mrcharles
edb9e4c5e3
Port Modules/Security/secharden-audit-agents.sh. Deploys hardened configurations for: - auditd (log rotation, disk space actions, email alerts) - systemd-journald (persistent storage) - logrotate (weekly rotation, 4 weeks retention) This role is disabled by default (run_security_audit: false) matching the legacy script which was commented out of the run order. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>
32 lines
700 B
YAML
32 lines
700 B
YAML
---
|
|
# Auditd / journald / logrotate — port of Modules/Security/secharden-audit-agents.sh.
|
|
|
|
- name: Deploy /etc/audit/auditd.conf
|
|
ansible.builtin.copy:
|
|
src: auditd.conf
|
|
dest: /etc/audit/auditd.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
backup: true
|
|
notify: Restart auditd
|
|
|
|
- name: Deploy /etc/systemd/journald.conf
|
|
ansible.builtin.copy:
|
|
src: journald.conf
|
|
dest: /etc/systemd/journald.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
backup: true
|
|
notify: Restart journald
|
|
|
|
- name: Deploy /etc/logrotate.conf
|
|
ansible.builtin.copy:
|
|
src: logrotate.conf
|
|
dest: /etc/logrotate.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
backup: true
|