andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add support for current versions of Debian and EL (#893)

Browse Source 
* Add support for current versions of Debian and EL

Signed-off-by: Martin Schurz <[email protected]>

* Add conditions for EL8

Signed-off-by: Martin Schurz <[email protected]>

* Fix Audit in AlmaLinux

Signed-off-by: Martin Schurz <[email protected]>

* Fix broken SSH host key config in rhel/almalinux 10

Signed-off-by: Jonathan Wright <[email protected]>

* Generate SSH Keys on EL10

Signed-off-by: Martin Schurz <[email protected]>

* Generate SSH Keys for tests via Systemd

Signed-off-by: Martin Schurz <[email protected]>

* Fixup tests

Signed-off-by: Martin Schurz <[email protected]>

* Remove auditd conditions

Signed-off-by: Martin Schurz <[email protected]>

* Add path to audit handler

Signed-off-by: Martin Schurz <[email protected]>

* Install init scripts

Signed-off-by: Martin Schurz <[email protected]>

* Update main README

---------

Signed-off-by: Martin Schurz <[email protected]>
Signed-off-by: Jonathan Wright <[email protected]>
Co-authored-by: Jonathan Wright <[email protected]>
This commit is contained in:
Martin SchurzandJonathan Wright authored and GitHub committed 2025-08-12 12:48:46 +02:00
1 parent f14460514d
commit b87188c619
14 files changed
+57 -23
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/mysql_hardening.yml
+6 -1
View File
@@ -37,14 +37,19 @@ jobs:
fail-fast: false fail-fast: false
matrix: matrix:
molecule_distro: molecule_distro:
- almalinux8
- almalinux9
# - almalinux10 # problem with baseline
- centosstream9 - centosstream9
- rocky8 - rocky8
- rocky9 - rocky9
# - rocky10 # problem with baseline
- ubuntu2004 - ubuntu2004
- ubuntu2204 - ubuntu2204
- ubuntu2404 - ubuntu2404
- debian11 - debian11
- debian12 - debian12
- debian13
# - amazon # geerlingguy.mysql does not support fedora # - amazon # geerlingguy.mysql does not support fedora
# - arch # geerlingguy.mysql does not support arch # - arch # geerlingguy.mysql does not support arch
- opensuse_tumbleweed - opensuse_tumbleweed
@@ -71,7 +76,7 @@ jobs:
pip install "ansible-core<2.17" pip install "ansible-core<2.17"
ansible-galaxy collection install 'community.crypto:<3.0.0' ansible-galaxy collection install 'community.crypto:<3.0.0'
working-directory: ansible_collections/devsec/hardening working-directory: ansible_collections/devsec/hardening
if: matrix.molecule_distro == 'rocky8' if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
# that was a hard one to fix. robert did it thankfully # that was a hard one to fix. robert did it thankfully
# https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212 # https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212
.github/workflows/nginx_hardening.yml
+6 -1
View File
@@ -36,14 +36,19 @@ jobs:
fail-fast: false fail-fast: false
matrix: matrix:
molecule_distro: molecule_distro:
- almalinux8
- almalinux9
- almalinux10
- centosstream9 - centosstream9
- rocky8 - rocky8
- rocky9 - rocky9
- rocky10
- ubuntu2004 - ubuntu2004
- ubuntu2204 - ubuntu2204
- ubuntu2404 - ubuntu2404
- debian11 - debian11
- debian12 - debian12
- debian13
- amazon2023 - amazon2023
# - arch # needs to be fixed # - arch # needs to be fixed
# - opensuse_tumbleweed # needs to be fixed # - opensuse_tumbleweed # needs to be fixed
@@ -70,7 +75,7 @@ jobs:
pip install "ansible-core<2.17" pip install "ansible-core<2.17"
ansible-galaxy collection install 'community.crypto:<3.0.0' ansible-galaxy collection install 'community.crypto:<3.0.0'
working-directory: ansible_collections/devsec/hardening working-directory: ansible_collections/devsec/hardening
if: matrix.molecule_distro == 'rocky8' if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
# Molecule has problems detecting the proper location for installing roles # Molecule has problems detecting the proper location for installing roles
# https://github.com/ansible/molecule/issues/3806 # https://github.com/ansible/molecule/issues/3806
.github/workflows/os_hardening.yml
+6 -1
View File
@@ -39,9 +39,13 @@ jobs:
- molecule_distro: opensuse_tumbleweed - molecule_distro: opensuse_tumbleweed
molecule_docker_command: "/usr/lib/systemd/systemd" molecule_docker_command: "/usr/lib/systemd/systemd"
molecule_distro: molecule_distro:
- almalinux8
- almalinux9
- almalinux10
- centosstream9 - centosstream9
- rocky8 - rocky8
- rocky9 - rocky9
- rocky10
- fedora39 - fedora39
- fedora40 - fedora40
- ubuntu2004 - ubuntu2004
@@ -49,6 +53,7 @@ jobs:
- ubuntu2404 - ubuntu2404
- debian11 - debian11
- debian12 - debian12
- debian13
- amazon2023 - amazon2023
- arch - arch
molecule_docker_command: molecule_docker_command:
@@ -75,7 +80,7 @@ jobs:
pip install "ansible-core<2.17" pip install "ansible-core<2.17"
ansible-galaxy collection install 'community.crypto:<3.0.0' ansible-galaxy collection install 'community.crypto:<3.0.0'
working-directory: ansible_collections/devsec/hardening working-directory: ansible_collections/devsec/hardening
if: matrix.molecule_distro == 'rocky8' if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
- name: Test with molecule - name: Test with molecule
run: molecule test -s os_hardening run: molecule test -s os_hardening
.github/workflows/os_hardening_vm.yml
+7 -1
View File
@@ -36,6 +36,9 @@ jobs:
fail-fast: false fail-fast: false
matrix: matrix:
molecule_distro: molecule_distro:
- almalinux/8
- almalinux/9
# - almalinux/10 # boot loop
- generic/centos9s - generic/centos9s
- generic/rocky8 - generic/rocky8
- generic/rocky9 - generic/rocky9
@@ -69,7 +72,10 @@ jobs:
pip install "ansible-core<2.17" pip install "ansible-core<2.17"
ansible-galaxy collection install 'community.crypto:<3.0.0' ansible-galaxy collection install 'community.crypto:<3.0.0'
working-directory: ansible_collections/devsec/hardening working-directory: ansible_collections/devsec/hardening
if: matrix.molecule_distro == 'generic/rocky8' || matrix.molecule_distro == 'generic/opensuse15' if: >
matrix.molecule_distro == 'generic/rocky8' ||
matrix.molecule_distro == 'almalinux/8' ||
matrix.molecule_distro == 'generic/opensuse15'
- name: Update Vagrant Box - name: Update Vagrant Box
run: | run: |
.github/workflows/ssh_hardening.yml
+6 -1
View File
@@ -42,9 +42,13 @@ jobs:
- molecule_distro: alpine - molecule_distro: alpine
molecule_docker_command: "/sbin/init" molecule_docker_command: "/sbin/init"
molecule_distro: molecule_distro:
- almalinux8
- almalinux9
- almalinux10
- centosstream9 - centosstream9
- rocky8 - rocky8
- rocky9 - rocky9
- rocky10
- fedora39 - fedora39
- fedora40 - fedora40
- ubuntu2004 - ubuntu2004
@@ -52,6 +56,7 @@ jobs:
- ubuntu2404 - ubuntu2404
- debian11 - debian11
- debian12 - debian12
- debian13
- amazon2023 - amazon2023
- arch - arch
molecule_docker_command: molecule_docker_command:
@@ -78,7 +83,7 @@ jobs:
pip install "ansible-core<2.17" pip install "ansible-core<2.17"
ansible-galaxy collection install 'community.crypto:<3.0.0' ansible-galaxy collection install 'community.crypto:<3.0.0'
working-directory: ansible_collections/devsec/hardening working-directory: ansible_collections/devsec/hardening
if: matrix.molecule_distro == 'rocky8' if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
- name: Test with molecule - name: Test with molecule
run: molecule test -s ssh_hardening run: molecule test -s ssh_hardening
.github/workflows/ssh_hardening_custom_tests.yml
+6 -1
View File
@@ -42,9 +42,13 @@ jobs:
- molecule_distro: alpine - molecule_distro: alpine
molecule_docker_command: "/sbin/init" molecule_docker_command: "/sbin/init"
molecule_distro: molecule_distro:
- almalinux8
- almalinux9
- almalinux10
- centosstream9 - centosstream9
- rocky8 - rocky8
- rocky9 - rocky9
- rocky10
- fedora39 - fedora39
- fedora40 - fedora40
- ubuntu2004 - ubuntu2004
@@ -52,6 +56,7 @@ jobs:
- ubuntu2404 - ubuntu2404
- debian11 - debian11
- debian12 - debian12
- debian13
- amazon2023 - amazon2023
- arch - arch
molecule_docker_command: molecule_docker_command:
@@ -78,7 +83,7 @@ jobs:
pip install "ansible-core<2.17" pip install "ansible-core<2.17"
ansible-galaxy collection install 'community.crypto:<3.0.0' ansible-galaxy collection install 'community.crypto:<3.0.0'
working-directory: ansible_collections/devsec/hardening working-directory: ansible_collections/devsec/hardening
if: matrix.molecule_distro == 'rocky8' if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
- name: Test with molecule - name: Test with molecule
run: molecule test -s ssh_hardening_custom_tests run: molecule test -s ssh_hardening_custom_tests
README.md
+3 -3
View File
@@ -14,9 +14,9 @@ This collection provides battle tested hardening for:
- Linux operating systems: - Linux operating systems:
- CentOS Stream 9 - CentOS Stream 9
- AlmaLinux 8/9 - AlmaLinux 8/9/10
- Rocky Linux 8/9 - Rocky Linux 8/9/10
- Debian 11/12 - Debian 11/12/13
- Ubuntu 20.04/22.04/24.04 - Ubuntu 20.04/22.04/24.04
- Amazon Linux (some roles supported) - Amazon Linux (some roles supported)
- Arch Linux (some roles supported) - Arch Linux (some roles supported)
molecule/os_hardening_vm/prepare.yml
+6 -1
View File
@@ -59,6 +59,12 @@
- python3-libselinux - python3-libselinux
when: ansible_facts.distribution == 'Fedora' when: ansible_facts.distribution == 'Fedora'
- name: Install required tools on AlmaLinux
ansible.builtin.dnf:
name:
- initscripts
when: ansible_facts.distribution == 'AlmaLinux'
- name: Install required tools on Arch - name: Install required tools on Arch
community.general.pacman: community.general.pacman:
name: name:
@@ -84,7 +90,6 @@
ansible.posix.mount: ansible.posix.mount:
path: /boot/efi path: /boot/efi
state: unmounted state: unmounted
when: ansible_facts.distribution == 'Fedora'
- name: Include YUM prepare tasks - name: Include YUM prepare tasks
ansible.builtin.include_tasks: prepare_tasks/yum.yml ansible.builtin.include_tasks: prepare_tasks/yum.yml
molecule/ssh_hardening/prepare.yml
+1 -6
View File
@@ -75,11 +75,6 @@
update_cache: true update_cache: true
when: ansible_facts.os_family == 'Archlinux' when: ansible_facts.os_family == 'Archlinux'
- name: Create ssh host keys # noqa ignore-errors - name: Create ssh host keys # noqa ignore-errors no-changed-when
ansible.builtin.command: ssh-keygen -A ansible.builtin.command: ssh-keygen -A
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
or ansible_facts.distribution == "Fedora"
or ansible_facts.distribution == "Amazon"
or ansible_facts.os_family == "Suse"
changed_when: false
ignore_errors: true ignore_errors: true
molecule/ssh_hardening_custom_tests/prepare.yml
+1 -6
View File
@@ -75,11 +75,6 @@
update_cache: true update_cache: true
when: ansible_facts.os_family == 'Alpine' when: ansible_facts.os_family == 'Alpine'
- name: Create ssh host keys # noqa ignore-errors - name: Create ssh host keys # noqa ignore-errors no-changed-when
ansible.builtin.command: ssh-keygen -A ansible.builtin.command: ssh-keygen -A
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
or ansible_facts.distribution == "Fedora"
or ansible_facts.distribution == "Amazon"
or ansible_facts.os_family == "Suse"
changed_when: false
ignore_errors: true ignore_errors: true
roles/mysql_hardening/meta/main.yml
+3 -1
View File
@@ -10,6 +10,7 @@ galaxy_info:
versions: versions:
- "8" - "8"
- "9" - "9"
- "10"
- name: Ubuntu - name: Ubuntu
versions: versions:
- focal - focal
@@ -17,8 +18,9 @@ galaxy_info:
- noble - noble
- name: Debian - name: Debian
versions: versions:
- bullseye - trixie
- bookworm - bookworm
- bullseye
- name: Amazon - name: Amazon
- name: opensuse - name: opensuse
galaxy_tags: galaxy_tags:
roles/nginx_hardening/meta/main.yml
+2
View File
@@ -10,6 +10,7 @@ galaxy_info:
versions: versions:
- "8" - "8"
- "9" - "9"
- "10"
- name: Ubuntu - name: Ubuntu
versions: versions:
- focal - focal
@@ -17,6 +18,7 @@ galaxy_info:
- noble - noble
- name: Debian - name: Debian
versions: versions:
- trixie
- bookworm - bookworm
- bullseye - bullseye
- name: Amazon - name: Amazon
roles/os_hardening/meta/main.yml
+2
View File
@@ -10,6 +10,7 @@ galaxy_info:
versions: versions:
- "8" - "8"
- "9" - "9"
- "10"
- name: Ubuntu - name: Ubuntu
versions: versions:
- focal - focal
@@ -17,6 +18,7 @@ galaxy_info:
- noble - noble
- name: Debian - name: Debian
versions: versions:
- trixie
- bookworm - bookworm
- bullseye - bullseye
- name: Amazon - name: Amazon
roles/ssh_hardening/meta/main.yml
+2
View File
@@ -10,6 +10,7 @@ galaxy_info:
versions: versions:
- "8" - "8"
- "9" - "9"
- "10"
- name: Ubuntu - name: Ubuntu
versions: versions:
- focal - focal
@@ -17,6 +18,7 @@ galaxy_info:
- noble - noble
- name: Debian - name: Debian
versions: versions:
- trixie
- bookworm - bookworm
- bullseye - bullseye
- name: Alpine - name: Alpine