43 lines
1.7 KiB
YAML
43 lines
1.7 KiB
YAML
---
|
|
- name: Install AIDE
|
|
when: cis_effective_rules.aide | default(false)
|
|
# Debian's aideinit lives in aide-common (only Recommended, so absent under
|
|
# the installer's --no-install-recommends); pull it explicitly.
|
|
ansible.builtin.command: "{{ cis_pkg_install }} {{ 'aide aide-common' if is_debian | bool else 'aide' }}"
|
|
register: cis_aide_install
|
|
changed_when: cis_aide_install.rc == 0
|
|
|
|
- name: Initialize the AIDE database
|
|
when: cis_effective_rules.aide | default(false)
|
|
# Absolute path: arch-chroot's PATH omits /usr/sbin, so bare aide/aideinit is rc127.
|
|
# Debian's aideinit assembles its split config; RHEL/Arch run --init on /etc/aide.conf.
|
|
ansible.builtin.command: "{{ chroot_command }} {{ '/usr/sbin/aideinit -y -f' if is_debian | bool else '/usr/sbin/aide --init' }}"
|
|
register: cis_aide_init
|
|
changed_when: cis_aide_init.rc == 0
|
|
|
|
- name: Locate the freshly built AIDE database
|
|
when: cis_effective_rules.aide | default(false)
|
|
ansible.builtin.find:
|
|
paths: /mnt/var/lib/aide
|
|
patterns: "aide.db.new*"
|
|
register: cis_aide_newdb
|
|
|
|
- name: Activate the AIDE database
|
|
when:
|
|
- cis_effective_rules.aide | default(false)
|
|
- cis_aide_newdb.files | length > 0
|
|
ansible.builtin.copy:
|
|
src: "{{ cis_aide_newdb.files[0].path }}"
|
|
dest: "{{ cis_aide_newdb.files[0].path | regex_replace('\\.new', '') }}"
|
|
remote_src: true
|
|
mode: "0600"
|
|
|
|
- name: Schedule the daily AIDE integrity check
|
|
when: cis_effective_rules.aide | default(false)
|
|
ansible.builtin.copy:
|
|
dest: /mnt/etc/cron.d/cis-aide
|
|
mode: "0644"
|
|
content: |
|
|
PATH=/usr/sbin:/usr/bin:/sbin:/bin
|
|
{{ cis_cfg.aide_cron_minute }} {{ cis_cfg.aide_cron_hour }} * * * root aide --check
|