morphit/ops/ansible/roles/hardening/tasks/rkhunter.yml

24 lines
809 B
YAML

# §37.15 — rkhunter rootkit scanner.
---
- name: Configure rkhunter for weekly automatic checks
ansible.builtin.lineinfile:
path: /etc/default/rkhunter
regexp: "^{{ item.key }}="
line: '{{ item.key }}="{{ item.value }}"'
state: present
loop:
- { key: "CRON_DAILY_RUN", value: "false" }
- { key: "CRON_DB_UPDATE", value: "true" }
- { key: "APT_AUTOGEN", value: "true" }
- { key: "REPORT_EMAIL", value: "{{ morphit_alert_email_to }}" }
- name: Schedule weekly rkhunter check
ansible.builtin.copy:
dest: /etc/cron.weekly/rkhunter-check
owner: root
group: root
mode: '0755'
content: |
#!/bin/sh
rkhunter --update --quiet
rkhunter --check --sk --rwo 2>&1 | mail -s "[morphit] rkhunter weekly $(date +%F)" {{ morphit_alert_email_to }}