Ensure AIDE initializes on subsequent runs

If a deployer installs AIDE the first time they apply the role
without initializing AIDE and they want to initialize it later,
the handler that does the initialization never fires.

This patch does a few things:

  - Ensures AIDE initialization if the initialize_aide bool is True
  - Doesn't intialize the AIDE db if it already exists
  - Moves the new db into place on Red Hat systems
  - Moves the AIDE tasks into its own file with tags
  - Prevents AIDE from trawling through /var

Manual backport of two reviews:
  * https://review.openstack.org/#/c/359554/
  * https://review.openstack.org/#/c/361460/

Closes-bug: 1616281
Depends-on: I60aa62ff688d32c14031773d35af29b3cf6b6fd6
Change-Id: I170eb3898b4336333b1fbe663ec4f069823898e0
This commit is contained in:
Major Hayden 2016-08-29 11:11:09 -05:00
parent 373a03ebf8
commit c16d11786a
6 changed files with 105 additions and 56 deletions

View File

@ -31,9 +31,9 @@ cache_timeout: 600
# The following three default exclusions are highly recommended for AIDE to
# work properly, but additional exclusions can be added to this list if needed.
aide_exclude_dirs:
- /var/lib/lxc
- /openstack
- /opt
- /var
#
# By default, the AIDE database won't be initialized immediately since it can
# consume plenty of CPU and I/O resources while it runs. To initialize the

View File

@ -59,11 +59,5 @@
command: augenrules --load
notify: restart auditd
# This will take a while to complete the first run, so we will fork it into
# the background so it doesn't hold up the whole playbook.
- name: initialize AIDE
shell: "aideinit -b"
when: initialize_aide | bool
- name: rehash aliases
command: newaliases

View File

@ -0,0 +1,17 @@
---
features:
- |
AIDE is configured to skip the entire ``/var`` directory when it does the
database initialization and when it performs checks. This reduces disk
I/O and allows these jobs to complete faster.
This also allows the initialization to become a blocking process and
Ansible will wait for the initialization to complete prior to running the
next task.
fixes:
- |
AIDE initialization is now always run on subsequent playbook runs when
``initialize_aide`` is set to ``yes``. The initialization will
be skipped if AIDE isn't installed or if the AIDE database already exists.
See `bug 1616281 <https://launchpad.net/bugs/1616281>`_ for more details.

86
tasks/aide.yml Normal file
View File

@ -0,0 +1,86 @@
---
# Copyright 2016, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
- name: V-38489 - Install AIDE (with apt)
apt:
name: "{{ item }}"
state: present
with_items:
- aide
- aide-common
when: ansible_pkg_mgr == 'apt'
tags:
- aide
- cat2
- V-38489
- name: Verify that AIDE configuration directory exists
stat:
path: /etc/aide/aide.conf.d
register: aide_conf
always_run: true
tags:
- always
- name: V-38489 - Exclude certain directories from AIDE
template:
src: ZZ_aide_exclusions.j2
dest: /etc/aide/aide.conf.d/ZZ_aide_exclusions
when: aide_conf.stat.exists | bool
tags:
- aide
- cat2
- V-38489
- name: Check to see if AIDE database is already in place
stat:
path: /var/lib/aide/aide.db
register: aide_database
always_run: True
tags:
- always
- name: V-38489 - Initialize AIDE (this will take a few minutes)
shell: "aideinit"
register: aide_init
when:
- aide_conf.stat.exists | bool
- not aide_database.stat.exists | bool
- initialize_aide | bool
tags:
- aide
- cat2
- V-38489
- name: Check for AIDE cron job (for V-38670)
stat:
path: "/etc/cron.daily/aide"
register: v38670_result
changed_when: False
tags:
- aide
- cat2
- V-38670
- name: V-38670 - System must detect unauthorized changes to software and information
fail:
msg: "FAILED: AIDE cron job is missing"
when:
- not check_mode
- v38670_result.stat.exists == False
tags:
- aide
- cat2
- V-38670

View File

@ -26,6 +26,7 @@
- always
- include: apt.yml
- include: aide.yml
- include: auditd.yml
- include: auth.yml
- include: boot.yml

View File

@ -13,55 +13,6 @@
# See the License for the specific language governing permissions and
# limitations under the License.
- name: V-38489 - Install AIDE
apt:
name: "{{ item }}"
state: present
with_items:
- aide
- aide-common
tags:
- cat2
- V-38489
- name: Verify that AIDE configuration directory exists
stat:
path: /etc/aide/aide.conf.d
register: aide_conf
always_run: true
tags:
- always
- name: V-38489 - Exclude certain directories from AIDE and initialize DB
template:
src: ZZ_aide_exclusions.j2
dest: /etc/aide/aide.conf.d/ZZ_aide_exclusions
when: aide_conf.stat.exists | bool
notify:
- initialize AIDE
tags:
- cat2
- V-38489
- name: Check for AIDE cron job (for V-38670)
stat:
path: /etc/cron.daily/aide
register: v38670_result
changed_when: False
tags:
- cat2
- V-38670
- name: V-38670 - System must detect unauthorized changes to software and information
fail:
msg: "FAILED: AIDE cron job is missing"
when:
- not check_mode
- v38670_result.stat.exists == False
tags:
- cat2
- V-38670
- name: Search for .netrc files (for V-38619)
shell: find /root /home -xdev -name .netrc | wc -l
register: v38619_result