43 lines
1.7 KiB
YAML
43 lines
1.7 KiB
YAML
---
|
|
- name: Install the audit daemon
|
|
when: cis_effective_rules.auditd | default(false)
|
|
ansible.builtin.command: "{{ cis_pkg_install }} {{ 'auditd' if is_debian | bool else 'audit' }}"
|
|
register: cis_auditd_install
|
|
changed_when: cis_auditd_install.rc == 0
|
|
|
|
- name: Deploy the CIS audit rule set
|
|
when: cis_effective_rules.auditd | default(false)
|
|
ansible.builtin.copy:
|
|
dest: /mnt/etc/audit/rules.d/cis.rules
|
|
mode: "0640"
|
|
content: |
|
|
## CIS baseline audit rules
|
|
-D
|
|
-b 8192
|
|
-f 1
|
|
-a always,exit -F arch=b64 -S adjtimex,settimeofday,clock_settime -k time-change
|
|
-w /etc/localtime -p wa -k time-change
|
|
-w /etc/group -p wa -k identity
|
|
-w /etc/passwd -p wa -k identity
|
|
-w /etc/shadow -p wa -k identity
|
|
-w /etc/gshadow -p wa -k identity
|
|
-w /etc/security/opasswd -p wa -k identity
|
|
-a always,exit -F arch=b64 -S sethostname,setdomainname -k system-locale
|
|
-w /etc/hosts -p wa -k system-locale
|
|
-w /var/log/lastlog -p wa -k logins
|
|
-w /var/run/faillock -p wa -k logins
|
|
-w /var/run/utmp -p wa -k session
|
|
-w /var/log/wtmp -p wa -k session
|
|
-w /var/log/btmp -p wa -k session
|
|
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
|
|
-w /etc/sudoers -p wa -k scope
|
|
-w /etc/sudoers.d -p wa -k scope
|
|
-a always,exit -F arch=b64 -S init_module,delete_module -k modules
|
|
-e 2
|
|
|
|
- name: Enable the audit daemon
|
|
when: cis_effective_rules.auditd | default(false)
|
|
ansible.builtin.command: "{{ chroot_command }} systemctl enable auditd"
|
|
register: cis_auditd_enable
|
|
changed_when: "'Created symlink' in cis_auditd_enable.stderr"
|