160 lines
3.6 KiB
YAML
160 lines
3.6 KiB
YAML
---
|
|
- name: Debian family AIDE installation
|
|
become: true
|
|
ansible.builtin.apt:
|
|
name: aide-common
|
|
state: present
|
|
install_recommends: false
|
|
when: ansible_os_family == "Debian"
|
|
tags:
|
|
- aide
|
|
- CIS-UBUNTU2004-1.3.1
|
|
|
|
- name: RedHat family AIDE package installation
|
|
become: true
|
|
ansible.builtin.package:
|
|
name: aide
|
|
state: present
|
|
when: ansible_os_family == "RedHat"
|
|
tags:
|
|
- aide
|
|
- CCE-80844-4
|
|
|
|
- name: Stat AIDE cron.daily
|
|
become: true
|
|
ansible.builtin.stat:
|
|
path: /etc/cron.daily/aide
|
|
register: aidecron
|
|
tags:
|
|
- aide
|
|
- CCE-80844-4
|
|
- CIS-UBUNTU2004-1.3.1
|
|
|
|
- name: Install AIDE service
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: lib/systemd/system/aidecheck.service.j2
|
|
dest: /lib/systemd/system/aidecheck.service
|
|
backup: true
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
when: not aidecron.stat.exists
|
|
tags:
|
|
- aide
|
|
|
|
- name: Install AIDE timer
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: lib/systemd/system/aidecheck.timer.j2
|
|
dest: /lib/systemd/system/aidecheck.timer
|
|
backup: true
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
when: not aidecron.stat.exists
|
|
notify:
|
|
- Reload systemd
|
|
- Enable aidecheck
|
|
tags:
|
|
- aide
|
|
- CCE-80676-0
|
|
- CIS-UBUNTU2004-1.3.2
|
|
|
|
- name: Add AIDE Debian dir exclusions
|
|
become: true
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/aide/aide.conf
|
|
marker: "# {mark} ANSIBLE MANAGED BLOCK"
|
|
backup: true
|
|
insertafter: EOF
|
|
block: |
|
|
{% for exclude in _aide_exclude %}
|
|
{{ exclude }}
|
|
{% endfor %}
|
|
when: ansible_os_family == "Debian"
|
|
tags:
|
|
- aide
|
|
|
|
- name: Stat Debian aide.db
|
|
become: true
|
|
ansible.builtin.stat:
|
|
path: /var/lib/aide/aide.db
|
|
register: ubuaidedb
|
|
when: ansible_os_family == "Debian"
|
|
tags:
|
|
- aide
|
|
|
|
- name: Add AIDE RedHat dir exclusions
|
|
become: true
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/aide.conf
|
|
marker: "# {mark} ANSIBLE MANAGED BLOCK"
|
|
backup: true
|
|
insertafter: EOF
|
|
block: |
|
|
!/var/lib/docker
|
|
!/var/lib/lxcfs
|
|
!/var/lib/private/systemd
|
|
!/var/log/audit
|
|
!/var/log/journal
|
|
when: ansible_os_family == "RedHat"
|
|
tags:
|
|
- aide
|
|
|
|
- name: Stat RedHat aide.db
|
|
become: true
|
|
ansible.builtin.stat:
|
|
path: /var/lib/aide/aide.db.gz
|
|
register: rhelaidedb
|
|
changed_when: false
|
|
failed_when: false
|
|
when: ansible_os_family == "RedHat"
|
|
tags:
|
|
- aide
|
|
|
|
- name: Initialize RedHat AIDE
|
|
become: true
|
|
ansible.builtin.command:
|
|
cmd: aide --init -B 'database_out=file:/var/lib/aide/aide.db.gz'
|
|
register: init_redhat_aide
|
|
changed_when: init_redhat_aide.rc != 0
|
|
failed_when: init_redhat_aide.rc != 0
|
|
when: ansible_os_family == "RedHat" and not rhelaidedb.stat.exists
|
|
tags:
|
|
- aide
|
|
- CCE-80675-2
|
|
|
|
- name: Stat RedHat aide.db.new.gz
|
|
become: true
|
|
ansible.builtin.stat:
|
|
path: /var/lib/aide/aide.db.new.gz
|
|
register: rhelaidedbnew
|
|
changed_when: false
|
|
failed_when: false
|
|
when: ansible_os_family == "RedHat"
|
|
tags:
|
|
- aide
|
|
|
|
- name: Copy RedHat AIDE database
|
|
become: true
|
|
ansible.builtin.command:
|
|
cmd: cp /var/lib/aide/aide.db.gz /var/lib/aide/aide.db.new.gz
|
|
register: cp_redhat_aide_db
|
|
changed_when: cp_redhat_aide_db.rc != 0
|
|
failed_when: cp_redhat_aide_db.rc != 0
|
|
when: ansible_os_family == "RedHat" and not rhelaidedbnew.stat.exists
|
|
tags:
|
|
- aide
|
|
|
|
- name: Initialize Debian AIDE
|
|
become: true
|
|
ansible.builtin.command:
|
|
cmd: aideinit --force --yes
|
|
register: init_debian_aide
|
|
changed_when: init_debian_aide.rc != 0
|
|
failed_when: init_debian_aide.rc != 0
|
|
when: ansible_os_family == "Debian" and not ubuaidedb.stat.exists
|
|
tags:
|
|
- aide
|