From bda835d0051950c63c0f38bbf11fb6fe47b4af36 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Thu, 31 Oct 2013 01:10:49 +0100 Subject: Configure the (basic) logging policy. --- .../etc/logcheck/ignore.d.server/common.local | 6 ++ roles/common/files/etc/logcheck/logcheck.conf | 85 ++++++++++++++++++++++ roles/common/files/etc/logrotate.d/fripost-mail | 17 +++++ 3 files changed, 108 insertions(+) create mode 100644 roles/common/files/etc/logcheck/ignore.d.server/common.local create mode 100644 roles/common/files/etc/logcheck/logcheck.conf create mode 100644 roles/common/files/etc/logrotate.d/fripost-mail (limited to 'roles/common/files/etc') diff --git a/roles/common/files/etc/logcheck/ignore.d.server/common.local b/roles/common/files/etc/logcheck/ignore.d.server/common.local new file mode 100644 index 0000000..22fe621 --- /dev/null +++ b/roles/common/files/etc/logcheck/ignore.d.server/common.local @@ -0,0 +1,6 @@ +# Ansible Managed +# Do NOT edit this file directly! +# +^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/master\[[[:digit:]]+\]: reload -- version +# Ansible logs everything into syslog +^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ ansible-[a-z]+: Invoked diff --git a/roles/common/files/etc/logcheck/logcheck.conf b/roles/common/files/etc/logcheck/logcheck.conf new file mode 100644 index 0000000..9a7e7c6 --- /dev/null +++ b/roles/common/files/etc/logcheck/logcheck.conf @@ -0,0 +1,85 @@ +# The following variable settings are the initial default values, +# which can be uncommented and modified to alter logcheck's behaviour + +# Controls the format of date-/time-stamps in subject lines: +# Alternatively, set the format to suit your locale + +#DATE="$(date +'%Y-%m-%d %H:%M')" + +# Controls the presence of boilerplate at the top of each message: +# Alternatively, set to "0" to disable the introduction. +# +# If the files /etc/logcheck/header.txt and /etc/logcheck/footer.txt +# are present their contents will be read and used as the header and +# footer of any generated mails. + +INTRO=0 + +# Controls the level of filtering: +# Can be Set to "workstation", "server" or "paranoid" for different +# levels of filtering. Defaults to server if not set. + +REPORTLEVEL="server" + +# Controls the address mail goes to: +# *NOTE* the script does not set a default value for this variable! +# Should be set to an offsite "emailaddress@some.domain.tld" + +SENDMAILTO="admin@fripost.org" + +# Send the results as attachment or not. +# 0=not as attachment; 1=as attachment; 2=as gzip attachment +# Default is 0 + +MAILASATTACH=0 + +# Should the hostname in the subject of generated mails be fully qualified? + +FQDN=1 + +# Controls whether "sort -u" is used on log entries (which will +# eliminate duplicates but destroy the original ordering); the +# default is to use "sort -k 1,3 -s": +# Alternatively, set to "1" to enable unique sorting + +#SORTUNIQ=0 + +# Controls whether /etc/logcheck/cracking.ignore.d is scanned for +# exceptions to the rules in /etc/logcheck/cracking.d: +# Alternatively, set to "1" to enable cracking.ignore support + +#SUPPORT_CRACKING_IGNORE=0 + +# Controls the base directory for rules file location +# This must be an absolute path + +#RULEDIR="/etc/logcheck" + +# Controls if syslog-summary is run over each section. +# Alternatively, set to "1" to enable extra summary. +# HINT: syslog-summary needs to be installed. + +#SYSLOGSUMMARY=0 + +# Controls Subject: lines on logcheck reports: + +#ATTACKSUBJECT="Security Alerts" +#SECURITYSUBJECT="Security Events" +#EVENTSSUBJECT="System Events" + +# Controls [logcheck] prefix on Subject: lines + +#ADDTAG="no" + +# Set a different location for temporary files than /tmp +# this is useful if your /tmp is small and you are getting +# errors such as: +# cp: writing `/tmp/logcheck.y12449/checked': No space left on device +# /usr/sbin/logcheck: line 161: cannot create temp file for here document: No space left on device +# mail: /tmp/mail.RsXXXXpc2eAx: No space left on device +# Null message body; hope that's ok +# +# If this is happening, likely you will want to change the following to be some other +# location, such as /var/tmp + +TMP="/tmp" diff --git a/roles/common/files/etc/logrotate.d/fripost-mail b/roles/common/files/etc/logrotate.d/fripost-mail new file mode 100644 index 0000000..9ed2617 --- /dev/null +++ b/roles/common/files/etc/logrotate.d/fripost-mail @@ -0,0 +1,17 @@ +# Don't forget to remove these log files from other files under +# /etc/logrotate.d/ ! + +/var/log/mail.log +/var/log/mail.info +{ + rotate 3 + daily + missingok + notifempty + compress + delaycompress + sharedscripts + postrotate + invoke-rc.d rsyslog rotate > /dev/null + endscript +} -- cgit v1.2.3