andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix some wrong defaults and types in the readmes (#703)

Browse Source 
Signed-off-by: Sebastian Gumprich <[email protected]>
This commit is contained in:
Sebastian Gumprich authored and GitHub committed 2023-10-23 12:23:49 +02:00
1 parent 91d10892dc
commit 787ac9bd54
6 files changed
+53 -49
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

roles/mysql_hardening/README.md
+8 -9
View File
@@ -22,16 +22,15 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
- python-jmespath on the ansible host - python-jmespath on the ansible host
<!-- BEGIN_ANSIBLE_DOCS --> <!-- BEGIN_ANSIBLE_DOCS -->
## Supported Operating Systems ## Supported Operating Systems
- EL
| Platform | Versions | - 7, 8, 9
| -------- | -------------------- | - Ubuntu
| EL | 7, 8, 9 | - bionic, focal, jammy
| Ubuntu | bionic, focal, jammy | - Debian
| Debian | bullseye, buster | - bullseye, buster
| Amazon | | - Amazon
| opensuse | | - opensuse
## Role Variables ## Role Variables
roles/nginx_hardening/README.md
+11 -12
View File
@@ -15,22 +15,21 @@ It works with the following nginx-roles, including, but not limited to:
**NOTE: This role does not work with nginx 1.0.15 or older! Please use the latest version from the official nginx repositories!** **NOTE: This role does not work with nginx 1.0.15 or older! Please use the latest version from the official nginx repositories!**
<!-- BEGIN_ANSIBLE_DOCS --> <!-- BEGIN_ANSIBLE_DOCS -->
## Supported Operating Systems ## Supported Operating Systems
- EL
| Platform | Versions | - 7, 8, 9
| -------- | -------------------- | - Ubuntu
| EL | 7, 8, 9 | - bionic, focal, jammy
| Ubuntu | bionic, focal, jammy | - Debian
| Debian | buster, bullseye | - buster, bullseye
| Amazon | | - Amazon
## Role Variables ## Role Variables
- `nginx_add_header` - `nginx_add_header`
- Default: `['X-Frame-Options SAMEORIGIN', 'X-Content-Type-Options nosniff', 'X-XSS-Protection "1; mode=block"', 'Content-Security-Policy \\"script-src \'self\'; object-src \'self\'\\"']` - Default: `["X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"", "Content-Security-Policy \\\"script-src 'self'; object-src 'self'\\\""]`
- Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See [nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header) - Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See [nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
- Type: str - Type: list
- Required: no - Required: no
- `nginx_client_body_buffer_size` - `nginx_client_body_buffer_size`
- Default: `1k` - Default: `1k`
@@ -70,7 +69,7 @@ It works with the following nginx-roles, including, but not limited to:
- `nginx_dh_size` - `nginx_dh_size`
- Default: `2048` - Default: `2048`
- Description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam) - Description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam)
- Type: str - Type: int
- Required: no - Required: no
- `nginx_keepalive_timeout` - `nginx_keepalive_timeout`
- Default: `5 5` - Default: `5 5`
@@ -113,7 +112,7 @@ It works with the following nginx-roles, including, but not limited to:
- Type: int - Type: int
- Required: no - Required: no
- `nginx_server_tokens` - `nginx_server_tokens`
- Default: `False` - Default: `off`
- Description: Disables emitting nginx version in error messages and in the "Server" response header field. Set to on to enable the nginx version in error messages and "Server" response header. See [nginx_server_tokens](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens) - Description: Disables emitting nginx version in error messages and in the "Server" response header field. Set to on to enable the nginx version in error messages and "Server" response header. See [nginx_server_tokens](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens)
- Type: str - Type: str
- Required: no - Required: no
roles/nginx_hardening/meta/argument_specs.yml
+3 -3
View File
@@ -30,7 +30,7 @@ argument_specs:
keep-alive client connections. The optional second parameter sets a value keep-alive client connections. The optional second parameter sets a value
in the "Keep-Alive timeout=time" response header field. See [nginx_keepalive_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout) # noqa yaml[line-length] in the "Keep-Alive timeout=time" response header field. See [nginx_keepalive_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout) # noqa yaml[line-length]
nginx_server_tokens: nginx_server_tokens:
default: false default: 'off'
type: str type: str
description: Disables emitting nginx version in error messages and in the description: Disables emitting nginx version in error messages and in the
"Server" response header field. Set to on to enable the nginx version in "Server" response header field. Set to on to enable the nginx version in
@@ -72,7 +72,7 @@ argument_specs:
default: [X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff, X-XSS-Protection default: [X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff, X-XSS-Protection
"1; mode=block", Content-Security-Policy \"script-src 'self'; object-src "1; mode=block", Content-Security-Policy \"script-src 'self'; object-src
'self'\"] 'self'\"]
type: str type: list
description: Adds the specified field to a response header provided that the description: Adds the specified field to a response header provided that the
response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See
[nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header) [nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
@@ -91,7 +91,7 @@ argument_specs:
ciphers when using the TLS protocols. Set to false to disable it. See [nginx_ssl_prefer_server_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers) # noqa yaml[line-length] ciphers when using the TLS protocols. Set to false to disable it. See [nginx_ssl_prefer_server_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers) # noqa yaml[line-length]
nginx_dh_size: nginx_dh_size:
default: 2048 default: 2048
type: str type: int
description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam) # noqa yaml[line-length] description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam) # noqa yaml[line-length]
nginx_configuration_dir: nginx_configuration_dir:
default: /etc/nginx default: /etc/nginx
roles/os_hardening/README.md
-2
View File
@@ -54,9 +54,7 @@ We disable the following filesystems, because they're most likely not used:
To prevent some of the filesystems from being disabled, add them to the `os_filesystem_whitelist` variable. To prevent some of the filesystems from being disabled, add them to the `os_filesystem_whitelist` variable.
<!-- BEGIN_ANSIBLE_DOCS --> <!-- BEGIN_ANSIBLE_DOCS -->
## Supported Operating Systems ## Supported Operating Systems
- EL - EL
- 7, 8, 9 - 7, 8, 9
- Ubuntu - Ubuntu
roles/ssh_hardening/README.md
+23 -22
View File
@@ -9,20 +9,21 @@ This role provides secure ssh-client and ssh-server configurations. It is intend
Warning: This role disables root-login on the target server! Please make sure you have another user with su or sudo permissions that can login into the server. Warning: This role disables root-login on the target server! Please make sure you have another user with su or sudo permissions that can login into the server.
<!-- BEGIN_ANSIBLE_DOCS --> <!-- BEGIN_ANSIBLE_DOCS -->
## Supported Operating Systems ## Supported Operating Systems
- EL
| Platform | Versions | - 7, 8, 9
| --------- | -------------------- | - Ubuntu
| EL | 7, 8, 9 | - bionic, focal, jammy
| Ubuntu | bionic, focal, jammy | - Debian
| Debian | buster, bullseye | - buster, bullseye
| Amazon | | - Amazon
| Fedora | | - Fedora
| ArchLinux | | - ArchLinux
| SmartOS | | - SmartOS
| FreeBSD | 12.2 | - FreeBSD
| OpenBSD | 7.0 | - 12.2
- OpenBSD
- 7.0
## Role Variables ## Role Variables
@@ -109,12 +110,12 @@ Warning: This role disables root-login on the target server! Please make sure yo
- `ssh_client_alive_count` - `ssh_client_alive_count`
- Default: `3` - Default: `3`
- Description: Defines the number of acceptable unanswered client alive messages before disconnecting clients. - Description: Defines the number of acceptable unanswered client alive messages before disconnecting clients.
- Type: str - Type: int
- Required: no - Required: no
- `ssh_client_alive_interval` - `ssh_client_alive_interval`
- Default: `600` - Default: `300`
- Description: specifies an interval for sending keepalive messages. - Description: specifies an interval for sending keepalive messages.
- Type: str - Type: int
- Required: no - Required: no
- `ssh_client_compression` - `ssh_client_compression`
- Default: `false` - Default: `false`
@@ -157,9 +158,9 @@ Warning: This role disables root-login on the target server! Please make sure yo
- Type: bool - Type: bool
- Required: no - Required: no
- `ssh_custom_options` - `ssh_custom_options`
- Default: `[]` - Default: ``
- Description: Custom lines for SSH client configuration. - Description: Custom lines for SSH client configuration.
- Type: str - Type: list
- Required: no - Required: no
- `ssh_custom_selinux_dir` - `ssh_custom_selinux_dir`
- Default: `/etc/selinux/local-policies` - Default: `/etc/selinux/local-policies`
@@ -214,7 +215,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
- `ssh_host_rsa_key_size` - `ssh_host_rsa_key_size`
- Default: `4096` - Default: `4096`
- Description: Specifies the number of bits in the private host RSA key to create. - Description: Specifies the number of bits in the private host RSA key to create.
- Type: str - Type: int
- Required: no - Required: no
- `ssh_kerberos_support` - `ssh_kerberos_support`
- Default: `true` - Default: `true`
@@ -244,12 +245,12 @@ Warning: This role disables root-login on the target server! Please make sure yo
- `ssh_max_auth_retries` - `ssh_max_auth_retries`
- Default: `2` - Default: `2`
- Description: Specifies the maximum number of authentication attempts permitted per connection. - Description: Specifies the maximum number of authentication attempts permitted per connection.
- Type: str - Type: int
- Required: no - Required: no
- `ssh_max_sessions` - `ssh_max_sessions`
- Default: `10` - Default: `10`
- Description: Specifies the maximum number of open sessions permitted from a given connection. - Description: Specifies the maximum number of open sessions permitted from a given connection.
- Type: str - Type: int
- Required: no - Required: no
- `ssh_max_startups` - `ssh_max_startups`
- Default: `10:30:60` - Default: `10:30:60`
@@ -409,7 +410,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
- `sshd_moduli_minimum` - `sshd_moduli_minimum`
- Default: `2048` - Default: `2048`
- Description: remove Diffie-Hellman parameters smaller than the defined size to mitigate logjam. - Description: remove Diffie-Hellman parameters smaller than the defined size to mitigate logjam.
- Type: str - Type: int
- Required: no - Required: no
- `sshd_strict_modes` - `sshd_strict_modes`
- Default: `true` - Default: `true`
roles/ssh_hardening/meta/argument_specs.yml
+8 -1
View File
@@ -36,6 +36,7 @@ argument_specs:
installed sshd version. installed sshd version.
ssh_host_rsa_key_size: ssh_host_rsa_key_size:
default: 4096 default: 4096
type: int
description: Specifies the number of bits in the private host RSA key to create. description: Specifies the number of bits in the private host RSA key to create.
ssh_host_key_algorithms: ssh_host_key_algorithms:
default: [] default: []
@@ -53,12 +54,14 @@ argument_specs:
`ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make
sure you check the correct version! sure you check the correct version!
ssh_client_alive_interval: ssh_client_alive_interval:
default: 600 default: 300
description: specifies an interval for sending keepalive messages. description: specifies an interval for sending keepalive messages.
type: int
ssh_client_alive_count: ssh_client_alive_count:
default: 3 default: 3
description: Defines the number of acceptable unanswered client alive messages description: Defines the number of acceptable unanswered client alive messages
before disconnecting clients. before disconnecting clients.
type: int
ssh_permit_tunnel: ssh_permit_tunnel:
default: false default: false
type: bool type: bool
@@ -191,6 +194,7 @@ argument_specs:
default: 2048 default: 2048
description: remove Diffie-Hellman parameters smaller than the defined size description: remove Diffie-Hellman parameters smaller than the defined size
to mitigate logjam. to mitigate logjam.
type: int
ssh_challengeresponseauthentication: ssh_challengeresponseauthentication:
default: false default: false
type: bool type: bool
@@ -235,10 +239,12 @@ argument_specs:
default: 2 default: 2
description: Specifies the maximum number of authentication attempts permitted description: Specifies the maximum number of authentication attempts permitted
per connection. per connection.
type: int
ssh_max_sessions: ssh_max_sessions:
default: 10 default: 10
description: Specifies the maximum number of open sessions permitted from description: Specifies the maximum number of open sessions permitted from
a given connection. a given connection.
type: int
ssh_print_debian_banner: ssh_print_debian_banner:
default: false default: false
type: bool type: bool
@@ -315,6 +321,7 @@ argument_specs:
description: Change this list to overwrite ciphers. Defaults found in `defaults/main.yml` description: Change this list to overwrite ciphers. Defaults found in `defaults/main.yml`
ssh_custom_options: ssh_custom_options:
default: [] default: []
type: list
description: Custom lines for SSH client configuration. description: Custom lines for SSH client configuration.
sshd_custom_options: sshd_custom_options:
default: [] default: []