Improve VM based testing of SSH hardening (#878)
This commit is contained in:
Martin Schurz authored and GitHub committed
1 parent
c89fe9e5e4
commit
9bbae051d6
15 files changed
+27
-21
No files matched your search
@@ -8,9 +8,7 @@ exclude_paths:
|
||||
- .ansible/ # somehow someone decided that the cache directory should be renamed
|
||||
# add all waivers individually, since exclude_files does not support globs
|
||||
- molecule/os_hardening/waivers.yaml
|
||||
- molecule/ssh_hardening_bsd/waivers_freebsd13.yaml
|
||||
- molecule/ssh_hardening_bsd/waivers_freebsd14.yaml
|
||||
- molecule/ssh_hardening_bsd/waivers_openbsd7.yaml
|
||||
- molecule/ssh_hardening_vm/waivers_*.yaml
|
||||
|
||||
mock_roles:
|
||||
- geerlingguy.git
|
||||
|
||||
@@ -1,21 +1,21 @@
|
||||
---
|
||||
name: "devsec.ssh_hardening BSD"
|
||||
name: "devsec.ssh_hardening VM"
|
||||
on: # yamllint disable-line rule:truthy
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_bsd/**'
|
||||
- '.github/workflows/ssh_hardening_bsd.yml'
|
||||
- 'molecule/ssh_hardening_vm/**'
|
||||
- '.github/workflows/ssh_hardening_vm.yml'
|
||||
- 'requirements.txt'
|
||||
- 'requirements-vm.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_bsd/**'
|
||||
- '.github/workflows/ssh_hardening_bsd.yml'
|
||||
- 'molecule/ssh_hardening_vm/**'
|
||||
- '.github/workflows/ssh_hardening_vm.yml'
|
||||
- 'requirements.txt'
|
||||
- 'requirements-vm.txt'
|
||||
schedule:
|
||||
@@ -38,9 +38,11 @@ jobs:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- openbsd7
|
||||
- freebsd13
|
||||
- freebsd14
|
||||
- generic/openbsd7
|
||||
- generic/freebsd13
|
||||
- generic/freebsd14
|
||||
- cloud-image/debian-13
|
||||
- cloud-image/ubuntu-24.04
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
|
||||
@@ -58,14 +60,14 @@ jobs:
|
||||
|
||||
- name: Update Vagrant Box
|
||||
run: |
|
||||
vagrant box update --box generic/${{ matrix.molecule_distro }} || true
|
||||
vagrant box update --box ${{ matrix.molecule_distro }} || true
|
||||
|
||||
- name: Test with molecule
|
||||
run: |
|
||||
source ~/.venv/ansible-collection-hardening/bin/activate
|
||||
# Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
|
||||
export MOLECULE_VAGRANT_PLUGIN_DIR=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')/molecule_plugins/vagrant
|
||||
molecule test -s ssh_hardening_bsd
|
||||
molecule test -s ssh_hardening_vm
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
@@ -3,7 +3,7 @@
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
|
||||
|
||||
File renamed without changes.
File renamed without changes.
@@ -8,7 +8,7 @@ platforms:
|
||||
# since we also need to use different OS users to run the tests because of how molecule operates,
|
||||
# the VM names must be predictable by OS user (to clean up canceled runs)
|
||||
- name: ${USER}
|
||||
box: generic/${MOLECULE_DISTRO}
|
||||
box: ${MOLECULE_DISTRO}
|
||||
memory: 1024
|
||||
cpus: 2
|
||||
provisioner:
|
||||
@@ -8,13 +8,13 @@
|
||||
# temporary fix for https://github.com/lavabit/robox/issues/305
|
||||
ansible.builtin.raw: echo "https://ftp.eu.openbsd.org/pub/OpenBSD" > /etc/installurl
|
||||
changed_when: false
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
|
||||
|
||||
- name: Install python
|
||||
# BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
|
||||
ansible.builtin.raw: pkg_add python%3.10
|
||||
ansible.builtin.raw: pkg_add -I python%3.11
|
||||
changed_when: false
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
|
||||
|
||||
- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: all
|
||||
@@ -9,7 +9,7 @@
|
||||
dest: /usr/bin/type
|
||||
state: hard
|
||||
mode: "0770"
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
|
||||
|
||||
- name: Verify
|
||||
hosts: localhost
|
||||
@@ -36,7 +36,7 @@
|
||||
ansible.builtin.command: >
|
||||
docker run --rm
|
||||
--volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
|
||||
--volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') }}.yaml:/waivers.yaml
|
||||
--volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') | regex_replace('^.*/', '') }}.yaml:/waivers.yaml
|
||||
docker.io/cincproject/auditor exec
|
||||
--ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
|
||||
-t ssh://{{ lookup('env', 'USER') }}
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
{}
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
{}
|
||||
File renamed without changes.
File renamed without changes.
File renamed without changes.
@@ -0,0 +1,2 @@
|
||||
---
|
||||
{}
|
||||
@@ -1,7 +1,7 @@
|
||||
# dev-sec.ssh_hardening
|
||||
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml)
|
||||
|
||||
## Description
|
||||
|
||||
Reference in new issue
Block a user