dj-wasabi / ansible-ossec-agent Goto Github PK

Describe the bug
When running this role on Ubuntu 18.04.5 LTS (bionic) the installation fails:

TASK [ossec-agent : Debian/Ubuntu | Installing repository] **********************************************
fatal: [<<redacted>>]: FAILED! => {"changed": false, "msg": "apt cache update failed"}

Trying to add the repository manually gives "Access Denied". From a quick look it seems like this is because this repo doesn't support bionic.

The dj-wasabi/ansible-ossec-server role uses https://updates.atomicorp.com/channels/atomic/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} while this role uses http://ossec.wazuh.com/repos/apt/{{ ansible_distribution | lower }} {{ ansible_distribution_release }}.

I suggest using atomicorp.com instead as it seems to work fine for bionic, or even better: make this repository url and key configurable.

Installation method/version
Installed the role using an ansible galaxy requirements file as follows:

- src: dj-wasabi.ossec-agent
  name: "ossec-agent"
  version: master

Actual commit used is 6c29671c64909b9e0feb0e202cd8a00258a81187 (latest master at the time)

Ansible Version

ansible 2.9.6
  config file = /home/emmet/code/<<redacted>>/ansible.cfg
  configured module search path = ['/home/emmet/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3/dist-packages/ansible
  executable location = /usr/bin/ansible
  python version = 3.8.2 (default, Jul 16 2020, 14:00:26) [GCC 9.3.0]

Targetted hosts
Concerns the following OS(es):

• Ubuntu 18.04.5 LTS (bionic)

Expected behavior
The install to be successful.

Additional context
If any more info is needed just ask.

Hello,

if I run the playbook again on a host, the repository is added again everytime, resulting in duplicate entry warnings (Debian). Maybe there should be some check for that?

Thank you

https://github.com/dj-wasabi/ansible-ossec-agent/blob/master/tasks/main.yml#L47
https://github.com/dj-wasabi/ansible-ossec-agent/blob/master/tasks/main.yml#L65

Use run_once on those tasks to prevent repeated runs if you have many clients to register.

See here:

http://docs.ansible.com/ansible/playbooks_delegation.html#run-once

This role isn't tested with Molecule like other of my roles. Make it happen. :-)

Hello,

it would be great if this extension could get Ubuntu support as well. Basically the only change that needs to be made is to replace "debian" in this line with "ubuntu" if Ubuntu is detected:

deb http://ossec.alienvault.com/repos/apt/ubuntu trusty main

Hello,

First awesome work, thank for your contribution with Ossec community.
I have a quick question, any thought to move to Wazuh?

https://github.com/wazuh/wazuh/blob/master/CHANGELOG.md

The last version has a new improvements and tools as for example Openscap and Auditd integration.

I can help with the code here.

regards!!