A role to provide configuration for many different Intrusion Detection Systems, these are defined as "providers" to the Role.
Current supported list of providers:
- snort
Red Hat Enterprise Linux 7.x, or derived Linux distribution such as CentOS 7, Scientific Linux 7, etc
Role variables that get put into use are IDS provider specific, they are listed below.
For the Snort provider you will need to set the ids_provider variable as such:
vars:
ids_provider: snort
From there, all our ids_config_* variables will be namespaced to the
specific provider.
ids_config_snort_versionids_config_snort_rules_filesids_config_snort_home_netids_config_snort_external_netids_config_snort_dns_serversids_config_snort_smtp_serversids_config_snort_http_serversids_config_snort_sql_serversids_config_snort_telnet_serversids_config_snort_ssh_serversids_config_snort_ftp_serversids_config_snort_sip_serversids_config_snort_http_portsids_config_snort_shellcode_portsids_config_snort_oracle_portsids_config_snort_ssh_portsids_config_snort_ftp_portsids_config_snort_sip_portsids_config_snort_file_data_portsids_config_snort_gtp_portsids_config_snort_rule_pathids_config_snort_white_list_pathids_config_snort_black_list_pathids_config_snort_checksum_modeids_config_snort_alert_syslogids_config_snort_rules_dir
- FIXME - need a namespace for ASA content first, then probably
ids_isntallas dep
- name: configure snort
hosts: idshosts
vars:
ids_provider: "snort"
tasks:
- name: import ids_config role import_role: name: "ids_config"
BSD