Commit Graph
71 Commits
Author SHA1 Message Date
Martin Schurz c029b84138 update zypper
Signed-off-by: Martin Schurz <[email protected]>
2025-02-07 21:32:45 +01:00
Martin Schurz e13bb0fcae Use correct os_family for Suse ...
Signed-off-by: Martin Schurz <[email protected]>
2024-12-22 22:23:40 +01:00
Martin Schurz e8cf61bd3c Make changes portable
Signed-off-by: Martin Schurz <[email protected]>

Make changes portable

Signed-off-by: Martin Schurz <[email protected]>

Make changes portable

Signed-off-by: Martin Schurz <[email protected]>

Make changes portable

Signed-off-by: Martin Schurz <[email protected]>

Make changes portable

Signed-off-by: Martin Schurz <[email protected]>

Make changes portable

Signed-off-by: Martin Schurz <[email protected]>

Make changes portable

Signed-off-by: Martin Schurz <[email protected]>

Make changes portable

Signed-off-by: Martin Schurz <[email protected]>
2024-12-22 22:23:38 +01:00
Martin Schurz 767293e40b Install passlib on executor
Signed-off-by: Martin Schurz <[email protected]>
2024-12-22 19:26:22 +01:00
Martin Schurz 4b05df756c fix errors
Signed-off-by: Martin Schurz <[email protected]>
2024-12-22 18:58:39 +01:00
Martin Schurz fba07a4d41 MOdify PAM to allow SSH Key logins with locked passwords
Signed-off-by: Martin Schurz <[email protected]>
2024-12-22 18:51:18 +01:00
Martin Schurz 6cc57e1581 Don't run tests if the environment is not correct
Signed-off-by: Martin Schurz <[email protected]>
2024-10-07 23:02:51 +02:00
Martin Schurz 2b495bf6b9 Disable testing of audit in docker
Signed-off-by: Martin Schurz <[email protected]>
2024-10-04 13:29:17 +02:00
Martin Schurz 4c87d293ce Disable testing of audit in docker
Signed-off-by: Martin Schurz <[email protected]>
2024-10-04 13:29:17 +02:00
Martin Schurz 2e3d5e916b Remove unused files and variables
Signed-off-by: Martin Schurz <[email protected]>
2024-10-04 13:29:16 +02:00
Sebastian Gumprich 85aa1b22b3 do not force type of ssh_gateway_ports (#765)
* do not force type of gatewayports-var

this way it can be a bool or a string. we also now test for it

Signed-off-by: Sebastian Gumprich <[email protected]>

* replace yum with dnf

Signed-off-by: Sebastian Gumprich <[email protected]>

---------

Signed-off-by: Sebastian Gumprich <[email protected]>
2024-05-31 12:20:00 +02:00
Martin Schurz d8c9ac71ec fix assertion
Signed-off-by: Martin Schurz <[email protected]>
2023-12-09 19:14:41 +01:00
Martin Schurz dff224f4c4 correct typo
Signed-off-by: Martin Schurz <[email protected]>
2023-12-06 15:57:08 +01:00
Martin Schurz 422fb940a9 manually fix remaining problems
Signed-off-by: Martin Schurz <[email protected]>
2023-12-06 15:27:21 +01:00
Martin Schurz 7e33ea0bae use ansible-lint to autofix problems
Signed-off-by: Martin Schurz <[email protected]>
2023-12-06 14:37:09 +01:00
Martin Schurz e00716df62 fix lint findings
Signed-off-by: Martin Schurz <[email protected]>
2023-12-06 11:36:08 +01:00
schurzi 15f2de8b44 fix os ci (#711)
Signed-off-by: Martin Schurz <[email protected]>
2023-11-12 20:45:30 +01:00
Sebastian GumprichandSebastian Gumprich e3273a8d54 disable pam tests (#691)
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
2023-08-07 14:38:44 +02:00
Sebastian GumprichandSebastian Gumprich ef5e8801e4 add debian 12 support (#684)
* add debian 12 support

Signed-off-by: Sebastian Gumprich <[email protected]>

* temp disable pam-checks

Signed-off-by: Sebastian Gumprich <[email protected]>

* remove debian12 from vagrant tests as there's no box yet

Signed-off-by: Sebastian Gumprich <[email protected]>

* use new pam-tester from pip

Signed-off-by: Sebastian Gumprich <[email protected]>

* use new pam-tester from pip

Signed-off-by: Sebastian Gumprich <[email protected]>

* add setuptoolks to pam-tester install

Signed-off-by: Sebastian Gumprich <[email protected]>

* add setuptoolks to pam-tester install

Signed-off-by: Sebastian Gumprich <[email protected]>

* add setuptoolks to pam-tester install

Signed-off-by: Sebastian Gumprich <[email protected]>

* add setuptoolks to pam-tester install

Signed-off-by: Sebastian Gumprich <[email protected]>

* install pam-tester with python3 and use full path to it

Signed-off-by: Sebastian Gumprich <[email protected]>

* install python3-setupttools in verify-tests

Signed-off-by: Sebastian Gumprich <[email protected]>

* fix path for pam-tester in all tests

Signed-off-by: Sebastian Gumprich <[email protected]>

* set python interpreter to 3 for verify-tests

Signed-off-by: Sebastian Gumprich <[email protected]>

* Revert "set python interpreter to 3 for verify-tests"

This reverts commit 00b6556e33.

* add back accidentally deleted tasks

Signed-off-by: Sebastian Gumprich <[email protected]>

---------

Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
2023-08-04 12:59:40 +02:00
Martin Schurz 7259d6b5fd fix spelling errors
Signed-off-by: Martin Schurz <[email protected]>
2023-04-14 23:51:53 +02:00
Martin Schurz bb47300798 remove unneccessary collection include
Signed-off-by: Martin Schurz <[email protected]>
2023-04-12 20:27:35 +02:00
Martin Schurz 5cc7b8dee3 add waivers for os_hardening
Signed-off-by: Martin Schurz <[email protected]>
2023-04-11 07:17:29 +02:00
Martin Schurz e43f180112 update waiver path
Signed-off-by: Martin Schurz <[email protected]>
2023-04-10 23:48:52 +02:00
Martin Schurz 31c9885610 use docker for inspec-auditor
Signed-off-by: Martin Schurz <[email protected]>
2023-04-10 23:22:41 +02:00
Martin Schurz dd5ad568b3 fix deprecation warnings
Signed-off-by: Martin Schurz <[email protected]>
2023-04-10 20:36:03 +02:00
Martin Schurz e4ecfe2084 add collection to verify
Signed-off-by: Martin Schurz <[email protected]>
2023-04-10 11:03:33 +02:00
schurzi 5ed3f399f2 add check mode to molecule tests (#644)
* add check mode to molecule tests

Signed-off-by: Martin Schurz <[email protected]>

* bail on undefined variables

Signed-off-by: Martin Schurz <[email protected]>

* bail on undefined variables

Signed-off-by: Martin Schurz <[email protected]>

* execute tasks in check mode

Signed-off-by: Martin Schurz <[email protected]>

* fix error in check mode on SuSE

Signed-off-by: Martin Schurz <[email protected]>

* use when condition on task

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>
2023-03-09 09:37:59 +01:00
Sebastian Gumprich c2e9c9a8dd try to fix molecule local tests (#632)
these settings are probably not necessary (geerlingguys images dont have them either)

Signed-off-by: Sebastian Gumprich <[email protected]>
2023-02-06 14:01:40 +01:00
Norman Ziegner c594a1fe6a os_hardening: Add test for setting password warning days via variable os_auth_pw_warn_age
Signed-off-by: Norman Ziegner <[email protected]>
2023-02-03 14:47:27 +01:00
16e00b02db rewrite user home dir hardening (#584)
* rewrite user home dir hardening

* delete duplicate var that was missed in a merge conflict

Signed-off-by: Sebastian Gumprich <[email protected]>

* linting

Signed-off-by: Sebastian Gumprich <[email protected]>

* add tests for home rewrites

Signed-off-by: Sebastian Gumprich <[email protected]>

* Apply suggestions from code review

Co-authored-by: schurzi <[email protected]>

---------

Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: donestefan <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: schurzi <[email protected]>
2023-01-28 21:59:19 +01:00
89138be4ec Rewrite system account detection and hardening and create tests (#621)
* rewrite system account detection and hardening

* resolve failures created when resolving merge conflicts

Signed-off-by: Sebastian Gumprich <[email protected]>

* add tests for shell removal tasks

Signed-off-by: Sebastian Gumprich <[email protected]>

* Update molecule/os_hardening/prepare.yml

Signed-off-by: Martin Schurz <[email protected]>

* split tasks for locking and setting shell

Signed-off-by: Martin Schurz <[email protected]>

* fix some more linting

Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
Signed-off-by: Martin Schurz <[email protected]>
Co-authored-by: donestefan <[email protected]>
Co-authored-by: schurzi <[email protected]>
2023-01-27 11:01:03 +01:00
Sebastian Gumprich 281d706660 add waiver to not test mounts
Signed-off-by: Sebastian Gumprich <[email protected]>
2023-01-24 13:03:04 +01:00
Sebastian Gumprich d386bf36d2 Revert "manage tmp dir in tests"
This reverts commit 966f2fe137.
2023-01-24 12:53:39 +01:00
Sebastian Gumprich 966f2fe137 manage tmp dir in tests
Signed-off-by: Sebastian Gumprich <[email protected]>
2023-01-24 12:36:09 +01:00
Sebastian Gumprich fa2e90c6f2 mount cgroup rw, as suse seems to need it
Signed-off-by: Sebastian Gumprich <[email protected]>
2023-01-23 15:59:06 +01:00
Sebastian Gumprich ed1cb1c2a7 add cgroupns: host mode to molecule
Signed-off-by: Sebastian Gumprich <[email protected]>
2023-01-23 15:59:06 +01:00
Sebastian Gumprich a0d11faa8a Fixed problems with running molecule locally with cgroup v2
Signed-off-by: Sebastian Gumprich <[email protected]>
2023-01-23 15:59:06 +01:00
674be6dc6f apply password age settings to exisiting regular users (#582)
* apply password age settings to regular users

* add tests for password ageing

Signed-off-by: Sebastian Gumprich <[email protected]>

* add debugging vars

Signed-off-by: Sebastian Gumprich <[email protected]>

* add tests for password ageing

Signed-off-by: Sebastian Gumprich <[email protected]>

* add tests for password ageing

Signed-off-by: Sebastian Gumprich <[email protected]>

* Apply suggestions from code review

Co-authored-by: schurzi <[email protected]>

* add additional condtion for regular users

Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: DonEstefan <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: schurzi <[email protected]>
2023-01-23 10:50:05 +01:00
Sebastian Gumprich 142782bad6 add diff to molecule
Signed-off-by: Sebastian Gumprich <[email protected]>
2023-01-19 13:46:16 +01:00
PhilippFunkandPhilipp Funk fd3fc1cfba add option to bypass .netrc check function (#563)
add option to whitelist specific user that need a .netrc file in there home dirs
add test for .netrc files if option os_netrc_enabled is false

Signed-off-by: Philipp Funk <[email protected]>

Signed-off-by: Philipp Funk <[email protected]>
Co-authored-by: Philipp Funk <[email protected]>
2022-08-17 09:09:00 +02:00
Martin Schurz 72cb97c8d5 remove waivers file from docker test config
Signed-off-by: Martin Schurz <[email protected]>
2022-07-11 12:36:48 +02:00
Martin Schurz edda7075a2 add badge for tests
Signed-off-by: Martin Schurz <[email protected]>
2022-07-11 12:17:34 +02:00
Martin Schurz 21df60a71f fix includes
Signed-off-by: Martin Schurz <[email protected]>
2022-07-08 17:24:07 +02:00
Sebastian Gumprich bf372f8493 rename tasks file and remove redundant 'verify'
Signed-off-by: Sebastian Gumprich <[email protected]>
2022-07-08 16:04:24 +02:00
Sebastian Gumprich ef89d52f98 remove duplicate file
Signed-off-by: Sebastian Gumprich <[email protected]>
2022-07-07 16:22:10 +02:00
Sebastian Gumprich 9b50392d8a fix linting
Signed-off-by: Sebastian Gumprich <[email protected]>
2022-07-07 16:12:06 +02:00
Sebastian Gumprich 215c50709b tempt 2022-07-07 15:34:28 +02:00
Sebastian Gumprich af14af5954 add waivers to skip controls (#529)
Signed-off-by: rndmh3ro <[email protected]>
2022-02-21 13:58:39 +01:00
Sebastian Gumprich 8f22ce788c Feature coredump (#513)
* restructure limits-tasks

* disable coredumps in tests

* use notify-task for systemd-reload

Signed-off-by: rndmh3ro <[email protected]>

* add notify to another task

Signed-off-by: rndmh3ro <[email protected]>

* rm obsolete task and rename handler

Signed-off-by: rndmh3ro <[email protected]>
2021-12-10 22:10:14 +01:00
René Scheibe 0609cf729a Improve installing packages on Arch Linux
This prevents annoying task errors (even though they are ignored)
when testing on non-Arch distributions.

Running the "prepare" command, this was always visible:
> fatal: [instance]: FAILED! => {"changed": false, "msg": "Failed to find required executable \"pacman\" in paths: /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin"}

Signed-off-by: René Scheibe <[email protected]>
2021-11-07 13:53:03 +01:00