ChristophandChristoph Sieber
940ed980b3
* os_hardening: disable systemd audit logging disable audit logging via systemd-journald when enabling auditd as this leads to duplicate logs in the journal or even /var/log/messages depending on the configuration Signed-off-by: Christoph Sieber <[email protected]> * Don't disable systemd-journald-audit.socket on Suse it seems the socket doesn't exist on this OS Signed-off-by: Christoph Sieber <[email protected]> --------- Signed-off-by: Christoph Sieber <[email protected]> Co-authored-by: Christoph Sieber <[email protected]>
35 lines
1.1 KiB
YAML
35 lines
1.1 KiB
YAML
---
|
|
- name: Update-initramfs # noqa no-changed-when
|
|
ansible.builtin.command: update-initramfs -u
|
|
|
|
- name: Reload systemd
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|
|
|
|
- name: Restart auditd via systemd
|
|
ansible.builtin.systemd:
|
|
name: auditd.service
|
|
state: restarted
|
|
ignore_errors: "{{ ansible_check_mode }}"
|
|
when:
|
|
- molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
|
|
- not ansible_facts.os_family == 'RedHat'
|
|
|
|
- name: Restart auditd via service # noqa command-instead-of-module no-changed-when
|
|
ansible.builtin.command:
|
|
cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
|
|
when:
|
|
- molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
|
|
- ansible_facts.os_family == 'RedHat'
|
|
|
|
- name: Remount filesystems
|
|
ansible.posix.mount:
|
|
path: "{{ item }}"
|
|
state: remounted
|
|
loop: "{{ mountpoints_changed }}"
|
|
|
|
- name: Restart journald
|
|
ansible.builtin.systemd:
|
|
name: systemd-journald.service
|
|
state: restarted
|