chef-cookbooks / auditd Goto Github PK

include_recipe 'auditd::default'

auditd_ruleset 'cis.rules' do
  cookbook 'mitre-ipac-auditd'
end

m26560@ipac-ub18-tplt:~$ sudo auditctl -l
-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=time-change
-a always,exit -F arch=b32 -S stime,settimeofday,adjtimex -F key=time-change
-a always,exit -F arch=b64 -S clock_settime -F key=time-change
-a always,exit -F arch=b32 -S clock_settime -F key=time-change
-w /etc/localtime -p wa -k time-change
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity
-a always,exit -F arch=b64 -S sethostname,setdomainname -F key=system-locale
-a always,exit -F arch=b32 -S sethostname,setdomainname -F key=system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
m26560@ipac-ub18-tplt:~$

Recipe: auditd::default
  * service[auditd] action reload INFO: Processing service[auditd] action reload (auditd::default line 27)

    ================================================================================
    Error executing action `reload` on resource 'service[auditd]'
    ================================================================================
    
    Mixlib::ShellOut::ShellCommandFailed
    ------------------------------------
    Expected process to exit with [0], but received '3'
    ---- Begin output of ["/usr/bin/systemctl", "--system", "reload", "auditd"] ----
    STDOUT: 
    STDERR: Failed to reload auditd.service: Job type reload is not applicable for unit auditd.service.
    ---- End output of ["/usr/bin/systemctl", "--system", "reload", "auditd"] ----
    Ran ["/usr/bin/systemctl", "--system", "reload", "auditd"] returned 3
    
    Resource Declaration:
    ---------------------
    # In /opt/installers/chef/local-mode-cache/cache/cookbooks/auditd/recipes/default.rb
    
     27: service 'auditd' do
     28:   if platform_family?('rhel') && node['init_package'] == 'systemd' && node['platform_version'] < '7.5'
     29:     reload_command '/usr/libexec/initscripts/legacy-actions/auditd/reload'
     30:     restart_command '/usr/libexec/initscripts/legacy-actions/auditd/restart'
     31:   end
     32:   if platform_family?('rhel') && node['init_package'] == 'systemd' && node['platform_version'] >= '7.5'
    
    Compiled Resource:
    ------------------
    # Declared in /opt/installers/chef/local-mode-cache/cache/cookbooks/auditd/recipes/default.rb:27:in `from_file'
    
    service("auditd") do
      action [:enable]
      updated true
      default_guard_interpreter :default
      declared_type :service
      cookbook_name "auditd"
      recipe_name "default"
      supports {:start=>true, :stop=>true, :restart=>true, :reload=>true, :status=>true}
      service_name "auditd"
      running true
      enabled true
      masked false
    end
    
    System Info:
    ------------
    chef_version=16.1.0
    platform=ubuntu
    platform_version=20.04
    ruby=ruby 2.7.1p83 (2020-03-31 revision a0c7c23c9c) [x86_64-linux]
    program_name=/usr/bin/cinc-client
    executable=/opt/cinc/bin/cinc-client

/usr/bin/systemctl reload auditd
Failed to reload auditd.service: Job type reload is not applicable for unit auditd.service.

/usr/sbin/service auditd reload
 * Reloading audit daemon auditd                                                                                           [ OK ]

# CIS 4.1.14
-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete
-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

# grep delete /etc/audit/audit.rules
-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete
-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete

...
Recipe: auditd::default
  * yum_package[audit] action install (up to date)
  * service[auditd] action enable (up to date)
...

[m26560@cnide-db ~]$ pgrep --exact auditd
[m26560@cnide-db ~]$ ps -ef | grep auditd
root        96     2  0 Sep26 ?        00:00:35 [kauditd]
[m26560@cnide-db ~]$ sudo systemctl status auditd
● auditd.service - Security Auditing Service
   Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled)
   Active: inactive (dead) since Wed 2018-12-05 04:45:20 EST; 2 days ago
     Docs: man:auditd(8)
           https://github.com/linux-audit/audit-documentation
 Main PID: 649 (code=exited, status=0/SUCCESS)

Dec 05 04:45:20 cnide-db auditd[649]: The audit daemon is exiting.
Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.
[m26560@cnide-db ~]$

       Recipe: auditd::default                                                                                                                                                                   [33/1477]
         * service[auditd] action reload

           ================================================================================
           Error executing action `reload` on resource 'service[auditd]'
           ================================================================================

           Mixlib::ShellOut::ShellCommandFailed
           ------------------------------------
           Expected process to exit with [0], but received '3'
           ---- Begin output of /bin/systemctl --system reload auditd ----
           STDOUT:
           STDERR: Failed to reload auditd.service: Job type reload is not applicable for unit auditd.service.
           See system logs and 'systemctl status auditd.service' for details.
           ---- End output of /bin/systemctl --system reload auditd ----
           Ran /bin/systemctl --system reload auditd returned 3

           Resource Declaration:                                                                                                                                                                                     ---------------------
           # In /tmp/kitchen/cache/cookbooks/auditd/recipes/default.rb

            24: service 'auditd' do
            25:   restart_command '/usr/libexec/initscripts/legacy-actions/auditd/restart' if platform_family?('rhel') && node['init_package'] == 'systemd'
            26:   supports [:start, :stop, :restart, :reload, :status]
            27:   action :enable
            28: end

           Compiled Resource:
           ------------------
           # Declared in /tmp/kitchen/cache/cookbooks/auditd/recipes/default.rb:24:in `from_file'

           service("auditd") do
             action [:enable]
             default_guard_interpreter :default
             service_name "auditd"
             enabled true
             running true
             masked false
             pattern "auditd"
             restart_command "/usr/libexec/initscripts/legacy-actions/auditd/restart"
             declared_type :service
             cookbook_name "auditd"
             recipe_name "default"
             supports {:start=>true, :stop=>true, :restart=>true, :reload=>true, :status=>true}
           end

           System Info:
           ------------
           chef_version=14.7.17
           platform=centos
           platform_version=7.5.1804
           ruby=ruby 2.5.3p105 (2018-10-18 revision 65156) [x86_64-linux]
           program_name=/opt/chef/bin/chef-client
           executable=/opt/chef/bin/chef-client

# rcf-auditd/recipes/default.rb
#
# The following file exists in rcf-auditd/templates/default/modified-CIS.erb
# Setting this to just 'cis' does in fact put the cis ruleset in place though.
node.set['auditd']['ruleset'] = 'modified-CIS'
#
include_recipe 'auditd'
# EOF

Chef::Mixin::Template::TemplateError
    ------------------------------------
    (erubis):73: syntax error, unexpected '~', expecting keyword_then or ';' or '\n'
    ...; if node['platform_version'] ~= /^6/
    ...                              ^
    (erubis):76: syntax error, unexpected keyword_else, expecting '}'
    '; else
       ^~~~
    (erubis):79: syntax error, unexpected keyword_end, expecting end-of-input
    '; end
       ^~~

       Recipe: auditd::conf
         * auditd_conf_file[cis.auditd] action create
           * template[/etc/audit/cis.auditd] action create
             - create new file /etc/audit/cis.auditd
             - update content in file /etc/audit/cis.auditd from none to 64477b
             --- /etc/audit/cis.auditd	2019-02-06 20:40:55.410125292 +0000

[[email protected]]$ cat ~/.berkshelf/cookbooks/auditd-2.3.4/resources/conf_file.rb 
#
# Cookbook:: auditd
# Resource:: auditd_conf_file
#
# Copyright:: 2018, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

property :cookbook, String

action :create do
  extend AuditD::Helper

  template auditd_conffile(new_resource.name) do
    source "#{new_resource.name}.conf.erb"
    cookbook new_resource.cookbook if new_resource.cookbook
    notifies :reload, 'service[auditd]'
  end
end

       ================================================================================
       Error executing action `restart` on resource 'service[auditd]'
       ================================================================================

       Mixlib::ShellOut::ShellCommandFailed
       ------------------------------------
       Expected process to exit with [0], but received '4'
       ---- Begin output of /bin/systemctl restart auditd ----
       STDOUT:
       STDERR: Failed to restart auditd.service: Operation refused, unit auditd.service may be requested by dependency only.
       ---- End output of /bin/systemctl restart auditd ----
       Ran /bin/systemctl restart auditd returned 4

       Resource Declaration:
       ---------------------
       # In /tmp/kitchen/cache/cookbooks/auditd/recipes/default.rb

        27: service "auditd" do
        28:   supports [ :restart, :reload, :status ]
        29:   action :enable
        30: end

       Compiled Resource:
       ------------------
       # Declared in /tmp/kitchen/cache/cookbooks/auditd/recipes/default.rb:27:in `from_file'

       service("auditd") do
         action [:enable]
         supports {:restart=>true, :reload=>true, :status=>true}
         retries 0
         retry_delay 2
         default_guard_interpreter :default
         service_name "auditd"
         enabled true
         running true
         pattern "auditd"
         declared_type :service
         cookbook_name "auditd"
         recipe_name "default"
       end