88 lines
2.0 KiB
YAML
88 lines
2.0 KiB
YAML
|
---
|
||
|
|
- name: Configure systemd journald.conf
|
||
|
|
become: true
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: etc/systemd/journald.conf.j2
|
||
|
|
dest: /etc/systemd/journald.conf
|
||
|
|
backup: true
|
||
|
|
mode: "0644"
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
notify:
|
||
|
|
- Reload systemd
|
||
|
|
tags:
|
||
|
|
- systemd
|
||
|
|
- journald
|
||
|
|
- CIS-UBUNTU2004-4.2.2.1
|
||
|
|
- CIS-UBUNTU2004-4.2.2.2
|
||
|
|
- CIS-UBUNTU2004-4.2.2.3
|
||
|
|
|
||
|
|
- name: Configure logrotate(8)
|
||
|
|
become: true
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: etc/logrotate.conf.j2
|
||
|
|
dest: /etc/logrotate.conf
|
||
|
|
backup: true
|
||
|
|
mode: "0644"
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
tags:
|
||
|
|
- logrotate
|
||
|
|
|
||
|
|
- name: Configure cron.daily logrotate
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
line: "/usr/sbin/logrotate /etc/logrotate.conf"
|
||
|
|
dest: /etc/cron.daily/logrotate
|
||
|
|
mode: "0750"
|
||
|
|
state: present
|
||
|
|
create: true
|
||
|
|
tags:
|
||
|
|
- cron
|
||
|
|
- logrotate
|
||
|
|
|
||
|
|
- name: Stat rsyslog.conf
|
||
|
|
become: true
|
||
|
|
ansible.builtin.stat:
|
||
|
|
path: /etc/rsyslog.conf
|
||
|
|
register: rsyslogconf
|
||
|
|
tags:
|
||
|
|
- rsyslog
|
||
|
|
|
||
|
|
- name: Stat rsyslog.conf FileCreateMode
|
||
|
|
become: true
|
||
|
|
environment:
|
||
|
|
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||
|
|
ansible.builtin.shell: grep "^$FileCreateMode" /etc/rsyslog.conf
|
||
|
|
register: rsyslog_filecreatemode
|
||
|
|
changed_when: false
|
||
|
|
when: rsyslogconf.stat.exists
|
||
|
|
tags:
|
||
|
|
- rsyslog
|
||
|
|
|
||
|
|
- name: Configure rsyslog.conf FileCreateMode
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
regexp: '^\$FileCreateMode'
|
||
|
|
line: "$FileCreateMode 0600"
|
||
|
|
dest: /etc/rsyslog.conf
|
||
|
|
mode: "0640"
|
||
|
|
state: present
|
||
|
|
create: false
|
||
|
|
when: rsyslogconf.stat.exists and rsyslog_filecreatemode.stdout.find('FileCreateMode') != -1
|
||
|
|
tags:
|
||
|
|
- rsyslog
|
||
|
|
- CIS-UBUNTU2004-4.2.1.4
|
||
|
|
|
||
|
|
- name: Add FileCreateMode file to the rsyslog.d directory
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
regexp: '^\$FileCreateMode'
|
||
|
|
line: "$FileCreateMode 0600"
|
||
|
|
dest: /etc/rsyslog.d/99-filecreatemode.conf
|
||
|
|
mode: "0644"
|
||
|
|
state: present
|
||
|
|
create: true
|
||
|
|
tags:
|
||
|
|
- rsyslog
|