74 lines
3.2 KiB
YAML
74 lines
3.2 KiB
YAML
---
|
|
# Regles d'audit detaillees restantes (CIS 6.2.3.4-6.2.3.19) — appliquees a chaud, pas de reboot
|
|
#
|
|
# PREREQUIS : hardening/playbook-coredump-auditd-hardening.yml (auditd) et
|
|
# hardening/playbook-audit-rules-sudo-omnex.yml deja appliques.
|
|
#
|
|
# Couvre : date/heure, environnement reseau, acces fichier echoues, user/group (identity),
|
|
# permissions DAC (chmod/chown/xattr), montages, sessions, login/logout, suppressions fichiers,
|
|
# politique MAC (AppArmor), commandes chcon/setfacl/chacl/usermod, modules noyau.
|
|
#
|
|
# UID_MIN lu dynamiquement depuis /etc/login.defs de chaque host (1000 sur cette infra, mais
|
|
# pas suppose en dur pour rester correct si un host differe).
|
|
#
|
|
# `augenrules --load` recharge a chaud : PAS de redemarrage necessaire tant que le mode
|
|
# immutable (-e 2, check 35749) n'est pas active — volontairement PAS fait par ce playbook.
|
|
#
|
|
# `serial: 1` + `any_errors_fatal` : un host a la fois, arret immediat si un host casse.
|
|
#
|
|
# Usage recommande : tester sur un host avant le rollout complet :
|
|
# ansible-playbook hardening/playbook-audit-rules-cis-rest.yml --limit pre-prod-uber
|
|
|
|
- name: Regles d'audit detaillees restantes CIS 6.2.3.x (Ubuntu 24.04)
|
|
hosts: prod,pre-prod,bdd-redis-prod,replica-prod,infra,infra-runner,infra-utils,load-balancer
|
|
become: true
|
|
serial: 1
|
|
any_errors_fatal: true
|
|
|
|
tasks:
|
|
- name: Lire UID_MIN depuis /etc/login.defs
|
|
ansible.builtin.command:
|
|
cmd: awk '/^\s*UID_MIN/{print $2}' /etc/login.defs
|
|
register: uid_min_result
|
|
changed_when: false
|
|
|
|
- name: Deployer les regles d'audit CIS restantes
|
|
ansible.builtin.template:
|
|
src: ../templates/audit-52-cis-rest.rules.j2
|
|
dest: /etc/audit/rules.d/52-cis-rest.rules
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
vars:
|
|
uid_min: "{{ uid_min_result.stdout }}"
|
|
register: cis_rest_rules
|
|
|
|
- name: Charger les nouvelles regles d'audit (augenrules --load)
|
|
ansible.builtin.command:
|
|
cmd: augenrules --load
|
|
when: cis_rest_rules.changed
|
|
changed_when: true
|
|
|
|
- name: Verifier que les cles principales sont actives (auditctl -l)
|
|
ansible.builtin.command:
|
|
cmd: auditctl -l
|
|
register: auditctl_check
|
|
changed_when: false
|
|
failed_when: >
|
|
'time-change' not in auditctl_check.stdout or
|
|
'system-locale' not in auditctl_check.stdout or
|
|
'identity' not in auditctl_check.stdout or
|
|
'perm_mod' not in auditctl_check.stdout or
|
|
'mounts' not in auditctl_check.stdout or
|
|
'session' not in auditctl_check.stdout or
|
|
'logins' not in auditctl_check.stdout or
|
|
'delete' not in auditctl_check.stdout or
|
|
'MAC-policy' not in auditctl_check.stdout or
|
|
'perm_chng' not in auditctl_check.stdout or
|
|
'usermod' not in auditctl_check.stdout or
|
|
'kernel_modules' not in auditctl_check.stdout
|
|
|
|
- name: Confirmer le succes pour cet host
|
|
ansible.builtin.debug:
|
|
msg: "✅ Règles d'audit CIS 6.2.3.x restantes actives sur {{ inventory_hostname }} (UID_MIN={{ uid_min_result.stdout }}, pas de reboot requis)."
|