andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
203 Commits 14 Branches 64 Tags
3af185ba8d2f760bf46ef58d13ab9f7baa34ef73
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Sebastian Gumprich 3af185ba8d use new docker images 2017-01-22 16:05:45 +01:00
Sebastian Gumprich 5fc62a7f89 update changelog 2016-10-24 15:34:07 +02:00
Sebastian Gumprich 62a91011dd add comments to variables 2016-10-24 14:11:43 +02:00
Sebastian Gumprich 11c81971e1 fix deprecation warning for undefined error. #99 2016-10-07 21:28:57 +02:00
Sebastian Gumprich ef9d3d8f7f update template 2016-09-27 19:18:17 +02:00
Sebastian Gumprich 723205f8f2 add rhel7 pam_pwquality. fix #73 2016-08-10 21:47:53 +02:00
Sebastian Gumprich f7774d1503 push 3.1 2016-08-03 19:29:07 +02:00
Sebastian Gumprich 53b52bd0fa skip sysctl in docker tests 2016-07-27 13:53:12 +02:00
Sebastian Gumprich d7088cdeb6 remove thorfile, add sudo false, cleanup kitchen.yml 2016-07-26 17:59:07 +02:00
Sebastian Gumprich e436ebe66e Merge pull request #93 from conorsch/support-check-mode 
Supports --check mode
 2016-07-16 19:50:40 +02:00
Sebastian Gumprich accdeecde4 Local testing with Docker 
This PR changes the local testing method to docker by default, making
the tests significantly faster to execute.
 2016-06-28 18:32:33 +02:00
Sebastian Gumprich c5d9770f4a change name of suite 2016-06-28 18:29:56 +02:00
Sebastian Gumprich a6624db99d initial docker testing support 2016-06-28 18:29:30 +02:00
Sebastian Gumprich 371ed47878 Merge pull request #91 from conorsch/support-centos7 
Adds support for CentOS 7
 2016-06-28 18:23:42 +02:00
Sebastian Gumprich f059577d42 Merge pull request #88 from dev-sec/debian8 
debian 8 support
 2016-06-28 17:47:09 +02:00
Sebastian Gumprich cda2d58218 Merge pull request #92 from vivekagr/patch-1 
Fix a formatting issue in readme.
 2016-06-26 21:18:21 +02:00
Sebastian Gumprich 422489f5ca update meta file 2016-06-24 17:42:48 +02:00
Sebastian Gumprich 0999b7b1cf update meta file 2016-06-24 17:36:26 +02:00
Sebastian Gumprich cb54398e9c Merge pull request #89 from conorsch/permit-filemap-config-on-etc-shadow 
Permits overriding permissions on /etc/shadow
 2016-06-13 19:17:27 +02:00
Sebastian Gumprich 1c81e9f146 debian 8 support 
I implemented Debian 8 support (and removed debian 6 support, since its
EOL) as well as making it easier to locally test the role with inspec.
 2016-06-08 17:31:47 +02:00
Sebastian Gumprich b5f4bac9bd update testing method 
use default.yml in repo for testing
consolidate kitchen vars
 2016-05-22 20:06:29 +02:00
Sebastian Gumprich 7746eca682 update readme for dev-sec, make vars a table 2016-05-22 18:18:21 +02:00
Sebastian Gumprich 80e2365687 Merge pull request #85 from fitz123/ufw_manage_defaults 
Ufw manage defaults
 2016-05-22 16:38:30 +02:00
Sebastian Gumprich eaea10b3e7 Merge pull request #81 from fitz123/remove_ugly_red_errors 
replace ignore_errors to failed_when to supress ugly error warnings
 2016-05-19 20:43:16 +02:00
Sebastian Gumprich 87778593d0 Merge pull request #79 from fitz123/ansible_2.0-bare_vars_fix 
fix bare variables usage for loops
 2016-05-19 18:21:56 +02:00
Sebastian Gumprich 13ad1d2664 Merge pull request #75 from hardening-io/release 
Release 3.0.0
 2016-03-13 20:32:38 +01:00
Sebastian Gumprich 827af75e7d release 3.0.0 2016-03-13 20:30:12 +01:00
Sebastian Gumprich 2d97a0872a new release 2016-03-13 20:22:51 +01:00
Sebastian Gumprich c3e9115f75 add webhook again 2016-03-05 21:25:08 +01:00
Sebastian Gumprich ec8519e4ff remove vagrantfile in kitchen.yml 2016-03-05 21:24:15 +01:00
Sebastian Gumprich dfdf722979 add test support for ansible 1.9 and 2.0 2016-03-05 21:19:13 +01:00
Sebastian Gumprich 1b35de9644 Ansible 2.0 support 
This role was tested with Ansible 2.0
 2016-02-24 08:14:41 +01:00
Sebastian Gumprich e9eac79851 remove vars-include line 2016-02-24 08:07:58 +01:00
Sebastian Gumprich 8747be1d0d Move sysctl vars to defaults 2016-02-24 08:07:58 +01:00
Sebastian Gumprich 7d13247984 add webhook for ansible galaxy 
This way the build status is shown on ansible-galaxy.
 2016-02-24 07:54:48 +01:00
Sebastian Gumprich 5587a2343e add debian 8 support. 2016-02-24 07:39:55 +01:00
Sebastian Gumprich 42d333d278 update platforms in meta-file 
this way the match the style used by ansible galaxy.
 2016-02-24 07:39:55 +01:00
Sebastian Gumprich 66f390f7e9 Merge pull request #66 from conorsch/update-include-tags 
Updates "tags" parameters on includes in main.yml
 2016-02-01 19:04:24 +01:00
Sebastian Gumprich 4b4b58c643 make sys_uid and sys_gid configurable 2016-01-31 13:18:29 +01:00
Sebastian Gumprich 7bc186e215 remove whitespace 2016-01-29 23:04:31 +01:00
Sebastian Gumprich a960535611 remove commented task 2016-01-20 21:05:56 +01:00
Sebastian Gumprich 73a8534712 set suid-var to default=omit 
this prevents the task "remove suid/sgid bit from all binaries except in system and user whitelist"
from failing when the suid-var is not set and `os_security_suid_sgid_remove_from_unknown`
is not set either.
See: https://github.com/ansible/ansible/issues/11964
 2016-01-20 21:04:16 +01:00
Sebastian Gumprich 469aa9ce7b Merge pull request #58 from hardening-io/kitchen-inspec 
use inspec as test framework
 2016-01-04 17:35:08 +01:00
Sebastian Gumprich 3078651291 Add apt-file for debian-based systems 2016-01-02 22:19:30 +01:00
Sebastian Gumprich dd60bea3d4 Remove packages with known issues on debian/ubuntu 2016-01-02 22:19:30 +01:00
Sebastian Gumprich 0bba152a01 Expose list of packages to remove as an attribute 2016-01-02 22:19:30 +01:00
Sebastian Gumprich b5bafbf75c Change categories to tags for upcoming ansible 2.0 2015-12-29 15:08:18 +01:00
Sebastian Gumprich 13d056a0db Add SINGLE and PROMPT parameters. 2015-12-20 16:57:02 +01:00
Sebastian Gumprich d377b2bc5f Merge pull request #54 from hardening-io/chris-rock/changelog 
add changelog generator
 2015-12-06 20:44:47 +01:00
Sebastian Gumprich 1e08e56958 Add explicit role-path to kitchen.yml 
Before this PR role path was searched with regex in the docroot.
Now it's explicitly declared.

Also added two gems to gemfile for faster copying to virtualbox
 2015-11-26 23:09:30 +01:00
Sebastian Gumprich 011a18d634 Fix pam passwdqc template 2015-10-25 12:17:34 +01:00
Sebastian Gumprich 057fffa013 Change travis role path 2015-10-21 20:58:55 +02:00
Sebastian Gumprich 7eb8b4f3d3 Change directory layout. fix #48 
This change gets rid of the separate role dir
and puts everything into the root-directory, making
it possible to install the role via ansible galaxy.
 2015-10-21 20:52:46 +02:00
Sebastian Gumprich 0d511b0137 Merge pull request #45 from fitz123/pam_fix 
Fix stuck in case pam files was updated before by force update
 2015-09-30 19:51:49 +02:00
Sebastian Gumprich cd0c69e5ff Merge pull request #44 from fitz123/bug_fix 
Fix nologin shell path, passwdqc options
 2015-09-24 17:27:31 +02:00
Sebastian Gumprich cf756ada2c improved travis-tests to cover more cases 
This change adds more tests in travis to check for different variable
uses.
 2015-09-22 18:31:48 +02:00
Sebastian Gumprich aa5dc8f8cc Update kitchen-ansible, remove separate debian install 
Due to the new kitchen-ansible version it is now
possible to install ansible on all major OS's via a
ansible omnibus script which is provided by
kitchen ansible. There's no more need to separate
the debian tests.
 2015-08-30 18:57:24 +02:00
Sebastian Gumprich c49708d5a2 Merge pull request #37 from hardening-io/update-common 
update common kitchen.yml platforms (ansible), kitchen_debian.yml platforms (ansible)
 2015-08-28 18:36:08 +02:00
Sebastian Gumprich 1ff939db76 Use correct variable and change travis-test 2015-08-14 17:44:12 +00:00
Sebastian Gumprich a1a439d38e Add mode to su-binary task. Fix #38 2015-08-13 21:02:57 +00:00
Sebastian Gumprich 9befb22e13 Change oneliner if-statements to be more readable 2015-08-06 14:00:14 +00:00
Sebastian Gumprich a1425befeb Separate system-vars from editable vars. Fix #34 2015-07-27 20:47:23 +00:00
Sebastian Gumprich b3af021cd9 Create limits.d-directory if it does not exist. 
See [here](https://github.com/hardening-io/chef-os-hardening/issues/84).
 2015-07-13 18:18:13 +00:00
Sebastian Gumprich 3eacdb7a29 Add correct CONTRIB-file 
* Added the correct CONTRIBUTING.MD
* Fixed some typos
* Added Ansible information
 2015-06-26 16:48:56 +00:00
Sebastian Gumprich 30818ad67e Add Ansible Galaxy badge 2015-06-26 16:35:13 +00:00
Sebastian Gumprich 78c8690677 Delete useless file 2015-06-26 14:39:56 +00:00
Sebastian Gumprich 348fb1cc53 Change var to true to remove pkgs by default 2015-06-24 10:21:13 +00:00
Sebastian Gumprich 5e1e2513c5 Update readme, todo, changelog, vars 
* This commit updates the readme in several ways.
* It adds a todo-list and a changelog.
* It deletes unused variables
 2015-06-23 23:58:40 +02:00
Sebastian Gumprich c8d9ac84ef Add module configuration 2015-06-23 23:58:12 +02:00
Sebastian Gumprich f6cf4fcdf5 Fix another sysctl-setting due to new tests 2015-06-23 23:51:18 +02:00
Sebastian Gumprich 8ba37823f9 Fix two sysctl-settings 2015-06-23 23:51:18 +02:00
Sebastian Gumprich 88f4f17786 Added condition to suid/sgid-execution 2015-06-23 17:49:37 +00:00
Sebastian Gumprich 46b50769aa List-cleanup and follow symlinks added 
- This change alters the black- and white-listed list for
suid/sgid-management to be a proper yaml-formatted list.

- Furthermore "follow symlinks" was added to the tasks
that remove suid/sgid because otherwise the suid/sgid
from the link-targets would not be removed.
 2015-06-23 11:01:00 +00:00
Sebastian Gumprich 3a004c90dc Add meta-files for Ansible Galaxy 2015-06-22 16:02:42 +00:00
Sebastian Gumprich a345da0023 Delete authconfig-task on rhel-systems 
The authconfig-task overrides changes we later do on files, so this
task is not necessary and causes some tasks to always change files
 2015-06-19 11:51:23 +02:00
Sebastian Gumprich e4c6436163 Add missing rhosts-include task 2015-06-19 11:51:09 +02:00
Sebastian Gumprich 1005cc133a Add ignore-vars. Change nologin-shell dep. on OS 2015-06-18 18:14:08 +00:00
Sebastian Gumprich f82e7684c6 Added option to disable system accounts 2015-06-18 18:14:08 +00:00
Sebastian Gumprich 6f910c28d8 Use changed_when to avoid changed tasks 
When a shell or command task, that only fetches data, gets executed,
the task will be marked as change, even though nothing changed.
This commit changes the behaviour of tasks that only fetch data.
For more info see here:
http://docs.ansible.com/playbooks_error_handling.html#overriding-the-changed-result
 2015-06-18 13:42:29 +00:00
Sebastian Gumprich e0fa80ac14 add missing spec-directory 2015-06-17 14:58:19 +00:00
Sebastian Gumprich 531a051ef9 Skip sysctl-tasks in travis-environment 2015-06-17 12:11:59 +02:00
Sebastian Gumprich be4a3d143e another try on json-vars-file 2015-06-17 12:11:59 +02:00
Sebastian Gumprich 7b8b009291 Change to yml-format of exceptions-file 2015-06-17 12:11:59 +02:00
Sebastian Gumprich 46f933b83c Change vars again 2015-06-17 12:11:59 +02:00
Sebastian Gumprich 7b4cf48db2 Add another var 2015-06-17 12:11:59 +02:00
Sebastian Gumprich f207116292 Change execution to read vars from file 2015-06-17 12:11:59 +02:00
Sebastian Gumprich 913c2eedb8 Change net.ipv4.tcp_timestamps to not fail on travis. 2015-06-17 12:11:31 +02:00
Sebastian Gumprich d8f83d0822 Revert "Merge branch 'master' of github.com:hardening-io/ansible-os-hardening" 
This reverts commit a7e353275b, reversing
changes made to 194ea7497f.
 2015-06-10 20:31:10 +00:00
Sebastian Gumprich a7e353275b Merge branch 'master' of github.com:hardening-io/ansible-os-hardening 2015-06-10 20:05:10 +00:00
Sebastian Gumprich e70974ba16 Add os_security_kernel_enable_module_loading 2015-06-08 17:25:50 +00:00
Sebastian Gumprich 81c171a55a Change sysctl-task. Fix #18 2015-06-06 18:35:09 +00:00
Sebastian Gumprich 989e5c2f42 Disable ipv6-deactivation for travis 2015-06-03 21:44:24 +02:00
Sebastian Gumprich c8736a5655 Add travis-support 2015-06-03 21:44:24 +02:00
Sebastian Gumprich b73ceae10d Add missing condition 2015-06-01 21:47:36 +00:00
Sebastian Gumprich 7c121b7e2b Add missing condition 2015-06-01 21:46:05 +00:00
Sebastian Gumprich a4cd8dbe94 Merge branch 'suidsgid' of github.com:hardening-io/ansible-os-hardening 2015-06-01 21:45:34 +00:00
Sebastian Gumprich 255948feb3 Add conditions for various tasks. Fix #15 2015-06-01 20:33:35 +00:00
Sebastian Gumprich fb59fab08f Remove duplicate whitelist-check 2015-06-01 19:36:37 +00:00
Sebastian Gumprich c5e470c2b6 Merge pull request #14 from hardening-io/fix-playbook-path 
fix configuration of playbook path
 2015-06-01 19:06:48 +00:00
Sebastian Gumprich 544779e26a Add remove suid/sgid function 2015-06-01 14:50:22 +02:00