---

- name: "6.3.1 | PATCH | Ensure AIDE is installed"
  when:
    - ubtu24cis_rule_6_3_1
    - ubtu24cis_config_aide
  tags:
    - level1-server
    - level1-workstation
    - patch
    - rule_6.3.1
    - aide
  block:
    - name: "6.3.1 | PATCH | Ensure AIDE is installed"
      when:
        - "'aide' not in ansible_facts.packages or
          'aide-common' not in ansible_facts.packages"
      ansible.builtin.package:
        name: ['aide', 'aide-common']
        state: present
        update_cache: true
      register: discovered_aide_pkgs_added

    - name: "6.3.1 | PATCH | Ensure AIDE is installed | Recapture packages"
      when: discovered_aide_pkgs_added.skipped is not defined
      ansible.builtin.package_facts:
        manager: auto

    - name: "6.3.1 | AUDIT | Ensure AIDE is installed | Check file exists"
      ansible.builtin.stat:
        path: "{{ ubtu24cis_aide_db_file }}"
      register: discovered_aide_db_file

    - name: "6.3.1 | AUDIT | Ensure AIDE is installed | Check current db file age"
      when: discovered_aide_db_file.stat.exists
      ansible.builtin.find:
        path: "{{ ubtu24cis_aide_db_file | dirname }}"
        pattern: "{{ ubtu24cis_aide_db_file | basename }}"
        age: "{{ ubtu24cis_aide_db_file_age }}"
      register: discovered_aide_db_age

    - name: "6.3.1 | PATCH | Ensure AIDE is installed | Configure AIDE"
      when:
        - not ansible_check_mode
        - not discovered_aide_db_file.stat.exists or
          (discovered_aide_db_age.files | length > 0) or
          ubtu24cis_aide_db_recreate
      block:
        - name: "6.3.1 | PATCH | Ensure AIDE is installed | Remove current db file"
          ansible.builtin.file:
            path: "{{ ubtu24cis_aide_db_file }}"
            state: absent

        - name: "6.3.1 | PATCH | Ensure AIDE is installed | Configure AIDE"
          when: not ansible_check_mode
          ansible.builtin.command: "{{ aide_initiate_command }}"
          changed_when: true
          args:
            creates: "{{ ubtu24cis_aide_db_file }}"
          async: "{{ ubtu24cis_aide_init_async }}"
          poll: "{{ ubtu24cis_aide_init_poll }}"

- name: "6.3.2 | PATCH | Ensure filesystem integrity is regularly checked"
  when:
    - ubtu24cis_config_aide
    - ubtu24cis_rule_6_3_2
  tags:
    - level1-server
    - level1-workstation
    - patch
    - rule_6.3.2
    - NIST800-53R5_AU-2
    - cron
    - aide
  block:
    - name: "6.3.2 | PATCH | Ensure filesystem integrity is regularly checked | cron"
      when: ubtu24cis_aide_scan == 'cron'
      ansible.builtin.cron:
        name: Run AIDE integrity check
        cron_file: "{{ ubtu24cis_aide_cron_file }}"
        user: "{{ ubtu24cis_aide_cron_user }}"
        minute: "{{ ubtu24cis_aide_cron_minute | default('0') }}"
        hour: "{{ ubtu24cis_aide_cron_hour | default('5') }}"
        day: "{{ ubtu24cis_aide_cron_day | default('*') }}"
        month: "{{ ubtu24cis_aide_cron_month | default('*') }}"
        weekday: "{{ ubtu24cis_aide_cron_weekday | default('*') }}"
        job: "{{ ubtu24cis_aide_cron_job }}"

    - name: "6.3.2 | PATCH | Ensure filesystem integrity is regularly checked | timer template"
      when: ubtu24cis_aide_scan == 'timer'
      ansible.builtin.template:
        src: "{{ item }}.j2"
        dest: "/{{ item }}"
        owner: root
        group: root
        mode: 'go-r'
      loop:
        - etc/systemd/system/aidecheck.service
        - etc/systemd/system/aidecheck.timer

    - name: "6.3.2 | PATCH | Ensure filesystem integrity is regularly checked | timer service"
      when: ubtu24cis_aide_scan == 'timer'
      ansible.builtin.systemd:
        name: "{{ item }}"
        state: started
        enabled: true
        daemon_reload: true
      loop:
        - aidecheck.service
        - aidecheck.timer

- name: "6.3.3 | Ensure cryptographic mechanisms are used to protect the integrity of audit tools"
  when:
    - ubtu24cis_rule_6_3_3
  tags:
    - level1-server
    - level1-workstation
    - aide
    - file_integrity
    - patch
    - rule_6.3.3
    - NIST800-53R5_NA
  ansible.builtin.blockinfile:
    path: /etc/aide/aide.conf
    marker: "# {mark} Audit tools - CIS benchmark - Ansible-lockdown"
    block: |
      /usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
      /usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
      /usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
      /usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
      /usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512
      /usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512
    validate: aide -D --config %s