From d72d516f2647a3e03b5e11d891c6ec4e9ddcf9cf Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Thu, 13 Mar 2014 16:43:50 +0100 Subject: Make use of Ansible 1.5 new features. Most notably pipelining=True and sysctl_set=yes. --- roles/common/files/etc/logcheck/ignore.d.server/common.local | 4 +++- roles/common/files/etc/logcheck/violations.ignore.d/logcheck-sudo | 7 +++++++ roles/common/tasks/logging.yml | 1 + roles/common/tasks/rkhunter.yml | 2 ++ roles/common/tasks/sysctl.yml | 2 +- 5 files changed, 14 insertions(+), 2 deletions(-) create mode 100644 roles/common/files/etc/logcheck/violations.ignore.d/logcheck-sudo (limited to 'roles/common') diff --git a/roles/common/files/etc/logcheck/ignore.d.server/common.local b/roles/common/files/etc/logcheck/ignore.d.server/common.local index 22fe621..331edeb 100644 --- a/roles/common/files/etc/logcheck/ignore.d.server/common.local +++ b/roles/common/files/etc/logcheck/ignore.d.server/common.local @@ -1,6 +1,8 @@ # Ansible Managed # Do NOT edit this file directly! # +^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: subsystem request for sftp by user [^[:space:]]+$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/master\[[[:digit:]]+\]: reload -- version +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo:[[:space:]]+[_[:alnum:].-]+ : TTY=(unknown|(pts/|tty|vc/)[[:digit:]]+) ; PWD=[^;]+ ; USER=[._[:alnum:]-]+ (; ENV=([_a-zA-Z]+=\S* )+)?; COMMAND=(/(usr|etc|bin|sbin)/|sudoedit ) # Ansible logs everything into syslog -^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ ansible-[a-z]+: Invoked +^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ ansible-([a-z]+|): Invoked with diff --git a/roles/common/files/etc/logcheck/violations.ignore.d/logcheck-sudo b/roles/common/files/etc/logcheck/violations.ignore.d/logcheck-sudo new file mode 100644 index 0000000..e474019 --- /dev/null +++ b/roles/common/files/etc/logcheck/violations.ignore.d/logcheck-sudo @@ -0,0 +1,7 @@ +^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sudo: pam_krb5\(sudo:auth\): user [[:alnum:]-]+ authenticated as [[:alnum:]-]+@[.A-Z]+$ +# ignore sudo with custom ENV +#^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo:[[:space:]]+[_[:alnum:].-]+ : TTY=(unknown|console|(pts/|tty|vc/)[[:digit:]]+) ; PWD=[^;]+ ; USER=[._[:alnum:]-]+ ; COMMAND=((/(usr|etc|bin|sbin)/|sudoedit ).*|list)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo:[[:space:]]+[_[:alnum:].-]+ : TTY=(unknown|console|(pts/|tty|vc/)[[:digit:]]+) ; PWD=[^;]+ ; USER=[._[:alnum:]-]+ (; ENV=([_a-zA-Z]+=\S* )+)?; COMMAND=((/(usr|etc|bin|sbin)/|sudoedit ).*|list)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo:[[:space:]]+[_[:alnum:].-]+ : \(command continued\).*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo: pam_[[:alnum:]]+\(sudo:session\): session opened for user [[:alnum:]-]+ by ([[:alnum:]-]+)?\(uid=[0-9]+\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo: pam_[[:alnum:]]+\(sudo:session\): session closed for user [[:alnum:]-]+$ diff --git a/roles/common/tasks/logging.yml b/roles/common/tasks/logging.yml index 06f06b0..d25a75e 100644 --- a/roles/common/tasks/logging.yml +++ b/roles/common/tasks/logging.yml @@ -20,6 +20,7 @@ with_items: - logcheck.conf - ignore.d.server/common.local + - violations.ignore.d/logcheck-sudo - name: Minimal logging policy (1) lineinfile: dest=/etc/logrotate.d/rsyslog diff --git a/roles/common/tasks/rkhunter.yml b/roles/common/tasks/rkhunter.yml index f6a4d71..78eec90 100644 --- a/roles/common/tasks/rkhunter.yml +++ b/roles/common/tasks/rkhunter.yml @@ -8,6 +8,8 @@ - unhide - unhide.rb +# To test the configuration: +# ansible all -m command -a '/usr/bin/rkhunter -c --nomow --rwo' - name: Configure rkhunter copy: src=etc/{{ item }} dest=/etc/{{ item }} diff --git a/roles/common/tasks/sysctl.yml b/roles/common/tasks/sysctl.yml index 9adeece..6ac7feb 100644 --- a/roles/common/tasks/sysctl.yml +++ b/roles/common/tasks/sysctl.yml @@ -1,4 +1,4 @@ -- sysctl: name={{ item.name }} value={{ item.value }} +- sysctl: name={{ item.name }} "value={{ item.value }}" sysctl_set=yes with_items: - { name: 'kernel.domainname', value: '{{ ansible_domain }}' } -- cgit v1.2.3