205 lines
4.9 KiB
YAML
205 lines
4.9 KiB
YAML
---
|
|
- name: Configure Debian auditd GRUB cmdline
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
line: 'GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX {{ grub_audit_cmdline }} {{ grub_audit_backlog_cmdline }}"'
|
|
dest: /etc/default/grub.d/99-hardening-audit.cfg
|
|
state: present
|
|
create: true
|
|
mode: "0640"
|
|
owner: root
|
|
group: root
|
|
when: ansible_os_family == "Debian"
|
|
tags:
|
|
- auditd
|
|
- CIS-UBUNTU2004-4.1.1.3
|
|
- CIS-UBUNTU2004-4.1.1.4
|
|
|
|
- name: Configure RedHat auditd GRUB cmdline
|
|
become: true
|
|
ansible.builtin.command:
|
|
cmd: 'grubby --update-kernel=ALL --args="{{ grub_audit_cmdline }} {{ grub_audit_backlog_cmdline }}"'
|
|
register: grubby_update_kernel
|
|
when: ansible_os_family == "RedHat"
|
|
changed_when: grubby_update_kernel.rc != 0
|
|
failed_when: grubby_update_kernel.rc != 0
|
|
tags:
|
|
- auditd
|
|
- CCE-80825-3
|
|
- CCE-80943-4
|
|
|
|
- name: Configure auditd action_mail_acct
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
regexp: "^action_mail_acct ="
|
|
line: "action_mail_acct = {{ auditd_action_mail_acct }}"
|
|
dest: /etc/audit/auditd.conf
|
|
mode: "0640"
|
|
state: present
|
|
create: false
|
|
tags:
|
|
- auditd
|
|
- CCE-80678-6
|
|
|
|
- name: Configure auditd admin_space_left_action
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
regexp: "^admin_space_left_action = "
|
|
line: "admin_space_left_action = {{ auditd_admin_space_left_action }}"
|
|
dest: /etc/audit/auditd.conf
|
|
mode: "0640"
|
|
state: present
|
|
create: false
|
|
tags:
|
|
- auditd
|
|
|
|
- name: Configure auditd disk_error_action
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
regexp: "^disk_error_action ="
|
|
line: "disk_error_action = {{ auditd_disk_error_action }}"
|
|
dest: /etc/audit/auditd.conf
|
|
mode: "0640"
|
|
state: present
|
|
create: false
|
|
tags:
|
|
- auditd
|
|
- CCE-84046-2
|
|
|
|
- name: Configure auditd disk_full_action
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
regexp: "^disk_full_action ="
|
|
line: "disk_full_action = {{ auditd_disk_full_action }}"
|
|
dest: /etc/audit/auditd.conf
|
|
mode: "0640"
|
|
state: present
|
|
create: false
|
|
tags:
|
|
- auditd
|
|
- CCE-84045-4
|
|
|
|
- name: Configure auditd max_log_file
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
regexp: "^max_log_file ="
|
|
line: "max_log_file = {{ auditd_max_log_file }}"
|
|
dest: /etc/audit/auditd.conf
|
|
mode: "0640"
|
|
state: present
|
|
create: false
|
|
tags:
|
|
- auditd
|
|
- CIS-UBUNTU2004-4.1.2.1
|
|
|
|
- name: Configure auditd max_log_file_action
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
regexp: "^max_log_file_action ="
|
|
line: "max_log_file_action = {{ auditd_max_log_file_action }}"
|
|
dest: /etc/audit/auditd.conf
|
|
mode: "0640"
|
|
state: present
|
|
create: false
|
|
tags:
|
|
- auditd
|
|
- CCE-80682-8
|
|
- CIS-UBUNTU2004-4.1.2.2
|
|
|
|
- name: Configure auditd num_logs
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
regexp: "^num_logs ="
|
|
line: "num_logs = {{ auditd_num_logs }}"
|
|
dest: /etc/audit/auditd.conf
|
|
mode: "0640"
|
|
state: present
|
|
create: false
|
|
tags:
|
|
- auditd
|
|
|
|
- name: Configure auditd space_left
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
regexp: "^space_left ="
|
|
line: "space_left = {{ auditd_space_left }}"
|
|
dest: /etc/audit/auditd.conf
|
|
mode: "0640"
|
|
state: present
|
|
create: false
|
|
tags:
|
|
- auditd
|
|
|
|
- name: Configure auditd space_left_action
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
regexp: "^space_left_action ="
|
|
line: "space_left_action = {{ auditd_space_left_action }}"
|
|
dest: /etc/audit/auditd.conf
|
|
mode: "0640"
|
|
state: present
|
|
create: false
|
|
tags:
|
|
- auditd
|
|
- CCE-80684-4
|
|
|
|
- name: Configure auditd name_format
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
regexp: "^name_format ="
|
|
line: "name_format = hostname"
|
|
dest: /etc/audit/auditd.conf
|
|
mode: "0640"
|
|
state: present
|
|
create: false
|
|
tags:
|
|
- auditd
|
|
|
|
- name: Enable auditd syslog plugin
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
dest: /etc/audit/plugins.d/syslog.conf
|
|
regexp: "^active"
|
|
line: "active = yes"
|
|
state: present
|
|
mode: "0640"
|
|
create: true
|
|
tags:
|
|
- auditd
|
|
|
|
- name: Add auditd rules
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: etc/audit/rules.d/hardening.rules.j2
|
|
dest: /etc/audit/rules.d/hardening.rules
|
|
backup: true
|
|
mode: "0600"
|
|
owner: root
|
|
group: root
|
|
when: auditd_apply_audit_rules | bool
|
|
notify:
|
|
- Generate auditd rules
|
|
- Restart Debian auditd
|
|
- Restart RedHat auditd
|
|
tags:
|
|
- auditd
|
|
- CCE-80708-1
|
|
- CIS-UBUNTU2004-4.1.1.2
|
|
- CIS-UBUNTU2004-4.1.3
|
|
- CIS-UBUNTU2004-4.1.4
|
|
- CIS-UBUNTU2004-4.1.5
|
|
- CIS-UBUNTU2004-4.1.6
|
|
- CIS-UBUNTU2004-4.1.7
|
|
- CIS-UBUNTU2004-4.1.8
|
|
- CIS-UBUNTU2004-4.1.9
|
|
- CIS-UBUNTU2004-4.1.10
|
|
- CIS-UBUNTU2004-4.1.11
|
|
- CIS-UBUNTU2004-4.1.12
|
|
- CIS-UBUNTU2004-4.1.13
|
|
- CIS-UBUNTU2004-4.1.14
|
|
- CIS-UBUNTU2004-4.1.15
|
|
- CIS-UBUNTU2004-4.1.16
|
|
- CIS-UBUNTU2004-4.1.17
|
|
- D3-SDM
|
|
- D3-SFA
|