Rich MegginsonandRichard Megginson
189c7a6f85
Cause: The aide role custom config test is using the old configuration options on newer EL9 systems which use AIDE version 0.17 and later. Consequence: The test gives errors like "ERROR: /etc/aide.conf:12: unexpected character" and the test fails. Fix: The role will now determine the AIDE version, set the new aide_version variable, and use this variable to determine the old or new style configuration. Result: The aide system role can process custom config on all supported AIDE versions. See https://github.com/aide/aide/blob/master/ChangeLog#L241 Signed-off-by: Rich Megginson <rmeggins@redhat.com>
173 lines
5.9 KiB
Markdown
173 lines
5.9 KiB
Markdown
# AIDE
|
|
|
|
[](https://github.com/linux-system-roles/aide/actions/workflows/ansible-lint.yml) [](https://github.com/linux-system-roles/aide/actions/workflows/ansible-test.yml) [](https://github.com/linux-system-roles/aide/actions/workflows/codespell.yml) [](https://github.com/linux-system-roles/aide/actions/workflows/markdownlint.yml) [](https://github.com/linux-system-roles/aide/actions/workflows/qemu-kvm-integration-tests.yml) [](https://github.com/linux-system-roles/aide/actions/workflows/shellcheck.yml) [](https://github.com/linux-system-roles/aide/actions/workflows/tft.yml) [](https://github.com/linux-system-roles/aide/actions/workflows/tft_citest_bad.yml) [](https://github.com/linux-system-roles/aide/actions/workflows/woke.yml)
|
|
|
|
This is an ansible role that installs and configures the [Advanced Intrusion Detection Environment (AIDE)](https://aide.github.io). For Day 2 tasks it can run integrity checks and update the AIDE database.
|
|
|
|
## What does this role do for you?
|
|
|
|
* It ensures that the `aide` package is installed on the remote nodes
|
|
* As an optional task it can generate the `/etc/aide.conf` file and template it out to the remote nodes
|
|
* It initializes the AIDE database
|
|
* The AIDE databases from the remote nodes are stored in a central directory on the controller node
|
|
* It runs AIDE integrity checks on the remote nodes
|
|
* It updates the AIDE databases and stores them on the controller node
|
|
|
|
## What does this role not do for you?
|
|
|
|
* It does not explain how to create a good AIDE configuration that suits your requirements; that task remains for you to accomplish
|
|
|
|
## Requirements
|
|
|
|
This role has no special requirements as it uses `ansible.builtin` modules
|
|
only.
|
|
|
|
## Role Variables
|
|
|
|
### aide_config_template
|
|
|
|
This variable takes a string to specify a path where the custom template for aide.conf is located.
|
|
|
|
To be sure that everything is correct, template needs to start with following snippet:
|
|
|
|
``` jinja
|
|
{{ ansible_managed | comment }}
|
|
{{ "system_role:aide" | comment(prefix="", postfix="") }}
|
|
```
|
|
|
|
Default: `null`
|
|
|
|
Type: `string`
|
|
|
|
**NOTE:** The config file format has changed somewhat in AIDE version 0.17.
|
|
The role exports a variable `aide_version` which you can use, and see
|
|
`examples/aide-custom.conf.j2` for an example of how to conditionally define
|
|
configuration which will work across multiple versions of AIDE.
|
|
|
|
### aide_db_fetch_dir
|
|
|
|
This variable takes a string to specify the directory on the Ansible Control
|
|
Node (ACN) where the role will store the AIDE database fetched from the remote
|
|
nodes. The default value is `files` which is expected to be a directory in the
|
|
same directory as the playbook.
|
|
|
|
In case you like to store the fetched AIDE database files somewhere else you
|
|
need to specify a different path here.
|
|
|
|
Default: `files`
|
|
|
|
Type: `string
|
|
|
|
### aide_init
|
|
|
|
Initializes the AIDE database.
|
|
|
|
Default: `false`
|
|
|
|
Type: `bool`
|
|
|
|
### aide_fetch_db
|
|
|
|
Fetches database from the remote nodes to store it on the controller node
|
|
|
|
Default: `false`
|
|
|
|
Type: `bool`
|
|
|
|
### aide_check
|
|
|
|
Runs an integrity check on the remote nodes
|
|
|
|
Default: `false`
|
|
|
|
Type: `bool`
|
|
|
|
### aide_update
|
|
|
|
Updates the AIDE database and stores it on the controller node
|
|
|
|
Default: `false`
|
|
|
|
Type: `bool`
|
|
|
|
### aide_cron_check
|
|
|
|
If set to `true`, configures periodic cron check for aide
|
|
If set to `false`, removes the periodic cron check
|
|
|
|
Default: `null`
|
|
|
|
Type: `bool`
|
|
|
|
### aide_cron_interval
|
|
|
|
Set check interval for cron
|
|
|
|
``` yaml
|
|
# Example of job definition:
|
|
# .---------------- minute (0 - 59)
|
|
# | .------------- hour (0 - 23)
|
|
# | | .---------- day of month (1 - 31)
|
|
# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...
|
|
# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
|
|
# | | | | |
|
|
# * * * * *
|
|
```
|
|
|
|
Default: `0 12 * * *`
|
|
|
|
Type: `string`
|
|
|
|
### Variables Exported by the Role
|
|
|
|
The role will export the following variables:
|
|
|
|
`aide_version` - string - this is the AIDE version you can use if you need to do
|
|
something which depends on the version e.g. in your custom template you can do:
|
|
|
|
```jinja2
|
|
{% if aide_version is version("0.17.0", ">=") %}
|
|
# The location of the database to be read.
|
|
database_in=file:@@{DBDIR}/aide.db.gz
|
|
... other new style parameters ...
|
|
{% else %}
|
|
database=file:@@{DBDIR}/aide.db.gz
|
|
... other old style parameters ...
|
|
{% endif %}
|
|
```
|
|
|
|
## Example Playbook
|
|
|
|
Including an example of how to use your role (for instance, with variables
|
|
passed in as parameters) is always nice for users too:
|
|
|
|
```yaml
|
|
# SPDX-License-Identifier: MIT
|
|
---
|
|
- name: Example aide role invocation
|
|
hosts: targets
|
|
tasks:
|
|
- name: Include role aide
|
|
vars:
|
|
aide_db_fetch_dir: files
|
|
aide_install: true
|
|
aide_generate_config: true
|
|
aide_init: true
|
|
aide_check: false
|
|
aide_update: false
|
|
ansible.builtin.include_role:
|
|
name: linux-system-roles.aide
|
|
```
|
|
|
|
More examples can be found in the [`examples/`](examples) directory.
|
|
|
|
## License
|
|
|
|
MIT.
|
|
|
|
## Author Information
|
|
|
|
* Radovan Sroka
|
|
* Joerg Kastning
|
|
* Based on [Tronde/aide](https://github.com/Tronde/aide) ansible role
|