andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix some wrong defaults and types in the readmes (#703)

Browse Source 
Signed-off-by: Sebastian Gumprich <[email protected]>
This commit is contained in:
Sebastian Gumprich authored and GitHub committed 2023-10-23 12:23:49 +02:00
1 parent 91d10892dc
commit 787ac9bd54
6 files changed
+53 -49
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

roles/mysql_hardening/README.md
+8 -9
View File
@@ -22,16 +22,15 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
- python-jmespath on the ansible host
<!-- BEGIN_ANSIBLE_DOCS -->
## Supported Operating Systems
| Platform | Versions |
| -------- | -------------------- |
| EL | 7, 8, 9 |
| Ubuntu | bionic, focal, jammy |
| Debian | bullseye, buster |
| Amazon | |
| opensuse | |
- EL
- 7, 8, 9
- Ubuntu
- bionic, focal, jammy
- Debian
- bullseye, buster
- Amazon
- opensuse
## Role Variables
roles/nginx_hardening/README.md
+11 -12
View File
@@ -15,22 +15,21 @@ It works with the following nginx-roles, including, but not limited to:
**NOTE: This role does not work with nginx 1.0.15 or older! Please use the latest version from the official nginx repositories!**
<!-- BEGIN_ANSIBLE_DOCS -->
## Supported Operating Systems
| Platform | Versions |
| -------- | -------------------- |
| EL | 7, 8, 9 |
| Ubuntu | bionic, focal, jammy |
| Debian | buster, bullseye |
| Amazon | |
- EL
- 7, 8, 9
- Ubuntu
- bionic, focal, jammy
- Debian
- buster, bullseye
- Amazon
## Role Variables
- `nginx_add_header`
- Default: `['X-Frame-Options SAMEORIGIN', 'X-Content-Type-Options nosniff', 'X-XSS-Protection "1; mode=block"', 'Content-Security-Policy \\"script-src \'self\'; object-src \'self\'\\"']`
- Default: `["X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"", "Content-Security-Policy \\\"script-src 'self'; object-src 'self'\\\""]`
- Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See [nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
- Type: str
- Type: list
- Required: no
- `nginx_client_body_buffer_size`
- Default: `1k`
@@ -70,7 +69,7 @@ It works with the following nginx-roles, including, but not limited to:
- `nginx_dh_size`
- Default: `2048`
- Description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam)
- Type: str
- Type: int
- Required: no
- `nginx_keepalive_timeout`
- Default: `5 5`
@@ -113,7 +112,7 @@ It works with the following nginx-roles, including, but not limited to:
- Type: int
- Required: no
- `nginx_server_tokens`
- Default: `False`
- Default: `off`
- Description: Disables emitting nginx version in error messages and in the "Server" response header field. Set to on to enable the nginx version in error messages and "Server" response header. See [nginx_server_tokens](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens)
- Type: str
- Required: no
roles/nginx_hardening/meta/argument_specs.yml
+3 -3
View File
@@ -30,7 +30,7 @@ argument_specs:
keep-alive client connections. The optional second parameter sets a value
in the "Keep-Alive timeout=time" response header field. See [nginx_keepalive_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout) # noqa yaml[line-length]
nginx_server_tokens:
default: false
default: 'off'
type: str
description: Disables emitting nginx version in error messages and in the
"Server" response header field. Set to on to enable the nginx version in
@@ -72,7 +72,7 @@ argument_specs:
default: [X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff, X-XSS-Protection
"1; mode=block", Content-Security-Policy \"script-src 'self'; object-src
'self'\"]
type: str
type: list
description: Adds the specified field to a response header provided that the
response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See
[nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
@@ -91,7 +91,7 @@ argument_specs:
ciphers when using the TLS protocols. Set to false to disable it. See [nginx_ssl_prefer_server_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers) # noqa yaml[line-length]
nginx_dh_size:
default: 2048
type: str
type: int
description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam) # noqa yaml[line-length]
nginx_configuration_dir:
default: /etc/nginx
roles/os_hardening/README.md
-2
View File
@@ -54,9 +54,7 @@ We disable the following filesystems, because they're most likely not used:
To prevent some of the filesystems from being disabled, add them to the `os_filesystem_whitelist` variable.
<!-- BEGIN_ANSIBLE_DOCS -->
## Supported Operating Systems
- EL
- 7, 8, 9
- Ubuntu
roles/ssh_hardening/README.md
+23 -22
View File
@@ -9,20 +9,21 @@ This role provides secure ssh-client and ssh-server configurations. It is intend
Warning: This role disables root-login on the target server! Please make sure you have another user with su or sudo permissions that can login into the server.
<!-- BEGIN_ANSIBLE_DOCS -->
## Supported Operating Systems
| Platform | Versions |
| --------- | -------------------- |
| EL | 7, 8, 9 |
| Ubuntu | bionic, focal, jammy |
| Debian | buster, bullseye |
| Amazon | |
| Fedora | |
| ArchLinux | |
| SmartOS | |
| FreeBSD | 12.2 |
| OpenBSD | 7.0 |
- EL
- 7, 8, 9
- Ubuntu
- bionic, focal, jammy
- Debian
- buster, bullseye
- Amazon
- Fedora
- ArchLinux
- SmartOS
- FreeBSD
- 12.2
- OpenBSD
- 7.0
## Role Variables
@@ -109,12 +110,12 @@ Warning: This role disables root-login on the target server! Please make sure yo
- `ssh_client_alive_count`
- Default: `3`
- Description: Defines the number of acceptable unanswered client alive messages before disconnecting clients.
- Type: str
- Type: int
- Required: no
- `ssh_client_alive_interval`
- Default: `600`
- Default: `300`
- Description: specifies an interval for sending keepalive messages.
- Type: str
- Type: int
- Required: no
- `ssh_client_compression`
- Default: `false`
@@ -157,9 +158,9 @@ Warning: This role disables root-login on the target server! Please make sure yo
- Type: bool
- Required: no
- `ssh_custom_options`
- Default: `[]`
- Default: ``
- Description: Custom lines for SSH client configuration.
- Type: str
- Type: list
- Required: no
- `ssh_custom_selinux_dir`
- Default: `/etc/selinux/local-policies`
@@ -214,7 +215,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
- `ssh_host_rsa_key_size`
- Default: `4096`
- Description: Specifies the number of bits in the private host RSA key to create.
- Type: str
- Type: int
- Required: no
- `ssh_kerberos_support`
- Default: `true`
@@ -244,12 +245,12 @@ Warning: This role disables root-login on the target server! Please make sure yo
- `ssh_max_auth_retries`
- Default: `2`
- Description: Specifies the maximum number of authentication attempts permitted per connection.
- Type: str
- Type: int
- Required: no
- `ssh_max_sessions`
- Default: `10`
- Description: Specifies the maximum number of open sessions permitted from a given connection.
- Type: str
- Type: int
- Required: no
- `ssh_max_startups`
- Default: `10:30:60`
@@ -409,7 +410,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
- `sshd_moduli_minimum`
- Default: `2048`
- Description: remove Diffie-Hellman parameters smaller than the defined size to mitigate logjam.
- Type: str
- Type: int
- Required: no
- `sshd_strict_modes`
- Default: `true`
roles/ssh_hardening/meta/argument_specs.yml
+8 -1
View File
@@ -36,6 +36,7 @@ argument_specs:
installed sshd version.
ssh_host_rsa_key_size:
default: 4096
type: int
description: Specifies the number of bits in the private host RSA key to create.
ssh_host_key_algorithms:
default: []
@@ -53,12 +54,14 @@ argument_specs:
`ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make
sure you check the correct version!
ssh_client_alive_interval:
default: 600
default: 300
description: specifies an interval for sending keepalive messages.
type: int
ssh_client_alive_count:
default: 3
description: Defines the number of acceptable unanswered client alive messages
before disconnecting clients.
type: int
ssh_permit_tunnel:
default: false
type: bool
@@ -191,6 +194,7 @@ argument_specs:
default: 2048
description: remove Diffie-Hellman parameters smaller than the defined size
to mitigate logjam.
type: int
ssh_challengeresponseauthentication:
default: false
type: bool
@@ -235,10 +239,12 @@ argument_specs:
default: 2
description: Specifies the maximum number of authentication attempts permitted
per connection.
type: int
ssh_max_sessions:
default: 10
description: Specifies the maximum number of open sessions permitted from
a given connection.
type: int
ssh_print_debian_banner:
default: false
type: bool
@@ -315,6 +321,7 @@ argument_specs:
description: Change this list to overwrite ciphers. Defaults found in `defaults/main.yml`
ssh_custom_options:
default: []
type: list
description: Custom lines for SSH client configuration.
sshd_custom_options:
default: []