diff --git a/roles/debian/rkhunter/tasks/main.yml b/roles/debian/rkhunter/tasks/main.yml index 9825b0606..76942cca0 100644 --- a/roles/debian/rkhunter/tasks/main.yml +++ b/roles/debian/rkhunter/tasks/main.yml @@ -19,6 +19,18 @@ when: item.stat.exists loop: "{{ _rkhunter_existing_scripts_to_whitelist.results }}" +- name: Check paths for portpath existence + ansible.builtin.stat: + path: "{{ item.split(':')[0] }}" + register: _rkhunter_existing_portpaths_to_whitelist + loop: "{{ rkhunter.portpathwhitelist }}" + +- name: Filter existing portpath + set_fact: + existing_portpaths: "{{ existing_portpaths | default([]) + [item.item] }}" + when: item.stat.exists + loop: "{{ _rkhunter_existing_portpaths_to_whitelist.results }}" + - name: Copy rkhunter configuration. ansible.builtin.template: src: rkhunter.conf.j2 diff --git a/roles/debian/rkhunter/templates/rkhunter.conf.j2 b/roles/debian/rkhunter/templates/rkhunter.conf.j2 index b9e3468a7..8c69d3c1f 100644 --- a/roles/debian/rkhunter/templates/rkhunter.conf.j2 +++ b/roles/debian/rkhunter/templates/rkhunter.conf.j2 @@ -937,9 +937,11 @@ SUSPSCAN_THRESH={{ rkhunter.supscan_threshold }} # #PORT_WHITELIST="" #PORT_PATH_WHITELIST="" -{% for item in rkhunter.portpathwhitelist %} +{% if existing_portpaths is defined and existing_portpaths | length > 0 %} +{% for item in existing_portpaths %} PORT_PATH_WHITELIST={{ item }} {% endfor %} +{% endif %} # # The following option can be used to tell rkhunter where the operating system