Introduce a puppet-module / service template to manage AIDE and ensure the AIDE package is installed, create rule entries and a cron job to allow a periodic check of the AIDE database. Create a tripleo-heat-template service to allow population of hiera data to be consumed by the puppet-module managing AIDE. The proposed puppet-module is lhinds-aide [2] as this module will accept rules declared in hiera data, initialise the Database and enables cron entries. Other puppet AIDE modules were missing hiera functionality or other features (such as cron population). I have already put together a puppet-module [1], work needed is to include the module in RDO and develop a composable service to feed hiera data into puppet-aide. This change is required to meet DISA STIG / CIS security compliance. A blueprint [2] and spec [3] have been submitted upstream. [1] https://forge.puppet.com/lhinds/aide [2] https://blueprints.launchpad.net/tripleo/+spec/tripleo-aide-database [3] https://review.openstack.org/#/c/437872/4
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2019:0045
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 500 days