---
# Copyright 2015, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

- name: V-38429 - Install AIDE
  apt:
    name: aide
    state: latest
  tags:
    - cat2
    - V-38489

- name: Search for .netrc files (for V-38619)
  shell: find /root /home -xdev -name .netrc | wc -l
  register: v38619_result
  changed_when: v38619_result.rc != 0
  failed_when: "'No such file' in v38619_result.stdout"
  tags:
    - cat2
    - V-38619

- name: V-38619 - There must be no .netrc files on the system
  debug:
    msg: "FAILED: .netrc files found -- they must be removed"
  when: v38619_result.stdout != '0'
  tags:
    - cat2
    - V-38619

- name: V-38620 - Synchronize system clock (installing chrony)
  apt:
    name: chrony
    state: latest
  tags:
    - cat2
    - V-38620

- name: V-38620 - Synchronize system clock (enable chrony)
  service:
    name: chrony
    state: started
    enabled: yes
  tags:
    - cat2
    - V-38620

- name: V-38620 - Synchronize system clock (configuration file)
  template:
    src: chrony.conf.j2
    dest: /etc/chrony/chrony.conf
  notify:
    - restart chrony
  tags:
    - cat2
    - V-38620

# The STIG only requires that logrotate is installed and configured in cron.
# The openstack-ansible project will configure logs to be rotated weekly and
# compressed with each run. We won't change the interval here, but we will
# ensure that logrotate is installed (to meet the STIG requirement).
- name: V-38624 - System logs must be rotated daily (install logrotate)
  apt:
    name: logrotate
    state: latest
  tags:
    - cat3
    - V-38624

- name: Check for logrotate cron job (for V-38624)
  stat:
    path: /etc/cron.daily/logrotate
  register: v38624_result
  tags:
    - cat3
    - V-38624

- name: V-38624 - System logs must be rotated daily (verify cron job)
  debug:
    msg: "FAILED: Cron job for logrotate is missing"
  when: v38624_result.stat.exists == False
  tags:
   - cat3
   - V-38624