forked from ansible-lockdown/RHEL9-CIS
Initial
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell
commit
a54b5216eb
87 changed files with 7693 additions and 0 deletions
177
tasks/section_4/cis_4.2.1.x.yml
Normal file
177
tasks/section_4/cis_4.2.1.x.yml
Normal file
|
|
@ -0,0 +1,177 @@
|
|||
---
|
||||
|
||||
- name: "4.2.1.1 | L1 | PATCH | Ensure rsyslog installed"
|
||||
package:
|
||||
name: rsyslog
|
||||
state: present
|
||||
when:
|
||||
- "'rsyslog' not in ansible_facts.packages"
|
||||
- rhel9cis_rule_4_2_1_1
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rule_4.2.1.1
|
||||
|
||||
- name: "4.2.1.2 | L1 | PATCH | Ensure rsyslog Service is enabled"
|
||||
service:
|
||||
name: rsyslog
|
||||
enabled: yes
|
||||
when:
|
||||
- rhel9cis_rule_4_2_1_2
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rsyslog
|
||||
- rule_4.2.1.2
|
||||
|
||||
- name: "4.2.1.3 | L1 | PATCH | Ensure rsyslog default file permissions configured"
|
||||
lineinfile:
|
||||
dest: /etc/rsyslog.conf
|
||||
regexp: '^\$FileCreateMode'
|
||||
line: '$FileCreateMode 0640'
|
||||
notify: restart rsyslog
|
||||
when:
|
||||
- rhel9cis_rule_4_2_1_3
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rule_4.2.1.3
|
||||
|
||||
- name: "4.2.1.4 | L1 | PATCH | Ensure logging is configured"
|
||||
block:
|
||||
- name: "4.2.1.4 | L1 | AUDIT | Ensure logging is configured | rsyslog current config message out"
|
||||
command: cat /etc/rsyslog.conf
|
||||
become: yes
|
||||
changed_when: false
|
||||
failed_when: no
|
||||
check_mode: no
|
||||
register: rhel_09_4_2_1_4_audit
|
||||
|
||||
- name: "4.2.1.4 | L1 | AUDIT | Ensure logging is configured | rsyslog current config message out"
|
||||
debug:
|
||||
msg:
|
||||
- "These are the current logging configurations for rsyslog, please review:"
|
||||
- "{{ rhel_09_4_2_1_4_audit.stdout_lines }}"
|
||||
|
||||
- name: "4.2.1.4 | L1 | PATCH | Ensure logging is configured | mail.* log setting"
|
||||
blockinfile:
|
||||
path: /etc/rsyslog.conf
|
||||
state: present
|
||||
marker: "# {mark} MAIL LOG SETTINGS (ANSIBLE MANAGED)"
|
||||
block: |
|
||||
# mail logging additions to meet CIS standards
|
||||
mail.* -/var/log/mail
|
||||
mail.info -/var/log/mail.info
|
||||
mail.warning -/var/log/mail.warning
|
||||
mail.err /var/log/mail.err
|
||||
insertafter: '# Log all the mail messages in one place.'
|
||||
notify: restart rsyslog
|
||||
when: rhel9cis_rsyslog_ansiblemanaged
|
||||
|
||||
- name: "4.2.1.4 | L1 | PATCH | Ensure logging is configured | news.crit log setting"
|
||||
blockinfile:
|
||||
path: /etc/rsyslog.conf
|
||||
state: present
|
||||
marker: "# {mark} NEWS LOG SETTINGS (ANSIBLE MANAGED)"
|
||||
block: |
|
||||
# news logging additions to meet CIS standards
|
||||
news.crit -/var/log/news/news.crit
|
||||
news.notice -/var/log/news/news.crit
|
||||
insertafter: '# Save news errors of level crit and higher in a special file.'
|
||||
notify: restart rsyslog
|
||||
when: rhel9cis_rsyslog_ansiblemanaged
|
||||
|
||||
- name: "4.2.1.4 | L1 | PATCH | Ensure logging is configured | Misc. log setting"
|
||||
blockinfile:
|
||||
path: /etc/rsyslog.conf
|
||||
state: present
|
||||
marker: "# {mark} MISC. LOG SETTINGS (ANSIBLE MANAGED)"
|
||||
block: |
|
||||
# misc. logging additions to meet CIS standards
|
||||
*.=warning;*.=err -/var/log/warn
|
||||
*.crit /var/log/warn
|
||||
*.*;mail.none;news.none /var/log/messages
|
||||
insertafter: '#### RULES ####'
|
||||
notify: restart rsyslog
|
||||
when: rhel9cis_rsyslog_ansiblemanaged
|
||||
|
||||
- name: "4.2.1.4 | L1 | PATCH | Ensure logging is configured | Local log settings"
|
||||
blockinfile:
|
||||
path: /etc/rsyslog.conf
|
||||
state: present
|
||||
marker: "#{mark} LOCAL LOG SETTINGS (ANSIBLE MANAGED)"
|
||||
block: |
|
||||
# local log settings
|
||||
local0,local1.* -/var/log/localmessages
|
||||
local2,local3.* -/var/log/localmessages
|
||||
local4,local5.* -/var/log/localmessages
|
||||
local6,local7.* -/var/log/localmessages
|
||||
*.emrg :omusrmsg:*
|
||||
insertafter: '#### RULES ####'
|
||||
notify: restart rsyslog
|
||||
when:
|
||||
- rhel9cis_rule_4_2_1_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rsyslog
|
||||
- rule_4.2.1.4
|
||||
|
||||
- name: "4.2.1.5 | L1 | PATCH | Ensure rsyslog is configured to send logs to a remote log host"
|
||||
blockinfile:
|
||||
path: /etc/rsyslog.conf
|
||||
state: present
|
||||
block: |
|
||||
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
|
||||
*.* @@{{ rhel9cis_remote_log_server }}
|
||||
insertafter: EOF
|
||||
register: result
|
||||
failed_when:
|
||||
- result is failed
|
||||
- result.rc != 257
|
||||
notify: restart rsyslog
|
||||
when:
|
||||
- rhel9cis_rule_4_2_1_5
|
||||
- rhel9cis_remote_log_server is defined
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rule_4.2.1.5
|
||||
- rsyslog
|
||||
|
||||
- name: "4.2.1.6 | L1 | PATCH | Ensure remote rsyslog messages are only accepted on designated log hosts."
|
||||
block:
|
||||
- name: "4.2.1.6 | L1 | PATCH | Ensure remote rsyslog messages are only accepted on designated log hosts. | When not log host"
|
||||
replace:
|
||||
path: /etc/rsyslog.conf
|
||||
regexp: '({{ item }})'
|
||||
replace: '#\1'
|
||||
notify: restart rsyslog
|
||||
with_items:
|
||||
- '^(\$ModLoad imtcp)'
|
||||
- '^(\$InputTCPServerRun)'
|
||||
when: not rhel9cis_system_is_log_server
|
||||
|
||||
- name: "4.2.1.6 | L1 | PATCH | Ensure remote rsyslog messages are only accepted on designated log hosts. | When log host"
|
||||
replace:
|
||||
path: /etc/rsyslog.conf
|
||||
regexp: '^#(.*{{ item }}.*)'
|
||||
replace: '\1'
|
||||
notify: restart rsyslog
|
||||
with_items:
|
||||
- 'ModLoad imtcp'
|
||||
- 'InputTCPServerRun'
|
||||
when: rhel9cis_system_is_log_server
|
||||
when:
|
||||
- rhel9cis_rule_4_2_1_6
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rule_4.2.1.6
|
||||
- rsyslog
|
||||
Loading…
Add table
Add a link
Reference in a new issue