From edb9e4c5e315e42a965f8e9dace346ba23b69ab9 Mon Sep 17 00:00:00 2001
From: reachableceo <charles@turnsys.com>
Date: Thu, 30 Jul 2026 12:16:38 -0500
Subject: [PATCH] feat(security): add auditd/journald/logrotate role
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Port Modules/Security/secharden-audit-agents.sh.

Deploys hardened configurations for:
- auditd (log rotation, disk space actions, email alerts)
- systemd-journald (persistent storage)
- logrotate (weekly rotation, 4 weeks retention)

This role is disabled by default (run_security_audit: false) matching
the legacy script which was commented out of the run order.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>
---
 roles/security_audit/files/auditd.conf    | 46 +++++++++++++++++++++++
 roles/security_audit/files/journald.conf  | 31 +++++++++++++++
 roles/security_audit/files/logrotate.conf | 23 ++++++++++++
 roles/security_audit/handlers/main.yml    | 10 +++++
 roles/security_audit/tasks/main.yml       | 31 +++++++++++++++
 5 files changed, 141 insertions(+)
 create mode 100644 roles/security_audit/files/auditd.conf
 create mode 100644 roles/security_audit/files/journald.conf
 create mode 100644 roles/security_audit/files/logrotate.conf
 create mode 100644 roles/security_audit/handlers/main.yml
 create mode 100644 roles/security_audit/tasks/main.yml

diff --git a/roles/security_audit/files/auditd.conf b/roles/security_audit/files/auditd.conf
new file mode 100644
index 0000000..e1482e3
--- /dev/null
+++ b/roles/security_audit/files/auditd.conf
@@ -0,0 +1,46 @@
+#
+# Known Element Enterprises Customized Config File
+# auditd
+# Initial version 2025-06-27 
+#
+
+local_events = yes
+write_logs = yes
+log_file = /var/log/audit/audit.log
+log_group = adm
+log_format = ENRICHED
+flush = INCREMENTAL_ASYNC
+freq = 50
+max_log_file = 8
+num_logs = 5
+priority_boost = 4
+name_format = NONE
+max_log_file_action = keep_logs
+space_left = 75
+space_left_action = email
+action_mail_acct = root
+
+admin_space_left_action = halt
+disk_full_action = SUSPEND
+disk_error_action = SUSPEND
+admin_space_left = 50
+
+verify_email = yes
+use_libwrap = yes
+tcp_listen_queue = 5
+tcp_max_per_addr = 1
+tcp_client_max_idle = 0
+transport = TCP
+distribute_network = no
+q_depth = 2000
+overflow_action = SYSLOG
+max_restarts = 10
+plugin_dir = /etc/audit/plugins.d
+end_of_event_timeout = 2
+##tcp_client_ports = 1024-65535
+##tcp_listen_port = 60
+
+##krb5_key_file = /etc/audit/audit.key
+krb5_principal = auditd
+
+##name = mydomain
diff --git a/roles/security_audit/files/journald.conf b/roles/security_audit/files/journald.conf
new file mode 100644
index 0000000..8b30ab3
--- /dev/null
+++ b/roles/security_audit/files/journald.conf
@@ -0,0 +1,31 @@
+[Journal]
+#Compress=yes
+#Seal=yes
+#SplitMode=uid
+#SyncIntervalSec=5m
+#RateLimitIntervalSec=30s
+#RateLimitBurst=10000
+#SystemMaxUse=
+#SystemKeepFree=
+#SystemMaxFileSize=
+#SystemMaxFiles=100
+#RuntimeMaxUse=
+#RuntimeKeepFree=
+#RuntimeMaxFileSize=
+#RuntimeMaxFiles=100
+#MaxRetentionSec=
+#MaxFileSec=1month
+#ForwardToSyslog=yes
+#ForwardToKMsg=no
+#ForwardToConsole=no
+#ForwardToWall=yes
+#TTYPath=/dev/console
+#MaxLevelStore=debug
+#MaxLevelSyslog=debug
+#MaxLevelKMsg=notice
+#MaxLevelConsole=info
+#MaxLevelWall=emerg
+#LineMax=48K
+#ReadKMsg=yes
+#Audit=no
+Storage=persistent
diff --git a/roles/security_audit/files/logrotate.conf b/roles/security_audit/files/logrotate.conf
new file mode 100644
index 0000000..9f2f271
--- /dev/null
+++ b/roles/security_audit/files/logrotate.conf
@@ -0,0 +1,23 @@
+# see "man logrotate" for details
+
+# global options do not affect preceding include directives
+
+# rotate log files weekly
+weekly
+
+# keep 4 weeks worth of backlogs
+rotate 4
+
+# create new (empty) log files after rotating old ones
+create 0640 root utmp
+
+# use date as a suffix of the rotated file
+#dateext
+
+# uncomment this if you want your log files compressed
+#compress
+
+# packages drop log rotation information into this directory
+include /etc/logrotate.d
+
+# system-specific logs may also be configured here.
diff --git a/roles/security_audit/handlers/main.yml b/roles/security_audit/handlers/main.yml
new file mode 100644
index 0000000..5488028
--- /dev/null
+++ b/roles/security_audit/handlers/main.yml
@@ -0,0 +1,10 @@
+---
+- name: Restart auditd
+  ansible.builtin.systemd:
+    name: auditd
+    state: restarted
+
+- name: Restart journald
+  ansible.builtin.systemd:
+    name: systemd-journald
+    state: restarted
diff --git a/roles/security_audit/tasks/main.yml b/roles/security_audit/tasks/main.yml
new file mode 100644
index 0000000..10746c5
--- /dev/null
+++ b/roles/security_audit/tasks/main.yml
@@ -0,0 +1,31 @@
+---
+# Auditd / journald / logrotate — port of Modules/Security/secharden-audit-agents.sh.
+
+- name: Deploy /etc/audit/auditd.conf
+  ansible.builtin.copy:
+    src: auditd.conf
+    dest: /etc/audit/auditd.conf
+    owner: root
+    group: root
+    mode: "0640"
+    backup: true
+  notify: Restart auditd
+
+- name: Deploy /etc/systemd/journald.conf
+  ansible.builtin.copy:
+    src: journald.conf
+    dest: /etc/systemd/journald.conf
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+  notify: Restart journald
+
+- name: Deploy /etc/logrotate.conf
+  ansible.builtin.copy:
+    src: logrotate.conf
+    dest: /etc/logrotate.conf
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true