From b5ca78a9cd19c9a66103df4b2e853a6c60b4b7b7 Mon Sep 17 00:00:00 2001 From: Sebastian Gumprich Date: Fri, 19 Mar 2021 15:03:57 +0100 Subject: [PATCH] chmod /home directories to 0700 This is based on https://github.com/dev-sec/ansible-collection-hardening/pull/277 and updated to work with the new collection. Thanks to @aardbol for this initial implementation! Signed-off-by: Sebastian Gumprich --- roles/os_hardening/README.md | 3 +++ roles/os_hardening/defaults/main.yml | 6 ++++++ roles/os_hardening/tasks/user_accounts.yml | 18 ++++++++++++++++++ 3 files changed, 27 insertions(+) diff --git a/roles/os_hardening/README.md b/roles/os_hardening/README.md index c6fb7d91..1067d611 100644 --- a/roles/os_hardening/README.md +++ b/roles/os_hardening/README.md @@ -187,6 +187,9 @@ We know that this is the case on Raspberry Pi. - `proc_mnt_options` - Default: `rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}` - Description: Mount proc with hardenized options, including `hidepid` with variable value. +- `os_ignore_home_folder_users` + - Default: `lost+found` + - Description: specify user home folders in `/home` that shouldn't be chmodded to 700 ## Packages diff --git a/roles/os_hardening/defaults/main.yml b/roles/os_hardening/defaults/main.yml index 93d13be7..e14d6083 100644 --- a/roles/os_hardening/defaults/main.yml +++ b/roles/os_hardening/defaults/main.yml @@ -13,8 +13,14 @@ os_auth_pam_pwquality_options: 'try_first_pass retry=3 type=' # used in RHEL7 os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6] os_chfn_restrict: '' + +# Set to false to disable chmod /home folders to 700 +os_chmod_home_folders: true + # may contain: change_user os_security_users_allow: [] +# specify user home folders in /home that shouldn't be chmodded to 700 +os_ignore_home_folder_users: ['lost+found'] # specify system accounts those login should not be disabled and password not changed os_ignore_users: ['vagrant', 'kitchen'] os_security_kernel_enable_module_loading: true diff --git a/roles/os_hardening/tasks/user_accounts.yml b/roles/os_hardening/tasks/user_accounts.yml index 4709df29..992196aa 100644 --- a/roles/os_hardening/tasks/user_accounts.yml +++ b/roles/os_hardening/tasks/user_accounts.yml @@ -45,3 +45,21 @@ createhome: false with_flattened: - '{{ sys_accs_cond | default([]) | difference(os_ignore_users) | list }}' + +- name: get all home directories in /home, but skip ignored users + find: + paths: /home/ + recurse: no + file_type: directory + excludes: "{{ os_ignore_home_folder_users | join(',') }}" + register: home_directories + when: os_chmod_home_folders | bool + +- name: set ownership of /home directories to 0700 + file: + mode: 0700 + path: "{{ item }}" + state: directory + loop: + - "{{ home_directories.files | map(attribute='path') | list }}" + when: os_chmod_home_folders | bool