Ansible role to setup and configure linux auditd Possible visualization with R.
It was tested on the following versions:
- 2.2
- 2.5
- Ubuntu 14.04, 16.04, 18.04
- Centos7
- Suse 12.x, 15.x
Just include this role in your list. For example
- hosts: all
roles:
- juju4.auditd
Nothing specific for now.
This role has a travis basic test (for github), more advanced with kitchen and also a Vagrantfile (test/vagrant). Default kitchen config (.kitchen.yml) is lxd-based, while (.kitchen.vagrant.yml) is vagrant/virtualbox based.
Once you ensured all necessary roles are present, You can test with:
$ gem install kitchen-ansible kitchen-lxd_cli kitchen-sync kitchen-vagrant
$ cd /path/to/roles/juju4.auditd
$ kitchen verify
$ kitchen login
$ KITCHEN_YAML=".kitchen.vagrant.yml" kitchen verify
or
$ cd /path/to/roles/juju4.auditd/test/vagrant
$ vagrant up
$ vagrant ssh
- As auditd is linked to the kernel, role will not do any change when executed inside containers.
- https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/chap-system_auditing.html
- https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-starting_the_audit_service.html
- https://github.com/bfuzzy/auditd-attack
BSD 2-clause