40 lines
1.3 KiB
YAML
40 lines
1.3 KiB
YAML
---
|
|
- name: "Ensure /etc/systemd/journald.conf.d directory exists (CIS 4.2.1.x)"
|
|
ansible.builtin.file:
|
|
path: "/etc/systemd/journald.conf.d"
|
|
state: directory
|
|
owner: "root"
|
|
group: "root"
|
|
mode: "0755"
|
|
|
|
- name: "Deploy journald hardening configuration (CIS 4.2.1.x)"
|
|
ansible.builtin.template:
|
|
src: "99-cis-journald.conf.j2"
|
|
dest: "/etc/systemd/journald.conf.d/99-cis-journald.conf"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: "0644"
|
|
notify: "Restart journald"
|
|
register: "journald_config_result"
|
|
|
|
- name: "Ensure /var/log/journal directory exists for persistent storage (CIS 4.2.1.1.1)"
|
|
when: "linux_journald_storage == 'persistent'"
|
|
ansible.builtin.file:
|
|
path: "/var/log/journal"
|
|
state: directory
|
|
owner: "root"
|
|
group: "systemd-journal"
|
|
mode: "2755"
|
|
register: "journal_dir_result"
|
|
|
|
- name: "Debug journald configuration status (verbosity >= 1)"
|
|
when: "ansible_verbosity >= 1"
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "Storage: {{ linux_journald_storage }}"
|
|
- "Compress: {{ linux_journald_compress }}"
|
|
- "ForwardToSyslog: {{ linux_journald_forward_to_syslog }}"
|
|
- "RateLimitBurst: {{ linux_journald_rate_limit_burst }}"
|
|
- "SystemMaxUse: {{ linux_journald_system_max_use }}"
|
|
- "Config changed: {{ journald_config_result.changed | default(false) }}"
|