From 3877a9bab10c8b087ec84b752789aa63f5c9d6c8 Mon Sep 17 00:00:00 2001 From: rndmh3ro Date: Mon, 18 Oct 2021 22:00:01 +0200 Subject: [PATCH] fix comment Signed-off-by: rndmh3ro --- .../workflows/ssh_hardening_custom_tests.yml | 2 +- .../ssh_hardening_custom_tests/INSTALL.rst | 22 ++++++ .../ssh_hardening_custom_tests/molecule.yml | 65 +++++++++++++++- .../ssh_hardening_custom_tests/prepare.yml | 76 +++++++++++++++++++ .../requirements.yml | 3 + .../ssh_hardening_custom_tests/verify.yml | 57 ++++++++++++++ 6 files changed, 222 insertions(+), 3 deletions(-) create mode 100644 molecule/ssh_hardening_custom_tests/INSTALL.rst create mode 100644 molecule/ssh_hardening_custom_tests/prepare.yml create mode 100644 molecule/ssh_hardening_custom_tests/requirements.yml create mode 100644 molecule/ssh_hardening_custom_tests/verify.yml diff --git a/.github/workflows/ssh_hardening_custom_tests.yml b/.github/workflows/ssh_hardening_custom_tests.yml index 71be0d5e..116e46f7 100644 --- a/.github/workflows/ssh_hardening_custom_tests.yml +++ b/.github/workflows/ssh_hardening_custom_tests.yml @@ -63,7 +63,7 @@ jobs: export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd" fi molecule --version - mol --base-config molecule/ssh_hardening/molecule.yml converge -s ssh_hardening_custom_tests + mol --base-config molecule/ssh_hardening/molecule.yml converge -s ssh_hardening_custom_tests env: MOLECULE_DISTRO: ${{ matrix.molecule_distro }} working-directory: ansible_collections/devsec/hardening diff --git a/molecule/ssh_hardening_custom_tests/INSTALL.rst b/molecule/ssh_hardening_custom_tests/INSTALL.rst new file mode 100644 index 00000000..d926ca25 --- /dev/null +++ b/molecule/ssh_hardening_custom_tests/INSTALL.rst @@ -0,0 +1,22 @@ +******* +Docker driver installation guide +******* + +Requirements +============ + +* Docker Engine + +Install +======= + +Please refer to the `Virtual environment`_ documentation for installation best +practices. If not using a virtual environment, please consider passing the +widely recommended `'--user' flag`_ when invoking ``pip``. + +.. _Virtual environment: https://virtualenv.pypa.io/en/latest/ +.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site + +.. code-block:: bash + + $ python3 -m pip install 'molecule[docker]' diff --git a/molecule/ssh_hardening_custom_tests/molecule.yml b/molecule/ssh_hardening_custom_tests/molecule.yml index 3850d626..fb5cd511 100644 --- a/molecule/ssh_hardening_custom_tests/molecule.yml +++ b/molecule/ssh_hardening_custom_tests/molecule.yml @@ -1,3 +1,64 @@ --- -# this file inherits molecule.yml from the ssh_hardening scenario when used like this: -# molecule --base-config molecule/ssh_hardening/molecule.yml converge -s ssh_hardening_custom_tests +dependency: + name: galaxy + options: + role-file: molecule/ssh_hardening/requirements.yml +driver: + name: docker +platforms: + - name: instance + image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest" + command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:ro + privileged: true + tmpfs: + - /tmp + - /run + capabilities: + - SYS_ADMIN + tty: true + env: + http_proxy: "${http_proxy}" + https_proxy: "${https_proxy}" + no_proxy: "${no_proxy}" + container: docker +provisioner: + name: ansible + config_options: + defaults: + interpreter_python: auto_silent + callback_whitelist: profile_tasks, timer, yaml +verifier: + name: ansible + +scenario: + create_sequence: + - dependency + - create + - prepare + check_sequence: + - dependency + - destroy + - create + - prepare + - converge + - check + - destroy + converge_sequence: + - dependency + - create + - prepare + - converge + destroy_sequence: + - destroy + test_sequence: + - dependency + - destroy + - syntax + - create + - prepare + - converge + - idempotence + - verify + - destroy diff --git a/molecule/ssh_hardening_custom_tests/prepare.yml b/molecule/ssh_hardening_custom_tests/prepare.yml new file mode 100644 index 00000000..28a4d77e --- /dev/null +++ b/molecule/ssh_hardening_custom_tests/prepare.yml @@ -0,0 +1,76 @@ +--- +- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings + hosts: all + become: true + environment: + http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}" + https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}" + no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}" + tasks: + - name: use python3 + set_fact: + ansible_python_interpreter: /usr/bin/python3 + when: ansible_facts.distribution == 'Fedora' + + - name: install packages + yum: + name: + - openssh-clients + - openssh-server + - libselinux-python + state: present + update_cache: true + ignore_errors: true + + - name: install packages + dnf: + name: + - openssh-clients + - openssh-server + - procps-ng + state: present + update_cache: true + ignore_errors: true + + - name: install packages + apt: + name: + - openssh-client + - openssh-server + state: present + update_cache: true + ignore_errors: true + + - name: install required tools on SuSE + # cannot use zypper module, since it depends on python-xml + shell: "zypper -n install python-xml" + when: ansible_facts.os_family == 'Suse' + + - name: install packages + zypper: + name: + - "openssh" + when: ansible_facts.os_family == 'Suse' + + - name: install packages + pacman: + name: + - "openssh" + - "awk" + state: present + update_cache: true + ignore_errors: true + + - name: created needed directory + file: + path: "/var/run/sshd" + state: directory + + - name: create ssh host keys + command: "ssh-keygen -A" + when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or + ansible_facts.distribution == "Fedora" or + ansible_facts.distribution == "Amazon" or + ansible_facts.os_family == "Suse" + changed_when: false + ignore_errors: true diff --git a/molecule/ssh_hardening_custom_tests/requirements.yml b/molecule/ssh_hardening_custom_tests/requirements.yml new file mode 100644 index 00000000..53fa9b49 --- /dev/null +++ b/molecule/ssh_hardening_custom_tests/requirements.yml @@ -0,0 +1,3 @@ +--- +roles: + - geerlingguy.git diff --git a/molecule/ssh_hardening_custom_tests/verify.yml b/molecule/ssh_hardening_custom_tests/verify.yml new file mode 100644 index 00000000..159c7617 --- /dev/null +++ b/molecule/ssh_hardening_custom_tests/verify.yml @@ -0,0 +1,57 @@ +--- +- name: Verify + hosts: all + become: true + environment: + http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}" + https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}" + no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}" + roles: + - geerlingguy.git + tasks: + - name: install fake SuSE-release for cinc compatibility + copy: + content: | + openSUSE Faked Enterprise 2020 (x86_64) + VERSION = 2020 + CODENAME = Faked Feature + dest: /etc/SuSE-release + owner: root + group: root + mode: '0444' + when: ansible_facts.os_family == 'Suse' + + - name: install git for SuSE since geerlinguy.git does not support it + zypper: + name: git + state: present + when: ansible_facts.os_family == 'Suse' + + - name: install crypto compat modules on fedora + dnf: + name: libxcrypt-compat + when: ansible_facts.distribution == 'Fedora' + + - name: download cinc-auditor + get_url: + url: https://omnitruck.cinc.sh/install.sh + dest: /tmp/install.sh + mode: '0775' + + - name: install cinc-auditor + shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4" + + - name: Execute cinc-auditor tests + command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip" + register: test_results + changed_when: false + ignore_errors: true + + - name: Display details about the cinc-auditor results + debug: + msg: "{{ test_results.stdout_lines }}" + + - name: Fail when tests fail + fail: + msg: "Inspec failed to validate" + when: test_results.rc != 0