From fb8b9142c8bc4579777be082f562a221f9880abe Mon Sep 17 00:00:00 2001 From: divialth <65872926+divialth@users.noreply.github.com> Date: Mon, 22 Aug 2022 11:16:57 +0200 Subject: [PATCH] rework filesystem hardening (#555) * rework filesystem hardening - removed a lot duplicated code by using a loop - added new hardening options for /tmp - added new options "passno" and "dump" for every filesystem. currently ansible changed that values to 0 for every fs new default depends on fstype, can be overwriten in config - removed default fstype in config the type will now be autodetected, can be overwriten in config - mount src setting is now optional the source will now be autodetected, can be overwriten in config - it will be now checked, if it is really a mount - changed fs reload to handler - removed check os_auditd_enabled on /var/log/audit Signed-off-by: divialth <65872926+divialth@users.noreply.github.com> * fix lint errors Signed-off-by: divialth <65872926+divialth@users.noreply.github.com> * implemented the name suggestions Signed-off-by: divialth <65872926+divialth@users.noreply.github.com> Signed-off-by: divialth <65872926+divialth@users.noreply.github.com> --- roles/os_hardening/README.md | 115 ++++++++-- roles/os_hardening/defaults/main.yml | 38 +++- roles/os_hardening/handlers/main.yml | 6 + roles/os_hardening/tasks/minimize_access.yml | 208 ++---------------- .../os_hardening/tasks/minimize_access_fs.yml | 36 +++ 5 files changed, 189 insertions(+), 214 deletions(-) create mode 100644 roles/os_hardening/tasks/minimize_access_fs.yml diff --git a/roles/os_hardening/README.md b/roles/os_hardening/README.md index 09aaacbc..471bead3 100644 --- a/roles/os_hardening/README.md +++ b/roles/os_hardening/README.md @@ -300,8 +300,14 @@ We know that this is the case on Raspberry Pi. - Default: `rw,nosuid,nodev,noexec` - Description: Configure mount options for /boot - `os_mnt_boot_filesystem` - - Default: `ext4` - - Description: Configure file system for fstab entry /boot + - Default: `""` + - Description: Configure file system for fstab entry /boot. If empty, the current file system type will be used. +- `os_mnt_boot_dump` + - Default: ext3 + ext4 `1` / other `0` + - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype. +- `os_mnt_boot_passno` + - Default: ext3 + ext4 `2` / other `0` + - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype. - `os_mnt_dev_dir_mode` - Default: `0755` - Description: Set default perimissions for /dev @@ -315,8 +321,14 @@ We know that this is the case on Raspberry Pi. - Default: `'rw,nosuid,noexec'` - Description: Configure mount options for /dev - `os_mnt_dev_filesystem` - - Default: `ext4` + - Default: `devtmpfs` - Description: Configure file system for fstab entry /dev +- `os_mnt_dev_dump` + - Default: `0` + - Description: Configure dump for fstab entry /var/tmp. +- `os_mnt_dev_passno` + - Default: `0` + - Description: Configure passno for fstab entry /var/tmp. - `os_mnt_dev_shm_dir_mode` - Default: `1777` - Description: Set default perimissions for /dev/shm @@ -330,8 +342,14 @@ We know that this is the case on Raspberry Pi. - Default: `rw,nosuid,nodev,noexec` - Description: Configure mount options for /dev/shm - `os_mnt_dev_shm_filesystem` - - Default: `ext4` + - Default: `tmpfs` - Description: Configure file system for fstab entry /dev/shm +- `os_mnt_dev_shm_dump` + - Default: `0` + - Description: Configure dump for fstab entry /var/tmp. +- `os_mnt_dev_shm_passno` + - Default: `0` + - Description: Configure passno for fstab entry /var/tmp. - `os_mnt_home_dir_mode` - Default: `0755` - Description: Set default perimissions for /home @@ -340,13 +358,19 @@ We know that this is the case on Raspberry Pi. - Description: Set to true to configure /home mountpoint - `os_mnt_home_src` - Default: `""` - - Description: Set mount source for /home + - Description: Set mount source for /home. If empty, the current file system source device will be used. - `os_mnt_home_options` - Default: `rw,nosuid,nodev` - Description: Configure mount options for /home - `os_mnt_home_filesystem` - - Default: `ext4` - - Description: Configure file system for fstab entry /home + - Default: `""` + - Description: Configure file system for fstab entry /home. If empty, the current file system type will be used. +- `os_mnt_home_dump` + - Default: ext3 + ext4 `1` / other `0` + - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype. +- `os_mnt_home_passno` + - Default: ext3 + ext4 `2` / other `0` + - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype. - `os_mnt_run_dir_mode` - Default: `0755` - Description: Set default perimissions for /run @@ -360,8 +384,35 @@ We know that this is the case on Raspberry Pi. - Default: `rw,nosuid,nodev` - Description: Configure mount options for /run - `os_mnt_run_filesystem` - - Default: `ext4` + - Default: `tmpfs` - Description: Configure file system for fstab entry /run +- `os_mnt_run_dump` + - Default: `0` + - Description: Configure dump for fstab entry /var/tmp. +- `os_mnt_run_passno` + - Default: `0` + - Description: Configure passno for fstab entry /var/tmp. +- `os_mnt_tmp_dir_mode` + - Default: `1777` + - Description: Set default perimissions for /tmp +- `os_mnt_tmp_enabled` + - Default: `false` + - Description: Set to true to configure /tmp mountpoint +- `os_mnt_tmp_src` + - Default: `""` + - Description: Set mount source for /tmp. If empty, the current file system source device will be used. +- `os_mnt_tmp_options` + - Default: `rw,nosuid,nodev,noexec` + - Description: Configure mount options for /tmp +- `os_mnt_tmp_filesystem` + - Default: `""` + - Description: Configure file system for fstab entry /tmp. If empty, the current file system type will be used. +- `os_mnt_tmp_dump` + - Default: ext3 + ext4 `1` / other `0` + - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype. +- `os_mnt_tmp_passno` + - Default: ext3 + ext4 `2` / other `0` + - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype. - `os_mnt_var_dir_mode` - Default: `0755` - Description: Set default perimissions for /var @@ -370,13 +421,19 @@ We know that this is the case on Raspberry Pi. - Description: Set to true to configure /var mountpoint - `os_mnt_var_src` - Default: `""` - - Description: Set mount source for /var + - Description: Set mount source for /var. If empty, the current file system source device will be used. - `os_mnt_var_options` - Default: `rw,nosuid,nodev` - Description: Configure mount options for /var - `os_mnt_var_filesystem` - - Default: `ext4` - - Description: Configure file system for fstab entry /var + - Default: `""` + - Description: Configure file system for fstab entry /var. If empty, the current file system type will be used. +- `os_mnt_var_dump` + - Default: ext3 + ext4 `1` / other `0` + - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype. +- `os_mnt_var_passno` + - Default: ext3 + ext4 `2` / other `0` + - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype. - `os_mnt_var_log_dir_mode` - Default: `0755` - Description: Set default perimissions for /var/log @@ -385,13 +442,19 @@ We know that this is the case on Raspberry Pi. - Description: Set to true to configure /var/log mountpoint - `os_mnt_var_log_src` - Default: `""` - - Description: Set mount source for /var/log + - Description: Set mount source for /var/log. If empty, the current file system source device will be used. - `os_mnt_var_log_options` - Default: `rw,nosuid,nodev,noexec` - Description: Configure mount options for /var/log - `os_mnt_var_log_filesystem` - - Default: `ext4` - - Description: Configure file system for fstab entry /var/log + - Default: `""` + - Description: Configure file system for fstab entry /var/log. If empty, the current file system type will be used. +- `os_mnt_var_log_dump` + - Default: ext3 + ext4 `1` / other `0` + - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype. +- `os_mnt_var_log_passno` + - Default: ext3 + ext4 `2` / other `0` + - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype. - `os_mnt_var_log_audit_dir_mode` - Default: `0640` - Description: Set default perimissions for /var/log/audit @@ -400,13 +463,19 @@ We know that this is the case on Raspberry Pi. - Description: Set to true to configure /var/log/audit mountpoint - `os_mnt_var_log_audit_src` - Default: `""` - - Description: Set mount source for /var/log/audit + - Description: Set mount source for /var/log/audit. If empty, the current file system source device will be used. - `os_mnt_var_log_audit_options` - Default: `rw,nosuid,nodev,noexec` - Description: Configure mount options for /var/log/audit - `os_mnt_var_log_audit_filesystem` - - Default: `ext4` - - Description: Configure file system for fstab entry /var/log/audit + - Default: `""` + - Description: Configure file system for fstab entry /var/log/audit. If empty, the current file system type will be used. +- `os_mnt_var_log_audit_dump` + - Default: ext3 + ext4 `1` / other `0` + - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype. +- `os_mnt_var_log_audit_passno` + - Default: ext3 + ext4 `2` / other `0` + - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype. - `os_mnt_var_tmp_dir_mode` - Default: `1777` - Description: Set default perimissions for /var/tmp @@ -415,13 +484,19 @@ We know that this is the case on Raspberry Pi. - Description: Set to true to configure /var/tmp mountpoint - `os_mnt_var_tmp_src` - Default: `""` - - Description: Set mount source for /var/tmp + - Description: Set mount source for /var/tmp. If empty, the current file system source device will be used. - `os_mnt_var_tmp_options` - Default: `rw,nosuid,nodev,noexec` - Description: Configure mount options for /var/tmp - `os_mnt_var_tmp_filesystem` - - Default: `ext4` - - Description: Configure file system for fstab entry /var/tmp + - Default: `""` + - Description: Configure file system for fstab entry /var/tmp. If empty, the current file system type will be used. +- `os_mnt_var_tmp_dump` + - Default: ext3 + ext4 `1` / other `0` + - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype. +- `os_mnt_var_tmp_passno` + - Default: ext3 + ext4 `2` / other `0` + - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype. - `os_netrc_enabled` - Default: `True` - Description: Configure filesystem for existence of .netrc file in homedir diff --git a/roles/os_hardening/defaults/main.yml b/roles/os_hardening/defaults/main.yml index 3fac801c..3a7a0b48 100644 --- a/roles/os_hardening/defaults/main.yml +++ b/roles/os_hardening/defaults/main.yml @@ -390,55 +390,81 @@ os_mnt_boot_dir_mode: '0700' os_mnt_boot_enabled: false os_mnt_boot_src: "" os_mnt_boot_options: 'rw,nosuid,nodev,noexec' -os_mnt_boot_filesystem: 'ext4' +os_mnt_boot_filesystem: "" +os_mnt_boot_dump: "" +os_mnt_boot_passno: "" os_mnt_dev_dir_mode: '0755' os_mnt_dev_enabled: true os_mnt_dev_src: "devtmpfs" os_mnt_dev_options: 'rw,nosuid,noexec' os_mnt_dev_filesystem: "devtmpfs" +os_mnt_dev_dump: "" +os_mnt_dev_passno: "" os_mnt_dev_shm_dir_mode: '1777' os_mnt_dev_shm_enabled: true os_mnt_dev_shm_src: "tmpfs" os_mnt_dev_shm_options: 'rw,nosuid,nodev,noexec' os_mnt_dev_shm_filesystem: "tmpfs" +os_mnt_dev_shm_dump: "" +os_mnt_dev_shm_passno: "" os_mnt_home_dir_mode: '0755' os_mnt_home_enabled: false os_mnt_home_src: "" os_mnt_home_options: 'rw,nosuid,nodev' -os_mnt_home_filesystem: "ext4" +os_mnt_home_filesystem: "" +os_mnt_home_dump: "" +os_mnt_home_passno: "" os_mnt_run_dir_mode: '0755' os_mnt_run_enabled: true os_mnt_run_src: "tmpfs" os_mnt_run_options: 'rw,nosuid,nodev' os_mnt_run_filesystem: "tmpfs" +os_mnt_run_dump: "" +os_mnt_run_passno: "" + +os_mnt_tmp_dir_mode: '1777' +os_mnt_tmp_enabled: false +os_mnt_tmp_src: "" +os_mnt_tmp_options: 'rw,nosuid,nodev,noexec' +os_mnt_tmp_filesystem: "" +os_mnt_tmp_dump: "" +os_mnt_tmp_passno: "" os_mnt_var_dir_mode: '0755' os_mnt_var_enabled: false os_mnt_var_src: "" os_mnt_var_options: 'rw,nosuid,nodev' -os_mnt_var_filesystem: "ext4" +os_mnt_var_filesystem: "" +os_mnt_var_dump: "" +os_mnt_var_passno: "" os_mnt_var_log_dir_mode: '0755' os_mnt_var_log_enabled: false os_mnt_var_log_src: "" os_mnt_var_log_options: 'rw,nosuid,nodev,noexec' -os_mnt_var_log_filesystem: "ext4" +os_mnt_var_log_filesystem: "" +os_mnt_var_log_dump: "" +os_mnt_var_log_passno: "" os_mnt_var_log_audit_dir_mode: '0700' os_mnt_var_log_audit_enabled: false os_mnt_var_log_audit_src: "" os_mnt_var_log_audit_options: 'rw,nosuid,nodev,noexec' -os_mnt_var_log_audit_filesystem: "ext4" +os_mnt_var_log_audit_filesystem: "" +os_mnt_var_log_audit_dump: "" +os_mnt_var_log_audit_passno: "" os_mnt_var_tmp_dir_mode: '1777' os_mnt_var_tmp_enabled: false os_mnt_var_tmp_src: "" os_mnt_var_tmp_options: 'rw,nosuid,nodev,noexec' -os_mnt_var_tmp_filesystem: "ext4" +os_mnt_var_tmp_filesystem: "" +os_mnt_var_tmp_dump: "" +os_mnt_var_tmp_passno: "" # # .netrc User whitelist diff --git a/roles/os_hardening/handlers/main.yml b/roles/os_hardening/handlers/main.yml index 91f49fab..875a5dfe 100644 --- a/roles/os_hardening/handlers/main.yml +++ b/roles/os_hardening/handlers/main.yml @@ -11,3 +11,9 @@ - name: Reload systemd systemd: daemon_reload: true + +- name: Remount filesystems + mount: + path: "{{ item }}" + state: remounted + loop: "{{ mountpoints_changed }}" diff --git a/roles/os_hardening/tasks/minimize_access.yml b/roles/os_hardening/tasks/minimize_access.yml index b1280f32..e3f38fe8 100644 --- a/roles/os_hardening/tasks/minimize_access.yml +++ b/roles/os_hardening/tasks/minimize_access.yml @@ -81,194 +81,26 @@ opts: '{{ proc_mnt_options }}' state: mounted -- name: Check if boot exists - stat: - path: /boot - register: boot_exists +- name: Generate list of current available mounted filesystems on the system + set_fact: + mountpoints_list: "{{ ansible_mounts | map(attribute='mount') | list }}" -- name: Mount /boot with hardened options - mount: - path: /boot - src: '{{ os_mnt_boot_src }}' - fstype: '{{ os_mnt_boot_filesystem }}' - opts: '{{ os_mnt_boot_options }}' - state: present - register: bootmount - when: - - os_mnt_boot_enabled | bool - - boot_exists.stat.exists | bool +- name: Append special devices list to valid mountpoint list + set_fact: + mountpoints_list: "{{ mountpoints_list + ['/dev', '/dev/shm', '/run'] }}" -- name: Harden permissions for /boot directory - file: - dest: /boot - owner: 'root' - group: 'root' - mode: '{{ os_mnt_boot_dir_mode }}' - when: boot_exists.stat.exists | bool - -- name: Mount /dev with hardened options - mount: - path: /dev - src: '{{ os_mnt_dev_src }}' - fstype: '{{ os_mnt_dev_filesystem }}' - opts: '{{ os_mnt_dev_options }}' - state: present - register: devmount - when: os_mnt_dev_enabled | bool - -- name: Harden permissions for /dev directory - file: - dest: /dev - owner: 'root' - group: 'root' - mode: '{{ os_mnt_dev_dir_mode }}' - -- name: Mount /dev/shm with hardened options - mount: - path: /dev/shm - src: '{{ os_mnt_dev_shm_src }}' - fstype: '{{ os_mnt_dev_shm_filesystem }}' - opts: '{{ os_mnt_dev_shm_options }}' - state: present - register: devshmmount - when: os_mnt_dev_shm_enabled | bool - -- name: Harden permissions for /dev/shm directory - file: - dest: /dev/shm - owner: 'root' - group: 'root' - mode: '{{ os_mnt_dev_shm_dir_mode }}' - -- name: Mount /home with hardened options - mount: - path: /home - src: '{{ os_mnt_home_src }}' - fstype: '{{ os_mnt_home_filesystem }}' - opts: '{{ os_mnt_home_options }}' - state: present - register: homemount - when: os_mnt_home_enabled | bool - -- name: Harden permissions for /home directory - file: - dest: /home - owner: 'root' - group: 'root' - mode: '{{ os_mnt_home_dir_mode }}' - -- name: Mount /run with hardened options - mount: - path: /run - src: '{{ os_mnt_run_src }}' - fstype: '{{ os_mnt_run_filesystem }}' - opts: '{{ os_mnt_run_options }}' - state: present - register: runmount - when: os_mnt_run_enabled | bool - -- name: Harden permissions for /run directory - file: - dest: /run - owner: 'root' - group: 'root' - mode: '{{ os_mnt_run_dir_mode }}' - -- name: Mount /var with hardened options - mount: - path: /var - src: '{{ os_mnt_var_src }}' - fstype: '{{ os_mnt_var_filesystem }}' - opts: '{{ os_mnt_var_options }}' - state: present - register: varmount - when: os_mnt_var_enabled | bool - -- name: Harden permissions for /var directory - file: - dest: /var - owner: 'root' - group: 'root' - mode: '{{ os_mnt_var_dir_mode }}' - -- name: Mount /var/log with hardened options - mount: - path: /var/log - src: '{{ os_mnt_var_log_src }}' - fstype: '{{ os_mnt_var_log_filesystem }}' - opts: '{{ os_mnt_var_log_options }}' - state: present - register: varlogmount - when: os_mnt_var_log_enabled | bool - -- name: Harden permissions for /var/log directory - file: - dest: /var/log - owner: 'root' - group: 'root' - mode: '{{ os_mnt_var_log_dir_mode }}' - -- name: Check if /var/log/audit exists - stat: - path: /var/log/audit - register: var_log_audit_exists - -- name: Mount /var/log/audit with hardened options - mount: - path: /var/log/audit - src: '{{ os_mnt_var_log_audit_src }}' - fstype: '{{ os_mnt_var_log_audit_filesystem }}' - opts: '{{ os_mnt_var_log_audit_options }}' - state: present - register: varlogauditmount - when: - - os_mnt_var_log_audit_enabled | bool - - var_log_audit_exists.stat.exists | bool - - os_auditd_enabled | bool - -- name: Harden permissions for /var/log/audit directory - file: - dest: /var/log/audit - owner: 'root' - group: 'root' - mode: '{{ os_mnt_var_log_audit_dir_mode }}' - when: - - os_mnt_var_log_audit_enabled | bool - - var_log_audit_exists.stat.exists | bool - - os_auditd_enabled | bool - -- name: Mount /var/tmp with hardened options - mount: - path: /var/tmp - src: '{{ os_mnt_var_tmp_src }}' - fstype: '{{ os_mnt_var_tmp_filesystem }}' - opts: '{{ os_mnt_var_tmp_options }}' - state: present - register: vartmpmount - when: os_mnt_var_tmp_enabled | bool - -- name: Harden permissions for /var/tmp directory - file: - dest: /var/tmp - owner: 'root' - group: 'root' - mode: '{{ os_mnt_var_tmp_dir_mode }}' - -- name: remount all changed mountpoints - mount: - path: "{{ item.path }}" - src: "{{ item.src }}" - fstype: "{{ item.fstype }}" - opts: "{{ item.opts }}" - state: remounted - when: item.when | bool +- name: Minimize access for filesystems + include_tasks: minimize_access_fs.yml loop: - - { path: '/boot', src: '{{ os_mnt_boot_src }}', fstype: '{{ os_mnt_boot_filesystem }}', opts: '{{ os_mnt_boot_options }}', when: "{{ bootmount.changed }}" } - - { path: '/dev', src: '{{ os_mnt_dev_src }}', fstype: '{{ os_mnt_dev_filesystem }}', opts: '{{ os_mnt_dev_options }}', when: "{{ devmount.changed }}" } - - { path: '/dev/shm', src: '{{ os_mnt_dev_shm_src }}', fstype: '{{ os_mnt_dev_shm_filesystem }}', opts: '{{ os_mnt_dev_shm_options }}', when: "{{ devshmmount.changed }}" } - - { path: '/home', src: '{{ os_mnt_home_src }}', fstype: '{{ os_mnt_home_filesystem }}', opts: '{{ os_mnt_home_options }}', when: "{{ homemount.changed }}" } - - { path: '/run', src: '{{ os_mnt_run_src }}', fstype: '{{ os_mnt_run_filesystem }}', opts: '{{ os_mnt_run_options }}', when: "{{ runmount.changed }}" } - - { path: '/var', src: '{{ os_mnt_var_src }}', fstype: '{{ os_mnt_var_filesystem }}', opts: '{{ os_mnt_var_options }}', when: "{{ varmount.changed }}" } - - { path: '/var/log', src: '{{ os_mnt_var_log_src }}', fstype: '{{ os_mnt_var_log_filesystem }}', opts: '{{ os_mnt_var_log_options }}', when: "{{ varlogmount.changed }}" } - - { path: '/var/log/audit', src: '{{ os_mnt_var_log_audit_src }}', fstype: '{{ os_mnt_var_log_audit_filesystem }}', opts: '{{ os_mnt_var_log_audit_options }}', when: "{{ varlogauditmount.changed }}" } - - { path: '/var/tmp', src: '{{ os_mnt_var_tmp_src }}', fstype: '{{ os_mnt_var_tmp_filesystem }}', opts: '{{ os_mnt_var_tmp_options }}', when: "{{ vartmpmount.changed }}" } + - { path: '/boot', src: '{{ os_mnt_boot_src }}', fstype: '{{ os_mnt_boot_filesystem }}', opts: '{{ os_mnt_boot_options }}', enabled: "{{ os_mnt_boot_enabled }}", mode: "{{ os_mnt_boot_dir_mode }}", dump: "{{ os_mnt_boot_dump }}", passno: "{{ os_mnt_boot_passno }}" } + - { path: '/dev', src: '{{ os_mnt_dev_src }}', fstype: '{{ os_mnt_dev_filesystem }}', opts: '{{ os_mnt_dev_options }}', enabled: "{{ os_mnt_dev_enabled }}", mode: "{{ os_mnt_dev_dir_mode }}", dump: "{{ os_mnt_dev_dump }}", passno: "{{ os_mnt_dev_passno }}" } + - { path: '/dev/shm', src: '{{ os_mnt_dev_shm_src }}', fstype: '{{ os_mnt_dev_shm_filesystem }}', opts: '{{ os_mnt_dev_shm_options }}', enabled: "{{ os_mnt_dev_shm_enabled }}", mode: "{{ os_mnt_dev_shm_dir_mode }}", dump: "{{ os_mnt_dev_shm_dump }}", passno: "{{ os_mnt_dev_shm_passno }}" } + - { path: '/home', src: '{{ os_mnt_home_src }}', fstype: '{{ os_mnt_home_filesystem }}', opts: '{{ os_mnt_home_options }}', enabled: "{{ os_mnt_home_enabled }}", mode: "{{ os_mnt_home_dir_mode }}", dump: "{{ os_mnt_home_dump }}", passno: "{{ os_mnt_home_passno }}" } + - { path: '/run', src: '{{ os_mnt_run_src }}', fstype: '{{ os_mnt_run_filesystem }}', opts: '{{ os_mnt_run_options }}', enabled: "{{ os_mnt_run_enabled }}", mode: "{{ os_mnt_run_dir_mode }}", dump: "{{ os_mnt_run_dump }}", passno: "{{ os_mnt_run_passno }}" } + - { path: '/tmp', src: '{{ os_mnt_tmp_src }}', fstype: '{{ os_mnt_tmp_filesystem }}', opts: '{{ os_mnt_tmp_options }}', enabled: "{{ os_mnt_tmp_enabled }}", mode: "{{ os_mnt_tmp_dir_mode }}", dump: "{{ os_mnt_tmp_dump }}", passno: "{{ os_mnt_tmp_passno }}" } + - { path: '/var', src: '{{ os_mnt_var_src }}', fstype: '{{ os_mnt_var_filesystem }}', opts: '{{ os_mnt_var_options }}', enabled: "{{ os_mnt_var_enabled }}", mode: "{{ os_mnt_var_dir_mode }}", dump: "{{ os_mnt_var_dump }}", passno: "{{ os_mnt_var_passno }}" } + - { path: '/var/log', src: '{{ os_mnt_var_log_src }}', fstype: '{{ os_mnt_var_log_filesystem }}', opts: '{{ os_mnt_var_log_options }}', enabled: "{{ os_mnt_var_log_enabled }}", mode: "{{ os_mnt_var_log_dir_mode }}", dump: "{{ os_mnt_var_log_dump }}", passno: "{{ os_mnt_var_log_passno }}" } + - { path: '/var/log/audit', src: '{{ os_mnt_var_log_audit_src }}', fstype: '{{ os_mnt_var_log_audit_filesystem }}', opts: '{{ os_mnt_var_log_audit_options }}', enabled: "{{ os_mnt_var_log_audit_enabled }}", mode: "{{ os_mnt_var_log_audit_dir_mode }}", dump: "{{ os_mnt_var_log_audit_dump }}", passno: "{{ os_mnt_var_log_audit_passno }}" } + - { path: '/var/tmp', src: '{{ os_mnt_var_tmp_src }}', fstype: '{{ os_mnt_var_tmp_filesystem }}', opts: '{{ os_mnt_var_tmp_options }}', enabled: "{{ os_mnt_var_tmp_enabled }}", mode: "{{ os_mnt_var_tmp_dir_mode }}", dump: "{{ os_mnt_var_tmp_dump }}", passno: "{{ os_mnt_var_tmp_passno }}" } + loop_control: + loop_var: mount diff --git a/roles/os_hardening/tasks/minimize_access_fs.yml b/roles/os_hardening/tasks/minimize_access_fs.yml new file mode 100644 index 00000000..831cdcf0 --- /dev/null +++ b/roles/os_hardening/tasks/minimize_access_fs.yml @@ -0,0 +1,36 @@ +--- +- name: "Configure mount {{ mount.path }} with hardened options" + mount: + path: "{{ mount.path }}" + src: "{{ mount.src | default(mountinfo.device, true) }}" + fstype: "{{ mount.fstype | default(mountinfo.fstype, true) }}" + opts: "{{ mount.opts }}" + dump: "{{ mount.dump | default('1' if mount.fstype | default(mountinfo.fstype, true) in ['ext3', 'ext4'] else '0', true) }}" + passno: "{{ mount.passno | default('2' if mount.fstype | default(mountinfo.fstype, true) in ['ext3', 'ext4'] else '0', true) }}" + state: present + register: mountpoint + when: + - mount.enabled | bool + - mount.path in mountpoints_list + vars: + mountinfo: "{{ ansible_mounts | selectattr('mount', 'equalto', mount.path) | list | first | default(None) }}" + notify: Remount filesystems + +- name: "Check if {{ mount.path }} exists" + stat: + path: "{{ mount.path }}" + register: mountpoint_exists + +- name: "Harden permissions for {{ mount.path }} directory" + file: + dest: "{{ mount.path }}" + owner: 'root' + group: 'root' + mode: "{{ mount.mode }}" + when: + - mountpoint_exists.stat.exists | bool + +- name: "Register changed mountpoints" + set_fact: + mountpoints_changed: "{{ mountpoints_changed | default([]) + [mount.path] }}" + when: mountpoint.changed # noqa no-handler