Amazon2 tweaks (#48)

* account for different amazon2 syntax

* cleanup

* kill auditd on Amazon

Author: Greg Malkov

tasks/disable_auditd.yml

@@ -0,0 +1,14 @@
+---
+- name: check auditd status
+  command: service auditd status
+  register: auditd_status
+  ignore_errors: true
+  changed_when: false
+
+- name: Stop service auditd
+  command: service auditd stop
+  when: auditd_status.rc == 0
+
+- name: Disable service auditd
+  command: systemctl disable auditd
+  when: auditd_status.rc == 0

tasks/main.yml

@@ -6,6 +6,10 @@
   include: pkg_url.yml
   when: threatstack_pkg_url is undefined
 
+- name: Disable auditd service
+  include: disable_auditd.yml
+  when: ansible_distribution == 'Amazon'
+
 - name: Run Apt configure and install Threat Stack
   include: apt_install.yml
   when: ansible_os_family == 'Debian'

tasks/tsagent_setup.yml

@@ -27,9 +27,6 @@
   set_fact:
     config_checksum: "{{ config_string | checksum }}"
 
-- debug:
-    msg: "{{ threatstack_agent_config_args }}"
-
 - name: Create file to track checksum of config string
   copy:
     content: "{{ config_checksum }}"

templates/threatstack.j2

@@ -3,7 +3,7 @@ name=Threat Stack Package Repository
 {% if ansible_distribution == 'Amazon' %}
 {% if threatstack_v1 %}
 baseurl={{threatstack_pkg_url}}/Amazon
-{% elif ansible_distribution_version == '2' %}
+{% elif ansible_distribution_version == '2' or ansible_kernel is search("\.amzn2\.") %}
 baseurl={{threatstack_pkg_url}}/Amazon/2
 {% else %}
 baseurl={{threatstack_pkg_url}}/Amazon/1