--- - name: Manage the rsyslog packages and service block: - name: Ensure that the rsyslog package is installed. deb/ubuntu apt: pkg=rsyslog state=present cache_valid_time=1800 when: ansible_distribution_file_variety == "Debian" - name: Ensure that the rsyslog package is installed. centos/rhel yum: pkg=rsyslog state=present when: ansible_distribution_file_variety == "RedHat" - name: Create the target logs rsyslog directory file: dest={{ rsyslog_remote_path }} state=directory owner=syslog group=adm - name: Ensure that rsyslog is running and enabled service: name=rsyslog state=started enabled=yes when: rsyslog_enable_remote_socket or rsyslog_enable_send_to_remote tags: [ 'syslog', 'rsyslog', 'remote_syslog' ] - name: Install the rsyslog TLS package on deb/ubuntu block: - name: Install the rsyslog TLS support apt: pkg={{ rsyslog_tls_deb_pkgs }} state=present cache_valid_time=1800 notify: Restart rsyslog when: - rsyslog_enable_remote_socket or rsyslog_enable_send_to_remote - rsyslog_tls_status == 'enabled' - ansible_distribution_file_variety == "Debian" tags: [ 'syslog', 'rsyslog', 'remote_syslog' ] - name: Install the rsyslog TLS package on RHEL/CentOS block: - name: Install the rsyslog TLS support yum: pkg={{ rsyslog_tls_rh_pkgs }} state=present notify: Restart rsyslog when: - rsyslog_enable_remote_socket or rsyslog_enable_send_to_remote - rsyslog_tls_status == 'enabled' - ansible_distribution_file_variety == "RedHat" tags: [ 'syslog', 'rsyslog', 'remote_syslog' ] - name: Install the rsyslog RELP package on deb/ubuntu block: - name: Install the rsyslog RELP support apt: pkg={{ rsyslog_relp_deb_pkgs }} state=present cache_valid_time=1800 notify: Restart rsyslog when: - rsyslog_enable_remote_socket or rsyslog_enable_send_to_remote - ansible_distribution_file_variety == "Debian" tags: [ 'syslog', 'rsyslog', 'remote_syslog' ] - name: Install the rsyslog RELP package on RHEL/CentOS block: - name: Install the rsyslog RELP support yum: pkg={{ rsyslog_relp_rh_pkgs }} state=present notify: Restart rsyslog when: - rsyslog_enable_remote_socket or rsyslog_enable_send_to_remote - ansible_distribution_file_variety == "RedHat" tags: [ 'syslog', 'rsyslog', 'remote_syslog' ] - name: Initialize the TLS configuration block: - name: Create the PKI directory file: dest={{ rsyslog_tls_certs_dir }} state=directory owner=root group=root mode='0700' - name: Download the remote CA file if required get_url: url={{ rsyslog_remote_ca_url }} dest={{ rsyslog_tls_ca }} owner=root group=root mode='0644' when: rsyslog_ca_is_remote - name: Check if a private key for the certificate is present stat: path: '{{ rsyslog_tls_key }}' get_checksum: no register: cert_key_presence - name: Create a certificate private key openssl_privatekey: path: '{{ rsyslog_tls_key }}' when: not cert_key_presence.stat.exists - name: Create a certificate request openssl_csr: path: '{{ rsyslog_tls_certs_dir }}/cert.csr' privatekey_path: '{{ rsyslog_tls_key }}' common_name: '{{ ansible_fqdn }}' when: not cert_key_presence.stat.exists - name: Create a self signed certificate is one is not present openssl_certificate: path: '{{ rsyslog_tls_cert }}' privatekey_path: '{{ rsyslog_tls_key }}' csr_path: '{{ rsyslog_tls_certs_dir }}/cert.csr' provider: selfsigned when: not cert_key_presence.stat.exists when: - rsyslog_tls_status == 'enabled' tags: [ 'syslog', 'rsyslog', 'remote_syslog' ] - name: Configure SELinux and firewalld on RHEL/CentOS block: - name: SELinux udp port seport: ignore_selinux_state=yes ports={{ rsyslog_udp_port }} proto=udp setype=syslogd_port_t state=present when: rsyslog_enable_remote_udp == 'enabled' - name: SELinux tcp port seport: ignore_selinux_state=yes ports={{ rsyslog_udp_port }} proto=tcp setype=syslogd_port_t state=present when: rsyslog_enable_remote_tcp == 'enabled' - name: SELinux RELP port seport: ignore_selinux_state=yes ports={{ rsyslog_relp_port }} proto=tcp setype=syslogd_port_t state=present when: rsyslog_tls_status == 'enabled' - name: rsyslog firewalld services firewalld: service={{ item.service }} zone={{ item.zone }} permanent={{ item.permanent | default(True) }} state={{ item.state }} immediate=True with_items: '{{ rsyslog_firewalld_services }}' - name: rsyslog firewalld ports firewalld: port={{ item.port }}/{{ item.protocol }} zone={{ item.zone }} permanent={{ item.permanent | default(False) }} state={{ item.state }} immediate=True with_items: '{{ rsyslog_firewalld_ports }}' when: - rsyslog_enable_remote_socket - ansible_distribution_file_variety == "RedHat" tags: [ 'syslog', 'rsyslog', 'remote_syslog', 'selinux', 'firewalld' ]