* Update testing and remove old, unsupported OS versions
Signed-off-by: Martin Schurz <[email protected]>
* Update Arch OS
Signed-off-by: Martin Schurz <[email protected]>
* Fix SuSE login.defs issues
Signed-off-by: Martin Schurz <[email protected]>
* Debug ...
Signed-off-by: Martin Schurz <[email protected]>
* Fix SuSE stuff
Signed-off-by: Martin Schurz <[email protected]>
* Fix SuSE stuff
Signed-off-by: Martin Schurz <[email protected]>
* Update OS Support
Signed-off-by: Martin Schurz <[email protected]>
* Use Ansible mysql module
Signed-off-by: Martin Schurz <[email protected]>
* Update OS Support
Signed-off-by: Martin Schurz <[email protected]>
* Use existing Fedora images
Signed-off-by: Martin Schurz <[email protected]>
* Fix VM tests
Signed-off-by: Martin Schurz <[email protected]>
* fix last errors
Signed-off-by: Martin Schurz <[email protected]>
* Final fixes
Signed-off-by: Martin Schurz <[email protected]>
---------
Signed-off-by: Martin Schurz <[email protected]>
Ansible can open multiple connections and it's possible for a new socket
to open before activation is fully disabled, leaving a zombie sshd
process. At least that is the guess. Ubuntu 24.04 suffers from this.
Reload the configuration after disabling socket activation to not enable
it again.
Signed-off-by: Tatu Argillander <[email protected]>
* Add support for current versions of Debian and EL
Signed-off-by: Martin Schurz <[email protected]>
* Add conditions for EL8
Signed-off-by: Martin Schurz <[email protected]>
* Fix Audit in AlmaLinux
Signed-off-by: Martin Schurz <[email protected]>
* Fix broken SSH host key config in rhel/almalinux 10
Signed-off-by: Jonathan Wright <[email protected]>
* Generate SSH Keys on EL10
Signed-off-by: Martin Schurz <[email protected]>
* Generate SSH Keys for tests via Systemd
Signed-off-by: Martin Schurz <[email protected]>
* Fixup tests
Signed-off-by: Martin Schurz <[email protected]>
* Remove auditd conditions
Signed-off-by: Martin Schurz <[email protected]>
* Add path to audit handler
Signed-off-by: Martin Schurz <[email protected]>
* Install init scripts
Signed-off-by: Martin Schurz <[email protected]>
* Update main README
---------
Signed-off-by: Martin Schurz <[email protected]>
Signed-off-by: Jonathan Wright <[email protected]>
Co-authored-by: Jonathan Wright <[email protected]>
* Provide granular noop for shh configuration
We would like to have more fine grained options on applying or not specific configurations.
This commit let the user choose to noop some configuration with a few new
boolean variables.
Motivation for theses options are we may configure ourselves some (ssh host key
regeneration in a templating system) or we are not ready for others (ssh_kex
will break dist-upgrades, letting the operator without ssh).
Signed-off-by: seven beep <[email protected]>
* Provide granula noop for ssh configuration
We would like to have more fine grained options on applying or not specific configurations.
This commit let the user choose to disable configurations for `ssh_host_key_config`,
`ssh_ciphers_config`, `ssh_host_key_config`, `ssh_macs_config` by setting them
to False.
Motivation for theses options are we may configure ourselves some (ssh host key
regeneration in a templating system) or we are not ready for others (ssh_kex
will break dist-upgrades, letting the operator without ssh).
Signed-off-by: seven beep <[email protected]>
---------
Signed-off-by: seven beep <[email protected]>
ssh_permit_tunnel needs quotes otherwise we will end up with an error:
```
TASK [devsec.hardening.ssh_hardening : Create sshd_config and set permissions to root/600] **********************************************************************************************************************
fatal: [vampdock02]: FAILED! => {"changed": false, "checksum": "fe6b74e30b1a653f83c2cbe1dd1332c14bd55833", "exit_status": 255, "msg": "failed to validate", "stderr": "/home/debian/.ansible/tmp/ansible-tmp-1728530891.493071-72386-149151737175948/source line 123: bad PermitTunnel argument True\r\n", "stderr_lines": ["/home/debian/.ansible/tmp/ansible-tmp-1728530891.493071-72386-149151737175948/source line 123: bad PermitTunnel argument True"], "stdout": "", "stdout_lines": []}
```
* disable systemd socket activation
Signed-off-by: Sebastian Gumprich <[email protected]>
* move start to after deactivation so it can start
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
* do not force type of gatewayports-var
this way it can be a bool or a string. we also now test for it
Signed-off-by: Sebastian Gumprich <[email protected]>
* replace yum with dnf
Signed-off-by: Sebastian Gumprich <[email protected]>
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
* centos7 is eol, remove it
Signed-off-by: Sebastian Gumprich <[email protected]>
* change workflow to update readmes when meta/main.yml is changed
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove mention of centos 7 from readme
Signed-off-by: Sebastian Gumprich <[email protected]>
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
Martin Schurz