* Provide granular noop for shh configuration
We would like to have more fine grained options on applying or not specific configurations.
This commit let the user choose to noop some configuration with a few new
boolean variables.
Motivation for theses options are we may configure ourselves some (ssh host key
regeneration in a templating system) or we are not ready for others (ssh_kex
will break dist-upgrades, letting the operator without ssh).
Signed-off-by: seven beep <[email protected]>
* Provide granula noop for ssh configuration
We would like to have more fine grained options on applying or not specific configurations.
This commit let the user choose to disable configurations for `ssh_host_key_config`,
`ssh_ciphers_config`, `ssh_host_key_config`, `ssh_macs_config` by setting them
to False.
Motivation for theses options are we may configure ourselves some (ssh host key
regeneration in a templating system) or we are not ready for others (ssh_kex
will break dist-upgrades, letting the operator without ssh).
Signed-off-by: seven beep <[email protected]>
---------
Signed-off-by: seven beep <[email protected]>
ssh_permit_tunnel needs quotes otherwise we will end up with an error:
```
TASK [devsec.hardening.ssh_hardening : Create sshd_config and set permissions to root/600] **********************************************************************************************************************
fatal: [vampdock02]: FAILED! => {"changed": false, "checksum": "fe6b74e30b1a653f83c2cbe1dd1332c14bd55833", "exit_status": 255, "msg": "failed to validate", "stderr": "/home/debian/.ansible/tmp/ansible-tmp-1728530891.493071-72386-149151737175948/source line 123: bad PermitTunnel argument True\r\n", "stderr_lines": ["/home/debian/.ansible/tmp/ansible-tmp-1728530891.493071-72386-149151737175948/source line 123: bad PermitTunnel argument True"], "stdout": "", "stdout_lines": []}
```
* do not force type of gatewayports-var
this way it can be a bool or a string. we also now test for it
Signed-off-by: Sebastian Gumprich <[email protected]>
* replace yum with dnf
Signed-off-by: Sebastian Gumprich <[email protected]>
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
* centos7 is eol, remove it
Signed-off-by: Sebastian Gumprich <[email protected]>
* change workflow to update readmes when meta/main.yml is changed
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove mention of centos 7 from readme
Signed-off-by: Sebastian Gumprich <[email protected]>
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
* add testing and support for current versions of Fedora and FreeBSD
Signed-off-by: Martin Schurz <[email protected]>
* add waivers for FreeBSD
Signed-off-by: Martin Schurz <[email protected]>
* use original fedora images
Signed-off-by: Martin Schurz <[email protected]>
* also harden /home mount
Signed-off-by: Martin Schurz <[email protected]>
* also harden /tmp mount
Signed-off-by: Martin Schurz <[email protected]>
* test mock efi directory
Signed-off-by: Martin Schurz <[email protected]>
* remove mock
Signed-off-by: Martin Schurz <[email protected]>
* umount efi
Signed-off-by: Martin Schurz <[email protected]>
* add /tmp to special mountpoints
Signed-off-by: Martin Schurz <[email protected]>
* set options for /tmp mount
Signed-off-by: Martin Schurz <[email protected]>
* create /tmp mount
Signed-off-by: Martin Schurz <[email protected]>
* create /tmp mount and mount it ...
Signed-off-by: Martin Schurz <[email protected]>
* make fewer changes to default test run
Signed-off-by: Martin Schurz <[email protected]>
* use correct Ansible var
Signed-off-by: Martin Schurz <[email protected]>
---------
Signed-off-by: Martin Schurz <[email protected]>
* add role argument spec for os, ssh, mysql
Signed-off-by: Sebastian Gumprich <[email protected]>
* add role argument spec for os, ssh, mysql
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove variable in variable as it cannot be used in argument spec
Signed-off-by: Sebastian Gumprich <[email protected]>
* fix wrong syntax
* fix spelling errors
Signed-off-by: Sebastian Gumprich <[email protected]>
* cannot use vars before arg-spec validation
Signed-off-by: Sebastian Gumprich <[email protected]>
* yamllint the arg-spec
Signed-off-by: Sebastian Gumprich <[email protected]>
* add back variable
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove redundant setting in tests
* fix descriptions in mysql hardening to betterreflect what they do
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove duplicate empty line
Signed-off-by: Sebastian Gumprich <[email protected]>
* set correct defaults on to ssl options
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove left-over hidepid argument spec
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove license and author infos, this lives in the collection readme
Signed-off-by: Sebastian Gumprich <[email protected]>
* fix styling
Signed-off-by: Sebastian Gumprich <[email protected]>
* update some descriptions and sort them in the readme
Signed-off-by: Sebastian Gumprich <[email protected]>
* some more linting
Signed-off-by: Sebastian Gumprich <[email protected]>
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
* add testing for OpenBSD and FreeBSD
Signed-off-by: Martin Schurz <[email protected]>
* make python work
Signed-off-by: Martin Schurz <[email protected]>
* remove jinja template ...
Signed-off-by: Martin Schurz <[email protected]>
* make verify work
Signed-off-by: Martin Schurz <[email protected]>
* correct verify
Signed-off-by: Martin Schurz <[email protected]>
* correct verify
Signed-off-by: Martin Schurz <[email protected]>
* correct verify
Signed-off-by: Martin Schurz <[email protected]>
* correct verify
Signed-off-by: Martin Schurz <[email protected]>
* use right vm name for connect
Signed-off-by: Martin Schurz <[email protected]>
* add a bit of documentation
Signed-off-by: Martin Schurz <[email protected]>
* remove sudo
Signed-off-by: Martin Schurz <[email protected]>
* add weird OpenSBD workaround
Signed-off-by: Martin Schurz <[email protected]>
* make verify playbook more consistent
Signed-off-by: Martin Schurz <[email protected]>
* rename nonlinux to BSD
Signed-off-by: Martin Schurz <[email protected]>
* use openbsd7 for testing
Signed-off-by: Martin Schurz <[email protected]>
* correct use openbsd7 everywhere
Signed-off-by: Martin Schurz <[email protected]>
* add waivers
Signed-off-by: Martin Schurz <[email protected]>
* update waiver descriptions
Signed-off-by: Martin Schurz <[email protected]>
* use docker for inspec
Signed-off-by: Martin Schurz <[email protected]>
* keep looking right ;)
Signed-off-by: Martin Schurz <[email protected]>
* correct path to waivers
Signed-off-by: Martin Schurz <[email protected]>
* use ephemeral directory in docker
Signed-off-by: Martin Schurz <[email protected]>
* use bsd inspec profile
Signed-off-by: Martin Schurz <[email protected]>
* remove openbsd workaround
Signed-off-by: Martin Schurz <[email protected]>
* re-add openbsd workaround
Signed-off-by: Martin Schurz <[email protected]>
* commit suggestions
Signed-off-by: Martin Schurz <[email protected]>
* add supportet OS to metadata
Signed-off-by: Martin Schurz <[email protected]>
* use current python
Signed-off-by: Martin Schurz <[email protected]>
---------
Signed-off-by: Martin Schurz <[email protected]>
Sebastian Gumprich