From dac66f4a88fa7919d110f969ff910a2c59e43764 Mon Sep 17 00:00:00 2001 From: Sebastian Gumprich Date: Wed, 7 Sep 2022 08:56:28 +0200 Subject: [PATCH] simplify OS-vars files Signed-off-by: Sebastian Gumprich --- .../vars/{RedHat_7.yml => RedHat.yml} | 0 roles/mysql_hardening/vars/RedHat_8.yml | 9 ---- roles/mysql_hardening/vars/RedHat_9.yml | 9 ---- roles/mysql_hardening/vars/Rocky_8.yml | 9 ---- roles/mysql_hardening/vars/Rocky_9.yml | 9 ---- .../vars/{Ubuntu_16.yml => Ubuntu.yml} | 0 roles/mysql_hardening/vars/Ubuntu_18.yml | 10 ----- roles/mysql_hardening/vars/Ubuntu_20.yml | 10 ----- roles/mysql_hardening/vars/Ubuntu_22.yml | 10 ----- roles/os_hardening/vars/RedHat.yml | 2 +- roles/os_hardening/vars/RedHat_8.yml | 45 ------------------- roles/os_hardening/vars/Rocky_8.yml | 45 ------------------- roles/ssh_hardening/vars/CentOS_8.yml | 23 ---------- roles/ssh_hardening/vars/CentOS_9.yml | 23 ---------- roles/ssh_hardening/vars/RedHat.yml | 2 +- .../vars/{RedHat_8.yml => RedHat_7.yml} | 2 +- roles/ssh_hardening/vars/RedHat_9.yml | 23 ---------- 17 files changed, 3 insertions(+), 228 deletions(-) rename roles/mysql_hardening/vars/{RedHat_7.yml => RedHat.yml} (100%) delete mode 100644 roles/mysql_hardening/vars/RedHat_8.yml delete mode 100644 roles/mysql_hardening/vars/RedHat_9.yml delete mode 100644 roles/mysql_hardening/vars/Rocky_8.yml delete mode 100644 roles/mysql_hardening/vars/Rocky_9.yml rename roles/mysql_hardening/vars/{Ubuntu_16.yml => Ubuntu.yml} (100%) delete mode 100644 roles/mysql_hardening/vars/Ubuntu_18.yml delete mode 100644 roles/mysql_hardening/vars/Ubuntu_20.yml delete mode 100644 roles/mysql_hardening/vars/Ubuntu_22.yml delete mode 100644 roles/os_hardening/vars/RedHat_8.yml delete mode 100644 roles/os_hardening/vars/Rocky_8.yml delete mode 100644 roles/ssh_hardening/vars/CentOS_8.yml delete mode 100644 roles/ssh_hardening/vars/CentOS_9.yml rename roles/ssh_hardening/vars/{RedHat_8.yml => RedHat_7.yml} (94%) delete mode 100644 roles/ssh_hardening/vars/RedHat_9.yml diff --git a/roles/mysql_hardening/vars/RedHat_7.yml b/roles/mysql_hardening/vars/RedHat.yml similarity index 100% rename from roles/mysql_hardening/vars/RedHat_7.yml rename to roles/mysql_hardening/vars/RedHat.yml diff --git a/roles/mysql_hardening/vars/RedHat_8.yml b/roles/mysql_hardening/vars/RedHat_8.yml deleted file mode 100644 index 7edaadd9..00000000 --- a/roles/mysql_hardening/vars/RedHat_8.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -mysql_daemon: mariadb -mysql_hardening_mysql_conf_file: '/etc/my.cnf' -mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d' - -mysql_cnf_owner: 'root' # owner of /etc/mysql/*.cnf files -mysql_cnf_group: 'mysql' # owner of /etc/mysql/*.cnf files - -mysql_hardening_group: 'mysql' diff --git a/roles/mysql_hardening/vars/RedHat_9.yml b/roles/mysql_hardening/vars/RedHat_9.yml deleted file mode 100644 index 7edaadd9..00000000 --- a/roles/mysql_hardening/vars/RedHat_9.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -mysql_daemon: mariadb -mysql_hardening_mysql_conf_file: '/etc/my.cnf' -mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d' - -mysql_cnf_owner: 'root' # owner of /etc/mysql/*.cnf files -mysql_cnf_group: 'mysql' # owner of /etc/mysql/*.cnf files - -mysql_hardening_group: 'mysql' diff --git a/roles/mysql_hardening/vars/Rocky_8.yml b/roles/mysql_hardening/vars/Rocky_8.yml deleted file mode 100644 index 7edaadd9..00000000 --- a/roles/mysql_hardening/vars/Rocky_8.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -mysql_daemon: mariadb -mysql_hardening_mysql_conf_file: '/etc/my.cnf' -mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d' - -mysql_cnf_owner: 'root' # owner of /etc/mysql/*.cnf files -mysql_cnf_group: 'mysql' # owner of /etc/mysql/*.cnf files - -mysql_hardening_group: 'mysql' diff --git a/roles/mysql_hardening/vars/Rocky_9.yml b/roles/mysql_hardening/vars/Rocky_9.yml deleted file mode 100644 index 7edaadd9..00000000 --- a/roles/mysql_hardening/vars/Rocky_9.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -mysql_daemon: mariadb -mysql_hardening_mysql_conf_file: '/etc/my.cnf' -mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d' - -mysql_cnf_owner: 'root' # owner of /etc/mysql/*.cnf files -mysql_cnf_group: 'mysql' # owner of /etc/mysql/*.cnf files - -mysql_hardening_group: 'mysql' diff --git a/roles/mysql_hardening/vars/Ubuntu_16.yml b/roles/mysql_hardening/vars/Ubuntu.yml similarity index 100% rename from roles/mysql_hardening/vars/Ubuntu_16.yml rename to roles/mysql_hardening/vars/Ubuntu.yml diff --git a/roles/mysql_hardening/vars/Ubuntu_18.yml b/roles/mysql_hardening/vars/Ubuntu_18.yml deleted file mode 100644 index ce0ebe36..00000000 --- a/roles/mysql_hardening/vars/Ubuntu_18.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- -mysql_daemon: mysql - -mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf' -mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d' - -mysql_cnf_owner: 'root' # owner of /etc/mysql/*.cnf files -mysql_cnf_group: 'mysql' # owner of /etc/mysql/*.cnf files - -mysql_hardening_group: 'adm' diff --git a/roles/mysql_hardening/vars/Ubuntu_20.yml b/roles/mysql_hardening/vars/Ubuntu_20.yml deleted file mode 100644 index ce0ebe36..00000000 --- a/roles/mysql_hardening/vars/Ubuntu_20.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- -mysql_daemon: mysql - -mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf' -mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d' - -mysql_cnf_owner: 'root' # owner of /etc/mysql/*.cnf files -mysql_cnf_group: 'mysql' # owner of /etc/mysql/*.cnf files - -mysql_hardening_group: 'adm' diff --git a/roles/mysql_hardening/vars/Ubuntu_22.yml b/roles/mysql_hardening/vars/Ubuntu_22.yml deleted file mode 100644 index ce0ebe36..00000000 --- a/roles/mysql_hardening/vars/Ubuntu_22.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- -mysql_daemon: mysql - -mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf' -mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d' - -mysql_cnf_owner: 'root' # owner of /etc/mysql/*.cnf files -mysql_cnf_group: 'mysql' # owner of /etc/mysql/*.cnf files - -mysql_hardening_group: 'adm' diff --git a/roles/os_hardening/vars/RedHat.yml b/roles/os_hardening/vars/RedHat.yml index a54384ac..2a0aa329 100644 --- a/roles/os_hardening/vars/RedHat.yml +++ b/roles/os_hardening/vars/RedHat.yml @@ -33,7 +33,7 @@ os_auth_sub_gid_min: 100000 os_auth_sub_gid_max: 600100000 os_auth_sub_gid_count: 65536 -os_auth_pam_sssd_enable: false +os_auth_pam_sssd_enable: true # defaults for useradd os_useradd_mail_dir: /var/spool/mail diff --git a/roles/os_hardening/vars/RedHat_8.yml b/roles/os_hardening/vars/RedHat_8.yml deleted file mode 100644 index 2a0aa329..00000000 --- a/roles/os_hardening/vars/RedHat_8.yml +++ /dev/null @@ -1,45 +0,0 @@ ---- - -os_packages_pam_ccreds: 'pam_ccreds' -os_nologin_shell_path: '/sbin/nologin' - -# Different distros use different standards for /etc/shadow perms, e.g. -# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640. -# You must provide key/value pairs for owner, group, and mode if overriding. -os_shadow_perms: - owner: root - group: root - mode: '0000' - -os_passwd_perms: - owner: root - group: root - mode: '0644' - -os_env_umask: '077' - -os_auth_uid_min: 1000 -os_auth_uid_max: 60000 -os_auth_gid_min: 1000 -os_auth_gid_max: 60000 -os_auth_sys_uid_min: 201 -os_auth_sys_uid_max: 999 -os_auth_sys_gid_min: 201 -os_auth_sys_gid_max: 999 -os_auth_sub_uid_min: 100000 -os_auth_sub_uid_max: 600100000 -os_auth_sub_uid_count: 65536 -os_auth_sub_gid_min: 100000 -os_auth_sub_gid_max: 600100000 -os_auth_sub_gid_count: 65536 - -os_auth_pam_sssd_enable: true - -# defaults for useradd -os_useradd_mail_dir: /var/spool/mail -os_useradd_create_home: true - -modprobe_package: 'module-init-tools' -auditd_package: 'audit' - -hidepid_option: '2' # allowed values: 0, 1, 2 diff --git a/roles/os_hardening/vars/Rocky_8.yml b/roles/os_hardening/vars/Rocky_8.yml deleted file mode 100644 index 2a0aa329..00000000 --- a/roles/os_hardening/vars/Rocky_8.yml +++ /dev/null @@ -1,45 +0,0 @@ ---- - -os_packages_pam_ccreds: 'pam_ccreds' -os_nologin_shell_path: '/sbin/nologin' - -# Different distros use different standards for /etc/shadow perms, e.g. -# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640. -# You must provide key/value pairs for owner, group, and mode if overriding. -os_shadow_perms: - owner: root - group: root - mode: '0000' - -os_passwd_perms: - owner: root - group: root - mode: '0644' - -os_env_umask: '077' - -os_auth_uid_min: 1000 -os_auth_uid_max: 60000 -os_auth_gid_min: 1000 -os_auth_gid_max: 60000 -os_auth_sys_uid_min: 201 -os_auth_sys_uid_max: 999 -os_auth_sys_gid_min: 201 -os_auth_sys_gid_max: 999 -os_auth_sub_uid_min: 100000 -os_auth_sub_uid_max: 600100000 -os_auth_sub_uid_count: 65536 -os_auth_sub_gid_min: 100000 -os_auth_sub_gid_max: 600100000 -os_auth_sub_gid_count: 65536 - -os_auth_pam_sssd_enable: true - -# defaults for useradd -os_useradd_mail_dir: /var/spool/mail -os_useradd_create_home: true - -modprobe_package: 'module-init-tools' -auditd_package: 'audit' - -hidepid_option: '2' # allowed values: 0, 1, 2 diff --git a/roles/ssh_hardening/vars/CentOS_8.yml b/roles/ssh_hardening/vars/CentOS_8.yml deleted file mode 100644 index 6bafe8c7..00000000 --- a/roles/ssh_hardening/vars/CentOS_8.yml +++ /dev/null @@ -1,23 +0,0 @@ ---- -sshd_path: /usr/sbin/sshd -ssh_host_keys_dir: '/etc/ssh' -sshd_service_name: sshd -ssh_owner: root -ssh_group: root -ssh_host_keys_owner: 'root' -ssh_host_keys_group: 'ssh_keys' -ssh_selinux_packages: - - policycoreutils-python-utils - - checkpolicy - -# true if SSH support Kerberos -ssh_kerberos_support: true - -# true if SSH has PAM support -ssh_pam_support: true - -sshd_moduli_file: '/etc/ssh/moduli' - -# disable CRYPTO_POLICY to take settings from sshd configuration -# see: https://access.redhat.com/solutions/4410591 -sshd_disable_crypto_policy: true diff --git a/roles/ssh_hardening/vars/CentOS_9.yml b/roles/ssh_hardening/vars/CentOS_9.yml deleted file mode 100644 index 6bafe8c7..00000000 --- a/roles/ssh_hardening/vars/CentOS_9.yml +++ /dev/null @@ -1,23 +0,0 @@ ---- -sshd_path: /usr/sbin/sshd -ssh_host_keys_dir: '/etc/ssh' -sshd_service_name: sshd -ssh_owner: root -ssh_group: root -ssh_host_keys_owner: 'root' -ssh_host_keys_group: 'ssh_keys' -ssh_selinux_packages: - - policycoreutils-python-utils - - checkpolicy - -# true if SSH support Kerberos -ssh_kerberos_support: true - -# true if SSH has PAM support -ssh_pam_support: true - -sshd_moduli_file: '/etc/ssh/moduli' - -# disable CRYPTO_POLICY to take settings from sshd configuration -# see: https://access.redhat.com/solutions/4410591 -sshd_disable_crypto_policy: true diff --git a/roles/ssh_hardening/vars/RedHat.yml b/roles/ssh_hardening/vars/RedHat.yml index 4c97cd6a..6bafe8c7 100644 --- a/roles/ssh_hardening/vars/RedHat.yml +++ b/roles/ssh_hardening/vars/RedHat.yml @@ -7,7 +7,7 @@ ssh_group: root ssh_host_keys_owner: 'root' ssh_host_keys_group: 'ssh_keys' ssh_selinux_packages: - - policycoreutils-python + - policycoreutils-python-utils - checkpolicy # true if SSH support Kerberos diff --git a/roles/ssh_hardening/vars/RedHat_8.yml b/roles/ssh_hardening/vars/RedHat_7.yml similarity index 94% rename from roles/ssh_hardening/vars/RedHat_8.yml rename to roles/ssh_hardening/vars/RedHat_7.yml index 31dadb10..4c97cd6a 100644 --- a/roles/ssh_hardening/vars/RedHat_8.yml +++ b/roles/ssh_hardening/vars/RedHat_7.yml @@ -7,7 +7,7 @@ ssh_group: root ssh_host_keys_owner: 'root' ssh_host_keys_group: 'ssh_keys' ssh_selinux_packages: - - python3-policycoreutils + - policycoreutils-python - checkpolicy # true if SSH support Kerberos diff --git a/roles/ssh_hardening/vars/RedHat_9.yml b/roles/ssh_hardening/vars/RedHat_9.yml deleted file mode 100644 index 31dadb10..00000000 --- a/roles/ssh_hardening/vars/RedHat_9.yml +++ /dev/null @@ -1,23 +0,0 @@ ---- -sshd_path: /usr/sbin/sshd -ssh_host_keys_dir: '/etc/ssh' -sshd_service_name: sshd -ssh_owner: root -ssh_group: root -ssh_host_keys_owner: 'root' -ssh_host_keys_group: 'ssh_keys' -ssh_selinux_packages: - - python3-policycoreutils - - checkpolicy - -# true if SSH support Kerberos -ssh_kerberos_support: true - -# true if SSH has PAM support -ssh_pam_support: true - -sshd_moduli_file: '/etc/ssh/moduli' - -# disable CRYPTO_POLICY to take settings from sshd configuration -# see: https://access.redhat.com/solutions/4410591 -sshd_disable_crypto_policy: true