lucab85/log4j-cve-2021-44228Ansible playbook automating Red Hat's Log4j detector script to scan Linux hosts for CVE-2021-44228 (Log4Shell) vulnerability with GPG verification.
Ansible playbook to verify target Linux hosts using the official Red Hat Log4j detector script for Log4Shell (CVE-2021-44228).
Red Hat version 1.3 detector 2022-01-10.
The result is saved in a txt file under detector_dir (default: /opt/cve-2021-44228/).
Code also available as Ansible Galaxy role lucab85.ansible_role_log4shell
ansible-galaxy install lucab85.ansible_role_log4shell
Default variables scan all the /var/ path for affected files.
You could customize the vars.yml file for more options.
ansible-playbook log4j-cve-2021-44228.yml
None.
ansible 2.9+
default values:
rh_bullettin: >-
https://access.redhat.com/security/vulnerabilities/RHSB-2021-009
intro: |
Ansible Playbook tested with detector version 1.3 released 2022-01-10.
If a 404 error occur please adjust the URL with the latest version available
for detector URL.
Please refer to the Red Hat Security Bullettin for up-to-date information and
adjust the playbook variables accordingly.
{{ rh_bullettin }}.
vulnerable: |
System MIGHT be vulnerable to log4j (CVE-2021-44228)
not_vulnerable: |
System IS NOT vulnerable to log4j (CVE-2021-44228)
report_txt: "/report/vuln_log4j2_path_*.txt"
sh_detector: "cve-2021-44228--2022-01-10-1242.sh"
sh_signature: "cve-2021-44228--2022-01-10-1242.sh.asc"
detector_baseurl: "https://access.redhat.com/sites/default/files/"
force_download: false
detector_path: "/var/"
detector_dir: "/opt/cve-2021-44228/"
detector_run_dir: "tmp"
detector_options: '-n -d --no-progress --scan {{ detector_path }}'
gpg_keyid: "7514F77D8366B0D9"
gpg_server: "pgp.mit.edu"
gpg_public_key: 'gpg --keyserver {{ gpg_server }} --recv {{ gpg_keyid }}'
clean_run_before: true
delete_after: false
verify_gpg: true
rh_bullettin: link of the RHSB (default: https://access.redhat.com/security/vulnerabilities/RHSB-2021-009)intro: introduction textvulnerable: vulnerable text (visible only on debug level 2 execution -vv)not_vulnerable: NOT vulnerable text (visible only on debug level 2 execution -vv)report_txt: report path to print (default: /report/vuln_log4j2_path_*.txt)sh_detector: the filename of the detector bash script filesh_signature: the filename of the detector GPG signature filedetector_baseurl: the base URL to download the previous filesforce_download: force to download every run the code (default: false)detector_path: the path to inspect (default /var/)detector_dir: the download path of the detector (default /opt/cve-2021-44228/)detector_run_dir: the subdirectory to create before the run (default tmp)detector_options: the command lines options for detector script (default -n -d --no-progress --scan {{ detector_path }})gpg_keyid: the GPG public key to download for the verification (default Red Hat Product Security 7514F77D8366B0D9)gpg_server: the GPG key server (default: pgp.mit.edu)gpg_public_key: command for gpg verification (default: gpg --keyserver {{ gpg_server }} --recv {{ gpg_keyid }})clean_run_before: remove the run directory and recreate before the execution - detector requires an empty directory (default true)delete_after: remove the detector_dir after the execution (default false)verify_gpg: perform the GPG signature download and verification (default: true)The full output of the execution of the playbook against the RHEL8 demo target host:
$ ansible-playbook -i test/inventory log4j-cve-2021-44228.yml -vv
ansible-playbook [core 2.12.1]
config file = None
configured module search path = ['/Users/lberton/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /usr/local/Cellar/ansible/5.1.0/libexec/lib/python3.10/site-packages/ansible
ansible collection location = /Users/lberton/.ansible/collections:/usr/share/ansible/collections
executable location = /usr/local/bin/ansible-playbook
python version = 3.10.1 (main, Dec 6 2021, 23:20:29) [Clang 13.0.0 (clang-1300.0.29.3)]
jinja version = 3.0.3
libyaml = True
No config file found; using defaults
Skipping callback 'default', as we already have a stdout callback.
Skipping callback 'minimal', as we already have a stdout callback.
Skipping callback 'oneline', as we already have a stdout callback.
PLAYBOOK: log4j-cve-2021-44228.yml *********************************************************************************************************************************************************
2 plays in log4j-cve-2021-44228.yml
PLAY [download detector for Apache Log4j (CVE-2021-44228)] *********************************************************************************************************************************
META: ran handlers
TASK [include_vars] ************************************************************************************************************************************************************************
task path: /Users/lberton/prj/github/log4j-cve-2021-44228/log4j-cve-2021-44228.yml:29
ok: [localhost] => {"ansible_facts": {"clean_run_before": true, "delete_after": false, "detector_baseurl": "https://access.redhat.com/sites/default/files/", "detector_dir": "/opt/cve-2021-44228/", "detector_options": "-n -d --no-progress --scan {{ detector_path }}", "detector_path": "/var/", "detector_run_dir": "tmp", "force_download": false, "gpg_keyid": "7514F77D8366B0D9", "gpg_public_key": "gpg --keyserver {{ gpg_server }} --recv {{ gpg_keyid }}", "gpg_server": "pgp.mit.edu", "intro": "Ansible Playbook tested with detector version 1.3 released 2022-01-10.\nIf a 404 error occur please adjust the URL with the latest version available\nfor detector URL.\nPlease refer to the Red Hat Security Bullettin for up-to-date information and\nadjust the playbook variables accordingly.\n{{ rh_bullettin }}.\n", "not_vulnerable": "System IS NOT vulnerable to log4j (CVE-2021-44228)\n", "report_txt": "/report/vuln_log4j2_path_*.txt", "rh_bullettin": "https://access.redhat.com/security/vulnerabilities/RHSB-2021-009", "sh_detector": "cve-2021-44228--2022-01-10-1242.sh", "sh_signature": "cve-2021-44228--2022-01-10-1242.sh.asc", "verify_gpg": true, "vulnerable": "System MIGHT be vulnerable to log4j (CVE-2021-44228)\n"}, "ansible_included_var_files": ["/Users/lberton/prj/github/log4j-cve-2021-44228/vars.yml"], "changed": false}
TASK [print information] *******************************************************************************************************************************************************************
task path: /Users/lberton/prj/github/log4j-cve-2021-44228/log4j-cve-2021-44228.yml:31
ok: [localhost] => {
"msg": "Ansible Playbook tested with detector version 1.3 released 2022-01-10.\nIf a 404 error occur please adjust the URL with the latest version available\nfor detector URL.\nPlease refer to the Red Hat Security Bullettin for up-to-date information and\nadjust the playbook variables accordingly.\nhttps://access.redhat.com/security/vulnerabilities/RHSB-2021-009.\n"
}