andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,915 Commits 14 Branches 64 Tags
0705a9cc904733de262a02b1dfd528e514c0fab7
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
rndmh3ro bc096e58e5 Prettified Code! 2023-01-28 20:59:35 +00:00
Sebastian Gumprichdonestefanschurzi
 		89138be4ec Rewrite system account detection and hardening and create tests (#621) 
* rewrite system account detection and hardening

* resolve failures created when resolving merge conflicts

Signed-off-by: Sebastian Gumprich <[email protected]>

* add tests for shell removal tasks

Signed-off-by: Sebastian Gumprich <[email protected]>

* Update molecule/os_hardening/prepare.yml

Signed-off-by: Martin Schurz <[email protected]>

* split tasks for locking and setting shell

Signed-off-by: Martin Schurz <[email protected]>

* fix some more linting

Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
Signed-off-by: Martin Schurz <[email protected]>
Co-authored-by: donestefan <[email protected]>
Co-authored-by: schurzi <[email protected]>
 2023-01-27 11:01:03 +01:00
Sebastian Gumprich bb588bd777 linting (#603) 
* linting

Signed-off-by: Sebastian Gumprich <[email protected]>

* more linting

Signed-off-by: Sebastian Gumprich <[email protected]>

* change line length issues

Signed-off-by: Sebastian Gumprich <[email protected]>

* replace yes with true in tasks

Signed-off-by: Sebastian Gumprich <[email protected]>

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

Signed-off-by: Sebastian Gumprich <[email protected]>

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

Signed-off-by: Sebastian Gumprich <[email protected]>

* add exception for task

Signed-off-by: Sebastian Gumprich <[email protected]>

* remove trailing whitespace

* add back deleted params

Signed-off-by: Sebastian Gumprich <[email protected]>

* add back deleted params

Signed-off-by: Sebastian Gumprich <[email protected]>

* add back tasks

Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-24 12:40:27 +01:00
rndmh3ro b3fbfcedbe Prettified Code! 2023-01-19 12:45:51 +00:00
Sebastian Gumprichandschurzi be0642bcfb add verify-task to check if mysql is running and enabled (#608) 
* add verify-task to check if mysql is running and enabled

Signed-off-by: Sebastian Gumprich <[email protected]>

* Update molecule/mysql_hardening/verify_tasks/service.yml

Co-authored-by: schurzi <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: schurzi <[email protected]>
 2022-12-07 08:49:07 +01:00
Sebastian GumprichandFlorian Goth e66c2eb6bb Add OpenSUSE support (#605) 
* Add variables for mariadb on opensuse

Signed-off-by: Florian Goth <[email protected]>

* enable pipeline

Signed-off-by: Florian Goth <[email protected]>

* add a note about the reuirement of the jmespath library.

Signed-off-by: Florian Goth <[email protected]>

* Use python3 on opensuse

Signed-off-by: Florian Goth <[email protected]>

* fix my yml.

Signed-off-by: Florian Goth <[email protected]>

* use right ansible variable

Signed-off-by: Florian Goth <[email protected]>

* Suse requires python-rpm

Signed-off-by: Florian Goth <[email protected]>

* try zypper

Signed-off-by: Florian Goth <[email protected]>

* python-xml

Signed-off-by: Florian Goth <[email protected]>

* another try at fixing the install

Signed-off-by: Florian Goth <[email protected]>

* fix my yml

Signed-off-by: Florian Goth <[email protected]>

* another try

Signed-off-by: Florian Goth <[email protected]>

* another try

Signed-off-by: Florian Goth <[email protected]>

* another try now with rpm.

Signed-off-by: Florian Goth <[email protected]>

* fix my yml...

Signed-off-by: Florian Goth <[email protected]>

* typo

Signed-off-by: Florian Goth <[email protected]>

* do the test for Suse on the shell and not in ansible

Signed-off-by: Florian Goth <[email protected]>

* specify to use bash

Signed-off-by: Florian Goth <[email protected]>

* specify to use bash

* try the removes keyword of builtin.shell

Signed-off-by: Florian Goth <[email protected]>

* fix ansible syntax

Signed-off-by: Florian Goth <[email protected]>

* fix zypper syntax

Signed-off-by: Florian Goth <[email protected]>

* ensure pymysql is present

Signed-off-by: Florian Goth <[email protected]>

* set ansible python interpreter in converge-step, too

Signed-off-by: Sebastian Gumprich <[email protected]>

* move install task to prepare

Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Florian Goth <[email protected]>
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Florian Goth <[email protected]>
 2022-11-29 15:09:27 +01:00
Sebastian Gumprich 44489dea5f run tests only on pushes to master or to PRs (#581) 
Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-09-28 10:44:31 +02:00
Sebastian Gumprich 9ac01fb358 add always-tag to include so other tags can be used (#569) 
Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-08-26 13:45:05 +02:00
Sebastian Gumprich 11d187e62e update supported OS in meta and fix linting (#572) 
Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-08-26 13:44:51 +02:00
Sebastian Gumprich fbea75ad18 only run release actions on upstream-repo (#568) 
fixes #566

Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-08-26 09:40:59 +02:00
Sebastian Gumprich 720d7786b5 fix typo 2022-08-22 12:39:21 +02:00
Sebastian Gumprich 84412e99c2 fix typo 2022-08-22 11:25:08 +02:00
Sebastian Gumprich 82bb46d7cc update supported OS 2022-08-16 17:21:06 +02:00
Sebastian Gumprich d11595d81a revert debian 9 change, only one tls variable now (#562) 
fixes #528

Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-08-15 16:01:49 +02:00
rndmh3ro e28e09cd0e Prettified Code! 2022-07-07 07:02:50 +00:00
Sebastian Gumprich 231036f882 update commit-action version 2022-06-29 12:59:44 +02:00
Sebastian Gumprich 36412f438a upadte commit-action version 2022-06-29 12:56:28 +02:00
Sebastian Gumprich af14af5954 add waivers to skip controls (#529) 
Signed-off-by: rndmh3ro <[email protected]>
 2022-02-21 13:58:39 +01:00
Sebastian Gumprich 2ba40b0891 move sysctls to debian specific vars (#524) 
* fix ansible-lint issue

https://github.com/ansible-community/ansible-lint/issues/1795
Signed-off-by: rndmh3ro <[email protected]>

* move 2 sysctls to debian specific

Signed-off-by: rndmh3ro <[email protected]>

* fix ansible-lint issue

https://github.com/ansible-community/ansible-lint/issues/1795
Signed-off-by: rndmh3ro <[email protected]>

* add arch linux sysctls

* simplify sysctl settings

Signed-off-by: rndmh3ro <[email protected]>

* ove overwrite to the bottom to let it acutally overwrite something

Signed-off-by: rndmh3ro <[email protected]>

* fix typo

Signed-off-by: rndmh3ro <[email protected]>
 2022-02-18 15:30:32 +01:00
Sebastian Gumprich 8f22ce788c Feature coredump (#513) 
* restructure limits-tasks

* disable coredumps in tests

* use notify-task for systemd-reload

Signed-off-by: rndmh3ro <[email protected]>

* add notify to another task

Signed-off-by: rndmh3ro <[email protected]>

* rm obsolete task and rename handler

Signed-off-by: rndmh3ro <[email protected]>
 2021-12-10 22:10:14 +01:00
Sebastian Gumprich f09b2b6338 fix molecule call 2021-10-25 10:26:56 +02:00
Sebastian Gumprichandschurzi 9f372c285c Update roles/os_hardening/defaults/main.yml 
Co-authored-by: schurzi <[email protected]>
 2021-10-24 10:59:49 +02:00
Sebastian Gumprich be0d501bc8 update minimum ansible version for roles 
fixes #407

Signed-off-by: rndmh3ro <[email protected]>
 2021-10-20 20:42:05 +02:00
rndmh3ro 8ff3d73bbf Prettified Code! 2021-08-25 10:58:16 +00:00
Sebastian Gumprich 545fd8798f Create LICENSE 2021-08-06 13:08:55 +02:00
Sebastian Gumprich 681047ba52 fix readme in galaxy 2021-07-23 11:06:22 +02:00
Sebastian Gumprich da50f20860 update metadata to include community.mysql deps 2021-07-13 14:08:27 +02:00
Sebastian Gumprich 4ca4f09453 Cleanup old OS-support and simplify vars (#458) 
* use os_family instead of distribution for debian systems

Signed-off-by: rndmh3ro <[email protected]>

* remove tasks related to rhel6 or debian 6

Signed-off-by: rndmh3ro <[email protected]>
 2021-06-30 13:09:46 +02:00
Sebastian Gumprich 72ec118a6d add rocky linux 8 tests and make sure that all relevant tasks are execd (#457) 
* add rocky linux 8 tests and make sure that all relevant tasks are executed

Signed-off-by: rndmh3ro <[email protected]>

* fix missing quote

Signed-off-by: rndmh3ro <[email protected]>
 2021-06-30 13:09:12 +02:00
Sebastian Gumprichandschurzi 9cefddd949 make sha rounds configurable and increase no of rounds (#452) 
* make sha rounds configurable and increase no of rounds

Fixes #365

Signed-off-by: rndmh3ro <[email protected]>

* Prettified Code!

* make password rounds configurable in pam system-auth

Signed-off-by: rndmh3ro <[email protected]>

* change wording of sha rounds documentation

Co-authored-by: schurzi <[email protected]>

Co-authored-by: schurzi <[email protected]>
 2021-06-30 10:41:59 +02:00
Sebastian Gumprich 41cd8485cb enable ipv6 globally (#450) 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-05-26 20:13:45 +02:00
rndmh3ro 07a0943c5a Prettified Code! 2021-04-30 12:50:12 +00:00
rndmh3ro 369c2986c6 Prettified Code! 2021-03-22 10:23:03 +00:00
Sebastian Gumprichandschurzi bf82736787 Update roles/os_hardening/tasks/user_accounts.yml 
Co-authored-by: schurzi <[email protected]>
 2021-03-22 11:18:51 +01:00
Sebastian Gumprich f9bbdb20fe add install instructions 2021-02-25 07:57:55 +01:00
Sebastian Gumprich bbf992d9fc Create dependabot.yml 2021-02-22 10:22:38 +01:00
Sebastian Gumprich 6be31fbc3b do not install mysql python package on target host (#401) 
this package has to be installed on the host that executes the task

Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-02-10 15:57:51 +01:00
Sebastian Gumprich 756839f8f0 make wrong password fail task (#400) 
* make wrong password fail task

Signed-off-by: Sebastian Gumprich <[email protected]>

* add name to fail task

Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-02-10 15:55:08 +01:00
Sebastian Gumprich c55c1f21ed add restart handler variable for mysql role (#399) 
* add restart handler variable for mysql role

Signed-off-by: Sebastian Gumprich <[email protected]>

* add prettierignore file to ignore CHANGELOG

Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-02-10 15:54:57 +01:00
rndmh3ro 0cfdb1954e Prettified Code! 2021-02-09 08:45:31 +00:00
Sebastian Gumprich faffddbf31 add a runtime.yml to declare minimum ansible version (#363) 
* add a runtime.yml to declare minimum ansible version

Signed-off-by: Sebastian Gumprich <[email protected]>

* add minimum ansible version to reamde

Signed-off-by: Sebastian Gumprich <[email protected]>

* Prettified Code!
 2020-12-26 21:27:19 +01:00
Sebastian Gumprich 5341f2a891 Update release.yml 2020-12-15 11:35:54 +01:00
Sebastian Gumprich 753e517678 fix second changelog generation task, too (#349) 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2020-12-15 10:10:10 +01:00
Sebastian Gumprich 253c5ec3eb fix changelog generation (#341) 
* fix changelog generation

the changelog generation fails because we merged other repos into
this one and these commits do not share a common ancestor.
see this issue: https://github.com/github-changelog-generator/github-changelog-generator/issues/665

to workaround this, we change the changelog generation so all tags older than 7.0.0 will be ignored
(--since-tag does not work here because it still works on all tags). This however will remove
 older releases from the changelog so we move these old releases into a separate file.
this is okay for me since these old releases are for ansible-os-hardening  and not the collection.
the new changelog file will contain all changes since 7.0.0.

Signed-off-by: Sebastian Gumprich <[email protected]>

* fix regex in action

Signed-off-by: Sebastian Gumprich <[email protected]>
 2020-12-15 09:58:19 +01:00
Sebastian Gumprich 837f99bdf8 update release action 2020-12-13 20:19:03 +01:00
Sebastian Gumprich cade17ec30 fix typo 2020-11-11 21:54:31 +01:00
rndmh3ro 1cf8a6380d Prettified Code! 2020-11-11 20:34:34 +00:00
Sebastian Gumprich 2f19ad1ce2 fix typo in galaxy (#332) 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2020-11-11 21:26:46 +01:00
Sebastian Gumprich 90151c3047 update galaxy version 2020-11-11 21:10:21 +01:00
rndmh3ro c94d973527 Prettified Code! 2020-11-08 10:20:25 +00:00
Sebastian Gumprich 81f1d3df6c Merge pull request #58 from szEvEz/master 
Run ansible-lint via github action
 2020-10-18 14:52:28 +02:00
Sebastian Gumprich 35695d979e Merge pull request #57 from szEvEz/master 
Fix kitchen and travisci for major distros
 2020-10-17 14:05:34 +02:00
Sebastian Gumprich daa49d0f47 Merge pull request #55 from dev-sec/fix_vars 
fix missing variables
 2020-10-13 05:23:20 +02:00
Sebastian Gumprich 3cf833f033 Merge pull request #56 from szEvEz/master 
Use mysql_query module instead of temporary files
 2020-10-11 17:53:13 +02:00
Sebastian Gumprich be67e73a7e this brings the task in line with the baseline (#311) 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2020-10-05 10:50:07 +02:00
Sebastian Gumprich e54061bcd5 Merge pull request #53 from dev-sec/update_docs 
update readme to new layout for vars
 2020-10-03 08:23:59 +02:00
Sebastian Gumprich 1e115d9eeb update readme to new layout for vars (#33) 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2020-10-03 08:18:22 +02:00
Sebastian Gumprich e6f5d0bb69 update readme to new layout for vars (#326) 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2020-10-03 08:17:48 +02:00
Sebastian Gumprich 2f9febef4e Merge pull request #51 from dev-sec/modesagain 
add mode to copy task
 2020-09-21 07:34:27 +02:00
Sebastian Gumprich ab0e5783b9 use touch with no date changes (#310) 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2020-09-20 14:27:09 +02:00
Sebastian Gumprich bfc80e8cfd Merge pull request #50 from dev-sec/modes 
add modes to template and file tasks
 2020-09-19 15:04:15 +02:00
Sebastian Gumprich 5c91da696a do not touch sysctl file to avoid idempotency problems (#309) 2020-09-19 14:36:57 +02:00
Sebastian Gumprich fa2cf790f8 Merge pull request #320 from dev-sec/pam 
add separate option for controlling motd via pam
 2020-08-09 17:02:02 +02:00
Sebastian Gumprich 04d19fd195 fix typo 2020-08-03 21:28:23 +02:00
Sebastian Gumprich f1a65f5f44 Merge pull request #318 from dev-sec/fix_kitchen 
fix local kitchen tests
 2020-07-28 09:24:22 +02:00
Sebastian Gumprich f50f22ca66 Merge pull request #294 from aqw/master 
add SmartOS support
 2020-07-28 08:30:17 +02:00
Sebastian Gumprich 65a8fa0c6c move hidepid vars into defaults so theyre overwritable (#285) 
fixes #284

Signed-off-by: Sebastian Gumprich <[email protected]>
 2020-07-22 21:27:25 +02:00
Sebastian Gumprich 3b75e49c0e fix typo 2020-07-20 11:52:22 +02:00
Sebastian Gumprich 8806f9f06a fix typo 2020-07-18 10:27:21 +02:00
Sebastian Gumprich b4b306484b Merge pull request #307 from nununo/master 
README: New section on server port and idempotency
 2020-07-13 18:52:38 +02:00
Sebastian Gumprich cb407267c0 remove mention of gitter 2020-07-12 09:16:53 +02:00
Sebastian Gumprich 4494ddd132 remove mention of gitter 2020-07-12 09:16:33 +02:00
Sebastian Gumprich 990f95807f remove mention of gitter 2020-07-12 09:16:22 +02:00
Sebastian Gumprich 8e7ce74953 remove mention of gitter 2020-07-12 09:16:04 +02:00
Sebastian Gumprich 147a26c27a Merge pull request #305 from dev-sec/order_crypto 
add blocks to crypto.yml checks
 2020-07-09 13:52:21 +02:00
Sebastian Gumprich fda42b7022 Merge branch 'master' into order_crypto 2020-07-09 13:40:39 +02:00
Sebastian Gumprich 4c248a4901 remove obsolete include_task 2020-07-09 13:33:19 +02:00
Sebastian Gumprich 41aef7eb80 Merge pull request #304 from dev-sec/fix_typo 
fix typo in hardening.yml
 2020-07-09 08:20:03 +02:00
Sebastian Gumprich 22580d853f Merge pull request #301 from dev-sec/fix_fedora_tests 
fix package install in tests
 2020-07-06 09:44:10 +02:00
Sebastian Gumprich 5b96f66835 Merge pull request #300 from divialth/feature/customize_sshd_x11forward 
allow customization of X11Forwarding
 2020-07-06 08:36:07 +02:00
Sebastian Gumprich 4d34d24c32 install procps in debian so sysctl.conf exists (#282) 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2020-07-05 19:01:21 +02:00
Sebastian Gumprich d06c87386f Merge pull request #298 from dev-sec/rndmh3ro-patch-2 
add centos 8 to meta
 2020-06-25 13:44:17 +02:00
Sebastian Gumprich 573f2483f5 add centos 8 to meta 2020-06-25 13:43:43 +02:00
Sebastian Gumprich 3f962b540f Merge pull request #290 from aisbergg/harmonize-style 
Harmonize style
 2020-06-20 09:07:04 +02:00
Sebastian Gumprich ce41b9f89a Merge branch 'master' into harmonize-style 2020-06-20 08:56:47 +02:00
Sebastian Gumprich b27c679a51 Merge pull request #291 from djesionek/master 
Add archlinux support
 2020-06-18 20:55:56 +02:00
Sebastian Gumprich 7621bca63b Merge pull request #46 from dev-sec/unify_actions 
unify changelog and release actions
 2020-06-06 10:25:57 +02:00
Sebastian Gumprich ab8ba4c6a4 unify changelog and release actions (#29) 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2020-06-06 10:25:55 +02:00
Sebastian Gumprich 1e9df18b64 Merge pull request #289 from dev-sec/unify_actions 
unify changelog and release actions
 2020-06-06 10:25:53 +02:00
Sebastian Gumprich c31ad460ff unify changelog and release actions (#279) 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2020-06-06 10:18:18 +02:00
Sebastian Gumprich 3480143584 Merge pull request #288 from jeanmonet/patch-1 
`ssh_allow_tcp_forwarding`: use quotes for values
 2020-06-04 06:48:03 +02:00
Sebastian Gumprich 21bec11b09 Merge pull request #287 from dev-sec/chris-rock/customize-ssh-params 
allow customization of login gracetime and max sessins
 2020-06-02 08:57:30 +02:00
Sebastian Gumprich 2c0fb49dee Merge pull request #284 from aqw/master 
make ssh client-side compression configurable
 2020-05-18 10:33:45 +02:00
Sebastian Gumprich 3b53c5a60f add changelog and release workflow (#28) 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2020-05-09 20:29:09 +02:00
Sebastian Gumprich 49af2e059d Merge pull request #45 from dev-sec/workflows 
add changelog and release workflow
 2020-05-09 20:28:47 +02:00
Sebastian Gumprich 5f741a6f9a Update release.yml 2020-05-09 20:26:19 +02:00
Sebastian Gumprich e060504f48 Update release.yml 2020-05-09 20:26:09 +02:00
Sebastian Gumprich 9e04f7bc1e Update release.yml 2020-05-09 20:21:38 +02:00
Sebastian Gumprich 4c5fa242bd Update release.yml 2020-05-09 20:21:22 +02:00
Sebastian Gumprich 1e6787204a add changelog and release workflow (#271) 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2020-05-09 20:07:36 +02:00