Restart rsyslog

    - name: "6.2.3.5 | PATCH | Ensure logging is configured | Auth Settings"
      ansible.builtin.blockinfile:
        path: /etc/rsyslog.conf
        state: present
        marker: "#{mark} Auth SETTINGS - CIS benchmark - Ansible-lockdown"
        block: |
          # Private settings to meet CIS standards
          auth,authpriv.*                                           /var/log/secure
        insertafter: '#### RULES ####'
      notify: Restart rsyslog

    - name: "6.2.3.5 | PATCH | Ensure logging is configured | Cron Settings"
      ansible.builtin.blockinfile:
        path: /etc/rsyslog.conf
        state: present
        marker: "#{mark} Cron SETTINGS - CIS benchmark - Ansible-lockdown"
        block: |
          # Cron settings to meet CIS standards
          cron.*                                                   /var/log/cron
        insertafter: '#### RULES ####'
      notify: Restart rsyslog

- name: "6.2.3.6 | PATCH | Ensure rsyslog is configured to send logs to a remote log host"
  when:
    - rhel9cis_rule_6_2_3_6
    - rhel9cis_remote_log_server
  tags:
    - level1-server
    - level1-workstation
    - patch
    - rsyslog
    - rule_6.2.3.6
    - NIST800-53R5_AU-6
  ansible.builtin.blockinfile:
    path: /etc/rsyslog.conf
    state: present
    block: |
      # target can be IP or FQDN
      *.* action(type="omfwd" target="{{ rhel9cis_remote_log_host }}" port="{{ rhel9cis_remote_log_port }}" protocol="{{ rhel9cis_remote_log_protocol }}" action.resumeRetryCount="{{ rhel9cis_remote_log_retrycount }}" queue.type="LinkedList" queue.size="{{ rhel9cis_remote_log_queuesize }}")
    insertafter: EOF
  failed_when:
    - discovered_rsyslog_remote_host is failed
    - discovered_rsyslog_remote_host.rc != 257
  register: discovered_rsyslog_remote_host
  notify: Restart rsyslog

- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client"
  when: rhel9cis_rule_6_2_3_7
  tags:
    - level1-server
    - level1-workstation
    - patch
    - rsyslog
    - rule_6.2.3.7
    - NIST800-53R5_AU-2
    - NIST800-53R5_AU-7
    - NIST800-53R5_AU-12
    - NIST800-53R5_CM-6
  block:
    - name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client. | When not log host"
      when: not rhel9cis_system_is_log_server
      ansible.builtin.replace:
        path: /etc/rsyslog.conf
        regexp: '{{ item }}'
        replace: '#\1'
      notify: Restart rsyslog
      loop:
        - '^(\$ModLoad imtcp)'
        - '^(\$InputTCPServerRun)'
        - '^(module\(load="imtcp"\))'
        - '^(input\(type="imtcp")'

    - name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote clients. | When log host"
      when: rhel9cis_system_is_log_server
      ansible.builtin.replace:
        path: /etc/rsyslog.conf
        regexp: '^#(.*{{ item }}.*)'
        replace: '\1'
      notify: Restart rsyslog
      loop:
        - 'ModLoad imtcp'
        - 'InputTCPServerRun'

- name: "6.2.3.8 | PATCH | Ensure rsyslog logrotate is configured"
  when: rhel9cis_rule_6_2_3_8
  tags:
    - level1-server
    - level1-workstation
    - manual
    - patch
    - logrotate
    - rule_6.2.3.8
    - NIST800-53R5_AU-8
  block:
    - name: "6.2.3.8 | PATCH | Ensure rsyslog logrotate is configured | installed"
      ansible.builtin.package:
        name: rsyslog-logrotate
        state: present

    - name: "6.2.3.8 | PATCH | Ensure rsyslog logrotate is configured | scheduled"
      ansible.builtin.systemd:
        name: logrotate.timer
        state: started
        enabled: true

    - name: "6.2.3.8 | PATCH | Ensure logrotate is configured | set rsyslog conf"
      ansible.builtin.template:
        src: etc/logrotate.d/rsyslog.conf.j2
        dest: /etc/logrotate.d/rsyslog.conf
        owner: root
        group: root
        mode: 'g-wx,o-rwx'