forked from ansible-lockdown/RHEL9-CIS
initial v2
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell
parent
6ea105374a
commit
3b346f7fe1
11 changed files with 1415 additions and 814 deletions
293
tasks/section_6/cis_6.2.3.x.yml
Normal file
293
tasks/section_6/cis_6.2.3.x.yml
Normal file
|
|
@ -0,0 +1,293 @@
|
|||
---
|
||||
|
||||
- name: "6.2.3.1 | PATCH | Ensure rsyslog installed"
|
||||
when:
|
||||
- "'rsyslog' not in ansible_facts.packages"
|
||||
- rhel9cis_rule_6_2_3_1
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rsyslog
|
||||
- rule_6.2.3.1
|
||||
- NIST800-53R5_AU-2
|
||||
- NIST800-53R5_AU-3
|
||||
- NIST800-53R5_AU-12
|
||||
ansible.builtin.package:
|
||||
name: rsyslog
|
||||
state: present
|
||||
|
||||
- name: "6.2.3.2 | PATCH | Ensure rsyslog Service is enabled and active"
|
||||
when:
|
||||
- rhel9cis_rule_6_2_3_2
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rsyslog
|
||||
- rule_6.2.3.2
|
||||
- NIST800-53R5_AU-2
|
||||
- NIST800-53R5_AU-3
|
||||
- NIST800-53R5_AU-12
|
||||
ansible.builtin.systemd:
|
||||
name: rsyslog
|
||||
enabled: true
|
||||
state: started
|
||||
|
||||
- name: "6.2.3.3 | PATCH | Ensure journald is configured to send logs to rsyslog"
|
||||
when:
|
||||
- rhel9cis_rule_6_2_3_3
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rule_6.2.3.3
|
||||
- NIST800-53R5_AC-3
|
||||
- NIST800-53R5_AU-2
|
||||
- NIST800-53R5_AU-4
|
||||
- NIST800-53R5_AU-12
|
||||
- NIST800-53R5_MP-2
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/systemd/journald.conf
|
||||
regexp: "^#ForwardToSyslog=|^ForwardToSyslog="
|
||||
line: ForwardToSyslog=yes
|
||||
notify: Restart rsyslog
|
||||
|
||||
- name: "6.2.3.4 | PATCH | Ensure rsyslog log file creation mode is configured"
|
||||
when:
|
||||
- rhel9cis_rule_6_2_3_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rsyslog
|
||||
- rule_6.2.3.4
|
||||
- NIST800-53R5_AC-3
|
||||
- NIST800-53R5_AC-6
|
||||
- NIST800-53R5_MP-2
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/rsyslog.conf
|
||||
regexp: '^\$FileCreateMode'
|
||||
line: '$FileCreateMode 0640'
|
||||
notify: Restart rsyslog
|
||||
|
||||
- name: "6.2.3.5 | PATCH | Ensure logging is configured"
|
||||
when:
|
||||
- rhel9cis_rule_6_2_3_5
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rsyslog
|
||||
- rule_6.2.3.5
|
||||
- NIST800-53R5_AU-2
|
||||
- NIST800-53R5_AU-7
|
||||
- NIST800-53R5_AU-12
|
||||
block:
|
||||
- name: "6.2.3.5 | AUDIT | Ensure logging is configured | rsyslog current config message out"
|
||||
ansible.builtin.shell: cat /etc/rsyslog.conf | grep -Ev "^#|^$"
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
check_mode: false
|
||||
register: rhel_09_6_2_3_5_audit
|
||||
|
||||
- name: "6.2.3.5 | AUDIT | Ensure logging is configured | rsyslog current config message out"
|
||||
ansible.builtin.debug:
|
||||
msg:
|
||||
- "These are the current logging configurations for rsyslog, please review:"
|
||||
- "{{ rhel_09_4_2_1_5_audit.stdout_lines }}"
|
||||
|
||||
- name: "6.2.3.5 | PATCH | Ensure logging is configured | mail.* log setting"
|
||||
when: rhel9cis_rsyslog_ansiblemanaged
|
||||
ansible.builtin.blockinfile:
|
||||
path: /etc/rsyslog.conf
|
||||
marker: "# {mark} MAIL LOG SETTINGS - CIS benchmark - Ansible-lockdown"
|
||||
block: |
|
||||
# mail logging additions to meet CIS standards
|
||||
mail.* -/var/log/mail
|
||||
mail.info -/var/log/mail.info
|
||||
mail.warning -/var/log/mail.warning
|
||||
mail.err /var/log/mail.err
|
||||
insertafter: '# Log all the mail messages in one place.'
|
||||
notify: Restart rsyslog
|
||||
|
||||
- name: "6.2.3.5 | PATCH | Ensure logging is configured | news.crit log setting"
|
||||
when: rhel9cis_rsyslog_ansiblemanaged
|
||||
ansible.builtin.blockinfile:
|
||||
path: /etc/rsyslog.conf
|
||||
state: present
|
||||
marker: "# {mark} NEWS LOG SETTINGS - CIS benchmark - Ansible-lockdown"
|
||||
block: |
|
||||
# news logging additions to meet CIS standards
|
||||
news.crit -/var/log/news/news.crit
|
||||
news.notice -/var/log/news/news.crit
|
||||
insertafter: '# Save news errors of level crit and higher in a special file.'
|
||||
notify: Restart rsyslog
|
||||
|
||||
- name: "6.2.3.5 | PATCH | Ensure logging is configured | Misc. log setting"
|
||||
when: rhel9cis_rsyslog_ansiblemanaged
|
||||
ansible.builtin.blockinfile:
|
||||
path: /etc/rsyslog.conf
|
||||
state: present
|
||||
marker: "# {mark} MISC. LOG SETTINGS - CIS benchmark - Ansible-lockdown"
|
||||
block: |
|
||||
# misc. logging additions to meet CIS standards
|
||||
*.=warning;*.=err -/var/log/warn
|
||||
*.crit /var/log/warn
|
||||
*.*;mail.none;news.none /var/log/messages
|
||||
insertafter: '#### RULES ####'
|
||||
notify: Restart rsyslog
|
||||
|
||||
- name: "6.2.3.5 | PATCH | Ensure logging is configured | Local log settings"
|
||||
ansible.builtin.blockinfile:
|
||||
path: /etc/rsyslog.conf
|
||||
state: present
|
||||
marker: "#{mark} LOCAL LOG SETTINGS - CIS benchmark - Ansible-lockdown"
|
||||
block: |
|
||||
# local log settings to meet CIS standards
|
||||
local0,local1.* -/var/log/localmessages
|
||||
local2,local3.* -/var/log/localmessages
|
||||
local4,local5.* -/var/log/localmessages
|
||||
local6,local7.* -/var/log/localmessages
|
||||
*.emrg :omusrmsg:*
|
||||
insertafter: '#### RULES ####'
|
||||
notify: Restart rsyslog
|
||||
|
||||
- name: "6.2.3.5 | PATCH | Ensure logging is configured | Auth Settings"
|
||||
ansible.builtin.blockinfile:
|
||||
path: /etc/rsyslog.conf
|
||||
state: present
|
||||
marker: "#{mark} Auth SETTINGS - CIS benchmark - Ansible-lockdown"
|
||||
block: |
|
||||
# Private settings to meet CIS standards
|
||||
auth,authpriv.* /var/log/secure
|
||||
insertafter: '#### RULES ####'
|
||||
notify: Restart rsyslog
|
||||
|
||||
- name: "6.2.3.5 | PATCH | Ensure logging is configured | Cron Settings"
|
||||
ansible.builtin.blockinfile:
|
||||
path: /etc/rsyslog.conf
|
||||
state: present
|
||||
marker: "#{mark} Cron SETTINGS - CIS benchmark - Ansible-lockdown"
|
||||
block: |
|
||||
# Cron settings to meet CIS standards
|
||||
cron.* /var/log/cron
|
||||
insertafter: '#### RULES ####'
|
||||
notify: Restart rsyslog
|
||||
|
||||
- name: "6.2.3.6 | PATCH | Ensure rsyslog is configured to send logs to a remote log host"
|
||||
when:
|
||||
- rhel9cis_rule_6_2_3_6
|
||||
- rhel9cis_remote_log_server
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rsyslog
|
||||
- rule_6.2.3.6
|
||||
- NIST800-53R5_AU-6
|
||||
ansible.builtin.blockinfile:
|
||||
path: /etc/rsyslog.conf
|
||||
state: present
|
||||
block: |
|
||||
# target can be IP or FQDN
|
||||
*.* action(type="omfwd" target="{{ rhel9cis_remote_log_host }}" port="{{ rhel9cis_remote_log_port }}" protocol="{{ rhel9cis_remote_log_protocol }}" action.resumeRetryCount="{{ rhel9cis_remote_log_retrycount }}" queue.type="LinkedList" queue.size="{{ rhel9cis_remote_log_queuesize }}")
|
||||
insertafter: EOF
|
||||
register: result
|
||||
failed_when:
|
||||
- result is failed
|
||||
- result.rc != 257
|
||||
notify: Restart rsyslog
|
||||
|
||||
- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client"
|
||||
when:
|
||||
- rhel9cis_rule_6_2_3_7
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rsyslog
|
||||
- rule_6.2.3.7
|
||||
- NIST800-53R5_AU-2
|
||||
- NIST800-53R5_AU-7
|
||||
- NIST800-53R5_AU-12
|
||||
- NIST800-53R5_CM-6
|
||||
block:
|
||||
- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client. | When not log host"
|
||||
when: not rhel9cis_system_is_log_server
|
||||
ansible.builtin.replace:
|
||||
path: /etc/rsyslog.conf
|
||||
regexp: '{{ item }}'
|
||||
replace: '#\1'
|
||||
notify: Restart rsyslog
|
||||
loop:
|
||||
- '^(\$ModLoad imtcp)'
|
||||
- '^(\$InputTCPServerRun)'
|
||||
- '^(module\(load="imtcp"\))'
|
||||
- '^(input\(type="imtcp")'
|
||||
|
||||
- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote clients. | When log host"
|
||||
when: rhel9cis_system_is_log_server
|
||||
ansible.builtin.replace:
|
||||
path: /etc/rsyslog.conf
|
||||
regexp: '^#(.*{{ item }}.*)'
|
||||
replace: '\1'
|
||||
notify: Restart rsyslog
|
||||
loop:
|
||||
- 'ModLoad imtcp'
|
||||
- 'InputTCPServerRun'
|
||||
|
||||
- name: "6.2.3.8 | PATCH | Ensure logrotate is configured"
|
||||
when:
|
||||
- rhel9cis_rule_6_2_3_8
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- manual
|
||||
- patch
|
||||
- logrotate
|
||||
- rule_6.2.3.8
|
||||
- NIST800-53R5_AU-8
|
||||
block:
|
||||
- name: "6.2.3.8 | PATCH | Ensure logrotate is configured | installed"
|
||||
ansible.builtin.package:
|
||||
name: rsyslog-logrotate
|
||||
state: present
|
||||
|
||||
- name: "6.2.3.8 | PATCH | Ensure logrotate is configured | scheduled"
|
||||
ansible.builtin.systemd:
|
||||
name: logrotate.timer
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
- name: "6.2.3.8 | PATCH | Ensure logrotate is configured | set default conf"
|
||||
ansible.builtin.replace:
|
||||
path: "/etc/logrotate.conf"
|
||||
regexp: '^(\s*)(daily|weekly|monthly|yearly)$'
|
||||
replace: "\\1{{ rhel9cis_logrotate }}"
|
||||
|
||||
- name: "6.2.3.8 | AUDIT | Ensure logrotate is configured | Get non default logrotate settings"
|
||||
ansible.builtin.find:
|
||||
paths: /etc/logrotate.d/
|
||||
contains: '^(\s*)(?!{{ rhel9cis_logrotate }})(daily|weekly|monthly|yearly)$'
|
||||
register: log_rotates
|
||||
|
||||
- name: "6.2.3.8 | AUDIT | Ensure logrotate is configured"
|
||||
when: log_rotates.matched > 0
|
||||
vars:
|
||||
warn_control_id: '6.2.3.8'
|
||||
block:
|
||||
- name: "6.2.3.8 | AUDIT | Ensure logrotate is configured | generate file list"
|
||||
ansible.builtin.set_fact:
|
||||
logrotate_non_def_conf: "{{ log_rotates.files | map(attribute='path') | join (', ') }}"
|
||||
|
||||
- name: "6.2.3.8 | AUDIT | Ensure logrotate is configured | List configured files"
|
||||
ansible.builtin.debug:
|
||||
msg: |
|
||||
"Warning!! The following files are not covered by default logrotate settings ensure they match site policy"
|
||||
"{{ logrotate_non_def_conf }}"
|
||||
loop: "{{ log_rotates.files }}"
|
||||
|
||||
- name: "6.2.3.8 | AUDIT | Ensure logrotate is configured | Warning count"
|
||||
ansible.builtin.import_tasks:
|
||||
file: warning_facts.yml
|
||||
Loading…
Add table
Add a link
Reference in a new issue