1.4.2 Add config path to aide.wrapper cronjob as suggested for CIS co…

…mpliance (#67) * 1.4.2 Add config path to aide.wrapper conf as suggested for CIS compliance. * 1.5.1 Set /boot/grub/grub.cfg to permission 0400
florianutz · Jun 6, 2020 · 4a06bcf · 4a06bcf
1 parent 6c37e06
commit 4a06bcf
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/defaults/main.yml b/defaults/main.yml
@@ -344,7 +344,7 @@ ubuntu1804cis_config_aide: true
 ubuntu1804cis_aide_cron:
   cron_user: root
   cron_file: /etc/crontab
-  aide_job: '/usr/bin/aide.wrapper --check'
+  aide_job: '/usr/bin/aide.wrapper --config /etc/aide/aide.conf --check'
   aide_minute: 0
   aide_hour: 5
   aide_day: '*'

diff --git a/tasks/section1.yml b/tasks/section1.yml
@@ -719,7 +719,7 @@
       path: "/boot/grub/grub.cfg"
       owner: root
       group: root
-      mode: 0600
+      mode: 0400
   when:
       - ansible_os_family == "Debian"
       - ubuntu1804cis_rule_1_5_1