History rewrite

ansible/roles/clean/tasks/debian.yml

@@ -0,0 +1,81 @@
+---
+
+- name: Remove audit log files
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - "/var/log/audit/audit.log"
+    - "/var/log/wtmp"
+    - "/var/log/lastlog"
+
+- name: Check to see if the /var/log/audit directory exists
+  ansible.builtin.stat:
+    path: "/var/log/audit"
+  register: audit_directory
+
+- name: Ensure /var/log/audit directory exists
+  ansible.builtin.file:
+    path: /var/log/audit
+    state: directory
+    mode: "0750"
+    owner: root
+    group: adm
+  when: audit_directory.stat.exists
+
+- name: Ensure /var/log/audit/audit.log exists
+  ansible.builtin.file:
+    path: /var/log/audit/audit.log
+    state: touch
+    mode: "0640"
+    owner: root
+    group: adm
+  when: audit_directory.stat.exists
+
+- name: Ensure wtmp and lastlog exist with the correct permissions
+  ansible.builtin.copy:
+    dest: "{{ item }}"
+    content: ""
+    mode: "0664"
+    owner: root
+    group: utmp
+  loop:
+    - "/var/log/wtmp"
+    - "/var/log/lastlog"
+
+- name: Cleaning persistent udev rules
+  ansible.builtin.file:
+    path: /etc/udev/rules.d/70-persistent-net.rules
+    state: absent
+
+- name: "Cleaning the /tmp directories"
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - "/tmp/*"
+    - "/var/tmp/*"
+
+- name: "Cleaning the SSH host keys."
+  shell: |
+    rm -f /etc/ssh/ssh_host_*
+
+- name: remove /etc/machine-id
+  file:
+    path: /etc/machine-id
+    state: absent
+
+- name: remove /var/lib/dbus/machine-id
+  file:
+    path: /var/lib/dbus/machine-id
+    state: absent
+
+- name: generate new machine-id
+  command: systemd-machine-id-setup
+
+- name: Cleaning the shell history
+  shell: |
+    unset HISTFILE
+    history -cw
+    echo > ~/.bash_history
+    rm -fr /root/.bash_history

ansible/roles/clean/tasks/main.yml

@@ -0,0 +1,10 @@
+---
+- name: "Clean the {{ ansible_facts['distribution'] }} guest operating system."
+  include_tasks: "{{ ansible_facts['distribution'] | lower }}.yml"
+  when: "ansible_facts['distribution'] == 'Debian'"
+- name: "Clean the {{ ansible_facts['distribution'] }} guest operating system."
+  include_tasks: "{{ ansible_facts['distribution'] | lower }}.yml"
+  when: "ansible_facts['distribution'] == 'Ubuntu'"
+- name: "Clean the {{ ansible_facts['distribution'] }} guest operating system."
+  include_tasks: redhat.yml
+  when: "ansible_facts['distribution'] in ['RedHat', 'CentOS', 'Rocky', 'AlmaLinux', 'OracleLinux']"

ansible/roles/clean/tasks/redhat.yml

@@ -0,0 +1,59 @@
+---
+
+- name: "Cleaning all audit logs."
+  shell: |
+    if [ -f /var/log/audit/audit.log ]; then
+    cat /dev/null > /var/log/audit/audit.log
+    fi
+    if [ -f /var/log/wtmp ]; then
+    cat /dev/null > /var/log/wtmp
+    fi
+    if [ -f /var/log/lastlog ]; then
+    cat /dev/null > /var/log/lastlog
+    fi
+
+- name: "Cleaning persistent udev rules."
+  shell: |
+    if [ -f /etc/udev/rules.d/70-persistent-net.rules ]; then
+    rm /etc/udev/rules.d/70-persistent-net.rules
+    fi
+
+- name: "Cleaning the /tmp directories"
+  shell: |
+    rm -rf /tmp/*
+    rm -rf /var/tmp/*
+    rm -rf /var/cache/dnf/*
+
+- name: "Cleaning the Red Hat Subscription Manager logs."
+  shell: |
+    rm -rf /var/log/rhsm/*
+  when: "ansible_facts['distribution'] == 'RedHat'"
+
+- name: "Cleaning the SSH host keys."
+  shell: |
+    rm -f /etc/ssh/ssh_host_*
+
+- name: "Cleaning the machine-id."
+  when: 'ansible_facts[''distribution_major_version''] <= "8"'
+  shell: |
+    truncate -s 0 /etc/machine-id
+    rm /var/lib/dbus/machine-id
+    ln -s /etc/machine-id /var/lib/dbus/machine-id
+
+- name: "Cleaning the machine-id."
+  when: 'ansible_facts[''distribution_major_version''] >= "9"'
+  shell: |
+    truncate -s 0 /etc/machine-id
+
+- name: "Cleaning the shell history."
+  shell: |
+    unset HISTFILE
+    history -cw
+    echo > ~/.bash_history
+    rm -fr /root/.bash_history
+
+- name: "Running a sync."
+  shell: |
+    sync && sync
+
+...

ansible/roles/clean/tasks/ubuntu.yml

@@ -0,0 +1,93 @@
+---
+
+- name: Remove audit log files
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - "/var/log/audit/audit.log"
+    - "/var/log/wtmp"
+    - "/var/log/lastlog"
+
+- name: Check to see if the /var/log/audit directory exists
+  ansible.builtin.stat:
+    path: "/var/log/audit"
+  register: audit_directory
+
+- name: Ensure /var/log/audit directory exists
+  ansible.builtin.file:
+    path: /var/log/audit
+    state: directory
+    mode: "0750"
+    owner: root
+    group: adm
+  when: audit_directory.stat.exists
+
+- name: Ensure /var/log/audit/audit.log exists
+  ansible.builtin.file:
+    path: /var/log/audit/audit.log
+    state: touch
+    mode: "0640"
+    owner: root
+    group: adm
+  when: audit_directory.stat.exists
+
+- name: Ensure wtmp and lastlog exist with the correct permissions
+  ansible.builtin.copy:
+    dest: "{{ item }}"
+    content: ""
+    mode: "0664"
+    owner: root
+    group: utmp
+  loop:
+    - "/var/log/wtmp"
+    - "/var/log/lastlog"
+
+- name: Cleaning persistent udev rules
+  ansible.builtin.file:
+    path: /etc/udev/rules.d/70-persistent-net.rules
+    state: absent
+
+- name: "Cleaning the /tmp directories"
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - "/tmp/*"
+    - "/var/tmp/*"
+
+- name: Cleaning the SSH host keys
+  shell: |
+    rm -f /etc/ssh/ssh_host_*
+
+- name: remove /etc/machine-id
+  file:
+    path: /etc/machine-id
+    state: absent
+
+- name: remove /var/lib/dbus/machine-id
+  file:
+    path: /var/lib/dbus/machine-id
+    state: absent
+
+- name: generate new machine-id
+  command: systemd-machine-id-setup
+
+- name: Clean apt
+  ansible.builtin.apt:
+    autoclean: yes
+    autoremove: yes
+    clean: yes
+
+- name: Cleaning the shell history
+  shell: |
+    unset HISTFILE
+    history -cw
+    echo > ~/.bash_history
+    rm -fr /root/.bash_history
+
+- name: Clean cloud-init
+  ansible.builtin.command: cloud-init clean
+  when: cloud_init | bool
+
+...