Add OSSEC rule to indicate to admins what ansible-apt-key alert means

[redshiftzero]

Status

Ready for review

Description of Changes

This PR:

• Towards OSSEC: Running Ansible playbooks triggers level 13 alerts #2156. This adds an OSSEC rule to catch the alerts that bubble up when the Ansible playbooks are run and allow the alert to fire with a useful description for admins.
• DRYs up the OSSEC configuration tests and moves alert text to the YAML vars.
• Closes Add developer docs for testing OSSEC rules #2182.

Testing

• Config tests fail on 1da1664 in the staging environment (error should involve rule_id)
• After 7d8af79 all config tests pass

Deployment

Rules should be deployed via the SecureDrop OSSEC deb packages without issue.

Checklist

If you made changes to the system configuration:

• Configuration tests pass

If you made changes to documentation:

• Doc linting passed locally

[conorsch]

Reviewing now.

[conorsch]

Beautiful job on the new test vars! The additions even pass YAML linting standards. 🥇

[conorsch]

In the note::, the leading "This" refers to statements made in the preceding paragraph text, which somewhat defeats the purpose of using a Note. How about:

The use of automatic upgrades for release deployment means that any changes made locally by administrators to their OSSEC rules will not persist after a SecureDrop update.

[redshiftzero]

Fair! Let me know when you're done reviewing / when it's cool for me to force push without being annoying and I'll fix this.

[conorsch]

Confirmed that the testinfra tests fail when run against staging machines provisioned on latest develop, and pass when run against staging machines provisioned with new deb packages based on this feature branch.

The docs additions are solid. We'll certainly have to flesh out the docs more in the coming releases—some of the info such as useful logfiles should be ported from the OSSEC guide to the writing alerts guide—but these additions are great to have in as soon as possible.

One question: won't only the first Ansible-related alert get a custom message, and all the other events will continue to fire? It appears as if only the apt_key module events will get a custom message, and all the rest will operate as before. If that's the case, then perhaps we should leave #2156 open, since it's still very much a problem.

For example, during testing just now, running the playbooks against staging creates dozens of alerts—if we detect an Ansible playbook run, I'd prefer to silence the subsequent alerts, as well.

[redshiftzero]

What you say re: this PR only addressing the first Ansible-related alert is true. I agree in that case that #2156 should stay open until we silence the other alerts (if they are not providing useful information). Edited PR description accordingly.

[conorsch]

Excellent, thanks for the clarification, @redshiftzero.

[redshiftzero]

FYI I made that docs change @conorsch

[conorsch]

Solid progress toward the goal of reducing IDS noise. Excellent additions to testing and developer documentation. 😎