andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add SUB_UID_MIN/MAX/COUNT, SUB_GID_MIN/MAX/COUNT (#463)

Browse Source 
* add SUB_UID_MIN/MAX/COUNT, SUB_GID_MIN/MAX/COUNT

Similar reason as #461

> If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate user IDs)
> allocate SUB_UID_COUNT unused user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user.
> The default values for SUB_UID_MIN, SUB_UID_MAX, SUB_UID_COUNT are respectively 100000, 600100000 and 65536.

Signed-off-by: Leo Gallucci <[email protected]>

* document SUB_UID_MIN/MAX/COUNT, etc

Signed-off-by: Leo Gallucci <[email protected]>
This commit is contained in:
Leo Gallucci authored and GitHub committed 2021-07-16 09:41:37 +02:00
1 parent 2c5cf45573
commit 585f1dc227
11 files changed
+94
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

roles/os_hardening/README.md
+30
View File
@@ -148,6 +148,36 @@ We know that this is the case on Raspberry Pi.
- `os_security_suid_sgid_remove_from_unknown`
- Default: `false`
- Description: true if you want to remove SUID/SGID bits from any file, that is not explicitly configured in a `blacklist`. This will make every Ansible-run search through the mounted filesystems looking for SUID/SGID bits that are not configured in the default and user blacklist. If it finds an SUID/SGID bit, it will be removed, unless this file is in your `whitelist`.
- `os_auth_uid_min`
- Default: `1000`
- Description: minimum number for automatic uid selection in useradd.
- `os_auth_uid_max`
- Default: `60000`
- Description: maximum number for automatic uid selection in useradd.
- `os_auth_gid_min`
- Default: `1000`
- Description: minimum number for automatic gid selection in groupadd.
- `os_auth_gid_max`
- Default: `60000`
- Description: maximum number for automatic gid selection in groupadd.
- `os_auth_sub_uid_count`
- Default: `65536`
- Description: If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate user IDs) allocate SUB_UID_COUNT unused user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user. See also `os_auth_sub_uid_min` and `os_auth_sub_uid_max`.
- `os_auth_sub_uid_min`.
- Default: `100000`
- Description: minimum number for automatic subordinate uid selection in useradd and newusers.
- `os_auth_sub_uid_max`
- Default: `600100000`
- Description: maximum number for automatic subordinate uid selection in useradd and newusers.
- `os_auth_sub_gid_count`
- Default: `65536`
- Description: If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate group IDs) allocate SUB_GID_COUNT unused group IDs from the range SUB_GID_MIN to SUB_GID_MAX for each new user. See also `os_auth_sub_gid_min` and `os_auth_sub_gid_max`.
- `os_auth_sub_gid_min`
- Default: `100000`
- Description: minimum number for automatic subordinate gid selection in useradd and newusers.
- `os_auth_sub_gid_max`
- Default: `600100000`
- Description: maximum number for automatic subordinate gid selection in useradd and newusers.
- `os_security_packages_clean`
- Default: `true`
- Description: removes packages with known issues. See section packages.