lynis

Ansible Role: Lynis

An Ansible role to install Lynis, an open source security auditing tool.

Quick howto

requirements.yml:

- src: infothrill.lynis
  version: v4.2.0

Install:

ansible-galaxy install -r requirements.yml -p ./roles/

Playbook:

- hosts: servers
    roles:
      - role: infothrill.lynis

Role Variables

```yml
lynis_version: 3.0.8
lynis_version_sha256sum: 98373a4cc9d0471ab9bebb249e442fcf94b6bf6d4e9c6fc0b22bca1506646c63
```

The version and corresponding sha256sum of Lynis to install. Latest version and hash can be found on the Lynis download page.

```yml
lynis_directory: /opt/lynis
```

The directory to hold the Lynis installation.

```yml
lynis_log_directory: /var/log/lynis
```

The directory for the Lynis logs. Used by the cron job. By default, Lynis will output the report to stdout and log to /var/log/lynis.log and /var/log/lynis-report.dat.

```yml
lynis_log_group: adm
```

The unix group that should own the generated logs.

```yml
lynis_config_directory: /etc/lynis
```

The directory to store cron related scripts and configuration.

```yml
lynis_cron: yes
lynis_cron_month: "*"
lynis_cron_day: "*"
lynis_cron_weekday: "*"
lynis_cron_hour: 3
lynis_cron_minute: 30
```

Lynis cron job configuration. The report, report log, and report data are all written to the lynis_log_directory.

```yml
lynis_cron_rotate: 14
```

How many logs to keep in rotation (only meaningful when lynis_cron is true).

```yml
lynis_cron_initial_run: false
```

Set this to true to trigger an initial cron job run after initial installation or version change of lynis.

Dependencies

None.

License

MIT

Author Information

This role was forked from https://github.com/tommarshall/ansible-role-lynis in 2018 by Paul Kremer.

Changes

vxx

add ansible 7, python 3.11
drop ansible 5, python 3.8

v4.2.0

updated lynis default version to 3.0.8
dropped testing support for Debian Jessie, added Ubuntu 22.04
dropped support for python older than 3.8
dropped support for ansible older than 5
Applied modern linting
Switch to Github Actions for CI

v4.1.1

updated lynis default version to 3.0.3
drop python 3.6 test support
add python 3.7, 3.8, 3.9 test support
drop ansible 2.8 testing support
add ansible 3.0 testing support

v4.1.0

fix for issue #55
updated lynis default version to 3.0.1

v4.0.0

Drop support for ansible <=2.7
Add support for ansible 2.10
Upgrade molecule to 3.x

v3.0.2

updated lynis default version to 3.0.0

v3.0.1

add support for ubuntu 20.04 (focal)
updated lynis default version to 2.7.5

v3.0.0

add support for ansible 2.8
add support for ansible 2.9
drop support for ansible 2.4
drop support for python2
drop support for Ubuntu 14.04
upgraded ansible-lint

v2.1.1

use ansible tempfile module
use ionice in cronjob

v2.1.0

only run log rotation when actually configured (lynis_cron_rotate > 1)

v2.0.0

added feature to run lynis on initial install or version change (lynis_cron_initial_run)
renamed variable lynis_rotate to lynis_cron_rotate
removed molecule playbooks that are just upstream copies