--- - name: "4.2.1.1 | PATCH | Ensure rsyslog installed" ansible.builtin.package: name: rsyslog state: present when: - "'rsyslog' not in ansible_facts.packages" - rhel9cis_rule_4_2_1_1 tags: - level1-server - level1-workstation - patch - rsyslog - rule_4.2.1.1 - name: "4.2.1.2 | PATCH | Ensure rsyslog Service is enabled" ansible.builtin.systemd: name: rsyslog enabled: true when: - rhel9cis_rule_4_2_1_2 tags: - level1-server - level1-workstation - patch - rsyslog - rule_4.2.1.2 - name: "4.2.1.3 | PATCH | Ensure journald is configured to send logs to rsyslog" ansible.builtin.lineinfile: path: /etc/systemd/journald.conf regexp: "^#ForwardToSyslog=|^ForwardToSyslog=" line: ForwardToSyslog=yes notify: Restart rsyslog when: - rhel9cis_rule_4_2_1_3 - rhel9cis_syslog == "rsyslog" tags: - level1-server - level1-workstation - patch - rule_4.2.1.3 - name: "4.2.1.4 | PATCH | Ensure rsyslog default file permissions configured" ansible.builtin.lineinfile: path: /etc/rsyslog.conf regexp: '^\$FileCreateMode' line: '$FileCreateMode 0640' notify: Restart rsyslog when: - rhel9cis_rule_4_2_1_4 tags: - level1-server - level1-workstation - patch - rsyslog - rule_4.2.1.4 - name: "4.2.1.5 | PATCH | Ensure logging is configured" block: - name: "4.2.1.5 | AUDIT | Ensure logging is configured | rsyslog current config message out" ansible.builtin.shell: cat /etc/rsyslog.conf changed_when: false failed_when: false check_mode: false register: rhel_09_4_2_1_5_audit - name: "4.2.1.5 | AUDIT | Ensure logging is configured | rsyslog current config message out" ansible.builtin.debug: msg: - "These are the current logging configurations for rsyslog, please review:" - "{{ rhel_09_4_2_1_5_audit.stdout_lines }}" - name: "4.2.1.5 | PATCH | Ensure logging is configured | mail.* log setting" ansible.builtin.blockinfile: path: /etc/rsyslog.conf marker: "# {mark} MAIL LOG SETTINGS (ANSIBLE MANAGED)" block: | # mail logging additions to meet CIS standards mail.* -/var/log/mail mail.info -/var/log/mail.info mail.warning -/var/log/mail.warning mail.err /var/log/mail.err insertafter: '# Log all the mail messages in one place.' notify: Restart rsyslog when: rhel9cis_rsyslog_ansiblemanaged - name: "4.2.1.5 | PATCH | Ensure logging is configured | news.crit log setting" ansible.builtin.blockinfile: path: /etc/rsyslog.conf state: present marker: "# {mark} NEWS LOG SETTINGS (ANSIBLE MANAGED)" block: | # news logging additions to meet CIS standards news.crit -/var/log/news/news.crit news.notice -/var/log/news/news.crit insertafter: '# Save news errors of level crit and higher in a special file.' notify: Restart rsyslog when: rhel9cis_rsyslog_ansiblemanaged - name: "4.2.1.5 | PATCH | Ensure logging is configured | Misc. log setting" ansible.builtin.blockinfile: path: /etc/rsyslog.conf state: present marker: "# {mark} MISC. LOG SETTINGS (ANSIBLE MANAGED)" block: | # misc. logging additions to meet CIS standards *.=warning;*.=err -/var/log/warn *.crit /var/log/warn *.*;mail.none;news.none /var/log/messages insertafter: '#### RULES ####' notify: Restart rsyslog when: rhel9cis_rsyslog_ansiblemanaged - name: "4.2.1.5 | PATCH | Ensure logging is configured | Local log settings" ansible.builtin.blockinfile: path: /etc/rsyslog.conf state: present marker: "#{mark} LOCAL LOG SETTINGS (ANSIBLE MANAGED)" block: | # local log settings to meet CIS standards local0,local1.* -/var/log/localmessages local2,local3.* -/var/log/localmessages local4,local5.* -/var/log/localmessages local6,local7.* -/var/log/localmessages *.emrg :omusrmsg:* insertafter: '#### RULES ####' notify: Restart rsyslog - name: "4.2.1.5 | PATCH | Ensure logging is configured | Auth Settings" ansible.builtin.blockinfile: path: /etc/rsyslog.conf state: present marker: "#{mark} Auth SETTINGS (ANSIBLE MANAGED)" block: | # Private settings to meet CIS standards auth,authpriv.* /var/log/secure insertafter: '#### RULES ####' notify: Restart rsyslog - name: "4.2.1.5 | PATCH | Ensure logging is configured | Cron Settings" ansible.builtin.blockinfile: path: /etc/rsyslog.conf state: present marker: "#{mark} Cron SETTINGS (ANSIBLE MANAGED)" block: | # Cron settings to meet CIS standards cron.* /var/log/cron insertafter: '#### RULES ####' notify: Restart rsyslog when: - rhel9cis_rule_4_2_1_5 tags: - level1-server - level1-workstation - patch - rsyslog - rule_4.2.1.5 - name: "4.2.1.6 | PATCH | Ensure rsyslog is configured to send logs to a remote log host" ansible.builtin.blockinfile: path: /etc/rsyslog.conf state: present block: | # target can be IP or FQDN *.* action(type="omfwd" target="{{ rhel9cis_remote_log_host }}" port="{{ rhel9cis_remote_log_port }}" protocol="{{ rhel9cis_remote_log_protocol }}" action.resumeRetryCount="{{ rhel9cis_remote_log_retrycount }}" queue.type="LinkedList" queue.size="{{ rhel9cis_remote_log_queuesize }}") insertafter: EOF register: result failed_when: - result is failed - result.rc != 257 notify: Restart rsyslog when: - rhel9cis_rule_4_2_1_6 - rhel9cis_remote_log_server tags: - level1-server - level1-workstation - patch - rsyslog - rule_4.2.1.6 - name: "4.2.1.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client" block: - name: "4.2.1.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client. | When not log host" ansible.builtin.replace: path: /etc/rsyslog.conf regexp: '{{ item }}' replace: '#\1' notify: Restart rsyslog loop: - '^(\$ModLoad imtcp)' - '^(\$InputTCPServerRun)' - '^(module\(load="imtcp"\))' - '^(input\(type="imtcp")' when: not rhel9cis_system_is_log_server - name: "4.2.1.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote clients. | When log host" ansible.builtin.replace: path: /etc/rsyslog.conf regexp: '^#(.*{{ item }}.*)' replace: '\1' notify: Restart rsyslog loop: - 'ModLoad imtcp' - 'InputTCPServerRun' when: rhel9cis_system_is_log_server when: - rhel9cis_rule_4_2_1_7 tags: - level1-server - level1-workstation - patch - rsyslog - rule_4.2.1.7