From 254b62d980002ec31ff1c0e0ab9c7d0b6a6be648 Mon Sep 17 00:00:00 2001 From: Farid Joubbi Date: Tue, 19 Jan 2021 14:05:33 +0100 Subject: [PATCH] Added comment on top of template about which role modified the resulting file. https://github.com/dev-sec/ansible-collection-hardening/issues/345 Signed-off-by: Farid Joubbi --- roles/nginx_hardening/templates/hardening.conf.j2 | 1 + roles/os_hardening/templates/etc/audit/auditd.conf.j2 | 1 + roles/os_hardening/templates/etc/default/ufw.j2 | 1 + roles/os_hardening/templates/etc/initramfs-tools/modules.j2 | 1 + roles/os_hardening/templates/etc/libuser.conf.j2 | 1 + roles/os_hardening/templates/etc/login.defs.j2 | 1 + roles/os_hardening/templates/etc/modprobe.d/modprobe.j2 | 1 + roles/os_hardening/templates/etc/pam.d/rhel_system_auth.j2 | 1 + roles/os_hardening/templates/etc/profile.d/profile.conf.j2 | 1 + roles/os_hardening/templates/etc/securetty.j2 | 1 + .../os_hardening/templates/etc/sysconfig/rhel_sysconfig_init.j2 | 1 + .../os_hardening/templates/usr/share/pam-configs/pam_passwdqd.j2 | 1 + roles/os_hardening/templates/usr/share/pam-configs/pam_tally2.j2 | 1 + roles/ssh_hardening/templates/authorized_principals.j2 | 1 + roles/ssh_hardening/templates/openssh.conf.j2 | 1 + roles/ssh_hardening/templates/opensshd.conf.j2 | 1 + roles/ssh_hardening/templates/revoked_keys.j2 | 1 + roles/ssh_hardening/templates/trusted_user_ca_keys.j2 | 1 + 18 files changed, 18 insertions(+) diff --git a/roles/nginx_hardening/templates/hardening.conf.j2 b/roles/nginx_hardening/templates/hardening.conf.j2 index f015dc80..7710f595 100644 --- a/roles/nginx_hardening/templates/hardening.conf.j2 +++ b/roles/nginx_hardening/templates/hardening.conf.j2 @@ -1,4 +1,5 @@ # {{ ansible_managed|comment }} +# Generated by Ansible {{ ansible_role_name }} # Additional configuration for Nginx. client_header_buffer_size {{ nginx_client_header_buffer_size }}; diff --git a/roles/os_hardening/templates/etc/audit/auditd.conf.j2 b/roles/os_hardening/templates/etc/audit/auditd.conf.j2 index 68cf83ac..21b37c1f 100644 --- a/roles/os_hardening/templates/etc/audit/auditd.conf.j2 +++ b/roles/os_hardening/templates/etc/audit/auditd.conf.j2 @@ -1,4 +1,5 @@ {{ ansible_managed | comment }} +# Generated by Ansible {{ ansible_role_name }} log_file = /var/log/audit/audit.log log_format = RAW diff --git a/roles/os_hardening/templates/etc/default/ufw.j2 b/roles/os_hardening/templates/etc/default/ufw.j2 index 6cea59ad..d668e620 100644 --- a/roles/os_hardening/templates/etc/default/ufw.j2 +++ b/roles/os_hardening/templates/etc/default/ufw.j2 @@ -1,4 +1,5 @@ {{ ansible_managed | comment }} +# Generated by Ansible {{ ansible_role_name }} # /etc/default/ufw # diff --git a/roles/os_hardening/templates/etc/initramfs-tools/modules.j2 b/roles/os_hardening/templates/etc/initramfs-tools/modules.j2 index 8e4eeb13..52b7a332 100644 --- a/roles/os_hardening/templates/etc/initramfs-tools/modules.j2 +++ b/roles/os_hardening/templates/etc/initramfs-tools/modules.j2 @@ -1,4 +1,5 @@ {{ ansible_managed | comment }} +# Generated by Ansible {{ ansible_role_name }} # This file contains the names of kernel modules that should be loaded at boot time, one per line. Lines beginning with "#" are ignored. # diff --git a/roles/os_hardening/templates/etc/libuser.conf.j2 b/roles/os_hardening/templates/etc/libuser.conf.j2 index 20ea2e69..58564e91 100644 --- a/roles/os_hardening/templates/etc/libuser.conf.j2 +++ b/roles/os_hardening/templates/etc/libuser.conf.j2 @@ -1,4 +1,5 @@ {{ ansible_managed | comment }} +# Generated by Ansible {{ ansible_role_name }} # See libuser.conf(5) for more information. diff --git a/roles/os_hardening/templates/etc/login.defs.j2 b/roles/os_hardening/templates/etc/login.defs.j2 index cc4c275e..e210d162 100644 --- a/roles/os_hardening/templates/etc/login.defs.j2 +++ b/roles/os_hardening/templates/etc/login.defs.j2 @@ -1,4 +1,5 @@ {{ ansible_managed | comment }} +# Generated by Ansible {{ ansible_role_name }} # Configuration control definitions for the login package. # diff --git a/roles/os_hardening/templates/etc/modprobe.d/modprobe.j2 b/roles/os_hardening/templates/etc/modprobe.d/modprobe.j2 index ca8c20ca..c2626d3d 100644 --- a/roles/os_hardening/templates/etc/modprobe.d/modprobe.j2 +++ b/roles/os_hardening/templates/etc/modprobe.d/modprobe.j2 @@ -1,4 +1,5 @@ {{ ansible_managed | comment }} +# Generated by Ansible {{ ansible_role_name }} {% for fs in os_unused_filesystems | difference(os_filesystem_whitelist) %} install {{fs}} /bin/true diff --git a/roles/os_hardening/templates/etc/pam.d/rhel_system_auth.j2 b/roles/os_hardening/templates/etc/pam.d/rhel_system_auth.j2 index cc7d4876..c50af6ed 100644 --- a/roles/os_hardening/templates/etc/pam.d/rhel_system_auth.j2 +++ b/roles/os_hardening/templates/etc/pam.d/rhel_system_auth.j2 @@ -1,4 +1,5 @@ {{ ansible_managed | comment }} +# Generated by Ansible {{ ansible_role_name }} #%PAM-1.0 {% if os_auth_retries > 0 %} diff --git a/roles/os_hardening/templates/etc/profile.d/profile.conf.j2 b/roles/os_hardening/templates/etc/profile.d/profile.conf.j2 index 9f788187..a6e2a9d4 100644 --- a/roles/os_hardening/templates/etc/profile.d/profile.conf.j2 +++ b/roles/os_hardening/templates/etc/profile.d/profile.conf.j2 @@ -1,4 +1,5 @@ {{ ansible_managed | comment }} +# Generated by Ansible {{ ansible_role_name }} # Disable core dumps via soft limits for all users. Compliance to this setting is voluntary and can be modified by users up to a hard limit. This setting is a sane default. ulimit -S -c 0 > /dev/null 2>&1 diff --git a/roles/os_hardening/templates/etc/securetty.j2 b/roles/os_hardening/templates/etc/securetty.j2 index 2d58bf4f..b08965a9 100644 --- a/roles/os_hardening/templates/etc/securetty.j2 +++ b/roles/os_hardening/templates/etc/securetty.j2 @@ -1,4 +1,5 @@ {{ ansible_managed | comment }} +# Generated by Ansible {{ ansible_role_name }} # A list of TTYs, from which root can log in # see `man securetty` for reference diff --git a/roles/os_hardening/templates/etc/sysconfig/rhel_sysconfig_init.j2 b/roles/os_hardening/templates/etc/sysconfig/rhel_sysconfig_init.j2 index e5c3f76c..f5a8ca6a 100644 --- a/roles/os_hardening/templates/etc/sysconfig/rhel_sysconfig_init.j2 +++ b/roles/os_hardening/templates/etc/sysconfig/rhel_sysconfig_init.j2 @@ -1,4 +1,5 @@ {{ ansible_managed | comment }} +# Generated by Ansible {{ ansible_role_name }} # color => new RH6.0 bootup # verbose => old-style bootup diff --git a/roles/os_hardening/templates/usr/share/pam-configs/pam_passwdqd.j2 b/roles/os_hardening/templates/usr/share/pam-configs/pam_passwdqd.j2 index f81d743e..77f9ab1f 100644 --- a/roles/os_hardening/templates/usr/share/pam-configs/pam_passwdqd.j2 +++ b/roles/os_hardening/templates/usr/share/pam-configs/pam_passwdqd.j2 @@ -1,4 +1,5 @@ {{ ansible_managed | comment }} +# Generated by Ansible {{ ansible_role_name }} Name: passwdqc password strength enforcement Default: yes diff --git a/roles/os_hardening/templates/usr/share/pam-configs/pam_tally2.j2 b/roles/os_hardening/templates/usr/share/pam-configs/pam_tally2.j2 index 5e813b9f..8023f565 100644 --- a/roles/os_hardening/templates/usr/share/pam-configs/pam_tally2.j2 +++ b/roles/os_hardening/templates/usr/share/pam-configs/pam_tally2.j2 @@ -1,4 +1,5 @@ {{ ansible_managed | comment }} +# Generated by Ansible {{ ansible_role_name }} Name: tally2 lockout after failed attempts enforcement Default: yes diff --git a/roles/ssh_hardening/templates/authorized_principals.j2 b/roles/ssh_hardening/templates/authorized_principals.j2 index be837911..aaaba5ee 100644 --- a/roles/ssh_hardening/templates/authorized_principals.j2 +++ b/roles/ssh_hardening/templates/authorized_principals.j2 @@ -1,4 +1,5 @@ {{ ansible_managed | comment }} +# Generated by Ansible {{ ansible_role_name }} {% for principal in item.principals %} {{ principal }} diff --git a/roles/ssh_hardening/templates/openssh.conf.j2 b/roles/ssh_hardening/templates/openssh.conf.j2 index 0b9dfe83..13ff1a6a 100644 --- a/roles/ssh_hardening/templates/openssh.conf.j2 +++ b/roles/ssh_hardening/templates/openssh.conf.j2 @@ -1,5 +1,6 @@ #jinja2: trim_blocks: "true", lstrip_blocks: "true" {{ ansible_managed | comment }} +# Generated by Ansible {{ ansible_role_name }} # This is the ssh client system-wide configuration file. # See ssh_config(5) for more information on any settings used. diff --git a/roles/ssh_hardening/templates/opensshd.conf.j2 b/roles/ssh_hardening/templates/opensshd.conf.j2 index 1deefa44..1fd5f5b4 100644 --- a/roles/ssh_hardening/templates/opensshd.conf.j2 +++ b/roles/ssh_hardening/templates/opensshd.conf.j2 @@ -1,5 +1,6 @@ #jinja2: trim_blocks: "true", lstrip_blocks: "true" {{ ansible_managed | comment }} +# Generated by Ansible {{ ansible_role_name }} # This is the sshd server system-wide configuration file. # See sshd_config(5) for more information. diff --git a/roles/ssh_hardening/templates/revoked_keys.j2 b/roles/ssh_hardening/templates/revoked_keys.j2 index 1a7eba6c..654b52fd 100644 --- a/roles/ssh_hardening/templates/revoked_keys.j2 +++ b/roles/ssh_hardening/templates/revoked_keys.j2 @@ -1,4 +1,5 @@ {{ ansible_managed | comment }} +# Generated by Ansible {{ ansible_role_name }} {% for key in ssh_server_revoked_keys %} {{ key }} diff --git a/roles/ssh_hardening/templates/trusted_user_ca_keys.j2 b/roles/ssh_hardening/templates/trusted_user_ca_keys.j2 index bd62ccd4..a627fb0d 100644 --- a/roles/ssh_hardening/templates/trusted_user_ca_keys.j2 +++ b/roles/ssh_hardening/templates/trusted_user_ca_keys.j2 @@ -1,4 +1,5 @@ {{ ansible_managed | comment }} +# Generated by Ansible {{ ansible_role_name }} {% for key in ssh_trusted_user_ca_keys %} {{ key }}