Commit Graph
16 Commits
Author SHA1 Message Date
蚯蚓 27c6b93d04 add "when" statements in hardening.yml(#453) (#455)
* add "when" statements in hardening.yml(#453)

Signed-off-by: jqiuyin <[email protected]>

* add "when" statements in hardening.yml(#453)

Signed-off-by: jqiuyin <[email protected]>

* add "when" statements in hardening.yml(#453)

Signed-off-by: jqiuyin <[email protected]>
2021-07-01 11:25:14 +02:00
Sebastian Gumprichandschurzi 9cefddd949 make sha rounds configurable and increase no of rounds (#452)
* make sha rounds configurable and increase no of rounds

Fixes #365

Signed-off-by: rndmh3ro <[email protected]>

* Prettified Code!

* make password rounds configurable in pam system-auth

Signed-off-by: rndmh3ro <[email protected]>

* change wording of sha rounds documentation

Co-authored-by: schurzi <[email protected]>

Co-authored-by: schurzi <[email protected]>
2021-06-30 10:41:59 +02:00
Sebastian Gumprich 41cd8485cb enable ipv6 globally (#450)
Signed-off-by: Sebastian Gumprich <[email protected]>
2021-05-26 20:13:45 +02:00
Lars Düsing 0beeb3ee03 Removed sysctl that tries to disable IPv6. #416
Signed-off-by: Lars Düsing <[email protected]>
2021-05-24 13:33:38 +02:00
Farid Joubbi c90bbd2c23 Improved comments. (#436)
Signed-off-by: Farid Joubbi <[email protected]>
2021-03-24 14:31:58 +01:00
Farid Joubbi d1143a06b1 Not accepting source routing for IPv6. This was already done for IPv4. (#424)
Signed-off-by: Farid Joubbi <[email protected]>
2021-03-24 07:55:29 +01:00
Farid Joubbi 240d8acc0c Changed os_auth_pam_pwquality_options type to authtok_type.
Signed-off-by: Farid Joubbi <[email protected]>
2021-03-23 11:16:05 +01:00
Sebastian Gumprich b5ca78a9cd chmod /home directories to 0700
This is based on https://github.com/dev-sec/ansible-collection-hardening/pull/277
and updated to work with the new collection.

Thanks to @aardbol for this initial implementation!

Signed-off-by: Sebastian Gumprich <[email protected]>
2021-03-22 11:18:51 +01:00
Farid Joubbi 97c55d6e55 Documented rationale for sysctl values set.
Signed-off-by: Farid Joubbi <[email protected]>
2021-03-15 14:01:19 +01:00
Farid Joubbi d01abb44c0 Syncookie (#372)
* Enabled SYN cookie sysctl.

Signed-off-by: Farid Joubbi <[email protected]>

* Removed SYN cookies from here since it's a default now.

Signed-off-by: Farid Joubbi <[email protected]>
2021-01-15 09:56:29 +01:00
Farid Joubbi 5675589e01 Sorted sysctl values and lists in READMEs alphabetically (No functional changes). (#371)
* Add s's for consistency.

Signed-off-by: Farid Joubbi <[email protected]>

* Sort lists alphabetically.

Signed-off-by: Farid Joubbi <[email protected]>

* Sorted sysctl_config alphabetically.

Signed-off-by: Farid Joubbi <[email protected]>

* Sort removed protocols.

Signed-off-by: Farid Joubbi <[email protected]>

* Added dots in variable descriptions for the sake of consistency.

Signed-off-by: Farid Joubbi <[email protected]>

* Added dots in variable descriptions for the sake of consistency.

Signed-off-by: Farid Joubbi <[email protected]>
2021-01-08 20:45:50 +01:00
tgueldner-mms e8e552f3ae make auditd 'max_log_file' configurable (#370)
* make auditd 'max_log_file' configurable

Signed-off-by: Thomas Gueldner <[email protected]>

* fix documentation for os_auditd_max_log_file

Signed-off-by: Thomas Gueldner <[email protected]>
2021-01-08 13:23:58 +01:00
schurzi b4ca950122 set hidepid=0 on RHEL/CentOS 7 (#369)
Signed-off-by: Martin Schurz <[email protected]>
2021-01-03 12:53:08 +01:00
schurziandSebastian Gumprich a75e2c028b change inclusion of os specific defaults (#353)
* change inclusion of os specific defaults

we now include the os specific options into a separate variable and
merge this with the default ansible namespace, when the corresponding
keys do not already exist (eg. are defined by default oder by user)

Signed-off-by: Martin Schurz <[email protected]>

* simplify check for os specific variables

Signed-off-by: Martin Schurz <[email protected]>

* add test for variable override

Signed-off-by: Martin Schurz <[email protected]>

* move tests to verify stage

Signed-off-by: Martin Schurz <[email protected]>

* correct grep

Signed-off-by: Martin Schurz <[email protected]>

* linting

Signed-off-by: Martin Schurz <[email protected]>

* fix typo

Signed-off-by: Martin Schurz <[email protected]>

* Revert "Merge pull request #351 from sprat/fix-umask"

This reverts commit 9e8e0bc8fb, reversing
changes made to 98c7553016.

Signed-off-by: Martin Schurz <[email protected]>

* move immutable ssh vars to internal vars

Signed-off-by: Martin Schurz <[email protected]>

* move vars to OS files

Signed-off-by: Martin Schurz <[email protected]>

* change default handling for all roles

Signed-off-by: Martin Schurz <[email protected]>

* fix issues

Signed-off-by: Martin Schurz <[email protected]>

* add documentation

Signed-off-by: Martin Schurz <[email protected]>

* Update main.yml

Co-authored-by: Sebastian Gumprich <[email protected]>
2020-12-20 20:46:57 +01:00
Sylvain Prat ea471b38b7 Fix #344: make the os_env_umask variable usable again
Signed-off-by: Sylvain Prat <[email protected]>
2020-12-15 21:31:51 +01:00
Sebastian Gumprich dd3959276b merge os-hardening role into collection 2020-11-07 22:09:28 +01:00