Skip to content

Commit

Permalink
Add ansible remediation for audispd plugin UBTU-20-010216
Browse files Browse the repository at this point in the history
This commit will add in ansible remediation for audispd plugin which also ensures that the plugin is enabled within au-remote.conf.
  • Loading branch information
yunimoo committed Aug 11, 2024
1 parent 0c4f15e commit 83fe180
Showing 1 changed file with 22 additions and 3 deletions.
Original file line number Diff line number Diff line change
@@ -1,13 +1,32 @@
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = configure
# complexity = low
# disruption = low
{{{ ansible_instantiate_variables("var_audispd_remote_server") }}}
{{% set audisp_config_file_path = audisp_conf_path + "/audisp-remote.conf" %}}

- name: Make sure that a remote server is configured for Audispd
lineinfile:
{{% if 'ubuntu' in product %}}
{{% set audisp_config_plugin_path = audisp_conf_path + "/plugins.d/au-remote.conf" %}}
- name: "{{{ rule_title }}} - Uncomment active for offloading to remote server"
ansible.builtin.lineinfile:
path: "{{{ audisp_config_plugin_path }}}"
regexp: ^(#.*)(active\s*=)
line: \2
backrefs: true

- name: "{{{ rule_title }}} - Set active to true for offloading to remote server"
ansible.builtin.lineinfile:
path: "{{{ audisp_config_plugin_path }}}"
regexp: ^(.*)(active\s*=)(?!.*yes)
line: \2 yes
craete: true
state: present
backrefs: true
{{% endif %}}

- name: "{{{ rule_title }}} - Make sure that a remote server is configured for Audispd"
ansible.builtin.lineinfile:
path: "{{{ audisp_config_file_path }}}"
line: "remote_server = {{ var_audispd_remote_server }}"
regexp: '^\s*remote_server\s*=.*$'
Expand Down

0 comments on commit 83fe180

Please sign in to comment.