updated

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/section_1/cis_1.3.x.yml

@@ -1,44 +1,51 @@
 ---
 
-- name: "1.3.1 | L1 | PATCH | Ensure sudo is installed"
-  package:
-      name: sudo
-      state: present
+- name: "1.3.1 | PATCH | Ensure AIDE is installed"
+  block:
+      - name: "1.3.1 | PATCH | Ensure AIDE is installed | Install AIDE"
+        package:
+            name: aide
+            state: present
+
+      - name: "1.3.1 | PATCH | Ensure AIDE is installed | Configure AIDE"
+        command: /usr/sbin/aide --init -B 'database_out=file:/var/lib/aide/aide.db.gz'
+        changed_when: false
+        failed_when: false
+        async: 45
+        poll: 0
+        args:
+            creates: /var/lib/aide/aide.db.gz
+        when: not ansible_check_mode
   when:
-      - rhel9cis_rule_1_3_1
+      - rhel8cis_config_aide
+      - rhel8cis_rule_1_3_1
   tags:
       - level1-server
       - level1-workstation
-      - scored
-      - sudo
+      - automated
+      - aide
       - patch
       - rule_1.3.1
 
-- name: "1.3.2 | L1 | PATCH | Ensure sudo commands use pty"
-  lineinfile:
-      dest: /etc/sudoers
-      line: "Defaults    use_pty"
-      state: present
+- name: "1.3.2 | PATCH | Ensure filesystem integrity is regularly checked"
+  cron:
+      name: Run AIDE integrity check
+      cron_file: "{{ rhel8cis_aide_cron['cron_file'] }}"
+      user: "{{ rhel8cis_aide_cron['cron_user'] }}"
+      minute: "{{ rhel8cis_aide_cron['aide_minute'] | default('0') }}"
+      hour: "{{ rhel8cis_aide_cron['aide_hour'] | default('5') }}"
+      day: "{{ rhel8cis_aide_cron['aide_day'] | default('*') }}"
+      month: "{{ rhel8cis_aide_cron['aide_month'] | default('*') }}"
+      weekday: "{{ rhel8cis_aide_cron['aide_weekday'] | default('*') }}"
+      job: "{{ rhel8cis_aide_cron['aide_job'] }}"
   when:
-      - rhel9cis_rule_1_3_2
+      - rhel8cis_rule_1_3_2
+      - not system_is_ec2
   tags:
       - level1-server
       - level1-workstation
-      - scored
+      - automated
+      - aide
+      - file_integrity
       - patch
       - rule_1.3.2
-
-- name: "1.3.3 | L1 | PATCH | Ensure sudo log file exists"
-  lineinfile:
-      dest: /etc/sudoers
-      regexp: '^Defaults    logfile='
-      line: 'Defaults    logfile="{{ rhel9cis_varlog_location }}"'
-      state: present
-  when:
-      - rhel9cis_rule_1_3_3
-  tags:
-      - level1-server
-      - level1-workstation
-      - scored
-      - patch
-      - rule_1.3.3