* Write sysctl config to separate file
Write our sysctl config to separate file, since newer distributions no longer use the global /etc/sysctl.conf file. All older distributions seem to already support reading from /etc/sysctl.d so this should be no breaking change.
* Add support for current versions of Debian and EL
Signed-off-by: Martin Schurz <[email protected]>
* Add conditions for EL8
Signed-off-by: Martin Schurz <[email protected]>
* Fix Audit in AlmaLinux
Signed-off-by: Martin Schurz <[email protected]>
* Fix broken SSH host key config in rhel/almalinux 10
Signed-off-by: Jonathan Wright <[email protected]>
* Generate SSH Keys on EL10
Signed-off-by: Martin Schurz <[email protected]>
* Generate SSH Keys for tests via Systemd
Signed-off-by: Martin Schurz <[email protected]>
* Fixup tests
Signed-off-by: Martin Schurz <[email protected]>
* Remove auditd conditions
Signed-off-by: Martin Schurz <[email protected]>
* Add path to audit handler
Signed-off-by: Martin Schurz <[email protected]>
* Install init scripts
Signed-off-by: Martin Schurz <[email protected]>
* Update main README
---------
Signed-off-by: Martin Schurz <[email protected]>
Signed-off-by: Jonathan Wright <[email protected]>
Co-authored-by: Jonathan Wright <[email protected]>
Signed-off-by: Martin Schurz <[email protected]>
Make changes portable
Signed-off-by: Martin Schurz <[email protected]>
Make changes portable
Signed-off-by: Martin Schurz <[email protected]>
Make changes portable
Signed-off-by: Martin Schurz <[email protected]>
Make changes portable
Signed-off-by: Martin Schurz <[email protected]>
Make changes portable
Signed-off-by: Martin Schurz <[email protected]>
Make changes portable
Signed-off-by: Martin Schurz <[email protected]>
Make changes portable
Signed-off-by: Martin Schurz <[email protected]>
* Provide granular noop for shh configuration
We would like to have more fine grained options on applying or not specific configurations.
This commit let the user choose to noop some configuration with a few new
boolean variables.
Motivation for theses options are we may configure ourselves some (ssh host key
regeneration in a templating system) or we are not ready for others (ssh_kex
will break dist-upgrades, letting the operator without ssh).
Signed-off-by: seven beep <[email protected]>
* Provide granula noop for ssh configuration
We would like to have more fine grained options on applying or not specific configurations.
This commit let the user choose to disable configurations for `ssh_host_key_config`,
`ssh_ciphers_config`, `ssh_host_key_config`, `ssh_macs_config` by setting them
to False.
Motivation for theses options are we may configure ourselves some (ssh host key
regeneration in a templating system) or we are not ready for others (ssh_kex
will break dist-upgrades, letting the operator without ssh).
Signed-off-by: seven beep <[email protected]>
---------
Signed-off-by: seven beep <[email protected]>
ssh_permit_tunnel needs quotes otherwise we will end up with an error:
```
TASK [devsec.hardening.ssh_hardening : Create sshd_config and set permissions to root/600] **********************************************************************************************************************
fatal: [vampdock02]: FAILED! => {"changed": false, "checksum": "fe6b74e30b1a653f83c2cbe1dd1332c14bd55833", "exit_status": 255, "msg": "failed to validate", "stderr": "/home/debian/.ansible/tmp/ansible-tmp-1728530891.493071-72386-149151737175948/source line 123: bad PermitTunnel argument True\r\n", "stderr_lines": ["/home/debian/.ansible/tmp/ansible-tmp-1728530891.493071-72386-149151737175948/source line 123: bad PermitTunnel argument True"], "stdout": "", "stdout_lines": []}
```
Martin Schurz