andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,707 Commits 14 Branches 64 Tags
2ba40b08918fe47e242593e9340ae03e9d01ba5d
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
schurzi 82be5db515 Merge pull request #510 from alegrey91/master 
change hidepid mount task state to mounted
 2021-11-30 10:22:24 +01:00
schurzi ad43f908df prettify nginx options (#509) 
Signed-off-by: Martin Schurz <[email protected]>
 2021-11-29 10:25:43 +01:00
schurzi cb3574ed56 Merge pull request #501 from ksaadDE/patch-3 
Updated dh_params to 4096
 2021-11-28 11:38:39 +01:00
schurzi b0393a12ce Merge pull request #470 from ksaadDE/patch-2 
Add TLSv1.3 to nginx default configuration
 2021-11-15 19:41:49 +01:00
schurzi ff939a2b4c Merge pull request #499 from darxriggs/improvement-arch-linux 
Improve testing: install packages on Arch Linux
 2021-11-07 22:21:58 +01:00
schurzi 12c1f3dd78 Merge pull request #491 from dev-sec/recreate_tests 
revive old tests with custom ssh settings
 2021-10-25 11:12:10 +02:00
schurzi c1974282b1 add old role names to tags in Galaxy (#495) 
We deprecated our roles in Ansible Galaxy the deprecation link contains
a search keyword with the role name and our new collection should be
found, if someone clicks this link.

Signed-off-by: Martin Schurz <[email protected]>
 2021-10-24 12:39:16 +02:00
schurzi 08b0fd14f4 Merge pull request #494 from dev-sec/sysctl-34 
implement sysctl-34 - link protection settings
 2021-10-24 11:21:14 +02:00
schurzi ff37289879 Merge pull request #493 from dev-sec/rndmh3ro-patch-1 
update minimum ansible version for roles
 2021-10-24 11:09:37 +02:00
schurzi 215c8042ad Merge pull request #490 from dev-sec/change_baseline_urlsa 
change baseline urls to full zip-url
 2021-10-18 21:04:05 +02:00
schurzi d7eb00f4b7 Merge pull request #475 from dev-sec/ansible_lint 
use Ansible lint in separate task
 2021-08-15 22:53:41 +02:00
schurzi 430e6c366f Merge pull request #469 from dev-sec/rndmh3ro-patch-1 
fix license in galaxy
 2021-07-23 12:04:59 +02:00
schurzi b24ee631cb fix double space 2021-07-23 12:04:45 +02:00
schurzi 5618655ce5 Merge pull request #465 from dev-sec/rndmh3ro-patch-1 
update metadata to include community.mysql deps
 2021-07-13 16:07:27 +02:00
schurzi 29e10e5c3b add tag always to os dependent vars task (#456) 
when our collection is used with tags, the os dependent variables are
not resolved. This task should run every time, so the behaviour is
correct.

Signed-off-by: Martin Schurz <[email protected]>
 2021-06-29 13:07:25 +02:00
schurzi 2597854735 Merge pull request #449 from lduesing/enable_ipv6 
Removed sysctl that tries to disable IPv6
 2021-05-24 21:12:14 +02:00
schurzi eb28ebe298 Merge pull request #448 from dev-sec/limit_labels 
limit changelog labels to role names
 2021-05-05 23:01:12 +02:00
Martin Schurz 8dbeae7b39 limit changelog labels to role names 
Signed-off-by: Martin Schurz <[email protected]>
 2021-05-05 22:53:20 +02:00
schurzi 66b0fa28e5 Merge pull request #446 from rndmh3ro/fixing 
add back labels to changelog
 2021-05-05 21:06:41 +02:00
schurzi 6e24797d2f Merge pull request #423 from dev-sec/drop_users_wo_passwords 
add new tasks to delete mysql users without passwords
 2021-04-01 22:04:59 +02:00
schurzi add303f2be Merge pull request #437 from BenjaminBoehm/bugfix/ssh-kex-sntrup-openssh8.5 
Fix ssh kex [email protected] for openssh >= 8.5
 2021-04-01 21:13:50 +02:00
schurzi fdadb78080 Merge pull request #438 from dev-sec/remove_depracted_secure-auth 
remove secure-auth param if mysql >= 8.0.3
 2021-04-01 21:07:04 +02:00
schurzi 2882a15ee1 Merge pull request #427 from dev-sec/snoopotic-fix/add_auditd_restart_handler 
add restart-auditd handler after configuration change
 2021-03-29 21:15:46 +02:00
schurzi 0f424469be Merge pull request #432 from joubbi/authtok_type 
os_auth_pam_pwquality_options: Changed type to authtok_type
 2021-03-23 22:01:40 +01:00
schurzi a45eee2204 Merge pull request #431 from joubbi/pwhistory 
Use pam_pwhistory.so instead of pam_unix.so for remembering old passwords
 2021-03-23 09:59:11 +01:00
Martin Schurz d693a8e200 also use requisite for pwhistory 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-23 08:53:49 +01:00
Martin Schurz 0ac56e4c00 Merge branch 'master' into pwhistory 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-23 08:53:23 +01:00
schurzi 5be13e878f Merge pull request #430 from joubbi/comment 
Remove comments from PAM config file, but keep it in the template
 2021-03-23 08:40:20 +01:00
schurzi 69193fe249 Merge pull request #428 from dev-sec/harden_user_home_dires 
Harden user home dirs
 2021-03-22 12:49:48 +01:00
schurzi 876cdab430 Merge pull request #429 from dev-sec/proxy 
add support for using a proxy to test with molecule
 2021-03-21 13:18:03 +01:00
schurzi a64838272c Merge pull request #418 from joubbi/documentation2 
Improve Documentation for sysctl defaults
 2021-03-16 15:49:55 +01:00
schurzi 8706246309 Merge pull request #421 from schurzi/imprel 
Improve Release Action
 2021-03-16 11:26:21 +01:00
Martin Schurz cd4925d411 checkout master between 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-16 11:07:21 +01:00
Martin Schurz d1b8e7d7a3 update paths 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-16 11:00:40 +01:00
Martin Schurz 19d5a17a99 remove second call to changelog generator 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-16 10:56:17 +01:00
schurzi 976f83e88b Merge pull request #420 from dev-sec/fqcn_docs 
remove FQCN from roles in examples
 2021-03-16 10:14:03 +01:00
schurzi 74c729404b Merge pull request #392 from dev-sec/tally 
restructure PAM handling and update for currently supported Linux distributions
 2021-03-16 00:10:36 +01:00
Martin Schurz b2dd73d27e remove unneeded tasks 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-15 23:53:40 +01:00
Martin Schurz ec9d7d2cb8 cleanup and typos 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-15 23:39:12 +01:00
Martin Schurz 5f97dffddf Merge branch 'master' into tally 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-11 19:26:37 +01:00
schurzi 0b945536e2 Merge pull request #405 from joubbi/crontab 
Ensure permissions on cron files and directories are configured
 2021-03-11 17:44:26 +01:00
Martin Schurz 75fc31b80c remove cracklib 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 19:10:45 +01:00
Martin Schurz 10841ced62 case sensitive 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 18:29:55 +01:00
Martin Schurz 335df545fb correct version 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 18:15:33 +01:00
Martin Schurz 6d2c92d4ab correct locale 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 18:14:59 +01:00
Martin Schurz 3334000b97 set locale for test 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 17:45:46 +01:00
Martin Schurz 26d84b5f84 use custom /tmp dir 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 16:46:41 +01:00
Martin Schurz 9b6f313065 move pam tests up 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 15:54:03 +01:00
Martin Schurz 23071a183c add testcases for PAM 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 15:42:13 +01:00
schurzi 8e4c22d8d9 remove FQCN from roles in examples (#404) 
Ansible does not work with FQCN and collections sepcified for including
roles. It is currently expecting to only get the role name in this
context.

Verified with Ansible 2.10.5

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-17 11:34:37 +01:00
Martin Schurz dba53718cf sssd is disabled on Amazonlinus 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-16 20:44:28 +01:00
Martin Schurz 4a5fa70507 default faillock to yes 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-16 19:31:51 +01:00
Martin Schurz 75683161a5 remove FQCN from roles in examples 
Ansible does not work with FQCN and collections sepcified for including
roles. It is currently expecting to only get the role name in this
context.

Verified with Ansible 2.10.5

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 11:26:59 +01:00
schurzi 5d55d29fe2 Merge pull request #403 from wzzrd/gssapi_client_support 
Extend GSSAPI configuration support to ssh_config
 2021-02-15 11:23:57 +01:00
Martin Schurz 64713ce75d add default for new variable 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 11:17:01 +01:00
Martin Schurz ec36bf5b9c document parameter 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 00:22:03 +01:00
Martin Schurz 08aad6e80f add documentation 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 00:13:14 +01:00
Martin Schurz 28c6bf5c66 put force on the right task 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 23:31:24 +01:00
Martin Schurz 26c73ed1c9 fix debian faillock config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 23:13:14 +01:00
Martin Schurz b9e33091e2 fix problems with auth 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 21:30:35 +01:00
Martin Schurz 7f1765c608 consolidate auth for rhel 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 17:30:02 +01:00
Martin Schurz 30f0839513 add support for rhel8 and sssd 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 12:44:20 +01:00
Martin Schurz 532917d956 remove rhel6 support from pam 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 12:14:54 +01:00
Martin Schurz 04654d0490 correct typo 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 11:19:12 +01:00
Martin Schurz aa166f43fc split debian and rhel pam config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 02:07:25 +01:00
Martin Schurz 19482c319c force create symlink 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-13 19:38:57 +01:00
Martin Schurz fc7fb4fc8a make compatible to authconfig 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-13 18:09:48 +01:00
Martin Schurz 7282187a90 Merge branch 'master' into tally 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 21:44:55 +01:00
Martin Schurz 157f4fca70 add tasks for faillock on debian 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 21:43:30 +01:00
schurzi a98876b350 update ansible-lint to version 5 (#397) 
* add ansible to requirements

Signed-off-by: Martin Schurz <[email protected]>

* trigger run

Signed-off-by: Martin Schurz <[email protected]>

* update noqa for ansible-lint 5

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 13:47:01 +01:00
schurzi 2b39258d47 Merge pull request #395 from Normo/update-galaxy-version 
fix galaxy action to update local galaxy.yml
 2021-02-10 12:56:53 +01:00
Martin Schurz 75a8aca905 fix galaxy action to update local galaxy.yml 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 12:53:02 +01:00
Martin Schurz 94b9bfc3cd add files for faillock 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 12:49:12 +01:00
Martin Schurz 3ad4fbab0e add guard for tally debian unstable 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 11:18:50 +01:00
Martin Schurz ebbf6855e8 add rhel faillock config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 10:51:16 +01:00
Martin Schurz b210df1233 re-add debian tally config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 10:51:03 +01:00
Martin Schurz a55a4d2024 remove pam_tally2 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 08:09:43 +01:00
schurzi 30f03bc124 Merge pull request #390 from dev-sec/fix_docs 
fix minimum required ansible version in docs
 2021-02-05 20:40:42 +01:00
Martin Schurz c6114278a1 fix minimum required ansible version in docs 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-05 20:39:04 +01:00
schurzi 4b0819349d use fqcn for community.crypto.openssh_keypair module (#389) 
tihis fixes a problem with Ansible 2.9 where the default openssh_keypair
is not supporting every option we need

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-05 19:44:23 +01:00
schurzi 9db01d5fbe Merge pull request #386 from dev-sec/changelog_gen_v1 
use version tag for changelog action
 2021-02-02 11:00:11 +01:00
Martin Schurz e4b0801d22 use version tag for changelog action 
Referencing actions by the short SHA will be deprecated soon

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-02 10:58:52 +01:00
schurzi 8a1064ded4 make release workflow manually runnable (#384) 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-22 13:57:20 +01:00
schurzi 6e84f53a75 run labeler workflow with higher privileges (#383) 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-22 12:34:59 +01:00
schurzi 7a560b3d38 remove issue labels from changelog (#382) 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-22 12:34:51 +01:00
schurzi 66feb7c2ad Merge pull request #380 from mpraeger/feature/host_certificates 
add Support for OpenSSH HostCertificate config option
 2021-01-22 10:43:32 +01:00
schurzi f010b9a17e Merge pull request #378 from joubbi/iwashere 
Added comment on top of templates about which role manages the file
 2021-01-20 11:42:38 +01:00
Martin Schurz 0600cdae75 add "role" to comment 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-20 11:23:40 +01:00
schurzi 16a41412bb check for correct cpu vendor in initramfs-tools (#374) 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-12 06:31:13 +01:00
schurzi d83ad9e6a9 Merge pull request #368 from dev-sec/max_startups 
reduce maximum unauthenticated ssh sessions
 2021-01-11 20:49:29 +01:00
schurzi b4ca950122 set hidepid=0 on RHEL/CentOS 7 (#369) 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-03 12:53:08 +01:00
Martin Schurz 168af7fb6f reduce maximum unauthenticated ssh sessions 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-03 00:21:26 +01:00
schurziandSebastian Gumprich a75e2c028b change inclusion of os specific defaults (#353) 
* change inclusion of os specific defaults

we now include the os specific options into a separate variable and
merge this with the default ansible namespace, when the corresponding
keys do not already exist (eg. are defined by default oder by user)

Signed-off-by: Martin Schurz <[email protected]>

* simplify check for os specific variables

Signed-off-by: Martin Schurz <[email protected]>

* add test for variable override

Signed-off-by: Martin Schurz <[email protected]>

* move tests to verify stage

Signed-off-by: Martin Schurz <[email protected]>

* correct grep

Signed-off-by: Martin Schurz <[email protected]>

* linting

Signed-off-by: Martin Schurz <[email protected]>

* fix typo

Signed-off-by: Martin Schurz <[email protected]>

* Revert "Merge pull request #351 from sprat/fix-umask"

This reverts commit 9e8e0bc8fb, reversing
changes made to 98c7553016.

Signed-off-by: Martin Schurz <[email protected]>

* move immutable ssh vars to internal vars

Signed-off-by: Martin Schurz <[email protected]>

* move vars to OS files

Signed-off-by: Martin Schurz <[email protected]>

* change default handling for all roles

Signed-off-by: Martin Schurz <[email protected]>

* fix issues

Signed-off-by: Martin Schurz <[email protected]>

* add documentation

Signed-off-by: Martin Schurz <[email protected]>

* Update main.yml

Co-authored-by: Sebastian Gumprich <[email protected]>
 2020-12-20 20:46:57 +01:00
schurzi 9e8e0bc8fb Merge pull request #351 from sprat/fix-umask 
make the os_env_umask variable usable
 2020-12-16 10:39:11 +01:00
schurzi 257504f156 add SuSE support (#328) 
Signed-off-by: Martin Schurz <[email protected]>
 2020-10-15 08:27:23 +02:00
schurziandSebastian Gumprich c954b8af8f Improve Documentation (#315) 
* improve formatting

Signed-off-by: Martin Schurz <[email protected]>

* add limitation for vm.mmap_rnd_bits to documentation

Signed-off-by: Martin Schurz <[email protected]>

* Apply suggestions from code review

Co-authored-by: Sebastian Gumprich <[email protected]>
Signed-off-by: Martin Schurz <[email protected]>

Co-authored-by: Sebastian Gumprich <[email protected]>
 2020-10-02 20:48:18 +02:00
schurzi 9394688158 use touch for 10.hardcore.conf to avoid problems with dry-run (#314) 
Signed-off-by: Martin Schurz <[email protected]>
 2020-10-02 20:43:35 +02:00
schurzi e266decde8 use ansible dhparam module (#32) 
* use ansible dhparam module
 2020-08-28 12:35:52 +02:00
schurzi 57f7a15b51 imove chmod to end because of generated files (#31) 
Signed-off-by: Martin Schurz <[email protected]>
 2020-08-24 11:22:33 +02:00
schurzi 3028b5ddc7 fix linting issues (#30) 
* fix linting issues

Signed-off-by: Martin Schurz <[email protected]>

* set file permissions

Signed-off-by: Martin Schurz <[email protected]>
 2020-08-24 10:45:13 +02:00