andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,176 Commits 14 Branches 64 Tags
00443de5082764884ffe4dfb07898d3a7bd9a964
Commit Graph
14 Commits
Author SHA1 Message Date
Sebastian Gumprich 2db75b53c1 make it possible to configure more then yes and no for PermitTunnel (#715) 
This is a breaking change, since the default variable is now a string instead of a bool

Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-11-16 15:20:22 +01:00
schurzi 3d98cbf67b add testing and support for current versions of Fedora and FreeBSD (#709) 
* add testing and support for current versions of Fedora and FreeBSD

Signed-off-by: Martin Schurz <[email protected]>

* add waivers for FreeBSD

Signed-off-by: Martin Schurz <[email protected]>

* use original fedora images

Signed-off-by: Martin Schurz <[email protected]>

* also harden /home mount

Signed-off-by: Martin Schurz <[email protected]>

* also harden /tmp mount

Signed-off-by: Martin Schurz <[email protected]>

* test mock efi directory

Signed-off-by: Martin Schurz <[email protected]>

* remove mock

Signed-off-by: Martin Schurz <[email protected]>

* umount efi

Signed-off-by: Martin Schurz <[email protected]>

* add /tmp to special mountpoints

Signed-off-by: Martin Schurz <[email protected]>

* set options for /tmp mount

Signed-off-by: Martin Schurz <[email protected]>

* create /tmp mount

Signed-off-by: Martin Schurz <[email protected]>

* create /tmp mount and mount it ...

Signed-off-by: Martin Schurz <[email protected]>

* make fewer changes to default test run

Signed-off-by: Martin Schurz <[email protected]>

* use correct Ansible var

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>
 2023-11-16 09:14:03 +01:00
Moritz 8252b82764 fix: roles-readme action default value (#706) 
* fix: default value for push-branch

Signed-off-by: Nemental <[email protected]>

* docs(ssh_hardening): meta arguments desc

Signed-off-by: Nemental <[email protected]>

* fix: split checkout for forked repos in pull requests

Signed-off-by: Nemental <[email protected]>

* fix: push not on pr and added diff

Signed-off-by: Nemental <[email protected]>

---------

Signed-off-by: Nemental <[email protected]>
 2023-10-26 10:43:10 +02:00
MoritzandSebastian Gumprich 1b0576695e feat: workflow for roles readme (#705) 
* chore: added aar_doc config

Signed-off-by: Nemental <[email protected]>

* feat: added initial state of roles readme workflow

Signed-off-by: Nemental <[email protected]>

* fix: runs on

Signed-off-by: Nemental <[email protected]>

* fix: install poetry

Signed-off-by: Nemental <[email protected]>

* feat: loop over all roles and install peotry with pip

Signed-off-by: Nemental <[email protected]>

* fix: working dir for poetry run

Signed-off-by: Nemental <[email protected]>

* fix: cli path

Signed-off-by: Nemental <[email protected]>

* chore: scale down matrix loop for testing

Signed-off-by: Nemental <[email protected]>

* fix: poetry run for py execution command

Signed-off-by: Nemental <[email protected]>

* fix: work dir for poetry run

Signed-off-by: Nemental <[email protected]>

* fix: cli.py path

Signed-off-by: Nemental <[email protected]>

* fix: roles path

Signed-off-by: Nemental <[email protected]>

* feat: push readme

Signed-off-by: Nemental <[email protected]>

* fix: on push branch master

Signed-off-by: Nemental <[email protected]>

* fix: uncomment other roles

Signed-off-by: Nemental <[email protected]>

* chore: limit trigger to master and arguments

Co-authored-by: Sebastian Gumprich <[email protected]>
Signed-off-by: Nemental <[email protected]>

* fix: push branch name

Co-authored-by: Sebastian Gumprich <[email protected]>
Signed-off-by: Nemental <[email protected]>

* refactor: simplify steps

Co-authored-by: Sebastian Gumprich <[email protected]>
Signed-off-by: Nemental <[email protected]>

* style: linting and styling

Signed-off-by: Nemental <[email protected]>

* chore: trigger for pull request

Signed-off-by: Nemental <[email protected]>

* fix: push only if ref is master

Signed-off-by: Nemental <[email protected]>

* chore: output diff of generated README

Signed-off-by: Nemental <[email protected]>

* fix: push readme in pull request

Signed-off-by: Nemental <[email protected]>

* docs: role var description text

Signed-off-by: Nemental <[email protected]>

* fix: aar_doc roles path

Signed-off-by: Nemental <[email protected]>

* fix: git diff

Signed-off-by: Nemental <[email protected]>

* fix: fetch all history and changed diff branch

Signed-off-by: Nemental <[email protected]>

* fix: run diff only for pr

Signed-off-by: Nemental <[email protected]>

* fix: remove fetch-depth and switch to normal diff

Signed-off-by: Nemental <[email protected]>

* fix: remove diff and set push-branch

Signed-off-by: Nemental <[email protected]>

* fix: head_ref with default ref_name for push-branch

Signed-off-by: Nemental <[email protected]>

---------

Signed-off-by: Nemental <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
 2023-10-25 15:10:02 +02:00
Sebastian Gumprich 787ac9bd54 fix some wrong defaults and types in the readmes (#703) 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-10-23 12:23:49 +02:00
Sebastian GumprichandSebastian Gumprich f295397611 add role argument spec for os, ssh, mysql (#687) 
* add role argument spec for os, ssh, mysql

Signed-off-by: Sebastian Gumprich <[email protected]>

* add role argument spec for os, ssh, mysql

Signed-off-by: Sebastian Gumprich <[email protected]>

* remove variable in variable as it cannot be used in argument spec

Signed-off-by: Sebastian Gumprich <[email protected]>

* fix wrong syntax

* fix spelling errors

Signed-off-by: Sebastian Gumprich <[email protected]>

* cannot use vars before arg-spec validation

Signed-off-by: Sebastian Gumprich <[email protected]>

* yamllint the arg-spec

Signed-off-by: Sebastian Gumprich <[email protected]>

* add back variable

Signed-off-by: Sebastian Gumprich <[email protected]>

* remove redundant setting in tests

* fix descriptions in mysql hardening to betterreflect what they do

Signed-off-by: Sebastian Gumprich <[email protected]>

* remove duplicate empty line

Signed-off-by: Sebastian Gumprich <[email protected]>

* set correct defaults on to ssl options

Signed-off-by: Sebastian Gumprich <[email protected]>

* remove left-over hidepid argument spec

Signed-off-by: Sebastian Gumprich <[email protected]>

* remove license and author infos, this lives in the collection readme

Signed-off-by: Sebastian Gumprich <[email protected]>

* fix styling

Signed-off-by: Sebastian Gumprich <[email protected]>

* update some descriptions and sort them in the readme

Signed-off-by: Sebastian Gumprich <[email protected]>

* some more linting

Signed-off-by: Sebastian Gumprich <[email protected]>

---------

Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
 2023-08-07 14:30:59 +02:00
Martin Schurz 0014a3be36 update metadata 
Signed-off-by: Martin Schurz <[email protected]>
 2023-04-12 20:18:29 +02:00
schurzi 29f8a2fb78 add testing for OpenBSD and FreeBSD (#642) 
* add testing for OpenBSD and FreeBSD

Signed-off-by: Martin Schurz <[email protected]>

* make python work

Signed-off-by: Martin Schurz <[email protected]>

* remove jinja template ...

Signed-off-by: Martin Schurz <[email protected]>

* make verify work

Signed-off-by: Martin Schurz <[email protected]>

* correct verify

Signed-off-by: Martin Schurz <[email protected]>

* correct verify

Signed-off-by: Martin Schurz <[email protected]>

* correct verify

Signed-off-by: Martin Schurz <[email protected]>

* correct verify

Signed-off-by: Martin Schurz <[email protected]>

* use right vm name for connect

Signed-off-by: Martin Schurz <[email protected]>

* add a bit of documentation

Signed-off-by: Martin Schurz <[email protected]>

* remove sudo

Signed-off-by: Martin Schurz <[email protected]>

* add weird OpenSBD workaround

Signed-off-by: Martin Schurz <[email protected]>

* make verify playbook more consistent

Signed-off-by: Martin Schurz <[email protected]>

* rename nonlinux to BSD

Signed-off-by: Martin Schurz <[email protected]>

* use openbsd7 for testing

Signed-off-by: Martin Schurz <[email protected]>

* correct use openbsd7 everywhere

Signed-off-by: Martin Schurz <[email protected]>

* add waivers

Signed-off-by: Martin Schurz <[email protected]>

* update waiver descriptions

Signed-off-by: Martin Schurz <[email protected]>

* use docker for inspec

Signed-off-by: Martin Schurz <[email protected]>

* keep looking right ;)

Signed-off-by: Martin Schurz <[email protected]>

* correct path to waivers

Signed-off-by: Martin Schurz <[email protected]>

* use ephemeral directory in docker

Signed-off-by: Martin Schurz <[email protected]>

* use bsd inspec profile

Signed-off-by: Martin Schurz <[email protected]>

* remove openbsd workaround

Signed-off-by: Martin Schurz <[email protected]>

* re-add openbsd workaround

Signed-off-by: Martin Schurz <[email protected]>

* commit suggestions

Signed-off-by: Martin Schurz <[email protected]>

* add supportet OS to metadata

Signed-off-by: Martin Schurz <[email protected]>

* use current python

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>
 2023-03-31 09:50:04 +02:00
Sebastian Gumprich bb588bd777 linting (#603) 
* linting

Signed-off-by: Sebastian Gumprich <[email protected]>

* more linting

Signed-off-by: Sebastian Gumprich <[email protected]>

* change line length issues

Signed-off-by: Sebastian Gumprich <[email protected]>

* replace yes with true in tasks

Signed-off-by: Sebastian Gumprich <[email protected]>

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

Signed-off-by: Sebastian Gumprich <[email protected]>

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

Signed-off-by: Sebastian Gumprich <[email protected]>

* add exception for task

Signed-off-by: Sebastian Gumprich <[email protected]>

* remove trailing whitespace

* add back deleted params

Signed-off-by: Sebastian Gumprich <[email protected]>

* add back deleted params

Signed-off-by: Sebastian Gumprich <[email protected]>

* add back tasks

Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-24 12:40:27 +01:00
Sebastian Gumprich 11d187e62e update supported OS in meta and fix linting (#572) 
Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-08-26 13:44:51 +02:00
Sebastian Gumprich be0d501bc8 update minimum ansible version for roles 
fixes #407

Signed-off-by: rndmh3ro <[email protected]>
 2021-10-20 20:42:05 +02:00
Roger Meier 8fdb4e55b8 chore(ssh_hardening): set min_ansible_version to >=2.9.10 (#479) 2021-08-28 15:21:59 +02:00
Sebastian Gumprich c8ada5c13c Merge branch 'migrate_os' into collection 2020-11-08 11:18:38 +01:00
Sebastian Gumprich a46642ee92 merge ssh-hardening role into collection 2020-11-07 21:46:45 +01:00