# platform = multi_platform_ubuntu
# reboot = false
# strategy = configure
# complexity = low
# disruption = medium
- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-UBTU-22-652015
  - NIST-800-53-AC-17(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_access_monitoring

- name: Ensure remote access methods are monitored in Rsyslog - Set Facts
  ansible.builtin.set_fact:
    conf_files:
    - /etc/rsyslog.d/50-default.conf
    remote_methods:
    - selector: auth.*
      regexp: ^.*auth\.\*.*$
      log_path_name: secure
    - selector: authpriv.*
      regexp: ^.*authpriv\.\*.*$
      log_path_name: secure
    - selector: daemon.*
      regexp: ^.*daemon\.\*.*$
      log_path_name: messages
  when:
  - '"linux-base" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  tags:
  - DISA-STIG-UBTU-22-652015
  - NIST-800-53-AC-17(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_access_monitoring

- name: Ensure remote access methods are monitored in Rsyslog - Ensure /etc/rsyslog.d/50-default.conf
    Exists
  ansible.builtin.file:
    path: '{{ conf_files.0 }}'
    state: touch
  when:
  - '"linux-base" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  tags:
  - DISA-STIG-UBTU-22-652015
  - NIST-800-53-AC-17(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_access_monitoring

- name: Ensure remote access methods are monitored in Rsyslog - Check for Existing
    Values in Conf Files
  ansible.builtin.lineinfile:
    path: '{{ item.1 }}'
    regexp: '{{ item.0.regexp }}'
    state: absent
  check_mode: true
  changed_when: false
  register: remote_method_values
  loop: '{{ remote_methods|product(conf_files)|list }}'
  when:
  - '"linux-base" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  tags:
  - DISA-STIG-UBTU-22-652015
  - NIST-800-53-AC-17(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_access_monitoring

- name: Ensure remote access methods are monitored in Rsyslog - Configure /etc/rsyslog.d/50-default.conf
    With Proper Log Paths
  ansible.builtin.lineinfile:
    path: /etc/rsyslog.d/50-default.conf
    line: '{{ item.item.0.selector }} /var/log/{{ item.item.0.log_path_name }}'
    insertafter: ^.*\/var\/log\/secure.*$
    create: true
  loop: '{{ remote_method_values.results }}'
  when:
  - '"linux-base" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  - item.found == 0
  tags:
  - DISA-STIG-UBTU-22-652015
  - NIST-800-53-AC-17(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_access_monitoring
