andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,925 Commits 14 Branches 64 Tags
0cd3b0d02edb0721413dea7e3d0ad1ed1111c11f
Commit Graph
1925 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
dev-sec CI 0cd3b0d02e update changelog 2023-02-07 08:41:03 +00:00
schurzi 9b32aca0ca run our CI tests periodically (#634) 
* allow multiple instances for os vm tests

Signed-off-by: Martin Schurz <[email protected]>

* add scheduled trigger to all test actions

Signed-off-by: Martin Schurz <[email protected]>

* use different scenario names

Signed-off-by: Martin Schurz <[email protected]>

* use different scenario names

Signed-off-by: Martin Schurz <[email protected]>

* use different scenario names

Signed-off-by: Martin Schurz <[email protected]>

* use username to create uniqe vms

Signed-off-by: Martin Schurz <[email protected]>

* use compatible name

Signed-off-by: Martin Schurz <[email protected]>

* add explaination

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>
 2023-02-07 09:27:46 +01:00
dev-sec CI 8d667aa069 update changelog 2023-02-06 13:04:41 +00:00
Sebastian Gumprich c2e9c9a8dd try to fix molecule local tests (#632) 
these settings are probably not necessary (geerlingguys images dont have them either)

Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-02-06 14:01:40 +01:00
dev-sec CI 3d9dfc90df update changelog 2023-02-06 12:53:51 +00:00
Nejc Habjan 1fc2809307 Make action_mail_acct configurable in auditd (#631) 
Signed-off-by: Nejc Habjan <[email protected]>
 2023-02-06 13:24:43 +01:00
dev-sec CI 071b270b94 update changelog 2023-02-06 07:40:43 +00:00
schurzi 1ef9171393 remove unneccessary tasks for VM based test (#629) 
* add remaining platforms to test

Signed-off-by: Martin Schurz <[email protected]>

* remove unneccessary tasks for test

Signed-off-by: Martin Schurz <[email protected]>

* use current opensuse version

Signed-off-by: Martin Schurz <[email protected]>

* disable sysctl for missing yama in opensuse

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>
 2023-02-06 08:37:40 +01:00
dev-sec CI a505c3039d update galaxy.yml with new version 2023-02-06 07:37:06 +00:00
dev-sec CI 965013efed update changelog 2023-02-04 17:25:00 +00:00
schurzi 0705a9cc90 Merge pull request #628 from Normo/add-password-warn-age-option 
Set number of warning days before user password expires
8.6.0 		2023-02-04 18:21:52 +01:00
Norman Ziegner c594a1fe6a os_hardening: Add test for setting password warning days via variable os_auth_pw_warn_age 
Signed-off-by: Norman Ziegner <[email protected]>
 2023-02-03 14:47:27 +01:00
Norman Ziegner 2f60b44cca os_hardening: Add variable to set the number of days of warning before user password expires 
Signed-off-by: Norman Ziegner <[email protected]>
 2023-02-01 16:17:36 +01:00
dev-sec CI 1b1b0e10f2 update changelog 2023-02-01 11:40:40 +00:00
dependabot[bot] f34f24deb7 Bump hugo19941994/delete-draft-releases from 1.0.0 to 1.0.1 (#627) 
Bumps [hugo19941994/delete-draft-releases](https://github.com/hugo19941994/delete-draft-releases) from 1.0.0 to 1.0.1.
- [Release notes](https://github.com/hugo19941994/delete-draft-releases/releases)
- [Commits](https://github.com/hugo19941994/delete-draft-releases/compare/v1.0.0...v1.0.1)

---
updated-dependencies:
- dependency-name: hugo19941994/delete-draft-releases
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-02-01 12:37:31 +01:00
dev-sec CI 6ccdaee45d update galaxy.yml with new version 2023-01-31 06:55:37 +00:00
dev-sec CI e8d16766ad update changelog 2023-01-31 06:48:47 +00:00
schurzi e6bc422f5b Merge pull request #626 from dev-sec/dependabot_labels 
do not let dependabot label our prs
8.5.0 		2023-01-30 16:21:11 +01:00
Sebastian Gumprich bfedba6907 do not let dependabot label our prs 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-30 16:20:35 +01:00
dev-sec CI 1fe0677b0b update changelog 2023-01-30 14:59:08 +00:00
schurzi 894c6117a0 Merge pull request #625 from dev-sec/linting_roles 
run linting only when files inside roles change
 2023-01-30 10:48:22 +01:00
Sebastian Gumprich 330a1eb94d run linting only when files inside roles change 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-30 10:23:25 +01:00
dev-sec CI 52d08ff009 update changelog 2023-01-29 12:39:47 +00:00
dev-sec CI 01cb20d644 update changelog 2023-01-28 21:01:52 +00:00
rndmh3ro bc096e58e5 Prettified Code! 2023-01-28 20:59:35 +00:00
DonEstefanschurzidonestefanSebastian GumprichSebastian Gumprich
 		16e00b02db rewrite user home dir hardening (#584) 
* rewrite user home dir hardening

* delete duplicate var that was missed in a merge conflict

Signed-off-by: Sebastian Gumprich <[email protected]>

* linting

Signed-off-by: Sebastian Gumprich <[email protected]>

* add tests for home rewrites

Signed-off-by: Sebastian Gumprich <[email protected]>

* Apply suggestions from code review

Co-authored-by: schurzi <[email protected]>

---------

Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: donestefan <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: schurzi <[email protected]>
 2023-01-28 21:59:19 +01:00
Sebastian Gumprich a75b339526 fix more linting errors 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-27 11:27:35 +01:00
dev-sec CI 9fe8ca7294 update changelog 2023-01-27 10:04:18 +00:00
Sebastian Gumprichdonestefanschurzi
 		89138be4ec Rewrite system account detection and hardening and create tests (#621) 
* rewrite system account detection and hardening

* resolve failures created when resolving merge conflicts

Signed-off-by: Sebastian Gumprich <[email protected]>

* add tests for shell removal tasks

Signed-off-by: Sebastian Gumprich <[email protected]>

* Update molecule/os_hardening/prepare.yml

Signed-off-by: Martin Schurz <[email protected]>

* split tasks for locking and setting shell

Signed-off-by: Martin Schurz <[email protected]>

* fix some more linting

Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
Signed-off-by: Martin Schurz <[email protected]>
Co-authored-by: donestefan <[email protected]>
Co-authored-by: schurzi <[email protected]>
 2023-01-27 11:01:03 +01:00
dev-sec CI f1169749f4 update changelog 2023-01-25 22:59:48 +00:00
schurzi ee80418496 Merge pull request #618 from dev-sec/deprecate_intitramfs 
deprecate rebuilding of initramfs
 2023-01-25 23:56:36 +01:00
Martin Schurz 7f8e9919ee add readme 
Signed-off-by: Martin Schurz <[email protected]>
 2023-01-25 22:30:17 +01:00
dev-sec CI bbee0b74ec update changelog 2023-01-25 12:21:00 +00:00
schurzi 0e8533049d Merge pull request #620 from dev-sec/molecule_fixes 
Fixed problems with running molecule locally with cgroup v2
 2023-01-25 13:18:50 +01:00
Sebastian Gumprich a1028c7504 deprecate initramfs 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-25 13:07:37 +01:00
dev-sec CI aa555b9290 update changelog 2023-01-25 08:15:45 +00:00
mmitnyan 83a0a9242b Support for Amazon Linux 2 (#624) 
Signed-off-by: Manuel Mitnyan <[email protected]>

Signed-off-by: Manuel Mitnyan <[email protected]>
 2023-01-25 09:12:25 +01:00
dev-sec CI fdd0bfc72a update changelog 2023-01-24 13:27:02 +00:00
schurzi 154f862ccd Merge pull request #622 from dev-sec/stop_old_tests 
cancel running tests if new commit to branch is made
 2023-01-24 13:21:18 +01:00
Sebastian Gumprich db4bd32767 cancel running tests if new commit to branch is made 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-24 13:08:04 +01:00
Sebastian Gumprich 281d706660 add waiver to not test mounts 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-24 13:03:04 +01:00
dev-sec CI 85271c2375 update changelog 2023-01-24 12:01:58 +00:00
Sebastian Gumprich d386bf36d2 Revert "manage tmp dir in tests" 
This reverts commit 966f2fe137.
 2023-01-24 12:53:39 +01:00
Sebastian Gumprich bb588bd777 linting (#603) 
* linting

Signed-off-by: Sebastian Gumprich <[email protected]>

* more linting

Signed-off-by: Sebastian Gumprich <[email protected]>

* change line length issues

Signed-off-by: Sebastian Gumprich <[email protected]>

* replace yes with true in tasks

Signed-off-by: Sebastian Gumprich <[email protected]>

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

Signed-off-by: Sebastian Gumprich <[email protected]>

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

Signed-off-by: Sebastian Gumprich <[email protected]>

* add exception for task

Signed-off-by: Sebastian Gumprich <[email protected]>

* remove trailing whitespace

* add back deleted params

Signed-off-by: Sebastian Gumprich <[email protected]>

* add back deleted params

Signed-off-by: Sebastian Gumprich <[email protected]>

* add back tasks

Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-24 12:40:27 +01:00
Sebastian Gumprich 966f2fe137 manage tmp dir in tests 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-24 12:36:09 +01:00
Sebastian Gumprich fa2e90c6f2 mount cgroup rw, as suse seems to need it 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-23 15:59:06 +01:00
Sebastian Gumprich ed1cb1c2a7 add cgroupns: host mode to molecule 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-23 15:59:06 +01:00
Sebastian Gumprich a0d11faa8a Fixed problems with running molecule locally with cgroup v2 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-23 15:59:06 +01:00
dev-sec CI a94168c84f update changelog 2023-01-23 09:52:21 +00:00
DonEstefanschurziDonEstefanSebastian GumprichSebastian Gumprich
 		674be6dc6f apply password age settings to exisiting regular users (#582) 
* apply password age settings to regular users

* add tests for password ageing

Signed-off-by: Sebastian Gumprich <[email protected]>

* add debugging vars

Signed-off-by: Sebastian Gumprich <[email protected]>

* add tests for password ageing

Signed-off-by: Sebastian Gumprich <[email protected]>

* add tests for password ageing

Signed-off-by: Sebastian Gumprich <[email protected]>

* Apply suggestions from code review

Co-authored-by: schurzi <[email protected]>

* add additional condtion for regular users

Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: DonEstefan <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: schurzi <[email protected]>
 2023-01-23 10:50:05 +01:00