Skip to content

Commit

Permalink
Add ansible remediation for audispd plugin UBTU-20-010216
Browse files Browse the repository at this point in the history
This commit will add in ansible remediation for audispd plugin which also ensures that the plugin is enabled within au-remote.conf.
  • Loading branch information
yunimoo committed Aug 8, 2024
1 parent 0c4f15e commit cee3639
Showing 1 changed file with 22 additions and 3 deletions.
Original file line number Diff line number Diff line change
@@ -1,13 +1,32 @@
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = configure
# complexity = low
# disruption = low
{{{ ansible_instantiate_variables("var_audispd_remote_server") }}}
{{% set audisp_config_file_path = audisp_conf_path + "/audisp-remote.conf" %}}

- name: Make sure that a remote server is configured for Audispd
lineinfile:
{{% if 'ubuntu' in product %}}
{{% set audisp_config_plugin_path = audisp_conf_path + "/plugins.d/au-remote.conf" %}}
- name: "{{{ rule_title }}} - Uncomment active for offloading to remote server"
ansible.builtin.lineinfile:
path: "{{{ audisp_config_plugin_path }}}"
regexp: ^(#.*)(active\s*=)
line: \2
backrefs: true

- name: "{{{ rule_title }}} - Set active to true for offloading to remote server"
ansible.builtin.lineinfile:
path: "{{{ audisp_config_plugin_path }}}"
regexp: ^(.*)(active\s*=)(?!.*yes)
line: \2 yes
create: true
state: present
backrefs: true
{{% endif %}}

- name: "{{{ rule_title }}} - Make sure that a remote server is configured for Audispd"
ansible.builtin.lineinfile:
path: "{{{ audisp_config_file_path }}}"
line: "remote_server = {{ var_audispd_remote_server }}"
regexp: '^\s*remote_server\s*=.*$'
Expand Down

0 comments on commit cee3639

Please sign in to comment.