initial commit

playbooks/verify.yml

@@ -0,0 +1,78 @@
+---
+# Post-deployment sanity checks. Read-only, makes no changes.
+# Run: ansible-playbook playbooks/verify.yml
+
+- name: Verify baseline hardening status
+  hosts: linux_all
+  become: true
+  gather_facts: true
+  tasks:
+    - name: Collect service facts
+      ansible.builtin.service_facts:
+
+    - name: Check expected services are running
+      ansible.builtin.assert:
+        that:
+          - "'sshd.service' in ansible_facts.services"
+          - "ansible_facts.services['sshd.service'].state == 'running'"
+          - "'firewalld.service' in ansible_facts.services"
+          - "ansible_facts.services['firewalld.service'].state == 'running'"
+          - "'auditd.service' in ansible_facts.services"
+          - "ansible_facts.services['auditd.service'].state == 'running'"
+        fail_msg: "One or more expected core services are not running."
+        success_msg: "Core services (sshd, firewalld, auditd) are running."
+
+    - name: Check SELinux is enforcing (RedHat family)
+      ansible.builtin.command: getenforce
+      register: verify_selinux_status
+      changed_when: false
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Assert SELinux enforcing (RedHat family)
+      ansible.builtin.assert:
+        that:
+          - "verify_selinux_status.stdout == 'Enforcing'"
+        fail_msg: "SELinux is not in enforcing mode."
+        success_msg: "SELinux is enforcing."
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Check AppArmor status (Debian family)
+      ansible.builtin.command: aa-status --enforced
+      register: verify_apparmor_status
+      changed_when: false
+      failed_when: false
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Report AppArmor enforced profile count (Debian family)
+      ansible.builtin.debug:
+        msg: "AppArmor enforced profiles on {{ inventory_hostname }}: {{ verify_apparmor_status.stdout | default('unavailable') }}"
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Check CrowdStrike Falcon sensor health
+      ansible.builtin.command: /opt/CrowdStrike/falconctl -g --rfm-state
+      register: verify_falcon_rfm
+      changed_when: false
+      failed_when: false
+
+    - name: Report Falcon sensor status
+      ansible.builtin.debug:
+        msg: "Falcon sensor RFM state on {{ inventory_hostname }}: {{ verify_falcon_rfm.stdout | default('not installed / not reachable') }}"
+
+    - name: Check AIDE database exists (RedHat family)
+      ansible.builtin.stat:
+        path: /var/lib/aide/aide.db.gz
+      register: verify_aide_db_redhat
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Check AIDE database exists (Debian family)
+      ansible.builtin.stat:
+        path: /var/lib/aide/aide.db
+      register: verify_aide_db_debian
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Assert AIDE database is present
+      ansible.builtin.assert:
+        that:
+          - (verify_aide_db_redhat.stat.exists | default(false)) or (verify_aide_db_debian.stat.exists | default(false))
+        fail_msg: "AIDE database has not been initialized."
+        success_msg: "AIDE database is present."