# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu,multi_platform_almalinux
# reboot = false
# strategy = configure
# complexity = low
# disruption = low
- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-UBTU-22-653020
  - auditd_audispd_configure_remote_server
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
- (xccdf-var var_audispd_remote_server)

- name: Configure audispd Plugin To Send Logs To Remote Server - Uncomment active
    for offloading to remote server
  ansible.builtin.lineinfile:
    path: /etc/audit/plugins.d/au-remote.conf
    regexp: ^(#.*)(active\s*=)
    line: \2
    backrefs: true
  when:
  - '"auditd" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  tags:
  - DISA-STIG-UBTU-22-653020
  - auditd_audispd_configure_remote_server
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure audispd Plugin To Send Logs To Remote Server - Set active to true
    for offloading to remote server
  ansible.builtin.lineinfile:
    path: /etc/audit/plugins.d/au-remote.conf
    regexp: ^(.*)(active\s*=)(?!.*yes)
    line: \2 yes
    create: true
    state: present
    backrefs: true
  when:
  - '"auditd" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  tags:
  - DISA-STIG-UBTU-22-653020
  - auditd_audispd_configure_remote_server
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure audispd Plugin To Send Logs To Remote Server - Make sure that a
    remote server is configured for Audispd
  ansible.builtin.lineinfile:
    path: /etc/audit/audisp-remote.conf
    line: remote_server = {{ var_audispd_remote_server }}
    regexp: ^\s*remote_server\s*=.*$
    create: true
    state: present
  when:
  - '"auditd" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  tags:
  - DISA-STIG-UBTU-22-653020
  - auditd_audispd_configure_remote_server
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
