andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

disable systemd audit logging (#902)

Browse Source 
* os_hardening: disable systemd audit logging

disable audit logging via systemd-journald when enabling auditd
as this leads to duplicate logs in the journal or even /var/log/messages
depending on the configuration

Signed-off-by: Christoph Sieber <[email protected]>

* Don't disable systemd-journald-audit.socket on Suse

it seems the socket doesn't exist on this OS

Signed-off-by: Christoph Sieber <[email protected]>

---------

Signed-off-by: Christoph Sieber <[email protected]>
Co-authored-by: Christoph Sieber <[email protected]>
This commit is contained in:
ChristophandChristoph Sieber authored and GitHub committed 2025-10-27 22:23:39 +01:00
1 parent 9976169cad
commit 940ed980b3
2 files changed
+17
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

roles/os_hardening/handlers/main.yml
+5
View File
@@ -27,3 +27,8 @@
path: "{{ item }}" path: "{{ item }}"
state: remounted state: remounted
loop: "{{ mountpoints_changed }}" loop: "{{ mountpoints_changed }}"
- name: Restart journald
ansible.builtin.systemd:
name: systemd-journald.service
state: restarted
roles/os_hardening/tasks/auditd.yml
+12
View File
@@ -16,3 +16,15 @@
- Restart auditd via service - Restart auditd via service
- Restart auditd via systemd - Restart auditd via systemd
tags: auditd tags: auditd
- name: Disable systemd-journald.audit
when:
- ansible_facts.os_family != 'Suse' # socket doesn't seem to exist on suse
ansible.builtin.systemd:
name: systemd-journald-audit.socket
state: stopped
enabled: false
masked: true
notify:
- Restart journald
tags: auditd