7.5. Configuring file integrity checks with the aide RHEL system role

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: Configure system integrity
     hosts: managed-node-01.example.com
     tasks:
       - name: Configure file integrity checks with AIDE
         ansible.builtin.include_role:
           name: rhel-system-roles.aide.aide
         vars:
           aide_db_fetch_dir: files
           aide_init: true
           aide_check: false
           aide_update: false
           aide_cron_check: true
           aide_cron_interval: 0 12 * * *

   The settings specified in the example playbook include the following:

   aide_db_fetch_dir: files

   Specifies the directory on the Ansible Control Node (ACN) for storing the AIDE database fetched from the remote nodes. With the default files value, the role stores the database in the same directory as the playbook. To store the database files somewhere else, specify a different path.

   aide_check: false

   Runs an integrity check on the remote nodes.

   aide_update: false

   Updates the AIDE database and stores it on the control node.

   aide_cron_check: true

   Configures a periodic cron job that activates AIDE integrity checks on the managed nodes.

   aide_cron_interval: 0 12 * * *

   Sets the interval for the cron job in the format <minute> <hour> <day_of_month> <month> <day of week>. The value 0 12 * * * sets it to run every day at noon.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.aide/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml