Merge branch 'master' into tally

Signed-off-by: Martin Schurz <[email protected]>

roles/mysql_hardening/README.md

@@ -24,7 +24,7 @@ It configures:
   collections:
     - devsec.hardening
   roles:
-    - devsec.hardening.mysql_hardening
+    - mysql_hardening
 ```
 
 This role expects an existing installation of MySQL or MariaDB. Please ensure that the following variables are set accordingly:

roles/nginx_hardening/README.md

@@ -83,7 +83,7 @@ It works with the following nginx-roles, including, but not limited to:
   collections:
     - devsec.hardening
   roles:
-    - devsec.hardening.nginx_hardening
+    - nginx_hardening
 ```
 
 [nginx_client_body_buffer_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size

roles/os_hardening/README.md

@@ -222,7 +222,7 @@ To prevent some of the filesystems from being disabled, add them to the `os_file
   collections:
     - devsec.hardening
   roles:
-    - devsec.hardening.os_hardening
+    - os_hardening
 ```
 
 ## Changing sysctl variables
@@ -235,7 +235,7 @@ So for example if you want to change the IPv4 traffic forwarding variable to `1`
   collections:
     - devsec.hardening
   roles:
-    - devsec.hardening.os_hardening
+    - os_hardening
   vars:
     sysctl_overwrite:
       # Enable IPv4 traffic forwarding.

roles/os_hardening/tasks/cron.yml

@@ -0,0 +1,28 @@
+---
+# Granting write access to this directory for non-privileged users could provide
+# them the means for gaining unauthorized elevated privileges.
+# Granting read access to this directory could give an unprivileged user insight
+# in how to gain elevated privileges or circumvent auditing controls.
+# CIS 5.1.2 - CIS 5.1.7
+#
+- name: Find cron files and directories
+  find:
+    paths:
+      - /etc
+    patterns:
+      - cron.hourly
+      - cron.daily
+      - cron.weekly
+      - cron.monthly
+      - cron.d
+      - crontab
+    file_type: any
+  register: cron_directories
+
+- name: Ensure permissions on cron files and directories are configured
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    owner: root
+    group: root
+    mode: og-rwx
+  with_items: "{{ cron_directories.files }}"

roles/os_hardening/tasks/hardening.yml

@@ -25,6 +25,9 @@
   tags: auditd
   when: os_auditd_enabled | bool
 
+- import_tasks: cron.yml
+  tags: cron
+
 - import_tasks: limits.yml
   tags: limits
 

roles/ssh_hardening/README.md

@@ -76,7 +76,10 @@ Warning: This role disables root-login on the target server! Please make sure yo
   - Description: false to disable pam authentication.
 - `ssh_gssapi_support`
   - Default: `false`
-  - Description: true if SSH has GSSAPI support.
+  - Description: Set to true to enable GSSAPI authentication (both client and server).
+- `ssh_gssapi_delegation`
+  - Default: `false`
+  - Description: Set to true to enable GSSAPI credential forwarding.
 - `ssh_kerberos_support`
   - Default: `true`
   - Description: true if SSH has Kerberos support.
@@ -241,7 +244,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
   collections:
     - devsec.hardening
   roles:
-    - devsec.hardening.ssh_hardening
+    - ssh_hardening
 ```
 
 ## Configuring settings not listed in role-variables
@@ -255,7 +258,7 @@ Example playbook:
   collections:
     - devsec.hardening
   roles:
-    - devsec.hardening.ssh_hardening
+    - ssh_hardening
   vars:
     ssh_custom_options:
       - "Include /etc/ssh/ssh_config.d/*"

roles/ssh_hardening/defaults/main.yml

@@ -91,9 +91,12 @@ ssh_use_pam: true                   # sshd
 # specify AuthenticationMethods
 sshd_authenticationmethods: 'publickey'
 
-# true if SSH support GSSAPI
+# Set to true to enable GSSAPI authentication (both client and server)
 ssh_gssapi_support: false
 
+# Set to true to enable GSSAPI credential forwarding
+ssh_gssapi_delegation: false
+
 # if specified, login is disallowed for user names that match one of the patterns.
 ssh_deny_users: ''                  # sshd
 

roles/ssh_hardening/templates/openssh.conf.j2

@@ -104,8 +104,8 @@ RSAAuthentication yes
 PasswordAuthentication {{ 'yes' if ssh_client_password_login else 'no' }}
 
 # Only use GSSAPIAuthentication if implemented on the network.
-GSSAPIAuthentication no
-GSSAPIDelegateCredentials no
+GSSAPIAuthentication {{ 'yes' if (ssh_gssapi_support|bool) else 'no' }}
+GSSAPIDelegateCredentials {{ 'yes' if (ssh_gssapi_delegation|bool) else 'no' }}
 
 # Disable tunneling
 Tunnel no