diff options
| author | mail_redacted_for_web | 2026-04-18 10:20:56 +0200 |
|---|---|---|
| committer | mail_redacted_for_web | 2026-04-18 10:20:56 +0200 |
| commit | 77628b800070a825e0b7e28f0ccc647d1912f4a4 (patch) | |
| tree | 9edce05e98b1142f480a07b08b3f4d9a95eaa4ae /roles/patch_debian/tasks/main.yaml | |
| parent | b8f96d867a7296bed82c49023f03c16a16da40c0 (diff) | |
| download | os-patch-77628b800070a825e0b7e28f0ccc647d1912f4a4.tar.bz2 | |
feat: Remove rkhunter
- SHM monitoring becomes tedious, and SSH monitoring ignores any
includes. --> infeasible, better switch to other mechanisms like
integrit, tripwire, ...
- http://www.catb.org/~esr/writings/unix-koans/nervous.html
Diffstat (limited to 'roles/patch_debian/tasks/main.yaml')
| -rw-r--r-- | roles/patch_debian/tasks/main.yaml | 20 |
1 files changed, 1 insertions, 19 deletions
diff --git a/roles/patch_debian/tasks/main.yaml b/roles/patch_debian/tasks/main.yaml index 485d60a..f566135 100644 --- a/roles/patch_debian/tasks/main.yaml +++ b/roles/patch_debian/tasks/main.yaml @@ -19,19 +19,6 @@ #changed_when: aue.stdout|int > 0 changed_when: false - block: - - name: Check for existence of rkhunter - ansible.builtin.stat: - path: /usr/bin/rkhunter - register: rkhex - ignore_errors: true - no_log: true - changed_when: false - - name: RKhunter pre-check - ansible.builtin.command: rkhunter -c --sk --rwo --ns - become: true - no_log: true - changed_when: false - when: rkhex.stat is defined and rkhex.stat.executable is defined and rkhex.stat.executable|bool == True - name: Clean packages cache ansible.builtin.command: apt clean changed_when: true @@ -45,7 +32,7 @@ autoremove: "yes" purge: "yes" become: true - name: Update and RKhunter checks + name: Updates when: aue.stdout|int > 0 - block: - name: Check for existence of needrestart @@ -73,11 +60,6 @@ changed_when: false become: true # here, we already listen to "debian updates available" already since we already did a more generic cleanup above (unless narrowed down as well) -- name: RKhunter properties update - ansible.builtin.command: rkhunter --propupd --rwo --ns - become: true - changed_when: true - when: rkhex.stat is defined and rkhex.stat.executable is defined and rkhex.stat.executable|bool == True - name: Reboot if required # ignore_errors: yes ansible.builtin.reboot: |