Update supported OS versions to current Fedora (42/43/44) and Ubuntu (22.04/24.04/26.04) (#946)
* Update testing and remove old, unsupported OS versions Signed-off-by: Martin Schurz <[email protected]> * Update Arch OS Signed-off-by: Martin Schurz <[email protected]> * Fix SuSE login.defs issues Signed-off-by: Martin Schurz <[email protected]> * Debug ... Signed-off-by: Martin Schurz <[email protected]> * Fix SuSE stuff Signed-off-by: Martin Schurz <[email protected]> * Fix SuSE stuff Signed-off-by: Martin Schurz <[email protected]> * Update OS Support Signed-off-by: Martin Schurz <[email protected]> * Use Ansible mysql module Signed-off-by: Martin Schurz <[email protected]> * Update OS Support Signed-off-by: Martin Schurz <[email protected]> * Use existing Fedora images Signed-off-by: Martin Schurz <[email protected]> * Fix VM tests Signed-off-by: Martin Schurz <[email protected]> * fix last errors Signed-off-by: Martin Schurz <[email protected]> * Final fixes Signed-off-by: Martin Schurz <[email protected]> --------- Signed-off-by: Martin Schurz <[email protected]>
This commit is contained in:
Martin Schurz authored and GitHub committed
1 parent
6c0d54cbe5
commit
38791f0199
35 files changed
+85
-78
No files matched your search
@@ -44,9 +44,9 @@ jobs:
|
||||
- rocky8
|
||||
- rocky9
|
||||
# - rocky10 # problem with baseline
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
# - ubuntu2604 # problem with test setup
|
||||
- debian11
|
||||
- debian12
|
||||
- debian13
|
||||
|
||||
@@ -43,9 +43,9 @@ jobs:
|
||||
- rocky8
|
||||
- rocky9
|
||||
- rocky10
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
- ubuntu2604
|
||||
- debian11
|
||||
- debian12
|
||||
- debian13
|
||||
|
||||
@@ -46,11 +46,12 @@ jobs:
|
||||
- rocky8
|
||||
- rocky9
|
||||
- rocky10
|
||||
- fedora39
|
||||
- fedora40
|
||||
- ubuntu2004
|
||||
- fedora42
|
||||
- fedora43
|
||||
- fedora44
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
- ubuntu2604
|
||||
- debian11
|
||||
- debian12
|
||||
- debian13
|
||||
|
||||
@@ -44,13 +44,14 @@ jobs:
|
||||
- generic/centos9s
|
||||
- generic/rocky8
|
||||
- generic/rocky9
|
||||
- fedora/39-cloud-base
|
||||
- fedora/40-cloud-base
|
||||
- generic/ubuntu2004
|
||||
- alvistack/fedora-42
|
||||
# - alvistack/fedora-43 # no compatible test image
|
||||
- generic/ubuntu2204
|
||||
- alvistack/ubuntu-24.04
|
||||
# - alvistack/ubuntu-26.04 # no compatible test image
|
||||
- generic/debian11
|
||||
- generic/debian12
|
||||
- cloud-image/debian-13
|
||||
- generic/opensuse15
|
||||
- generic/arch
|
||||
steps:
|
||||
|
||||
@@ -49,11 +49,12 @@ jobs:
|
||||
- rocky8
|
||||
- rocky9
|
||||
- rocky10
|
||||
- fedora39
|
||||
- fedora40
|
||||
- ubuntu2004
|
||||
- fedora42
|
||||
- fedora43
|
||||
- fedora44
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
- ubuntu2604
|
||||
- debian11
|
||||
- debian12
|
||||
- debian13
|
||||
|
||||
@@ -49,11 +49,12 @@ jobs:
|
||||
- rocky8
|
||||
- rocky9
|
||||
- rocky10
|
||||
- fedora39
|
||||
- fedora40
|
||||
- ubuntu2004
|
||||
- fedora42
|
||||
- fedora43
|
||||
- fedora44
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
- ubuntu2604
|
||||
- debian11
|
||||
- debian12
|
||||
- debian13
|
||||
|
||||
@@ -39,10 +39,10 @@ jobs:
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- generic/openbsd7
|
||||
- generic/freebsd13
|
||||
- generic/freebsd14
|
||||
- cloud-image/debian-13
|
||||
- cloud-image/ubuntu-24.04
|
||||
- cloud-image/ubuntu-26.04
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
|
||||
@@ -17,10 +17,10 @@ This collection provides battle tested hardening for:
|
||||
- AlmaLinux 8/9/10
|
||||
- Rocky Linux 8/9/10
|
||||
- Debian 11/12/13
|
||||
- Ubuntu 20.04/22.04/24.04
|
||||
- Ubuntu 22.04/24.04/26.04
|
||||
- Amazon Linux (some roles supported)
|
||||
- Arch Linux (some roles supported)
|
||||
- Fedora 39/40 (some roles supported)
|
||||
- Fedora 42/43/44 (some roles supported)
|
||||
- Suse Tumbleweed (some roles supported)
|
||||
- MySQL
|
||||
- MariaDB >= 5.5.65, >= 10.1.45, >= 10.3.17
|
||||
|
||||
@@ -15,14 +15,6 @@
|
||||
- ansible_facts.distribution == "Ubuntu"
|
||||
- ansible_facts.distribution_major_version|int > 19
|
||||
|
||||
- name: Determine required MySQL Python libraries.
|
||||
ansible.builtin.set_fact:
|
||||
mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
|
||||
when:
|
||||
- mysql_python_package_debian is not defined
|
||||
- ansible_facts.distribution != "Ubuntu"
|
||||
- ansible_facts.distribution_major_version|int < 20
|
||||
|
||||
- name: Use Python 3 on Suse
|
||||
ansible.builtin.set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
|
||||
@@ -51,14 +51,6 @@
|
||||
- ansible_facts.distribution == "Ubuntu"
|
||||
- ansible_facts.distribution_major_version|int > 19
|
||||
|
||||
- name: Determine required MySQL Python libraries.
|
||||
ansible.builtin.set_fact:
|
||||
mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
|
||||
when:
|
||||
- mysql_python_package_debian is not defined
|
||||
- ansible_facts.distribution != "Ubuntu"
|
||||
- ansible_facts.distribution_major_version|int < 20
|
||||
|
||||
- name: Install required MySQL Python libraries on RHEL
|
||||
ansible.builtin.dnf:
|
||||
name: "{% if 'python3' in ansible_python_interpreter | default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
- name: Create users for test
|
||||
community.mysql.mysql_query:
|
||||
ansible.mysql.mysql_query:
|
||||
query:
|
||||
- CREATE USER 'user'@'delete';
|
||||
- CREATE USER 'user'@'127.0.0.1';
|
||||
@@ -15,7 +15,7 @@
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
|
||||
- name: Detect role support on MySQL
|
||||
community.mysql.mysql_query:
|
||||
ansible.mysql.mysql_query:
|
||||
query: >
|
||||
SELECT 1 FROM information_schema.COLUMNS
|
||||
WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
|
||||
@@ -24,7 +24,7 @@
|
||||
register: mysql_role_support
|
||||
|
||||
- name: Create roles for test
|
||||
community.mysql.mysql_query:
|
||||
ansible.mysql.mysql_query:
|
||||
query:
|
||||
- CREATE ROLE 'role_keep';
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
|
||||
@@ -2,8 +2,3 @@
|
||||
roles:
|
||||
- name: dev-sec.mysql
|
||||
version: master
|
||||
|
||||
collections:
|
||||
- name: https://github.com/ansible-collections/community.mysql.git
|
||||
type: git
|
||||
version: main
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
- name: Get all users from MySQL server
|
||||
community.mysql.mysql_query:
|
||||
ansible.mysql.mysql_query:
|
||||
query: >
|
||||
SELECT CONCAT(USER, '@', HOST) AS users FROM mysql.user;
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
@@ -25,7 +25,7 @@
|
||||
- '"[email protected].%" in mysql_users_list'
|
||||
|
||||
- name: Detect role support on MySQL
|
||||
community.mysql.mysql_query:
|
||||
ansible.mysql.mysql_query:
|
||||
query: >
|
||||
SELECT 1 FROM information_schema.COLUMNS
|
||||
WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
|
||||
|
||||
@@ -3,8 +3,10 @@
|
||||
user:
|
||||
name: pw_no_ageing
|
||||
password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
|
||||
password_expire_max: "-1"
|
||||
|
||||
- name: Create user those password ageing should be changed
|
||||
user:
|
||||
name: pw_ageing
|
||||
password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
|
||||
password_expire_max: "-1"
|
||||
@@ -80,7 +80,7 @@
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- output.rc | int == 5
|
||||
- output.stderr | length == 0
|
||||
- "'(password expired)' in output.stderr"
|
||||
- output.stdout | length == 0
|
||||
when:
|
||||
- ansible_facts.os_family == "Suse"
|
||||
|
||||
@@ -32,6 +32,15 @@
|
||||
- ansible_facts.distribution == 'Fedora'
|
||||
- ansible_facts.distribution_major_version|int == 40
|
||||
|
||||
- name: Overrides for Debian 13 image
|
||||
ansible.builtin.set_fact:
|
||||
os_mnt_tmp_enabled: true
|
||||
os_mnt_tmp_src: tmpfs
|
||||
os_mnt_tmp_filesystem: tmpfs
|
||||
when:
|
||||
- ansible_facts.distribution == 'Debian'
|
||||
- ansible_facts.distribution_major_version|int == 13
|
||||
|
||||
- name: Include os_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.os_hardening
|
||||
|
||||
@@ -4,6 +4,16 @@
|
||||
become: true
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Update keyring
|
||||
ansible.builtin.raw: pacman --noconfirm -Sy archlinux-keyring
|
||||
changed_when: false
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
|
||||
|
||||
- name: Update OS
|
||||
ansible.builtin.raw: pacman --noconfirm -Suy
|
||||
changed_when: false
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
|
||||
|
||||
- name: Install python, since it's not installed by default
|
||||
ansible.builtin.raw: pacman --noconfirm -Sy python
|
||||
changed_when: false
|
||||
|
||||
@@ -1,2 +1,3 @@
|
||||
---
|
||||
{}
|
||||
unrelated:
|
||||
run: false
|
||||
justification: "cinc-auditor needs at least one waived control"
|
||||
@@ -1,2 +1,3 @@
|
||||
---
|
||||
{}
|
||||
unrelated:
|
||||
run: false
|
||||
justification: "cinc-auditor needs at least one waived control"
|
||||
@@ -1,3 +0,0 @@
|
||||
sshd-45:
|
||||
run: false
|
||||
justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"
|
||||
@@ -1,2 +1,3 @@
|
||||
---
|
||||
{}
|
||||
unrelated:
|
||||
run: false
|
||||
justification: "cinc-auditor needs at least one waived control"
|
||||
@@ -0,0 +1,3 @@
|
||||
unrelated:
|
||||
run: false
|
||||
justification: "cinc-auditor needs at least one waived control"
|
||||
@@ -28,7 +28,7 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
|
||||
- EL
|
||||
- 8, 9, 10
|
||||
- Ubuntu
|
||||
- focal, jammy, noble
|
||||
- jammy, noble
|
||||
- Debian
|
||||
- trixie, bookworm, bullseye
|
||||
- Amazon
|
||||
|
||||
@@ -13,7 +13,6 @@ galaxy_info:
|
||||
- "10"
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- focal
|
||||
- jammy
|
||||
- noble
|
||||
- name: Debian
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
state: directory
|
||||
owner: "{{ mysql_hardening_user }}"
|
||||
group: "{{ mysql_hardening_user }}"
|
||||
mode: "0750"
|
||||
mode: '{{ mysql_hardening_datadir_permissions | default("0750") }}'
|
||||
when: item is defined and item != ""
|
||||
loop:
|
||||
- "{{ mysql_settings.settings.datadir }}"
|
||||
|
||||
@@ -39,13 +39,13 @@
|
||||
when: not mysql_distribution is defined
|
||||
|
||||
- name: Check which MySQL/MariaDB version is used
|
||||
community.mysql.mysql_info:
|
||||
ansible.mysql.mysql_info:
|
||||
filter: version
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_version
|
||||
|
||||
- name: Check MySQL/MariaDB settings
|
||||
community.mysql.mysql_info:
|
||||
ansible.mysql.mysql_info:
|
||||
filter: settings
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_settings
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'
|
||||
|
||||
- name: Ensure that the root password is present
|
||||
community.mysql.mysql_user:
|
||||
ansible.mysql.mysql_user:
|
||||
name: root
|
||||
host_all: true
|
||||
password: "{{ mysql_root_password | mandatory }}"
|
||||
@@ -20,14 +20,14 @@
|
||||
tags: my_cnf
|
||||
|
||||
- name: Ensure that the test database is absent
|
||||
community.mysql.mysql_db:
|
||||
ansible.mysql.mysql_db:
|
||||
name: test
|
||||
state: absent
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
when: mysql_remove_test_database
|
||||
|
||||
- name: Ensure that anonymous users are absent
|
||||
community.mysql.mysql_user:
|
||||
ansible.mysql.mysql_user:
|
||||
name: ""
|
||||
state: absent
|
||||
host_all: true
|
||||
@@ -35,7 +35,7 @@
|
||||
when: mysql_remove_anonymous_users
|
||||
|
||||
- name: Ensure that root can only login from localhost
|
||||
community.mysql.mysql_query:
|
||||
ansible.mysql.mysql_query:
|
||||
query: >
|
||||
DELETE
|
||||
FROM mysql.user
|
||||
@@ -47,7 +47,7 @@
|
||||
when: mysql_remove_remote_root
|
||||
|
||||
- name: Detect role support on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
|
||||
community.mysql.mysql_query:
|
||||
ansible.mysql.mysql_query:
|
||||
query: >
|
||||
SELECT 1 FROM information_schema.COLUMNS
|
||||
WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
|
||||
@@ -57,7 +57,7 @@
|
||||
check_mode: false
|
||||
|
||||
- name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
|
||||
community.mysql.mysql_query:
|
||||
ansible.mysql.mysql_query:
|
||||
query: >
|
||||
SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
|
||||
FROM mysql.user
|
||||
@@ -76,7 +76,7 @@
|
||||
is version('10.4.0', '>='))
|
||||
|
||||
- name: Get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
|
||||
community.mysql.mysql_query:
|
||||
ansible.mysql.mysql_query:
|
||||
query: >
|
||||
SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
|
||||
FROM mysql.user
|
||||
@@ -97,7 +97,7 @@
|
||||
version('10.4.0', '<'))
|
||||
|
||||
- name: Ensure that there are no users without password or authentication_string
|
||||
community.mysql.mysql_query:
|
||||
ansible.mysql.mysql_query:
|
||||
query:
|
||||
- DROP USER {{ item.user }}
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
|
||||
@@ -6,5 +6,7 @@ mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
|
||||
mysql_cnf_owner: 'root' # owner of /etc/my.cnf.d/*.cnf files
|
||||
mysql_cnf_group: 'mysql' # owner of /etc/my.cnf.d/*.cnf files
|
||||
|
||||
mysql_hardening_datadir_permissions: "0700"
|
||||
|
||||
mysql_hardening_group: 'mysql'
|
||||
login_unix_socket: '/run/mysql/mysql.sock'
|
||||
@@ -21,7 +21,7 @@ It works with the following nginx-roles, including, but not limited to:
|
||||
- EL
|
||||
- 8, 9, 10
|
||||
- Ubuntu
|
||||
- focal, jammy, noble
|
||||
- jammy, noble, resolute
|
||||
- Debian
|
||||
- trixie, bookworm, bullseye
|
||||
- Amazon
|
||||
|
||||
@@ -13,9 +13,9 @@ galaxy_info:
|
||||
- "10"
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- focal
|
||||
- jammy
|
||||
- noble
|
||||
- resolute
|
||||
- name: Debian
|
||||
versions:
|
||||
- trixie
|
||||
|
||||
@@ -161,7 +161,7 @@ This role is mostly based on guides by:
|
||||
- EL
|
||||
- 8, 9, 10
|
||||
- Ubuntu
|
||||
- focal, jammy, noble
|
||||
- jammy, noble, resolute
|
||||
- Debian
|
||||
- trixie, bookworm, bullseye
|
||||
- Amazon
|
||||
|
||||
@@ -13,9 +13,9 @@ galaxy_info:
|
||||
- "10"
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- focal
|
||||
- jammy
|
||||
- noble
|
||||
- resolute
|
||||
- name: Debian
|
||||
versions:
|
||||
- trixie
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
#
|
||||
# Three items must be defined: `MAIL_DIR`, `ENV_SUPATH`, and `ENV_PATH`. If unspecified, some arbitrary (and possibly incorrect) value will be assumed. All other items are optional - if not specified then the described action or option will be inhibited.
|
||||
#
|
||||
# Comment lines (lines beginning with `#`) and blank lines are ignored.
|
||||
# Comment lines and blank lines are ignored.
|
||||
#
|
||||
#-- Modified for Linux. --marekm
|
||||
|
||||
@@ -35,7 +35,7 @@ FAILLOG_ENAB yes
|
||||
|
||||
# Enable display of unknown usernames when login failures are recorded.
|
||||
#
|
||||
# *WARNING*: Unknown usernames may become world readable. See #290803 and #298773 for details about how this could become a security concern
|
||||
# *WARNING*: Unknown usernames may become world readable. See 290803 and 298773 for details about how this could become a security concern
|
||||
LOG_UNKFAIL_ENAB no
|
||||
|
||||
# Enable logging of successful logins
|
||||
@@ -56,7 +56,7 @@ SYSLOG_SG_ENAB yes
|
||||
# If defined, login failures will be logged here in a utmp format last, when invoked as lastb, will read `/var/log/btmp`, so...
|
||||
FTMP_FILE /var/log/btmp
|
||||
|
||||
# If defined, the command name to display when running "su -". For # example, if this is defined as "su" then a "ps" will display the command is "-su". If not defined, then "ps" would display the name of the shell actually being run, e.g. something like "-sh".
|
||||
# If defined, the command name to display when running "su -". For example, if this is defined as "su" then a "ps" will display the command is "-su". If not defined, then "ps" would display the name of the shell actually being run, e.g. something like "-sh".
|
||||
SU_NAME su
|
||||
|
||||
# If defined, file which inhibits all the usual chatter during the login sequence. If a full pathname, then hushed mode will be enabled if the user's name or shell are found in the file. If not a full pathname, then hushed mode will be enabled if the file exists in the user's home directory.
|
||||
@@ -96,7 +96,7 @@ KILLCHAR 025
|
||||
UMASK {{ os_env_umask }}
|
||||
|
||||
# Enable setting of the umask group bits to be the same as owner bits (examples: `022` -> `002`, `077` -> `007`) for non-root users, if the uid is the same as gid, and username is the same as the primary group name.
|
||||
# If set to yes, userdel will remove the user´s group if it contains no more members, and useradd will create by default a group with the name of the user.
|
||||
# If set to yes, userdel will remove the user's group if it contains no more members, and useradd will create by default a group with the name of the user.
|
||||
USERGROUPS_ENAB yes
|
||||
|
||||
|
||||
|
||||
@@ -50,7 +50,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
|
||||
- EL
|
||||
- 8, 9, 10
|
||||
- Ubuntu
|
||||
- focal, jammy, noble
|
||||
- jammy, noble, resolute
|
||||
- Debian
|
||||
- trixie, bookworm, bullseye
|
||||
- Alpine
|
||||
@@ -59,7 +59,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
|
||||
- ArchLinux
|
||||
- SmartOS
|
||||
- FreeBSD
|
||||
- 13.2, 14.0
|
||||
- 14.0
|
||||
- OpenBSD
|
||||
- 7.0
|
||||
|
||||
|
||||
@@ -13,9 +13,9 @@ galaxy_info:
|
||||
- "10"
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- focal
|
||||
- jammy
|
||||
- noble
|
||||
- resolute
|
||||
- name: Debian
|
||||
versions:
|
||||
- trixie
|
||||
@@ -28,7 +28,6 @@ galaxy_info:
|
||||
- name: SmartOS
|
||||
- name: FreeBSD
|
||||
versions:
|
||||
- "13.2"
|
||||
- "14.0"
|
||||
- name: OpenBSD
|
||||
versions:
|
||||
|
||||
Reference in new issue
Block a user