andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

rework filesystem hardening (#555)

Browse Source 
* rework filesystem hardening

-  removed a lot duplicated code by using a loop
-  added new hardening options for /tmp
-  added new options "passno" and "dump" for every filesystem.
   currently ansible changed that values to 0 for every fs
   new default depends on fstype, can be overwriten in config
-  removed default fstype in config
   the type will now be autodetected,  can be overwriten in config
-  mount src setting is now optional
   the source will now be autodetected,  can be overwriten in config
-  it will be now checked, if it is really a mount
-  changed fs reload to handler
-  removed check os_auditd_enabled on /var/log/audit

Signed-off-by: divialth <[email protected]>

* fix lint errors

Signed-off-by: divialth <[email protected]>

* implemented the name suggestions

Signed-off-by: divialth <[email protected]>

Signed-off-by: divialth <[email protected]>
This commit is contained in:
divialth authored and GitHub committed 2022-08-22 11:16:57 +02:00
1 parent ca266d25df
commit fb8b9142c8
5 files changed
+189 -214
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

roles/os_hardening/defaults/main.yml
+32 -6
View File
@@ -390,55 +390,81 @@ os_mnt_boot_dir_mode: '0700'
os_mnt_boot_enabled: false
os_mnt_boot_src: ""
os_mnt_boot_options: 'rw,nosuid,nodev,noexec'
os_mnt_boot_filesystem: 'ext4'
os_mnt_boot_filesystem: ""
os_mnt_boot_dump: ""
os_mnt_boot_passno: ""
os_mnt_dev_dir_mode: '0755'
os_mnt_dev_enabled: true
os_mnt_dev_src: "devtmpfs"
os_mnt_dev_options: 'rw,nosuid,noexec'
os_mnt_dev_filesystem: "devtmpfs"
os_mnt_dev_dump: ""
os_mnt_dev_passno: ""
os_mnt_dev_shm_dir_mode: '1777'
os_mnt_dev_shm_enabled: true
os_mnt_dev_shm_src: "tmpfs"
os_mnt_dev_shm_options: 'rw,nosuid,nodev,noexec'
os_mnt_dev_shm_filesystem: "tmpfs"
os_mnt_dev_shm_dump: ""
os_mnt_dev_shm_passno: ""
os_mnt_home_dir_mode: '0755'
os_mnt_home_enabled: false
os_mnt_home_src: ""
os_mnt_home_options: 'rw,nosuid,nodev'
os_mnt_home_filesystem: "ext4"
os_mnt_home_filesystem: ""
os_mnt_home_dump: ""
os_mnt_home_passno: ""
os_mnt_run_dir_mode: '0755'
os_mnt_run_enabled: true
os_mnt_run_src: "tmpfs"
os_mnt_run_options: 'rw,nosuid,nodev'
os_mnt_run_filesystem: "tmpfs"
os_mnt_run_dump: ""
os_mnt_run_passno: ""
os_mnt_tmp_dir_mode: '1777'
os_mnt_tmp_enabled: false
os_mnt_tmp_src: ""
os_mnt_tmp_options: 'rw,nosuid,nodev,noexec'
os_mnt_tmp_filesystem: ""
os_mnt_tmp_dump: ""
os_mnt_tmp_passno: ""
os_mnt_var_dir_mode: '0755'
os_mnt_var_enabled: false
os_mnt_var_src: ""
os_mnt_var_options: 'rw,nosuid,nodev'
os_mnt_var_filesystem: "ext4"
os_mnt_var_filesystem: ""
os_mnt_var_dump: ""
os_mnt_var_passno: ""
os_mnt_var_log_dir_mode: '0755'
os_mnt_var_log_enabled: false
os_mnt_var_log_src: ""
os_mnt_var_log_options: 'rw,nosuid,nodev,noexec'
os_mnt_var_log_filesystem: "ext4"
os_mnt_var_log_filesystem: ""
os_mnt_var_log_dump: ""
os_mnt_var_log_passno: ""
os_mnt_var_log_audit_dir_mode: '0700'
os_mnt_var_log_audit_enabled: false
os_mnt_var_log_audit_src: ""
os_mnt_var_log_audit_options: 'rw,nosuid,nodev,noexec'
os_mnt_var_log_audit_filesystem: "ext4"
os_mnt_var_log_audit_filesystem: ""
os_mnt_var_log_audit_dump: ""
os_mnt_var_log_audit_passno: ""
os_mnt_var_tmp_dir_mode: '1777'
os_mnt_var_tmp_enabled: false
os_mnt_var_tmp_src: ""
os_mnt_var_tmp_options: 'rw,nosuid,nodev,noexec'
os_mnt_var_tmp_filesystem: "ext4"
os_mnt_var_tmp_filesystem: ""
os_mnt_var_tmp_dump: ""
os_mnt_var_tmp_passno: ""
#
# .netrc User whitelist