ssh_permit_tunnel needs quotes otherwise we will end up with an error:
```
TASK [devsec.hardening.ssh_hardening : Create sshd_config and set permissions to root/600] **********************************************************************************************************************
fatal: [vampdock02]: FAILED! => {"changed": false, "checksum": "fe6b74e30b1a653f83c2cbe1dd1332c14bd55833", "exit_status": 255, "msg": "failed to validate", "stderr": "/home/debian/.ansible/tmp/ansible-tmp-1728530891.493071-72386-149151737175948/source line 123: bad PermitTunnel argument True\r\n", "stderr_lines": ["/home/debian/.ansible/tmp/ansible-tmp-1728530891.493071-72386-149151737175948/source line 123: bad PermitTunnel argument True"], "stdout": "", "stdout_lines": []}
```
* disable systemd socket activation
Signed-off-by: Sebastian Gumprich <[email protected]>
* move start to after deactivation so it can start
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
* do not force type of gatewayports-var
this way it can be a bool or a string. we also now test for it
Signed-off-by: Sebastian Gumprich <[email protected]>
* replace yum with dnf
Signed-off-by: Sebastian Gumprich <[email protected]>
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
* centos7 is eol, remove it
Signed-off-by: Sebastian Gumprich <[email protected]>
* change workflow to update readmes when meta/main.yml is changed
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove mention of centos 7 from readme
Signed-off-by: Sebastian Gumprich <[email protected]>
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
* add testing and support for current versions of Fedora and FreeBSD
Signed-off-by: Martin Schurz <[email protected]>
* add waivers for FreeBSD
Signed-off-by: Martin Schurz <[email protected]>
* use original fedora images
Signed-off-by: Martin Schurz <[email protected]>
* also harden /home mount
Signed-off-by: Martin Schurz <[email protected]>
* also harden /tmp mount
Signed-off-by: Martin Schurz <[email protected]>
* test mock efi directory
Signed-off-by: Martin Schurz <[email protected]>
* remove mock
Signed-off-by: Martin Schurz <[email protected]>
* umount efi
Signed-off-by: Martin Schurz <[email protected]>
* add /tmp to special mountpoints
Signed-off-by: Martin Schurz <[email protected]>
* set options for /tmp mount
Signed-off-by: Martin Schurz <[email protected]>
* create /tmp mount
Signed-off-by: Martin Schurz <[email protected]>
* create /tmp mount and mount it ...
Signed-off-by: Martin Schurz <[email protected]>
* make fewer changes to default test run
Signed-off-by: Martin Schurz <[email protected]>
* use correct Ansible var
Signed-off-by: Martin Schurz <[email protected]>
---------
Signed-off-by: Martin Schurz <[email protected]>
* add role argument spec for os, ssh, mysql
Signed-off-by: Sebastian Gumprich <[email protected]>
* add role argument spec for os, ssh, mysql
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove variable in variable as it cannot be used in argument spec
Signed-off-by: Sebastian Gumprich <[email protected]>
* fix wrong syntax
* fix spelling errors
Signed-off-by: Sebastian Gumprich <[email protected]>
* cannot use vars before arg-spec validation
Signed-off-by: Sebastian Gumprich <[email protected]>
* yamllint the arg-spec
Signed-off-by: Sebastian Gumprich <[email protected]>
* add back variable
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove redundant setting in tests
* fix descriptions in mysql hardening to betterreflect what they do
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove duplicate empty line
Signed-off-by: Sebastian Gumprich <[email protected]>
* set correct defaults on to ssl options
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove left-over hidepid argument spec
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove license and author infos, this lives in the collection readme
Signed-off-by: Sebastian Gumprich <[email protected]>
* fix styling
Signed-off-by: Sebastian Gumprich <[email protected]>
* update some descriptions and sort them in the readme
Signed-off-by: Sebastian Gumprich <[email protected]>
* some more linting
Signed-off-by: Sebastian Gumprich <[email protected]>
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
* add testing for OpenBSD and FreeBSD
Signed-off-by: Martin Schurz <[email protected]>
* make python work
Signed-off-by: Martin Schurz <[email protected]>
* remove jinja template ...
Signed-off-by: Martin Schurz <[email protected]>
* make verify work
Signed-off-by: Martin Schurz <[email protected]>
* correct verify
Signed-off-by: Martin Schurz <[email protected]>
* correct verify
Signed-off-by: Martin Schurz <[email protected]>
* correct verify
Signed-off-by: Martin Schurz <[email protected]>
* correct verify
Signed-off-by: Martin Schurz <[email protected]>
* use right vm name for connect
Signed-off-by: Martin Schurz <[email protected]>
* add a bit of documentation
Signed-off-by: Martin Schurz <[email protected]>
* remove sudo
Signed-off-by: Martin Schurz <[email protected]>
* add weird OpenSBD workaround
Signed-off-by: Martin Schurz <[email protected]>
* make verify playbook more consistent
Signed-off-by: Martin Schurz <[email protected]>
* rename nonlinux to BSD
Signed-off-by: Martin Schurz <[email protected]>
* use openbsd7 for testing
Signed-off-by: Martin Schurz <[email protected]>
* correct use openbsd7 everywhere
Signed-off-by: Martin Schurz <[email protected]>
* add waivers
Signed-off-by: Martin Schurz <[email protected]>
* update waiver descriptions
Signed-off-by: Martin Schurz <[email protected]>
* use docker for inspec
Signed-off-by: Martin Schurz <[email protected]>
* keep looking right ;)
Signed-off-by: Martin Schurz <[email protected]>
* correct path to waivers
Signed-off-by: Martin Schurz <[email protected]>
* use ephemeral directory in docker
Signed-off-by: Martin Schurz <[email protected]>
* use bsd inspec profile
Signed-off-by: Martin Schurz <[email protected]>
* remove openbsd workaround
Signed-off-by: Martin Schurz <[email protected]>
* re-add openbsd workaround
Signed-off-by: Martin Schurz <[email protected]>
* commit suggestions
Signed-off-by: Martin Schurz <[email protected]>
* add supportet OS to metadata
Signed-off-by: Martin Schurz <[email protected]>
* use current python
Signed-off-by: Martin Schurz <[email protected]>
---------
Signed-off-by: Martin Schurz <[email protected]>
vmpr