Skill 2 in course 3.1: Method and Evidence

Central Logging, AIDE and Ansible

Send logs to a central host, detect changed files with AIDE, and push configuration with Ansible.

Advanced3 lessons9 exercises2 h 25 min
Start skill

You will be able to

  • Configure a client to forward all messages to a log host, and a server to file them per host.
  • Prove that messages arrive, and find the broken layer when they do not.
  • Build an AIDE baseline, read a check report, and update the baseline after an approved change.
  • Use ansible-doc, ad hoc commands and a playbook with a handler to configure several systems idempotently.

Lessons

  1. 01Sending logs to a central host with rsyslogConfigure rsyslog as a log server and as a forwarding client, open the right ports, and prove messages arrive.rsyslogdrsyslogd -N1/etc/rsyslog.dloggerlogger -nss -tlnp0/3 exercises
  2. 02Detecting changed files with AIDEBuild an AIDE baseline, define what to watch, read a check report and update the database after an approved change.aideaide --initaide --checkaide --updateaide --compare/etc/aide.conf0/3 exercises
  3. 03Ansible for repeatable fixes and checksUse ansible-doc, ad hoc commands and a playbook with handlers and check mode to apply and verify a configuration.ansibleansible-playbookansible-docansible-doc -lansible-doc -sansible-inventory0/3 exercises