improvements

Author: P4T12ICK

tasks/install_auditd.yml

@@ -49,6 +49,8 @@
   become: yes
 
 - name: Create folder directory for inputs configuration
+  become: true
+  become_user: splunkfwd
   file:
     path: "{{ item }}"
     state: directory
@@ -57,6 +59,8 @@
     - /opt/splunkforwarder/etc/apps/auditd_app/local/
 
 - name: copy inputs.conf to capture auditd logs
+  become: true
+  become_user: splunkfwd
   copy:
     src: auditd_inputs.conf
     dest: /opt/splunkforwarder/etc/apps/auditd_app/local/inputs.conf

tasks/install_osquery_linux.yml

@@ -75,6 +75,7 @@
 
 - name: Create folder directory for inputs configuration
   become: true
+  become_user: splunkfwd
   file:
     path: "{{ item }}"
     state: directory
@@ -84,6 +85,7 @@
 
 - name: copy inputs.conf to capture osquery logs
   become: true
+  become_user: splunkfwd
   copy:
     src: osquery_inputs.conf
     dest: /opt/splunkforwarder/etc/apps/osquery_app/local/inputs.conf

tasks/install_sysmon_linux.yml

@@ -50,6 +50,7 @@
 
 - name: Create folder directory for inputs configuration
   become: true
+  become_user: splunkfwd
   file:
     path: "{{ item }}"
     state: directory
@@ -59,6 +60,7 @@
 
 - name: copy inputs.conf to capture sysmon for linux logs
   become: true
+  become_user: splunkfwd
   copy:
     src: sysmon_inputs.conf
     dest: /opt/splunkforwarder/etc/apps/sysmon_app/local/inputs.conf

tasks/install_universal_forwarder.yml

@@ -1,26 +1,39 @@
 ---
 
+- name: Create splunkfwd group
+  become: true
+  group:
+    name: splunkfwd
+    state: present
+
+- name: Create splunkfwd user
+  become: true
+  user:
+    name: splunkfwd
+    group: splunkfwd
+    create_home: yes
+    state: present
+
 - name: Install splunk uf
   become: true
   apt: deb="{{ ludus_ar_linux_splunk_uf_url }}"
 
 - name: copy outputs.conf to forward data to splunk server
   become: true
+  become_user: splunkfwd
   template:
     src: outputs.conf.j2
     dest: /opt/splunkforwarder/etc/system/local/outputs.conf
     force: yes
 
 - name: splunk license acceptance
   become: true
+  become_user: splunkfwd
   command: /opt/splunkforwarder/bin/splunk start --accept-license --answer-yes --no-prompt --seed-passwd {{ ludus_ar_linux_splunk_password }}
 
-- name: Wait for splunk uf to start
-  pause:
-    seconds: 180
-
 - name: Stop splunk uf
   become: true
+  become_user: splunkfwd
   command: "/opt/splunkforwarder/bin/splunk stop"
 
 - name: setup to start at boot

tasks/main.yml

@@ -6,6 +6,8 @@
 - include_tasks: install_auditd.yml
 - include_tasks: install_art.yml
 
-- name: Restart splunk uf
+- name: Start splunk uf
   become: true
-  command: "systemctl restart SplunkForwarder"
+  systemd:
+    name: SplunkForwarder
+    state: restarted