Initial commit

.gitignore

@@ -0,0 +1,13 @@
+# OS generated files #
+######################
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db
+
+# Custom #
+##########
+secret*

LICENSE.md

@@ -0,0 +1,9 @@
+# The MIT License (MIT)
+---
+Copyright (c) 2017
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

README.md

@@ -0,0 +1,78 @@
+Ansible Role: OSSEC-HIDS
+=========
+
+This role installs and configures OSSEC-HIDS in local mode. Depending on the defined variables, it is possible to choose the protections and also if email notifications are enabled.
+
+Requirements
+------------
+
+No specific requirements for this role.
+
+Role Variables
+--------------
+
+There are a bunch of variables for this particular role. Most of them are used during the installation of OSSEC-HIDS which asks a number of questions.
+
+Here is an example of configuration with all protections and email notifications enabled:
+
+
+```
+# OSSEC installation questions (with email notifications)
+ossec_dir: /var/ossec
+ossec_install_type: local
+ossec_email: y
+ossec_email_address: [email protected]
+ossec_detected_smtp_use: n
+ossec_smtp_server: localhost
+ossec_integritycheck_daemon: y
+ossec_rootkit_engine: y
+ossec_active_response: y
+ossec_firewalldrop_response: y
+```
+
+
+This other example enables all protections but disables email notifications:
+
+
+```
+# OSSEC installation questions (without email notification)
+ossec_dir: /var/ossec
+ossec_install_type: local
+ossec_email: n
+ossec_integritycheck_daemon: y
+ossec_rootkit_engine: y
+ossec_active_response: y
+ossec_firewalldrop_response: y
+```
+
+These variables should be defined in either group_vars or host_vars.
+
+Dependencies
+------------
+
+No dependencies from other roles required.
+
+Example Playbook
+----------------
+
+Here is a simple example playbook to use this role:
+
+```
+hosts: all
+user: myuser
+become: true
+roles:
+  - { role: ossec, tags: [ 'ossec' ] }
+```
+
+License
+-------
+
+MIT / BSD
+
+Author Information
+------------------
+
+My name is Gaétan. You can follow me on [Twitter](https://twitter.com/gaetanict)
+
+Website: [ICT Pour Tous](https://www.ictpourtous.com)

defaults/main.yml

@@ -0,0 +1,23 @@
+---
+# Default variables for this role
+
+# OSSEC installation questions (with email notifications)
+ossec_dir: /var/ossec
+ossec_install_type: local
+ossec_email: y
+ossec_email_address: [email protected]
+ossec_detected_smtp_use: n
+ossec_smtp_server: localhost
+ossec_integritycheck_daemon: y
+ossec_rootkit_engine: y
+ossec_active_response: y
+ossec_firewalldrop_response: y
+
+# OSSEC installation questions (without email notification)
+#ossec_dir: /var/ossec
+#ossec_install_type: local
+#ossec_email: n
+#ossec_integritycheck_daemon: y
+#ossec_rootkit_engine: y
+#ossec_active_response: y
+#ossec_firewalldrop_response: y

handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: restart ossec
+  service:
+    name: ossec
+    state: restarted

meta/main.yml

@@ -0,0 +1,19 @@
+galaxy_info:
+  author: Gaétan
+  description: Install and configure OSSEC HIDS
+
+  license: license (MIT, BSD)
+
+  min_ansible_version: 2.3
+
+  platforms:
+   - name: Linux
+     versions:
+     - all
+
+  galaxy_tags:
+    - linux
+    - ossec
+    - hids
+
+dependencies: []

tasks/main.yml

@@ -0,0 +1,3 @@
+---
+# Install OSSEC HIDS
+- include: ossec.yml

tasks/ossec.yml

@@ -0,0 +1,68 @@
+---
+- name: (OSSEC) Install Prerequisites
+  package:
+    name: "{{ item }}"
+    state: latest
+  with_items:
+    - build-essential
+    - python-pexpect
+    - git
+
+- name: (OSSEC) Check if OSSEC is already installed
+  stat:
+    path: "{{ ossec_dir }}"
+  register: ossec
+
+- name: (OSSEC) Retrieve latest version of OSSEC from GitHub
+  git:
+    repo: https://github.com/ossec/ossec-hids.git
+    dest: /opt/ossec-hids
+    update: yes
+  register: gitupdate
+
+- name: (OSSEC) Install OSSEC-HIDS in local mode
+  expect:
+    command: "/bin/bash /opt/ossec-hids/install.sh"
+    responses:
+      en/br: "en"
+      Press ENTER: ""
+      What kind of installation do you want: "{{ ossec_install_type }}"
+      Choose where to install the OSSEC HIDS: "{{ ossec_dir }}"
+      Do you want e-mail notification: "{{ ossec_email }}"
+      e-mail address: "{{ ossec_email_address }}"
+      Do you want to use it: "{{ ossec_detected_smtp_use }}"
+      SMTP server ip: "{{ ossec_smtp_server }}"
+      Do you want to run the integrity check daemon: "{{ ossec_integritycheck_daemon }}"
+      Do you want to run the rootkit detection engine: "{{ ossec_rootkit_engine }}"
+      Do you want to enable active response: "{{ ossec_active_response }}"
+      Do you want to enable the firewall-drop response: "{{ ossec_firewalldrop_response }}"
+      Do you want to add more IPs to the white list: "n"
+  become: yes
+  notify: restart ossec
+  when: not ossec.stat.exists
+  register: ossecinstall
+
+- name: (OSSEC) Cleanup local changes in GIT repository
+  raw: "{{ item }}"
+  with_items:
+    - git -C /opt/ossec-hids/ checkout -f
+    - git -C /opt/ossec-hids/ clean -fd
+  register: gitcleanup
+  when: ossecinstall|changed
+
+- name: (OSSEC) Update OSSEC-HIDS
+  expect:
+    command: "/bin/bash /opt/ossec-hids/install.sh"
+    responses:
+      en/br: "en"
+      Press ENTER: ""
+      Do you want to update it: "y"
+      Do you want to update the rules: "y"
+  notify: restart ossec
+  become: yes
+  when: ossec.stat.exists and gitupdate|changed
+
+- name: (OSSEC) Start OSSEC service
+  service:
+    name: ossec
+    state: started