RHEL9-CIS/tasks/section_4/cis_4.2.1.x.yml

---

- name: "4.2.1.1 | PATCH | Ensure rsyslog installed"
  package:
      name: rsyslog
      state: present
  when:
      - "'rsyslog' not in ansible_facts.packages"
      - rhel9cis_rule_4_2_1_1
  tags:
      - level1-server
      - level1-workstation
      - automated
      - patch
      - rsyslog
      - rule_4.2.1.1

- name: "4.2.1.2 | PATCH | Ensure rsyslog Service is enabled"
  service:
      name: rsyslog
      enabled: yes
  when:
      - rhel9cis_rule_4_2_1_2
  tags:
      - level1-server
      - level1-workstation
      - automated
      - patch
      - rsyslog
      - rule_4.2.1.2

# This is counter to control 4.2.2.5??
- name: "4.2.1.3 | PATCH | Ensure journald is configured to send logs to rsyslog"
  lineinfile:
      dest: /etc/systemd/journald.conf
      regexp: "^#ForwardToSyslog=|^ForwardToSyslog="
      line: ForwardToSyslog=yes
      state: present
  when:
      - rhel9cis_rule_4_2_1_3
      - rhel9cis_preferred_log_capture == "rsyslog"
  tags:
      - level1-server
      - level1-workstation
      - manual
      - patch
      - rule_4.2.1.3

- name: "4.2.1.4 | PATCH | Ensure rsyslog default file permissions configured"
  lineinfile:
      dest: /etc/rsyslog.conf
      regexp: '^\$FileCreateMode'
      line: '$FileCreateMode 0640'
  notify: restart rsyslog
  when:
      - rhel9cis_rule_4_2_1_4
  tags:
      - level1-server
      - level1-workstation
      - automated
      - patch
      - rsyslog
      - rule_4.2.1.4

- name: "4.2.1.5 | PATCH | Ensure logging is configured"
  block:
      - name: "4.2.1.5 | AUDIT | Ensure logging is configured | rsyslog current config message out"
        command: cat /etc/rsyslog.conf
        become: yes
        changed_when: false
        failed_when: no
        check_mode: no
        register: rhel_08_4_2_1_5_audit

      - name: "4.2.1.5 | AUDIT | Ensure logging is configured | rsyslog current config message out"
        debug:
            msg:
                - "These are the current logging configurations for rsyslog, please review:"
                - "{{ rhel_08_4_2_1_5_audit.stdout_lines }}"

      - name: "4.2.1.5 | PATCH | Ensure logging is configured | mail.* log setting"
        blockinfile:
            path: /etc/rsyslog.conf
            state: present
            marker: "# {mark} MAIL LOG SETTINGS (ANSIBLE MANAGED)"
            block: |
              # mail logging additions to meet CIS standards
              mail.*                                                  -/var/log/mail
              mail.info                                               -/var/log/mail.info
              mail.warning                                            -/var/log/mail.warning
              mail.err                                                /var/log/mail.err
            insertafter: '# Log all the mail messages in one place.'
        notify: restart rsyslog
        when: rhel9cis_rsyslog_ansiblemanaged

      - name: "4.2.1.5 | PATCH | Ensure logging is configured | news.crit log setting"
        blockinfile:
            path: /etc/rsyslog.conf
            state: present
            marker: "# {mark} NEWS LOG SETTINGS (ANSIBLE MANAGED)"
            block: |
              # news logging additions to meet CIS standards
              news.crit                                               -/var/log/news/news.crit
              news.notice                                             -/var/log/news/news.crit
            insertafter: '# Save news errors of level crit and higher in a special file.'
        notify: restart rsyslog
        when: rhel9cis_rsyslog_ansiblemanaged

      - name: "4.2.1.5 | PATCH | Ensure logging is configured | Misc. log setting"
        blockinfile:
            path: /etc/rsyslog.conf
            state: present
            marker: "# {mark} MISC. LOG SETTINGS (ANSIBLE MANAGED)"
            block: |
              # misc. logging additions to meet CIS standards
              *.=warning;*.=err                                        -/var/log/warn
              *.crit                                                   /var/log/warn
              *.*;mail.none;news.none                                  /var/log/messages
            insertafter: '#### RULES ####'
        notify: restart rsyslog
        when: rhel9cis_rsyslog_ansiblemanaged

      - name: "4.2.1.5 | PATCH | Ensure logging is configured | Local log settings"
        blockinfile:
            path: /etc/rsyslog.conf
            state: present
            marker: "#{mark} LOCAL LOG SETTINGS (ANSIBLE MANAGED)"
            block: |
              # local log settings to meet CIS standards
              local0,local1.*                                          -/var/log/localmessages
              local2,local3.*                                          -/var/log/localmessages
              local4,local5.*                                          -/var/log/localmessages
              local6,local7.*                                          -/var/log/localmessages
              *.emrg                                                    :omusrmsg:*
            insertafter: '#### RULES ####'
        notify: restart rsyslog

      - name: "4.2.1.5 | PATCH | Ensure logging is configured | Auth Settings"
        blockinfile:
            path: /etc/rsyslog.conf
            state: present
            marker: "#{mark} Auth SETTINGS (ANSIBLE MANAGED)"
            block: |
              # Private settings to meet CIS standards
              auth,authpriv.*                                          -/var/log/secure
            insertafter: '#### RULES ####'
        notify: restart rsyslog

      - name: "4.2.1.5 | PATCH | Ensure logging is configured | Cron Settings"
        blockinfile:
            path: /etc/rsyslog.conf
            state: present
            marker: "#{mark} Cron SETTINGS (ANSIBLE MANAGED)"
            block: |
              # Cron settings to meet CIS standards
              cron.*                                                   /var/log/cron
            insertafter: '#### RULES ####'
        notify: restart rsyslog
  when:
      - rhel9cis_rule_4_2_1_5
  tags:
      - level1-server
      - level1-workstation
      - manual
      - patch
      - rsyslog
      - rule_4.2.1.5

- name: "4.2.1.6 | PATCH | Ensure rsyslog is configured to send logs to a remote log host"
  blockinfile:
      path: /etc/rsyslog.conf
      state: present
      block: |
        # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
        *.* @@{{ rhel9cis_remote_log_server }}
      insertafter: EOF
  register: result
  failed_when:
      - result is failed
      - result.rc != 257
  notify: restart rsyslog
  when:
      - rhel9cis_rule_4_2_1_6
      - rhel9cis_remote_log_server is defined
  tags:
      - level1-server
      - level1-workstation
      - manual
      - patch
      - rsyslog
      - rule_4.2.1.6

- name: "4.2.1.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client"
  block:
      - name: "4.2.1.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client. | When not log host"
        replace:
            path: /etc/rsyslog.conf
            regexp: '({{ item }})'
            replace: '#\1'
        notify: restart rsyslog
        with_items:
            - '^(\$ModLoad imtcp)'
            - '^(\$InputTCPServerRun)'
            - '^(module\(load="imtcp"\))'
            - '^(input\(type="imtcp")'
        when: not rhel9cis_system_is_log_server

      - name: "4.2.1.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote clients. | When log host"
        replace:
            path: /etc/rsyslog.conf
            regexp: '^#(.*{{ item }}.*)'
            replace: '\1'
        notify: restart rsyslog
        with_items:
            - 'ModLoad imtcp'
            - 'InputTCPServerRun'
            - 'module\(load="imtcp"\)'
            - 'input\(type="imtcp"'
        when: rhel9cis_system_is_log_server
  when:
      - rhel9cis_rule_4_2_1_7
  tags:
      - level1-server
      - level1-workstation
      - automated
      - patch
      - rsyslog
      - rule_4.2.1.7