diff --git a/files/rsyslog.d/mail-sasl.conf b/files/rsyslog.d/mail-sasl.conf new file mode 100644 index 0000000..e0b507d --- /dev/null +++ b/files/rsyslog.d/mail-sasl.conf @@ -0,0 +1,4 @@ +# Managed by Ansible +# Write SASLS log to file + +:msg, contains, "SASL" /var/log/mail-sasl.log diff --git a/files/rsyslog.d/mail.conf b/files/rsyslog.d/mail.conf new file mode 100644 index 0000000..3a5a074 --- /dev/null +++ b/files/rsyslog.d/mail.conf @@ -0,0 +1,4 @@ +# Managed by Ansible + +module(load="mmanon") +mail.* action(type="mmanon") diff --git a/tasks/fail2ban.yml b/tasks/fail2ban.yml index 5321173..98aef5e 100644 --- a/tasks/fail2ban.yml +++ b/tasks/fail2ban.yml @@ -1,12 +1,12 @@ --- -- name: "Fail2ban | Copy jaiil file" +- name: "Fail2ban | Copy jail file" ansible.builtin.copy: src: files/fail2ban/postfix-sasl.conf dest: "{{ fail2ban_jail_dir }}/postfix-sasl.conf" mode: "0644" notify: reload fail2ban -- name: "fail2ban | Copy SASL filter" +- name: "Fail2ban | Copy SASL filter" ansible.builtin.copy: src: files/fail2ban/postfix-sasl.local dest: "{{ fail2ban_filter_dir }}/postfix-sasl.local" @@ -14,9 +14,10 @@ notify: reload fail2ban - name: "Fail2ban | Setup SASL logging" - ansible.builtin.lineinfile: - dest: /etc/rsyslog.d/postfix.conf - line: ':msg, contains, \"SASL\" /var/log/{{ mail_sasl_log }}' + ansible.builtin.copy: + src: rsyslog.d/mail-sasl.conf + dest: /etc/rsyslog.d/mail-sasl.conf + mode: "0644" notify: restart rsyslog - name: "Fail2ban | Setup logrotate" diff --git a/tasks/main.yml b/tasks/main.yml index f39c431..0740942 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -49,3 +49,8 @@ - name: Monitoring ansible.builtin.import_tasks: monitoring.yml tags: monitoring + +- name: Logging + ansible.builtin.import_tasks: rsyslog.yml + tags: logging + when: postfix_type == "internet" diff --git a/tasks/rsyslog.yml b/tasks/rsyslog.yml new file mode 100644 index 0000000..acf4303 --- /dev/null +++ b/tasks/rsyslog.yml @@ -0,0 +1,14 @@ +--- +- name: "Rsyslog | Disable logging of IP addresses" + ansible.builtin.copy: + src: rsyslog.d/mail.conf + dest: /etc/rsyslog.d/mail.conf + mode: "0644" + notify: restart rsyslog + +- name: "Rsyslog | Disable mail logging to syslog" + ansible.builtin.replace: + path: /etc/rsyslog.conf + regexp: "^\\*\\.\\*(?!.*(mail\\.none).*$).*" + replace: "*.*;auth,authpriv.none,mail.none -/var/log/syslog" + notify: restart rsyslog