ChristophandChristoph Sieber
940ed980b3
* os_hardening: disable systemd audit logging disable audit logging via systemd-journald when enabling auditd as this leads to duplicate logs in the journal or even /var/log/messages depending on the configuration Signed-off-by: Christoph Sieber <[email protected]> * Don't disable systemd-journald-audit.socket on Suse it seems the socket doesn't exist on this OS Signed-off-by: Christoph Sieber <[email protected]> --------- Signed-off-by: Christoph Sieber <[email protected]> Co-authored-by: Christoph Sieber <[email protected]>
31 lines
716 B
YAML
31 lines
716 B
YAML
---
|
|
- name: Install auditd package | package-08
|
|
ansible.builtin.package:
|
|
name: "{{ auditd_package }}"
|
|
state: present
|
|
tags: auditd
|
|
|
|
- name: Configure auditd | package-08
|
|
ansible.builtin.template:
|
|
src: "{{ os_auditd_template }}"
|
|
dest: /etc/audit/auditd.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
notify:
|
|
- Restart auditd via service
|
|
- Restart auditd via systemd
|
|
tags: auditd
|
|
|
|
- name: Disable systemd-journald.audit
|
|
when:
|
|
- ansible_facts.os_family != 'Suse' # socket doesn't seem to exist on suse
|
|
ansible.builtin.systemd:
|
|
name: systemd-journald-audit.socket
|
|
state: stopped
|
|
enabled: false
|
|
masked: true
|
|
notify:
|
|
- Restart journald
|
|
tags: auditd
|