bf195e2ec7
The augenrules command joins together all of the audit rules from
rules.d and it is run any time the audit rules template changes. However,
the augenrules handler didn't actually restart auditd to apply the
changes to the system.
This patch fires off the auditd restart handler anytime the augenrules
handler is notified.
Closes-bug: 1590916
Change-Id: Ice83fe17ebb0e9edff9da897e435ae96c1778580
(cherry picked from commit 809b6cb52d)
70 lines
1.6 KiB
YAML
70 lines
1.6 KiB
YAML
---
|
|
# Copyright 2015, Rackspace US, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
# Restarting services ########################################################
|
|
- name: restart auditd
|
|
service:
|
|
name: auditd
|
|
state: restarted
|
|
|
|
- name: restart chrony
|
|
service:
|
|
name: chrony
|
|
state: restarted
|
|
|
|
- name: restart fail2ban
|
|
service:
|
|
name: fail2ban
|
|
state: restarted
|
|
|
|
- name: restart postfix
|
|
service:
|
|
name: postfix
|
|
state: restarted
|
|
|
|
- name: restart rsyslog
|
|
service:
|
|
name: rsyslog
|
|
state: restarted
|
|
|
|
- name: restart samba
|
|
service:
|
|
name: smbd
|
|
state: restarted
|
|
|
|
- name: restart ssh
|
|
service:
|
|
name: ssh
|
|
state: restarted
|
|
|
|
- name: restart vsftpd
|
|
service:
|
|
name: vsftpd
|
|
state: restarted
|
|
|
|
# Miscellaneous ##############################################################
|
|
- name: generate auditd rules
|
|
command: augenrules --load
|
|
notify: restart auditd
|
|
|
|
# This will take a while to complete the first run, so we will fork it into
|
|
# the background so it doesn't hold up the whole playbook.
|
|
- name: initialize AIDE
|
|
shell: "aideinit -b"
|
|
when: initialize_aide | bool
|
|
|
|
- name: rehash aliases
|
|
command: newaliases
|