You've already forked ansible-linux-infra
60 lines
1.8 KiB
YAML
60 lines
1.8 KiB
YAML
---
|
|
- name: Include OS-family-specific variables
|
|
ansible.builtin.include_vars: "{{ item }}"
|
|
with_first_found:
|
|
- "{{ ansible_facts['os_family'] }}.yml"
|
|
- "default.yml"
|
|
tags: [aide_integrity, always]
|
|
|
|
- name: Install AIDE
|
|
ansible.builtin.package:
|
|
name: aide
|
|
state: present
|
|
tags: [aide_integrity]
|
|
|
|
- name: Deploy custom AIDE configuration (additional watched paths)
|
|
ansible.builtin.template:
|
|
src: aide-custom.conf.j2
|
|
dest: "{{ aide_integrity_config_dest }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
tags: [aide_integrity]
|
|
|
|
- name: Check whether an AIDE database already exists
|
|
ansible.builtin.stat:
|
|
path: "{{ aide_integrity_db_path }}"
|
|
register: aide_integrity_db_stat
|
|
tags: [aide_integrity]
|
|
|
|
- name: Initialize AIDE database (first run only)
|
|
ansible.builtin.command: aide --init
|
|
when: not aide_integrity_db_stat.stat.exists
|
|
changed_when: true
|
|
tags: [aide_integrity]
|
|
|
|
- name: Activate the initial AIDE database
|
|
ansible.builtin.command: "mv {{ aide_integrity_db_new_path }} {{ aide_integrity_db_path }}"
|
|
when: not aide_integrity_db_stat.stat.exists
|
|
changed_when: true
|
|
tags: [aide_integrity]
|
|
|
|
- name: Schedule regular AIDE check via cron
|
|
ansible.builtin.cron:
|
|
name: "Daily AIDE integrity check"
|
|
hour: "{{ aide_check_cron_hour }}"
|
|
minute: "{{ aide_check_cron_minute }}"
|
|
job: >-
|
|
{{ aide_integrity_check_cmd }} | /usr/bin/mail -s
|
|
"AIDE integrity report {{ inventory_hostname }}" {{ aide_notify_email }}
|
|
user: root
|
|
tags: [aide_integrity]
|
|
|
|
- name: Note on updating the database after legitimate changes
|
|
ansible.builtin.debug:
|
|
msg: >-
|
|
After intended system changes (patches, config changes made outside
|
|
Ansible), update the AIDE database manually:
|
|
aide --update && mv {{ aide_integrity_db_new_path }} {{ aide_integrity_db_path }}
|
|
tags: [aide_integrity]
|