809b6cb52d
The augenrules command joins together all of the audit rules from rules.d and it is run any time the audit rules template changes. However, the augenrules handler didn't actually restart auditd to apply the changes to the system. This patch fires off the auditd restart handler anytime the augenrules handler is notified. Closes-bug: 1590916 Change-Id: Ice83fe17ebb0e9edff9da897e435ae96c1778580
70 lines
1.7 KiB
YAML
70 lines
1.7 KiB
YAML
---
|
|
# Copyright 2015, Rackspace US, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
# Restarting services ########################################################
|
|
- name: restart auditd
|
|
service:
|
|
name: auditd
|
|
state: restarted
|
|
|
|
- name: restart chrony
|
|
service:
|
|
name: chrony
|
|
state: restarted
|
|
|
|
- name: restart fail2ban
|
|
service:
|
|
name: fail2ban
|
|
state: restarted
|
|
|
|
- name: restart postfix
|
|
service:
|
|
name: postfix
|
|
state: restarted
|
|
|
|
- name: restart rsyslog
|
|
service:
|
|
name: rsyslog
|
|
state: restarted
|
|
|
|
- name: restart samba
|
|
service:
|
|
name: smbd
|
|
state: restarted
|
|
|
|
- name: restart ssh
|
|
service:
|
|
name: "{{ ssh_service }}"
|
|
state: restarted
|
|
|
|
- name: restart vsftpd
|
|
service:
|
|
name: vsftpd
|
|
state: restarted
|
|
|
|
# Miscellaneous ##############################################################
|
|
- name: generate auditd rules
|
|
command: augenrules --load
|
|
notify: restart auditd
|
|
|
|
# This will take a while to complete the first run, so we will fork it into
|
|
# the background so it doesn't hold up the whole playbook.
|
|
- name: initialize AIDE
|
|
shell: "aideinit -b"
|
|
when: security_initialize_aide | bool
|
|
|
|
- name: rehash aliases
|
|
command: newaliases
|