--- - name: "6.2.3.1 | PATCH | Ensure rsyslog installed" when: - "'rsyslog' not in ansible_facts.packages" - rhel9cis_rule_6_2_3_1 tags: - level1-server - level1-workstation - patch - rsyslog - rule_6.2.3.1 - NIST800-53R5_AU-2 - NIST800-53R5_AU-3 - NIST800-53R5_AU-12 ansible.builtin.package: name: rsyslog state: present - name: "6.2.3.2 | PATCH | Ensure rsyslog Service is enabled and active" when: rhel9cis_rule_6_2_3_2 tags: - level1-server - level1-workstation - patch - rsyslog - rule_6.2.3.2 - NIST800-53R5_AU-2 - NIST800-53R5_AU-3 - NIST800-53R5_AU-12 ansible.builtin.systemd: name: rsyslog enabled: true state: started - name: "6.2.3.3 | PATCH | Ensure journald is configured to send logs to rsyslog" when: rhel9cis_rule_6_2_3_3 tags: - level1-server - level1-workstation - patch - rule_6.2.3.3 - NIST800-53R5_AC-3 - NIST800-53R5_AU-2 - NIST800-53R5_AU-4 - NIST800-53R5_AU-12 - NIST800-53R5_MP-2 ansible.builtin.lineinfile: path: /etc/systemd/journald.conf regexp: "^#ForwardToSyslog=|^ForwardToSyslog=" line: ForwardToSyslog=yes notify: Restart rsyslog - name: "6.2.3.4 | PATCH | Ensure rsyslog log file creation mode is configured" when: rhel9cis_rule_6_2_3_4 tags: - level1-server - level1-workstation - patch - rsyslog - rule_6.2.3.4 - NIST800-53R5_AC-3 - NIST800-53R5_AC-6 - NIST800-53R5_MP-2 ansible.builtin.lineinfile: path: /etc/rsyslog.conf regexp: '^\$FileCreateMode' line: '$FileCreateMode 0640' notify: Restart rsyslog - name: "6.2.3.5 | PATCH | Ensure logging is configured" when: rhel9cis_rule_6_2_3_5 tags: - level1-server - level1-workstation - patch - rsyslog - rule_6.2.3.5 - NIST800-53R5_AU-2 - NIST800-53R5_AU-7 - NIST800-53R5_AU-12 block: - name: "6.2.3.5 | AUDIT | Ensure logging is configured | rsyslog current config message out" ansible.builtin.shell: cat /etc/rsyslog.conf | grep -Ev "^#|^$" changed_when: false failed_when: false check_mode: false register: discovered_configured_rsyslog - name: "6.2.3.5 | AUDIT | Ensure logging is configured | rsyslog current config message out" ansible.builtin.debug: msg: - "These are the current logging configurations for rsyslog, please review:" - "{{ discovered_configured_rsyslog.stdout_lines }}" - name: "6.2.3.5 | PATCH | Ensure logging is configured | mail.* log setting" when: rhel9cis_rsyslog_ansiblemanaged ansible.builtin.blockinfile: path: /etc/rsyslog.conf marker: "# {mark} MAIL LOG SETTINGS - CIS benchmark - Ansible-lockdown" block: | # mail logging additions to meet CIS standards mail.* -/var/log/mail mail.info -/var/log/mail.info mail.warning -/var/log/mail.warning mail.err /var/log/mail.err insertafter: '# Log all the mail messages in one place.' notify: Restart rsyslog - name: "6.2.3.5 | PATCH | Ensure logging is configured | news.crit log setting" when: rhel9cis_rsyslog_ansiblemanaged ansible.builtin.blockinfile: path: /etc/rsyslog.conf state: present marker: "# {mark} NEWS LOG SETTINGS - CIS benchmark - Ansible-lockdown" block: | # news logging additions to meet CIS standards news.crit -/var/log/news/news.crit news.notice -/var/log/news/news.crit insertafter: '# Save news errors of level crit and higher in a special file.' notify: Restart rsyslog - name: "6.2.3.5 | PATCH | Ensure logging is configured | Misc. log setting" when: rhel9cis_rsyslog_ansiblemanaged ansible.builtin.blockinfile: path: /etc/rsyslog.conf state: present marker: "# {mark} MISC. LOG SETTINGS - CIS benchmark - Ansible-lockdown" block: | # misc. logging additions to meet CIS standards *.=warning;*.=err -/var/log/warn *.crit /var/log/warn *.*;mail.none;news.none /var/log/messages insertbefore: '# ### sample forwarding rule ###' notify: Restart rsyslog - name: "6.2.3.5 | PATCH | Ensure logging is configured | Local log settings" ansible.builtin.blockinfile: path: /etc/rsyslog.conf state: present marker: "#{mark} LOCAL LOG SETTINGS - CIS benchmark - Ansible-lockdown" block: | # local log settings to meet CIS standards local0,local1.* -/var/log/localmessages local2,local3.* -/var/log/localmessages local4,local5.* -/var/log/localmessages local6,local7.* -/var/log/localmessages *.emerg :omusrmsg:* insertafter: '#### RULES ####' notify: Restart rsyslog - name: "6.2.3.5 | PATCH | Ensure logging is configured | Auth Settings" ansible.builtin.blockinfile: path: /etc/rsyslog.conf state: present marker: "#{mark} Auth SETTINGS - CIS benchmark - Ansible-lockdown" block: | # Private settings to meet CIS standards auth,authpriv.* /var/log/secure insertafter: '#### RULES ####' notify: Restart rsyslog - name: "6.2.3.5 | PATCH | Ensure logging is configured | Cron Settings" ansible.builtin.blockinfile: path: /etc/rsyslog.conf state: present marker: "#{mark} Cron SETTINGS - CIS benchmark - Ansible-lockdown" block: | # Cron settings to meet CIS standards cron.* /var/log/cron insertafter: '#### RULES ####' notify: Restart rsyslog - name: "6.2.3.6 | PATCH | Ensure rsyslog is configured to send logs to a remote log host" when: - rhel9cis_rule_6_2_3_6 - rhel9cis_remote_log_server tags: - level1-server - level1-workstation - patch - rsyslog - rule_6.2.3.6 - NIST800-53R5_AU-6 ansible.builtin.blockinfile: path: /etc/rsyslog.conf state: present block: | # target can be IP or FQDN *.* action(type="omfwd" target="{{ rhel9cis_remote_log_host }}" port="{{ rhel9cis_remote_log_port }}" protocol="{{ rhel9cis_remote_log_protocol }}" action.resumeRetryCount="{{ rhel9cis_remote_log_retrycount }}" queue.type="LinkedList" queue.size="{{ rhel9cis_remote_log_queuesize }}") insertafter: EOF failed_when: - discovered_rsyslog_remote_host is failed - discovered_rsyslog_remote_host.rc != 257 register: discovered_rsyslog_remote_host notify: Restart rsyslog - name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client" when: rhel9cis_rule_6_2_3_7 tags: - level1-server - level1-workstation - patch - rsyslog - rule_6.2.3.7 - NIST800-53R5_AU-2 - NIST800-53R5_AU-7 - NIST800-53R5_AU-12 - NIST800-53R5_CM-6 block: - name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client. | When not log host" when: not rhel9cis_system_is_log_server ansible.builtin.replace: path: /etc/rsyslog.conf regexp: '{{ item }}' replace: '#\1' notify: Restart rsyslog loop: - '^(\$ModLoad imtcp)' - '^(\$InputTCPServerRun)' - '^(module\(load="imtcp"\))' - '^(input\(type="imtcp")' - name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote clients. | When log host" when: rhel9cis_system_is_log_server ansible.builtin.replace: path: /etc/rsyslog.conf regexp: '^#(.*{{ item }}.*)' replace: '\1' notify: Restart rsyslog loop: - 'ModLoad imtcp' - 'InputTCPServerRun' - name: "6.2.3.8 | PATCH | Ensure rsyslog logrotate is configured" when: rhel9cis_rule_6_2_3_8 tags: - level1-server - level1-workstation - manual - patch - logrotate - rule_6.2.3.8 - NIST800-53R5_AU-8 block: - name: "6.2.3.8 | PATCH | Ensure rsyslog logrotate is configured | installed" ansible.builtin.package: name: rsyslog-logrotate state: present - name: "6.2.3.8 | PATCH | Ensure rsyslog logrotate is configured | scheduled" ansible.builtin.systemd: name: logrotate.timer state: started enabled: true - name: "6.2.3.8 | PATCH | Ensure logrotate is configured | set rsyslog conf" ansible.builtin.template: src: etc/logrotate.d/rsyslog_log.j2 dest: /etc/logrotate.d/rsyslog_log owner: root group: root mode: 'g-wx,o-rwx'