DLPX-86537 CIS: sudoers configuration

PR URL: https://www.github.com/delphix/delphix-platform/pull/498
delphix · Oct 1, 2024 · fe3b417 · fe3b417
1 parent 9e78010
commit fe3b417
Showing 1 changed file with 34 additions and 0 deletions.
diff --git a/...ar/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml b/...ar/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml
@@ -738,3 +738,37 @@
     path: /etc/environment
     state: absent
     regexp: '^\s*PATH\s*='
+
+
+#
+# Ensure Defaults use_pty is set in /etc/sudoers
+#
+- lineinfile:
+    path: /etc/sudoers
+    state: present
+    regexp: '^Defaults use_pty'
+    line: 'Defaults use_pty'
+
+#
+# Ensure Defaults logfile is set in /etc/sudoers
+#
+- lineinfile:
+    path: /etc/sudoers
+    state: present
+    regexp: '^Defaults logfile=/var/log/sudo.log'
+    line: 'Defaults logfile=/var/log/sudo.log'
+
+#
+# Create logrotate configuration for sudo.log
+#
+- copy:
+    dest: /etc/logrotate.d/sudo-log
+    content: |
+      /var/log/sudo.log {
+          weekly
+          rotate 4
+          compress
+          missingok
+          notifempty
+      }
+    mode: '0644'