Mirrors/ansible-collection-hardening
2
0
Fork 0
mirror of https://github.com/dev-sec/ansible-collection-hardening synced 2024-11-10 09:14:18 +00:00
Code Issues Projects Releases Packages Wiki Activity

Make max_log_file_action for auditd configurable (#246)

Browse source 
* Make max_log_file_action for auditd configurable

This commit allows to configure the max_log_file_action auf auditd to
avoid filling small /var/log partitions for systems that create many
audit log entries. Or run for a long period of time.

Signed-off-by: Jan Dittberner <jan.dittberner@t-systems.com>

* Add os_auditd_max_log_file_action to README

Signed-off-by: Jan Dittberner <jan.dittberner@t-systems.com>
This commit is contained in:
Jan Dittberner 2019-11-07 16:19:42 +01:00 committed by Sebastian Gumprich
parent 9f11c47730
commit ce6af914c8
3 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
README.md
View file

@ -78,6 +78,7 @@ If you're using Docker / Kubernetes+Docker you'll need to override the ipv4 ip f
| `ufw_default_output_policy` | ACCEPT | set default output policy of ufw to `ACCEPT` |
| `ufw_default_forward_policy` | DROP | set default forward policy of ufw to `DROP` |
| `os_auditd_enabled` | true | Set to false to disable installing and configuring auditd. |
| `os_auditd_max_log_file_action` | `keep_logs` | Defines the behaviour of auditd when its log file is filled up. Possible other values are described in the auditd.conf man page. The most common alternative to the default may be `rotate`. |
## Packages

1
defaults/main.yml
View file

@ -250,6 +250,7 @@ os_hardening_enabled: true
# Set to false to disable installing and configuring auditd.
os_auditd_enabled: true
os_auditd_max_log_file_action: keep_logs
# Set the SELinux state, can be either disabled, permissive, or enforcing.
os_selinux_state: enforcing

2
templates/etc/audit/auditd.conf.j2
View file

@ -10,7 +10,7 @@ dispatcher = /sbin/audispd
name_format = NONE
##name = mydomain
max_log_file = 6
max_log_file_action = keep_logs
max_log_file_action = {{ os_auditd_max_log_file_action }}
space_left = 75
space_left_action = SYSLOG
action_mail_acct = root