initial commit

roles/aide_integrity/tasks/main.yml

@@ -0,0 +1,59 @@
+---
+- name: Include OS-family-specific variables
+  ansible.builtin.include_vars: "{{ item }}"
+  with_first_found:
+    - "{{ ansible_facts['os_family'] }}.yml"
+    - "default.yml"
+  tags: [aide_integrity, always]
+
+- name: Install AIDE
+  ansible.builtin.package:
+    name: aide
+    state: present
+  tags: [aide_integrity]
+
+- name: Deploy custom AIDE configuration (additional watched paths)
+  ansible.builtin.template:
+    src: aide-custom.conf.j2
+    dest: "{{ aide_integrity_config_dest }}"
+    owner: root
+    group: root
+    mode: "0640"
+  tags: [aide_integrity]
+
+- name: Check whether an AIDE database already exists
+  ansible.builtin.stat:
+    path: "{{ aide_integrity_db_path }}"
+  register: aide_integrity_db_stat
+  tags: [aide_integrity]
+
+- name: Initialize AIDE database (first run only)
+  ansible.builtin.command: aide --init
+  when: not aide_integrity_db_stat.stat.exists
+  changed_when: true
+  tags: [aide_integrity]
+
+- name: Activate the initial AIDE database
+  ansible.builtin.command: "mv {{ aide_integrity_db_new_path }} {{ aide_integrity_db_path }}"
+  when: not aide_integrity_db_stat.stat.exists
+  changed_when: true
+  tags: [aide_integrity]
+
+- name: Schedule regular AIDE check via cron
+  ansible.builtin.cron:
+    name: "Daily AIDE integrity check"
+    hour: "{{ aide_check_cron_hour }}"
+    minute: "{{ aide_check_cron_minute }}"
+    job: >-
+      {{ aide_integrity_check_cmd }} | /usr/bin/mail -s
+      "AIDE integrity report {{ inventory_hostname }}" {{ aide_notify_email }}
+    user: root
+  tags: [aide_integrity]
+
+- name: Note on updating the database after legitimate changes
+  ansible.builtin.debug:
+    msg: >-
+      After intended system changes (patches, config changes made outside
+      Ansible), update the AIDE database manually:
+      aide --update && mv {{ aide_integrity_db_new_path }} {{ aide_integrity_db_path }}
+  tags: [aide_integrity]

roles/aide_integrity/templates/aide-custom.conf.j2

@@ -0,0 +1,12 @@
+# {{ ansible_managed }}
+/etc/ssh/sshd_config FIPSR
+/etc/sudoers.d FIPSR
+/etc/security/pwquality.conf FIPSR
+/etc/security/faillock.conf FIPSR
+/etc/audit/rules.d FIPSR
+/etc/firewalld FIPSR
+
+!/var/log
+!/var/cache
+!/tmp
+!/var/tmp

roles/aide_integrity/vars/Debian.yml

@@ -0,0 +1,5 @@
+---
+aide_integrity_config_dest: /etc/aide/aide.conf.d/99-custom.conf
+aide_integrity_db_path: /var/lib/aide/aide.db
+aide_integrity_db_new_path: /var/lib/aide/aide.db.new
+aide_integrity_check_cmd: /usr/bin/aide.wrapper --check

roles/aide_integrity/vars/RedHat.yml

@@ -0,0 +1,5 @@
+---
+aide_integrity_config_dest: /etc/aide.conf.d/99-custom.conf
+aide_integrity_db_path: /var/lib/aide/aide.db.gz
+aide_integrity_db_new_path: /var/lib/aide/aide.db.new.gz
+aide_integrity_check_cmd: /usr/sbin/aide --check