Skip to content
Open
Show file tree
Hide file tree
Changes from 17 commits
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
223b780
rainer regex new line support
Arden97 Oct 29, 2025
e490b6b
multiline support in rsyslog_cron_logging
Arden97 Oct 31, 2025
e19c94d
fixing rainer_loging_regex
Arden97 Oct 31, 2025
3b935f7
fixing tests for rsyslog_cron_logging
Arden97 Oct 31, 2025
75d7c5c
add newline and fix a commit message
Arden97 Nov 3, 2025
3ade7f7
multiline support for rsyslog_encrypt_offload_actionsendstreamdrivermode
Arden97 Nov 3, 2025
8b8b640
minor regex fix in rsyslog_encrypt_offload_actionsendstreamdrivermode
Arden97 Nov 3, 2025
9e49653
multiline support for rsyslog_encrypt_offload_defaultnetstreamdriver
Arden97 Nov 3, 2025
5e1b2ed
multiline support for rsyslog_encrypt_offload_actionsendstreamdrivera…
Arden97 Nov 4, 2025
517a5c4
updating tests and remediation of rsyslog_cron_logging
Arden97 Nov 4, 2025
393fcd6
updating tests for rsyslog_encrypt_offload_defaultnetstreamdriver
Arden97 Nov 4, 2025
ce972e1
updating tests for rsyslog_encrypt_offload_defaultnetstreamdriver
Arden97 Nov 4, 2025
386aa72
replacing setup.sh with jinja macros
Arden97 Nov 5, 2025
960bce9
adding macro for rsyslog_remote_loghost, regression test
Arden97 Nov 5, 2025
9aa18aa
removing RainerScript entries before rsyslog_remote_tls tests
Arden97 Nov 5, 2025
21f1ae7
fixing typo in default_no_pass.fail.sh tests
Arden97 Nov 5, 2025
a9f56ba
moving macros to test-scenarios
Arden97 Nov 7, 2025
c5ef30b
updating ansible remediations for ensure_rsyslog_log_file_configurati…
Arden97 Nov 7, 2025
d34214c
updating bash macros for ensure_rsyslog_log_file_configuration rules
Arden97 Nov 7, 2025
c16d5b2
fix 'rule_title is undefined' error
Arden97 Nov 7, 2025
cd99c9a
fixing error for ol7 target
Arden97 Nov 10, 2025
97cd619
removing \t separator from rsyslog_cron_logging playbook
Arden97 Nov 11, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,9 @@

- name: "{{{ rule_title }}} - Search if cron configuration exists"
{{% if 'ol' in families %}}
ansible.builtin.command: grep -Pzo '(?m)^\s*(cron|\*)\.\*\s*(/var/log/(cron|messages)|action\(\s*.*(?i:\btype\b)="omfile"\s*.*(?i:\bfile\b)="/var/log/(cron|messages)"\s*\))\s*$' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
ansible.builtin.command: grep -Pzo '(?ms)^\s*(cron|\*)\.\*\s*(/var/log/(cron|messages)|action\(\s*.*(?i:\btype\b)="omfile"\s*.*(?i:\bfile\b)="/var/log/(cron|messages)"\s*\))\s*$' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
{{% else %}}
ansible.builtin.command: grep -Pzo '(?m)^\s*cron\.\*\s*(/var/log/cron|action\(\s*.*(?i:\btype\b)="omfile"\s*.*(?i:\bfile\b)="/var/log/cron"\s*\))\s*$' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
ansible.builtin.command: grep -Pzo '(?ms)^\s*cron\.\*\s*(/var/log/cron|action\(\s*.*(?i:\btype\b)="omfile"\s*.*(?i:\bfile\b)="/var/log/cron"\s*\))\s*$' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
{{% endif %}}
register: cron_log_config_exists
failed_when: false
Expand Down
Original file line number Diff line number Diff line change
@@ -1,13 +1,8 @@
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux

{{% if 'ol' in families %}}
if ! grep -Pzo '(?m)^\s*(cron|\*)\.\*\s*(/var/log/(cron|messages)|action\(\s*.*(?i:\btype\b)="omfile"\s*.*(?i:\bfile\b)="/var/log/(cron|messages)"\s*\))\s*$' /etc/rsyslog.conf /etc/rsyslog.d/*.conf; then
{{% else %}}
if ! grep -Pzo '(?m)^\s*cron\.\*\s*(/var/log/cron|action\(\s*.*(?i:\btype\b)="omfile"\s*.*(?i:\bfile\b)="/var/log/cron"\s*\))\s*$' /etc/rsyslog.conf /etc/rsyslog.d/*.conf; then
{{% endif %}}
mkdir -p /etc/rsyslog.d
echo "cron.* /var/log/cron" >> /etc/rsyslog.d/cron.conf
fi
{{{ setup_rsyslog_cron_logging() }}}

echo "cron.* /var/log/cron" >> $RSYSLOG_D_CONF

if {{{ bash_not_bootc_build() }}} ; then
systemctl restart rsyslog.service
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,8 @@

{{% set legacy_regex = "^[\\s]*cron\\.\\*[\\s]+/var/log/cron\\s*(?:#.*)?$" %}}
{{# RainerScript keys are case-insensitive #}}
{{% set rainer_script_regex = "(?m)^\\s*cron\\.\\*\\s+action\\(\\s*.*(?i)\\btype\\b(?-i)=\"omfile\"\\s*.*(?i)\\bfile\\b(?-i)=\"/var/log/cron\"\\s*.*\\)\\s*$" %}}
{{% set rainer_cron_regex = "(?ms)^\\s*cron\\.\\*\\s+action\\(\\s*.*(?i)\\btype\\b(?-i)=\"omfile\"\\s*.*(?i)\\bfile\\b(?-i)=\"/var/log/cron\"\\s*.*\\)\\s*$" %}}
{{% set rainer_logging_regex = "(?ms)^[\\s]*\*\.\*[\s]+(/var/log/messages|action\(\s*.*(?i:\btype\b)=\"omfile\"\s*.*(?i:\bfile\b)=\"/var/log/messages\"\s*\))\s*(?:#.*)?$" %}}

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="cron is configured in /etc/rsyslog.conf"
Expand All @@ -42,7 +43,7 @@
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_cron_logging_rsyslog_rainer" version="1">
<ind:filepath>/etc/rsyslog.conf</ind:filepath>
<ind:pattern operation="pattern match">{{{ rainer_script_regex }}}</ind:pattern>
<ind:pattern operation="pattern match">{{{ rainer_cron_regex }}}</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

Expand All @@ -66,7 +67,7 @@
<ind:textfilecontent54_object id="obj_cron_logging_rsyslog_dir_rainer" version="1">
<ind:path>/etc/rsyslog.d</ind:path>
<ind:filename operation="pattern match">^.*$</ind:filename>
<ind:pattern operation="pattern match">{{{ rainer_script_regex }}}</ind:pattern>
<ind:pattern operation="pattern match">{{{ rainer_cron_regex }}}</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

Expand All @@ -78,7 +79,7 @@
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_cron_logging_rsyslog_logging_all_facilities" version="1">
<ind:filepath>/etc/rsyslog.conf</ind:filepath>
<ind:pattern operation="pattern match">(?m)^[\s]*\*\.\*[\s]+(/var/log/messages|action\(\s*.*(?i:\btype\b)="omfile"\s*.*(?i:\bfile\b)="/var/log/messages"\s*\))\s*(?:#.*)?$</ind:pattern>
<ind:pattern operation="pattern match">{{{ rainer_logging_regex }}}</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

Expand All @@ -90,7 +91,7 @@
<ind:textfilecontent54_object id="obj_cron_logging_rsyslog_dir_logging_all_facilities" version="1">
<ind:path>/etc/rsyslog.d</ind:path>
<ind:filename operation="pattern match">^.*$</ind:filename>
<ind:pattern operation="pattern match">(?m)^[\s]*\*\.\*[\s]+(/var/log/messages|action\(\s*.*(?i:\btype\b)="omfile"\s*.*(?i:\bfile\b)="/var/log/messages"\s*\))\s*(?:#.*)?$</ind:pattern>
<ind:pattern operation="pattern match">{{{ rainer_logging_regex }}}</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
{{% endif %}}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,15 +1,9 @@
#!/bin/bash
# packages = rsyslog
# platform = multi_platform_ol
{{{ setup_rsyslog_cron_logging() }}}

. set_cron_logging.sh

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FOLDER='/etc/rsyslog.d'
RSYSLOG_D_FILES=("${RSYSLOG_D_FOLDER}"/*)

mkdir -p "${RSYSLOG_D_FOLDER}"
rm -rf "${RSYSLOG_D_FILES[@]}"
rm -rf "$RSYSLOG_D_FOLDER/*.conf"
truncate -s 0 "${RSYSLOG_CONF}"

echo '*.* /var/log/messages' >> "${RSYSLOG_CONF}"
Original file line number Diff line number Diff line change
@@ -1,14 +1,9 @@
#!/bin/bash
# packages = rsyslog
# platform = multi_platform_ol
. set_cron_logging.sh
{{{ setup_rsyslog_cron_logging() }}}

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FOLDER='/etc/rsyslog.d'
RSYSLOG_D_FILE=$RSYSLOG_D_FOLDER'/test.conf'

mkdir -p $RSYSLOG_D_FOLDER
rm "$RSYSLOG_D_FOLDER/*"
rm "$RSYSLOG_D_FOLDER/*.conf"
truncate -s 0 $RSYSLOG_CONF

echo '*.* /var/log/messages' >> $RSYSLOG_D_FILE
echo '*.* /var/log/messages' >> $RSYSLOG_D_CONF
Original file line number Diff line number Diff line change
@@ -1,14 +1,5 @@
#!/bin/bash
# packages = rsyslog

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FILES='/etc/rsyslog.d/*'

# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with cron.*
touch $RSYSLOG_CONF
for rsyslog_d_file in $RSYSLOG_D_FILES
do
sed -i '/^[[:space:]]*cron\.\*/d' $rsyslog_d_file
done
{{{ setup_rsyslog_cron_logging() }}}

echo 'cron.* action(Name="local-cron" Type="omfile" FileCreateMode="0600" FileOwner="root" FileGroup="root" File="/var/log/cron")' >> "$RSYSLOG_CONF"
Original file line number Diff line number Diff line change
@@ -1,14 +1,5 @@
#!/bin/bash
# packages = rsyslog

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FILES='/etc/rsyslog.d/*'

# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with cron.*
touch $RSYSLOG_CONF
for rsyslog_d_file in $RSYSLOG_D_FILES
do
sed -i '/^[[:space:]]*cron\.\*/d' $rsyslog_d_file
done
{{{ setup_rsyslog_cron_logging() }}}

echo 'cron.* action(name="local-cron" type="omfile" fileCreateMode="0600" fileOwner="root" fileGroup="root" file="/var/log/cron")' >> "$RSYSLOG_CONF"
Original file line number Diff line number Diff line change
@@ -1,15 +1,6 @@
#!/bin/bash
# packages = rsyslog

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FILES='/etc/rsyslog.d/*'

# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with cron.*
touch $RSYSLOG_CONF
for rsyslog_d_file in $RSYSLOG_D_FILES
do
sed -i '/^[[:space:]]*cron\.\*/d' $rsyslog_d_file
done
{{{ setup_rsyslog_cron_logging() }}}

cat << EOF >> "$RSYSLOG_CONF"
cron.* action(
Expand Down
Original file line number Diff line number Diff line change
@@ -1,14 +1,5 @@
#!/bin/bash
# packages = rsyslog
{{{ setup_rsyslog_cron_logging() }}}

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FOLDER='/etc/rsyslog.d'
RSYSLOG_D_FILE=$RSYSLOG_D_FOLDER'/test.conf'

# Ensure that rsyslog.d folder exists and contains our 'test.conf' file
mkdir -p $RSYSLOG_D_FOLDER
touch $RSYSLOG_D_FILE

sed -i '/^[[:space:]]*cron\.\*/d' $RSYSLOG_CONF

echo 'cron.* action(name="local-cron" type="omfile" FileCreateMode="0600" fileOwner="root" fileGroup="root" File="/var/log/cron")' >> "$RSYSLOG_D_FILE"
echo 'cron.* action(name="local-cron" type="omfile" FileCreateMode="0600" fileOwner="root" fileGroup="root" File="/var/log/cron")' >> "$RSYSLOG_D_CONF"
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
#!/bin/bash
# packages = rsyslog
{{{ setup_rsyslog_cron_logging() }}}

cat << EOF >> "$RSYSLOG_D_CONF"
cron.* action(
name="local-cron"
type="omfile"
fileCreateMode="0600"
fileOwner="root"
fileGroup="root"
file="/var/log/cron"
)
EOF
Original file line number Diff line number Diff line change
@@ -1,15 +1,5 @@
#!/bin/bash
# packages = rsyslog
. set_cron_logging.sh
{{{ setup_rsyslog_cron_logging() }}}

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FILES='/etc/rsyslog.d/*'

# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with cron.*
touch $RSYSLOG_CONF
for rsyslog_d_file in $RSYSLOG_D_FILES
do
sed -i '/^[[:space:]]*cron\.\*/d' $rsyslog_d_file
done

set_cron_logging $RSYSLOG_CONF
echo 'cron.* /var/log/cron' >> $RSYSLOG_CONF
Original file line number Diff line number Diff line change
@@ -1,15 +1,5 @@
#!/bin/bash
# packages = rsyslog
. set_cron_logging.sh
{{{ setup_rsyslog_cron_logging() }}}

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FOLDER='/etc/rsyslog.d'
RSYSLOG_D_FILE=$RSYSLOG_D_FOLDER'/test.conf'

# Ensure that rsyslog.d folder exists and contains our 'test.conf' file
mkdir -p $RSYSLOG_D_FOLDER
touch $RSYSLOG_D_FILE

sed -i '/^[[:space:]]*cron\.\*/d' $RSYSLOG_CONF

set_cron_logging $RSYSLOG_D_FILE
echo 'cron.* /var/log/cron' >> $RSYSLOG_D_CONF
Original file line number Diff line number Diff line change
@@ -1,15 +1,3 @@
#!/bin/bash
# packages = rsyslog

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FILES='/etc/rsyslog.d/*'

# At least ensure that rsyslog.conf exist
touch $RSYSLOG_CONF

sed -i '/^[[:space:]]*cron\.\*/d' $RSYSLOG_CONF
for rsyslog_d_file in $RSYSLOG_D_FILES
do
[ -e "$rsyslog_d_file" ] || continue
sed -i '/^[[:space:]]*cron\.\*/d' $rsyslog_d_file
done
{{{ setup_rsyslog_cron_logging() }}}
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
#!/bin/bash
# packages = rsyslog
{{{ setup_rsyslog_cron_logging() }}}

rm -rf /etc/rsyslog.d
touch /etc/rsyslog.conf
sed -i '/^[[:space:]]*cron\.\*/d' /etc/rsyslog.conf

This file was deleted.

Original file line number Diff line number Diff line change
@@ -1,17 +1,6 @@
#!/bin/bash
# packages = rsyslog
{{{ setup_rsyslog_cron_logging() }}}

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FILES='/etc/rsyslog.d/*'

# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with cron.*
touch $RSYSLOG_CONF
for rsyslog_d_file in $RSYSLOG_D_FILES
do
sed -i '/^[[:space:]]*cron\.\*/d' $rsyslog_d_file
done

# If there's cron.* line, then remove it
sed -i '/^[[:space:]]*cron\.\*/d' $RSYSLOG_CONF
# Add cron.* that logs into wrong file
echo 'cron.* action(name="local-cron" type="omfile" fileCreateMode="0600" fileOwner="root" fileGroup="root" file="/tmp/log/cron")' >> "$RSYSLOG_CONF"
Original file line number Diff line number Diff line change
@@ -1,18 +1,7 @@
#!/bin/bash
# packages = rsyslog
{{{ setup_rsyslog_cron_logging() }}}

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FILES='/etc/rsyslog.d/*'

# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with cron.*
touch $RSYSLOG_CONF
for rsyslog_d_file in $RSYSLOG_D_FILES
do
sed -i '/^[[:space:]]*cron\.\*/d' $rsyslog_d_file
done

# If there's cron.* line, then remove it
sed -i '/^[[:space:]]*cron\.\*/d' $RSYSLOG_CONF
# Add cron.* that logs into wrong file
cat << EOF >> "$RSYSLOG_CONF"
cron.* action(
Expand Down
Original file line number Diff line number Diff line change
@@ -1,18 +1,6 @@
#!/bin/bash
# packages = rsyslog
. set_cron_logging.sh
{{{ setup_rsyslog_cron_logging() }}}

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FILES='/etc/rsyslog.d/*'

# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with cron.*
touch $RSYSLOG_CONF
for rsyslog_d_file in $RSYSLOG_D_FILES
do
sed -i '/^[[:space:]]*cron\.\*/d' $rsyslog_d_file
done

# If there's cron.* line, then remove it
sed -i '/^[[:space:]]*cron\.\*/d' $RSYSLOG_CONF
# Add cron.* that logs into wrong file
echo "cron.* /tmp/log/cron" >> $RSYSLOG_CONF
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,8 @@
# strategy = configure
# complexity = low
# disruption = low
{{{ setup_rsyslog_encrypt_offload_actionsendstreamdriverauthmode() }}}

sed -i '/^.*\$ActionSendStreamDriverAuthMode.*/d' /etc/rsyslog.conf /etc/rsyslog.d/*.conf 2> /dev/null

{{{ set_config_file(path="/etc/rsyslog.d/stream_driver_auth.conf",
{{{ set_config_file(path="$RSYSLOG_D_CONF",
parameter="\$ActionSendStreamDriverAuthMode", value="x509/name", create=true, separator=" ", separator_regex=" ", rule_id=rule_id)
}}}
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
</definition>

{{% set legacy_regex = "^\\$ActionSendStreamDriverAuthMode x509/name$" %}}
{{% set rainer_script_regex = "^\\s*action\\(.*(?i)\\btype\\b(?-i)=\"omfwd\".*(?i)\\bStreamDriverAuthMode\\b(?-i)=\"x509/name\".*\\)\\s*$" %}}
{{% set rainer_script_regex = "(?ms)^\\s*action\\(.*(?i)\\btype\\b(?-i)=\"omfwd\".*(?i)\\bStreamDriverAuthMode\\b(?-i)=\"x509/name\".*\\)\\s*$" %}}

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
#!/bin/bash
# packages = rsyslog
bash -x setup.sh
{{{ setup_rsyslog_encrypt_offload_actionsendstreamdriverauthmode() }}}

if [[ -f encrypt.conf ]]; then
sed -i "/^\$ActionSendStreamDriverMod.*/d" /etc/rsyslog.conf
if [[ -f $RSYSLOG_D_CONF ]]; then
sed -i "/^\$ActionSendStreamDriverAuthMode.*/d" $RSYSLOG_D_CONF
fi
sed -i "/^\$ActionSendStreamDriverMod.*/d" /etc/rsyslog.conf
sed -i "/^\$ActionSendStreamDriverAuthMode.*/d" $RSYSLOG_CONF
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#!/bin/bash
# packages = rsyslog
bash -x setup.sh
{{{ setup_rsyslog_encrypt_offload_actionsendstreamdriverauthmode() }}}

echo "\$ActionSendStreamDriverAuthMode x509/name" >> /etc/rsyslog.conf
echo "\$ActionSendStreamDriverAuthMode x509/name" >> $RSYSLOG_CONF
Original file line number Diff line number Diff line change
@@ -1,15 +1,5 @@
#!/bin/bash
# packages = rsyslog
bash -x setup.sh

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FILES='/etc/rsyslog.d/*'

# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with action
touch $RSYSLOG_CONF
for rsyslog_d_file in $RSYSLOG_D_FILES
do
sed -i '/^[[:space:]]*action\.\*/d' $rsyslog_d_file
done
{{{ setup_rsyslog_encrypt_offload_actionsendstreamdriverauthmode() }}}

echo 'action(type="omfwd" Target="some.example.com" StreamDriverAuthMode="x509/name")' >> "$RSYSLOG_CONF"
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
#!/bin/bash
# packages = rsyslog
{{{ setup_rsyslog_encrypt_offload_actionsendstreamdriverauthmode() }}}

cat << EOF >> "$RSYSLOG_CONF"
action(
type="omfwd"
Target="some.example.com"
StreamDriverAuthMode="x509/name"
)
EOF
Loading
Loading