andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,915 Commits 14 Branches 64 Tags
0705a9cc904733de262a02b1dfd528e514c0fab7
Commit Graph
1915 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
schurzi 0705a9cc90 Merge pull request #628 from Normo/add-password-warn-age-option 
Set number of warning days before user password expires
8.6.0 		2023-02-04 18:21:52 +01:00
Norman Ziegner c594a1fe6a os_hardening: Add test for setting password warning days via variable os_auth_pw_warn_age 
Signed-off-by: Norman Ziegner <[email protected]>
 2023-02-03 14:47:27 +01:00
Norman Ziegner 2f60b44cca os_hardening: Add variable to set the number of days of warning before user password expires 
Signed-off-by: Norman Ziegner <[email protected]>
 2023-02-01 16:17:36 +01:00
dev-sec CI 1b1b0e10f2 update changelog 2023-02-01 11:40:40 +00:00
dependabot[bot] f34f24deb7 Bump hugo19941994/delete-draft-releases from 1.0.0 to 1.0.1 (#627) 
Bumps [hugo19941994/delete-draft-releases](https://github.com/hugo19941994/delete-draft-releases) from 1.0.0 to 1.0.1.
- [Release notes](https://github.com/hugo19941994/delete-draft-releases/releases)
- [Commits](https://github.com/hugo19941994/delete-draft-releases/compare/v1.0.0...v1.0.1)

---
updated-dependencies:
- dependency-name: hugo19941994/delete-draft-releases
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-02-01 12:37:31 +01:00
dev-sec CI 6ccdaee45d update galaxy.yml with new version 2023-01-31 06:55:37 +00:00
dev-sec CI e8d16766ad update changelog 2023-01-31 06:48:47 +00:00
schurzi e6bc422f5b Merge pull request #626 from dev-sec/dependabot_labels 
do not let dependabot label our prs
8.5.0 		2023-01-30 16:21:11 +01:00
Sebastian Gumprich bfedba6907 do not let dependabot label our prs 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-30 16:20:35 +01:00
dev-sec CI 1fe0677b0b update changelog 2023-01-30 14:59:08 +00:00
schurzi 894c6117a0 Merge pull request #625 from dev-sec/linting_roles 
run linting only when files inside roles change
 2023-01-30 10:48:22 +01:00
Sebastian Gumprich 330a1eb94d run linting only when files inside roles change 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-30 10:23:25 +01:00
dev-sec CI 52d08ff009 update changelog 2023-01-29 12:39:47 +00:00
dev-sec CI 01cb20d644 update changelog 2023-01-28 21:01:52 +00:00
rndmh3ro bc096e58e5 Prettified Code! 2023-01-28 20:59:35 +00:00
DonEstefanschurzidonestefanSebastian GumprichSebastian Gumprich
 		16e00b02db rewrite user home dir hardening (#584) 
* rewrite user home dir hardening

* delete duplicate var that was missed in a merge conflict

Signed-off-by: Sebastian Gumprich <[email protected]>

* linting

Signed-off-by: Sebastian Gumprich <[email protected]>

* add tests for home rewrites

Signed-off-by: Sebastian Gumprich <[email protected]>

* Apply suggestions from code review

Co-authored-by: schurzi <[email protected]>

---------

Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: donestefan <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: schurzi <[email protected]>
 2023-01-28 21:59:19 +01:00
Sebastian Gumprich a75b339526 fix more linting errors 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-27 11:27:35 +01:00
dev-sec CI 9fe8ca7294 update changelog 2023-01-27 10:04:18 +00:00
Sebastian Gumprichdonestefanschurzi
 		89138be4ec Rewrite system account detection and hardening and create tests (#621) 
* rewrite system account detection and hardening

* resolve failures created when resolving merge conflicts

Signed-off-by: Sebastian Gumprich <[email protected]>

* add tests for shell removal tasks

Signed-off-by: Sebastian Gumprich <[email protected]>

* Update molecule/os_hardening/prepare.yml

Signed-off-by: Martin Schurz <[email protected]>

* split tasks for locking and setting shell

Signed-off-by: Martin Schurz <[email protected]>

* fix some more linting

Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
Signed-off-by: Martin Schurz <[email protected]>
Co-authored-by: donestefan <[email protected]>
Co-authored-by: schurzi <[email protected]>
 2023-01-27 11:01:03 +01:00
dev-sec CI f1169749f4 update changelog 2023-01-25 22:59:48 +00:00
schurzi ee80418496 Merge pull request #618 from dev-sec/deprecate_intitramfs 
deprecate rebuilding of initramfs
 2023-01-25 23:56:36 +01:00
Martin Schurz 7f8e9919ee add readme 
Signed-off-by: Martin Schurz <[email protected]>
 2023-01-25 22:30:17 +01:00
dev-sec CI bbee0b74ec update changelog 2023-01-25 12:21:00 +00:00
schurzi 0e8533049d Merge pull request #620 from dev-sec/molecule_fixes 
Fixed problems with running molecule locally with cgroup v2
 2023-01-25 13:18:50 +01:00
Sebastian Gumprich a1028c7504 deprecate initramfs 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-25 13:07:37 +01:00
dev-sec CI aa555b9290 update changelog 2023-01-25 08:15:45 +00:00
mmitnyan 83a0a9242b Support for Amazon Linux 2 (#624) 
Signed-off-by: Manuel Mitnyan <[email protected]>

Signed-off-by: Manuel Mitnyan <[email protected]>
 2023-01-25 09:12:25 +01:00
dev-sec CI fdd0bfc72a update changelog 2023-01-24 13:27:02 +00:00
schurzi 154f862ccd Merge pull request #622 from dev-sec/stop_old_tests 
cancel running tests if new commit to branch is made
 2023-01-24 13:21:18 +01:00
Sebastian Gumprich db4bd32767 cancel running tests if new commit to branch is made 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-24 13:08:04 +01:00
Sebastian Gumprich 281d706660 add waiver to not test mounts 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-24 13:03:04 +01:00
dev-sec CI 85271c2375 update changelog 2023-01-24 12:01:58 +00:00
Sebastian Gumprich d386bf36d2 Revert "manage tmp dir in tests" 
This reverts commit 966f2fe137.
 2023-01-24 12:53:39 +01:00
Sebastian Gumprich bb588bd777 linting (#603) 
* linting

Signed-off-by: Sebastian Gumprich <[email protected]>

* more linting

Signed-off-by: Sebastian Gumprich <[email protected]>

* change line length issues

Signed-off-by: Sebastian Gumprich <[email protected]>

* replace yes with true in tasks

Signed-off-by: Sebastian Gumprich <[email protected]>

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

Signed-off-by: Sebastian Gumprich <[email protected]>

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

Signed-off-by: Sebastian Gumprich <[email protected]>

* add exception for task

Signed-off-by: Sebastian Gumprich <[email protected]>

* remove trailing whitespace

* add back deleted params

Signed-off-by: Sebastian Gumprich <[email protected]>

* add back deleted params

Signed-off-by: Sebastian Gumprich <[email protected]>

* add back tasks

Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-24 12:40:27 +01:00
Sebastian Gumprich 966f2fe137 manage tmp dir in tests 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-24 12:36:09 +01:00
Sebastian Gumprich fa2e90c6f2 mount cgroup rw, as suse seems to need it 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-23 15:59:06 +01:00
Sebastian Gumprich ed1cb1c2a7 add cgroupns: host mode to molecule 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-23 15:59:06 +01:00
Sebastian Gumprich a0d11faa8a Fixed problems with running molecule locally with cgroup v2 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-23 15:59:06 +01:00
dev-sec CI a94168c84f update changelog 2023-01-23 09:52:21 +00:00
DonEstefanschurziDonEstefanSebastian GumprichSebastian Gumprich
 		674be6dc6f apply password age settings to exisiting regular users (#582) 
* apply password age settings to regular users

* add tests for password ageing

Signed-off-by: Sebastian Gumprich <[email protected]>

* add debugging vars

Signed-off-by: Sebastian Gumprich <[email protected]>

* add tests for password ageing

Signed-off-by: Sebastian Gumprich <[email protected]>

* add tests for password ageing

Signed-off-by: Sebastian Gumprich <[email protected]>

* Apply suggestions from code review

Co-authored-by: schurzi <[email protected]>

* add additional condtion for regular users

Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: DonEstefan <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: schurzi <[email protected]>
 2023-01-23 10:50:05 +01:00
dev-sec CI c1080de135 update changelog 2023-01-23 08:37:51 +00:00
stdtom 9d2c68ef2f Preserve default ownership and dir mode for /var/log on Ubuntu (#615) 
* Preserve default ownership and dir mode for /var/log on Ubuntu

Signed-off-by: stdtom <[email protected]>

* linting

Signed-off-by: stdtom <[email protected]>

* Define vars for each OS instead of using defaults.

Signed-off-by: stdtom <[email protected]>

* Fix values for os_mnt_var_log_dir_mode and os_mnt_var_log_group

Signed-off-by: stdtom <[email protected]>

Signed-off-by: stdtom <[email protected]>
 2023-01-23 09:34:41 +01:00
dev-sec CI c0b9c87dc1 update changelog 2023-01-19 12:47:40 +00:00
Sebastian Gumprich 142782bad6 add diff to molecule 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-19 13:46:16 +01:00
rndmh3ro b3fbfcedbe Prettified Code! 2023-01-19 12:45:51 +00:00
Paweł KrawczykPaweł KrawczykSebastian Gumprich
 		88ef3cf3af Parametrize more auditd.conf options (#535) 
* Parametrize more auditd.conf options

* Parametrize more auditd.conf options

* Add `os_auditd` options

* Add os_auditd_log_group

* Add os_auditd_log_group

Co-authored-by: Paweł Krawczyk <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
 2023-01-19 13:45:24 +01:00
dev-sec CI ca25f50ba6 update changelog 2023-01-12 11:56:07 +00:00
richardlock a82942a63a Add support for /etc/auditd.conf num_logs to go with max_log_file_action. (#617) 
Signed-off-by: Richard Lock <[email protected]>

Signed-off-by: Richard Lock <[email protected]>
 2023-01-12 12:52:48 +01:00
dev-sec CI fc060376ac update changelog 2022-12-24 09:43:18 +00:00
dependabot[bot] 16f78bc6be Bump actions/setup-python from 1 to 4 (#611) 
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 1 to 4.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v1...v4)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2022-12-24 10:28:54 +01:00