Forge Home

Modules

Resources

PuppetEcosystemPuppet CommunityUpdates

auditd

A SIMP puppet module for managing auditd and audispd
Project URLRSS FeedReport issues

55,760 downloads

1,291 latest version

4.5 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 8.14.0 (latest)
  • 8.13.0
  • 8.12.0
  • 8.11.0
  • 8.10.1
  • 8.10.0
  • 8.8.0
  • 8.7.5
  • 8.7.4
  • 8.7.3
  • 8.7.2
  • 8.7.1
  • 8.7.0
  • 8.6.5
  • 8.6.4
  • 8.6.3
  • 8.6.2
  • 8.6.1
  • 8.6.0
  • 8.5.3
  • 8.5.2
  • 8.5.1
  • 8.5.0
  • 8.4.0
  • 8.3.2
  • 8.3.1
  • 8.3.0
  • 8.2.1
  • 8.2.0
  • 8.1.1
  • 8.1.0
  • 8.0.1
  • 7.1.3
  • 7.1.2
  • 7.1.1
  • 7.1.0
  • 7.0.2
  • 7.0.1
  • 5.1.1
  • 5.0.4
released Nov 16th 2018
This version is compatible with:
  • Puppet Enterprise 2018.1.x, 2017.3.x, 2017.2.x, 2016.4.x
  • Puppet >= 4.10.4 < 6.0.0
  • , ,

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'simp-auditd', '8.1.1'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add simp-auditd
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install simp-auditd --version 8.1.1

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.

Download
Tags: auditd, simp, audispd

Documentation

simp/auditd — version 8.1.1 Nov 16th 2018

License CII Best Practices Puppet Forge Puppet Forge Downloads Build Status

Table of Contents

Overview

This module manages the Audit daemon, kernel parameters, and related subsystems.

This is a SIMP module

This module is a component of the System Integrity Management Platform, a compliance management framework built on Puppet.

If you find any issues, they can be submitted to our JIRA.

This module is optimally designed for use within a larger SIMP ecosystem, but it can be used independently:

  • When included within the SIMP ecosystem, security compliance settings will be managed from the Puppet server.
  • If used independently, all SIMP-managed security subsystems will be disabled by default and must be explicitly opted into by administrators. Please review simp_options for details.

Module Description

You can use this module for the management of all components of auditd including configuration, service management, kernel parameters, and custom rule sets.

By default, a rule set is provided that should meet a reasonable set of operational goals for most environments.

The audit kernel parameter may optionally be managed independently of the rest of the module using the ::auditd::config::grub class.

Setup

Setup Requirements

If auditd::syslog is true, you will need to install simp/rsyslog as a dependency.

What Auditd Affects

  • The audit kernel parameter
    • NOTE: This will be applied to all kernels in your standard grub configuration
  • The auditd service
  • The audid configuration in /etc/auditd.conf
  • The auditd rules in /etc/audit/rules.d
  • The audispd configuration in /etc/audisp/audispd.conf
  • The audispd syslog configuration in /etc/audisp/plugins.d/syslog.conf

Usage

Basic Usage

# Set up auditd with the default settings
# A message will be printed indicating that you need to reboot for this option
# to take full effect at each Puppet run until you reboot your system.

include '::auditd'

Disabling Auditd

To disable auditd at boot, set the following in hieradata:

auditd::at_boot : false

Changing Key Values

To override the default values included in the module, you can either include new values for the keys at the time that the classes are declared, or set the values in hieradata:


class { '::auditd':
  ignore_failures => true,
  log_group       => 'root',
  flush           => 'INCREMENTAL'
}

auditd::ignore_failures: true
auditd::log_group: 'root'
auditd::flush: 'INCREMENTAL'

Limitations

SIMP Puppet modules are generally intended to be used on a Redhat Enterprise Linux-compatible distribution such as EL6 and EL7.

Development

Please read our Contribution Guide

Acceptance tests

This module includes Beaker acceptance tests using the SIMP Beaker Helpers. By default the tests use Vagrant with VirtualBox as a back-end; Vagrant and VirtualBox must both be installed to run these tests without modification. To execute the tests run the following:

bundle exec rake beaker:suites

Some environment variables may be useful:

BEAKER_debug=true
BEAKER_provision=no
BEAKER_destroy=no
BEAKER_use_fixtures_dir_for_modules=yes
BEAKER_fips=yes
  • BEAKER_debug: show the commands being run on the STU and their output.
  • BEAKER_destroy=no: prevent the machine destruction after the tests finish so you can inspect the state.
  • BEAKER_provision=no: prevent the machine from being recreated. This can save a lot of time while you're writing the tests.
  • BEAKER_use_fixtures_dir_for_modules=yes: cause all module dependencies to be loaded from the spec/fixtures/modules directory, based on the contents of .fixtures.yml. The contents of this directory are usually populated by bundle exec rake spec_prep. This can be used to run acceptance tests to run on isolated networks.
  • BEAKER_fips=yes: enable FIPS-mode on the virtual instances. This can take a very long time, because it must enable FIPS in the kernel command-line, rebuild the initramfs, then reboot.

Please refer to the SIMP Beaker Helpers documentation for more information.