Skip to content

Latest commit

 

History

History
55 lines (38 loc) · 2.48 KB

README.md

File metadata and controls

55 lines (38 loc) · 2.48 KB
Raw

Ansible-Linux-Audit-Grab

Move-Audits

Mounts the shared drive and then goes to targets and fetches their audits, erasing or deleting the audits afterwards (depending on if rotated log or not). My configs are for a windows shared drive on the domain, edit as needed to fit your enviornment (i.e. removing the share_domain variable and entry in tasks)

Logs are saved to the mounted share in the following format: //share_name/YYYY-MM-DD/inventory_hostname/var/log/

This includes exemptions for fail2ban, to prevent the accidental deletion of its main log.

Requirements

cifs-utils is required on the server mounting the share

  1. ./roles/auditing/handlers/main.yml, under the "unmount share module" enter your share path.
  2. ./roles/auditing/vars/secrets.yml, enter your password to mount the share with. Encrypt the file with ansible-vault encrypt path_to_file.
  3. ./roles/auditing/vars/main.yml, enter your enviornment information for share_drive, share_domain, and share_username
  4. ./hosts, add the targets and list the host you are running from under the local group.
  5. ./playbooks/Move_Audit.yml, enter your ansible user you SSH/sudo with.

I typically run this play with ansible-playbooks -kK --ask-vault-pass path_to_playbook.yml

Role Variables

Variable Location Required Default Description
user_password ./roles/auditing/vars/secrets.yml Yes N/A password for user that can mount the share
delete_me ./roles/auditing/defaults/main.yml No [ ] empty array later used to hold files to be deleted
erase_me ./roles/auditing/defaults/main.yml No [ ] empty array later used to hold files to be erased
audits_list ./roles/auditing/defaults/main.yml No [ ] empty array later used to hold audits that will be copied
share_drive ./roles/auditing/vars/main.yml Yes N/A contains the path to the shared drive
share_domain ./roles/auditing/vars/main.yml Yes N/A the domain name of where the share resides
share_username ./roles/auditing/vars/main.yml Yes N/A username of the user capable of mounting the share

various self contained variables inside the play through register command

Example Playbook

- hosts: all
  become: true
  roles:
     - auditing

I run with ansible-playbook -kK --ask-vault-pass path_to_playbook

Author Information

Steven Craig, 27Jan19