Skip to content

Commit

Permalink
Initial Gentoo support
Browse files Browse the repository at this point in the history
Signed-off-by: Ryan Walter <ryan.walter@sectigo.com>
  • Loading branch information
Ryan Walter committed Sep 7, 2022
1 parent 20757ac commit cdbd736
Show file tree
Hide file tree
Showing 3 changed files with 20 additions and 1 deletion.
8 changes: 7 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ An Ansible role that replaces auditd with Auditbeat. Included modified version o

Please test the rules properly before using on production. Some rules may cause performance impact depending on your setup. For more information on Auditbeat please visit the official [documentation](https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-overview.html)

Supported platfroms:
Supported platforms:
- Ubuntu 20.04
- Ubuntu 18.04
- Ubuntu 16.04
Expand All @@ -22,6 +22,7 @@ Supported platfroms:
- Debian 10
- Debian 9
- Debian 8
- Gentoo \*\*
- Windows 10\*
- Windows Server 2019\*
- Windows Server 2016\*
Expand All @@ -30,6 +31,8 @@ Auditbeat should also work on Oracle Enterprise Linux but only with RHCK.

\* Auditbeat on Windows supports different set of features. If you wish to achieve similar functionality use Sysmon + Winlogbeat

\*\* If you want to run auditbeat on Gentoo, you will need to create your own ebuild, if you want to use the `system` metricset, you will need to build auditbeat with x-pack folder with the elastic licence.

If you wish to run Auditbeat from docker container use the official docker [image](https://hub.docker.com/_/auditbeat) provided by Elastic.

Requirements
Expand Down Expand Up @@ -61,6 +64,9 @@ Ansible variables from `defaults/main.yml`
- add_host_metadata: ~
- add_cloud_metadata: ~
- add_docker_metadata: ~
auditbeat_portage:
package: =auditbeat-{{ auditbeat_service.version }}
getbinpkg: no

The `auditbeat_service.install_rules` can be changed to false if you don't want to use the rules included.

Expand Down
4 changes: 4 additions & 0 deletions defaults/main.yml
Original file line number Diff line number Diff line change
Expand Up @@ -20,3 +20,7 @@ auditbeat_processors: |
- add_host_metadata: ~
- add_cloud_metadata: ~
- add_docker_metadata: ~
auditbeat_portage:
package: =auditbeat-{{ auditbeat_service.version }}
getbinpkg: no
9 changes: 9 additions & 0 deletions tasks/main.yml
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@
when:
- ansible_facts.services['auditd'] is defined
- ansible_os_family != "Windows"
- ansible_os_family != "Gentoo"
tags: install

- name: (Debian/Ubuntu) Install auditbeat apt
Expand All @@ -53,6 +54,14 @@
when: ansible_os_family == "RedHat"
tags: install

# INFO: Based on where and how you generate your auditbeat portage package, you may need to change the package name
- name: (Gentoo) Install auditbeat portage
community.general.portage:
package: "{{ auditbeat_portage.package }}"
getbinpkg: "{{ auditbeat_portage.getbinpkg }}"
when: ansible_os_family == "Gentoo"
tags: install

- name: (Linux) Create auditbeat configuration file
template:
src: auditbeat.yml.j2
Expand Down

0 comments on commit cdbd736

Please sign in to comment.