morphit/ops/ansible/roles/hardening/tasks/auditd.yml

77 lines
2.3 KiB
YAML

# §37.6 — auditd.
---
- name: Ensure the auditd rules.d directory exists
# auditd creates /etc/audit/rules.d on Ubuntu 24.04, but ensuring it keeps
# the rules write safe on any box/version that doesn't.
ansible.builtin.file:
path: /etc/audit/rules.d
state: directory
owner: root
group: root
mode: '0750'
- name: Deploy audit.rules
ansible.builtin.copy:
dest: /etc/audit/rules.d/morphit.rules
owner: root
group: root
mode: '0640'
content: |
# Managed by Ansible — see OPERATIONS.md §37.6 for rationale.
# CIS-flavored auditing of identity, sudo, time, and morphit
# service files.
-D
-b 8192
-f 1
# Identity files
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/sudoers -p wa -k identity
-w /etc/sudoers.d/ -p wa -k identity
# SSH
-w /etc/ssh/sshd_config -p wa -k sshd_config
-w /etc/ssh/sshd_config.d/ -p wa -k sshd_config
# Morphit service files
-w /etc/morphit/ -p wa -k morphit_config
-w {{ morphit_repo_path }}/apps/relay/ -p wa -k morphit_relay_code
-w {{ morphit_repo_path }}/apps/indexer/ -p wa -k morphit_indexer_code
# Privilege escalation
-a always,exit -F arch=b64 -S execve -F euid=0 -k root_exec
-a always,exit -F arch=b64 -S setuid -k setuid
-a always,exit -F arch=b64 -S setgid -k setgid
# Time changes
-a always,exit -F arch=b64 -S clock_settime -k time_change
-a always,exit -F arch=b64 -S settimeofday -k time_change
# Make rules immutable after load (-e 2 enables this). Comment
# out the next line if you need to reload rules without reboot
# during initial deployment.
-e 2
notify: Reload audit rules
- name: Configure auditd log rotation
ansible.builtin.lineinfile:
path: /etc/audit/auditd.conf
regexp: '^max_log_file\s*='
line: "max_log_file = {{ audit_log_max_size_mb }}"
notify: Restart auditd
- name: Configure auditd max log files
ansible.builtin.lineinfile:
path: /etc/audit/auditd.conf
regexp: '^num_logs\s*='
line: "num_logs = {{ audit_log_max_files }}"
notify: Restart auditd
- name: Enable + start auditd
ansible.builtin.systemd:
name: auditd
enabled: true
state: started