Merge branch 'master' into tally

Signed-off-by: Martin Schurz <[email protected]>

roles/mysql_hardening/README.md

@@ -75,5 +75,8 @@ This role expects an existing installation of MySQL or MariaDB. Please ensure th
 - `mysql_remove_test_database`
   - Default: true
   - Description: remove test database
+- `mysql_hardening_restart_mysql`
+  - Default: true
+  - Description: Restart mysql after running this role
 
 Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)

roles/mysql_hardening/defaults/main.yml

@@ -4,6 +4,8 @@ mysql_hardening_enabled: true
 
 mysql_daemon_enabled: true
 
+mysql_hardening_restart_mysql: true
+
 # general configuration
 mysql_datadir: '/var/lib/mysql'
 mysql_hardening_mysql_hardening_conf_file: '{{mysql_hardening_mysql_confd_dir}}/hardening.cnf'

roles/mysql_hardening/handlers/main.yml

@@ -1,4 +1,7 @@
 ---
 
 - name: restart mysql
-  service: name='{{ mysql_daemon }}' state=restarted
+  service:
+    name: '{{ mysql_daemon }}'
+    state: restarted
+  when: mysql_hardening_restart_mysql | bool

roles/mysql_hardening/tasks/mysql_secure_installation.yml

@@ -1,11 +1,7 @@
 ---
-- name: Install mysqld python libary for Ansible
-  package:
-    name: '{{ mysql_python_package }}'
-    state: present
-
-- debug:
-    msg: 'WARNING - you have to change default mysql_root_password'
+- name: fail the role if the mysql root password was not set
+  fail:
+    msg: 'ERROR - you have to change default mysql_root_password'
   when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'
 
 - name: root password is present

roles/mysql_hardening/vars/Debian.yml

@@ -10,5 +10,3 @@ mysql_hardening_group: 'adm'
 
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_python_package: "python3-pymysql"

roles/mysql_hardening/vars/RedHat_7.yml

@@ -5,8 +5,6 @@ mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
 
 mysql_hardening_log_file: '/var/log/mariadb/mariadb.log'
 
-mysql_python_package: 'MySQL-python'
-
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
 

roles/mysql_hardening/vars/RedHat_8.yml

@@ -4,8 +4,6 @@ mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
 mysql_hardening_log_file: '/var/log/mariadb/mariadb.log'
 
-mysql_python_package: 'python3-mysqlclient'
-
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
 

roles/mysql_hardening/vars/Ubuntu_16.yml

@@ -10,5 +10,3 @@ mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
 
 mysql_hardening_group: 'adm'
-
-mysql_python_package: "python-mysqldb"

roles/mysql_hardening/vars/Ubuntu_18.yml

@@ -10,5 +10,3 @@ mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
 
 mysql_hardening_group: 'adm'
-
-mysql_python_package: "python-mysqldb"

roles/mysql_hardening/vars/Ubuntu_20.yml

@@ -10,5 +10,3 @@ mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
 
 mysql_hardening_group: 'adm'
-
-mysql_python_package: "python3-mysqldb"

roles/os_hardening/tasks/minimize_access.yml

@@ -5,7 +5,7 @@
 # This is also the reason why there's ignore_errors: true on the task.
 # also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
 - name: find files with write-permissions for group
-  shell: "find -L {{ item }} -perm /go+w -type f"  # noqa 305
+  shell: "find -L {{ item }} -perm /go+w -type f"  # noqa command-instead-of-shell
   with_flattened:
     - '/usr/local/sbin'
     - '/usr/local/bin'
@@ -13,7 +13,7 @@
     - '/usr/bin'
     - '/sbin'
     - '/bin'
-    - "{{ os_env_extra_user_paths }}"  # noqa 104
+    - "{{ os_env_extra_user_paths }}"  # noqa deprecated-bare-vars
   register: minimize_access_directories
   ignore_errors: true
   changed_when: false

roles/ssh_hardening/README.md

@@ -35,6 +35,9 @@ Warning: This role disables root-login on the target server! Please make sure yo
 - `ssh_host_key_files`
   - Default: `[]`
   - Description: Host keys for sshd. If empty ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key', '/etc/ssh/ssh_host_ed25519_key'] will be used, as far as supported by the installed sshd version.
+- `ssh_host_rsa_key_size`
+  - Default: `4096`
+  - Description: Specifies the number of bits in the private host RSA key to create.
 - `ssh_host_key_algorithms`
   - Default: `[]`
   - Description: Host key algorithms that the server offers. If empty the [default list](https://man.openbsd.org/sshd_config#HostKeyAlgorithms) will be used, otherwise overrides the setting with specified list of algorithms.

roles/ssh_hardening/defaults/main.yml

@@ -36,6 +36,9 @@ ssh_listen_to: ['0.0.0.0']          # sshd
 # Host keys to look for when starting sshd.
 ssh_host_key_files: []              # sshd
 
+# Host RSA key size in bits
+ssh_host_rsa_key_size: 4096         # sshd
+
 # Host certificates to look for when starting sshd.
 ssh_host_certificates: []           # sshd
 

roles/ssh_hardening/tasks/crypto_hostkeys.yml

@@ -1,9 +1,9 @@
 ---
-- name: replace default 2048 bits RSA keypair with 4096 bits keypair
+- name: replace default 2048 bits RSA keypair
   community.crypto.openssh_keypair:
     state: present
     type: rsa
-    size: 4096
+    size: "{{ ssh_host_rsa_key_size }}"
     path: "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
     force: false
     regenerate: partial_idempotence

roles/ssh_hardening/tasks/hardening.yml

@@ -33,7 +33,9 @@
 
 - name: set default for ssh_host_key_files if not supplied
   include_tasks: crypto_hostkeys.yml
-  when: not ssh_host_key_files
+  when:
+    - ssh_server_hardening | bool
+    - not ssh_host_key_files
 
 - name: set default for ssh_macs if not supplied
   include_tasks: crypto_macs.yml