initial commit

roles/logging_rsyslog/files/README.md

@@ -0,0 +1,6 @@
+Place the customer's internal CA root/intermediate certificate here
+(filename set via syslog_ca_cert_src in group_vars, default: siem-ca.crt),
+unless the SIEM/syslog-collector certificate is already signed by a
+publicly trusted CA already present in the system trust store.
+
+Only relevant when syslog_ca_cert_enabled: true.

roles/logging_rsyslog/handlers/main.yml

@@ -0,0 +1,9 @@
+---
+- name: restart rsyslog
+  ansible.builtin.systemd:
+    name: rsyslog
+    state: restarted
+
+- name: update CA trust
+  ansible.builtin.command: "{{ logging_rsyslog_ca_trust_update_cmd }}"
+  changed_when: true

roles/logging_rsyslog/tasks/main.yml

@@ -0,0 +1,60 @@
+---
+- name: Include OS-family-specific variables
+  ansible.builtin.include_vars: "{{ item }}"
+  with_first_found:
+    - "{{ ansible_facts['os_family'] }}.yml"
+    - "default.yml"
+  tags: [logging_rsyslog, always]
+
+- name: Install rsyslog with TLS support
+  ansible.builtin.package:
+    name:
+      - rsyslog
+      - rsyslog-gnutls
+    state: present
+  when: syslog_use_tls | bool
+  tags: [logging_rsyslog]
+
+- name: Install rsyslog without TLS support
+  ansible.builtin.package:
+    name: rsyslog
+    state: present
+  when: not syslog_use_tls | bool
+  tags: [logging_rsyslog]
+
+- name: Distribute internal CA certificate for SIEM TLS connection
+  ansible.builtin.copy:
+    src: "{{ syslog_ca_cert_src }}"
+    dest: "{{ logging_rsyslog_ca_cert_dest }}"
+    owner: root
+    group: root
+    mode: "0644"
+  when: syslog_ca_cert_enabled | bool
+  notify: update CA trust
+  tags: [logging_rsyslog]
+
+- name: Deploy forwarding configuration
+  ansible.builtin.template:
+    src: 60-forward-siem.conf.j2
+    dest: /etc/rsyslog.d/60-forward-siem.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart rsyslog
+  tags: [logging_rsyslog]
+
+- name: Deploy logrotate configuration
+  ansible.builtin.template:
+    src: logrotate-cis.j2
+    dest: /etc/logrotate.d/rsyslog-cis
+    owner: root
+    group: root
+    mode: "0644"
+  tags: [logging_rsyslog]
+
+- name: Enable and start rsyslog
+  ansible.builtin.systemd:
+    name: rsyslog
+    enabled: true
+    state: started
+  tags: [logging_rsyslog]

roles/logging_rsyslog/templates/60-forward-siem.conf.j2

@@ -0,0 +1,24 @@
+# {{ ansible_managed }}
+{% if syslog_use_tls %}
+$DefaultNetstreamDriver gtls
+$DefaultNetstreamDriverCAFile /etc/pki/tls/certs/ca-bundle.crt
+$ActionSendStreamDriverMode 1
+$ActionSendStreamDriverAuthMode x509/name
+$ActionSendStreamDriverPermittedPeer {{ syslog_collector_host }}
+
+$ActionQueueType LinkedList
+$ActionQueueFileName siem_fwd_queue
+$ActionQueueMaxDiskSpace 1g
+$ActionQueueSaveOnShutdown on
+$ActionResumeRetryCount -1
+
+auth,authpriv.*;kern.*;cron.*  @@(o){{ syslog_collector_host }}:{{ syslog_collector_port }}
+{% else %}
+$ActionQueueType LinkedList
+$ActionQueueFileName siem_fwd_queue
+$ActionQueueMaxDiskSpace 1g
+$ActionQueueSaveOnShutdown on
+$ActionResumeRetryCount -1
+
+auth,authpriv.*;kern.*;cron.*  @{{ syslog_collector_host }}:{{ syslog_collector_port }}
+{% endif %}

roles/logging_rsyslog/templates/logrotate-cis.j2

@@ -0,0 +1,14 @@
+# {{ ansible_managed }}
+/var/log/messages /var/log/secure /var/log/maillog /var/log/cron /var/log/spooler {
+    weekly
+    rotate 12
+    compress
+    delaycompress
+    missingok
+    notifempty
+    create 0640 root root
+    sharedscripts
+    postrotate
+        /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
+    endscript
+}

roles/logging_rsyslog/vars/Debian.yml

@@ -0,0 +1,3 @@
+---
+logging_rsyslog_ca_cert_dest: /usr/local/share/ca-certificates/siem-ca.crt
+logging_rsyslog_ca_trust_update_cmd: update-ca-certificates

roles/logging_rsyslog/vars/RedHat.yml

@@ -0,0 +1,3 @@
+---
+logging_rsyslog_ca_cert_dest: /etc/pki/ca-trust/source/anchors/siem-ca.crt
+logging_rsyslog_ca_trust_update_cmd: update-ca-trust extract