andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,491 Commits 14 Branches 64 Tags
43b6402acf850ff9721cd7552f54b82eba798fa3
Commit Graph
2491 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Christoph Hartmann b069a12800 Merge pull request #36 from hardening-io/update_kitchen-ansible 
Update kitchen-ansible, remove separate debian install
 2015-08-31 07:33:51 +02:00
Christoph Hartmann b05517c1f1 Merge pull request #40 from hardening-io/update_kitchen-ansible 
Update kitchen-ansible, remove separate debian install
 2015-08-31 07:31:34 +02:00
Christoph Hartmann fd81dbf559 Merge pull request #4 from hardening-io/update_kitchen-ansible 
Update kitchen-ansible, remove separate debian install
 2015-08-31 07:31:00 +02:00
Sebastian Gumprich ae40dc6d33 Use correct package for python mysql module 2015-08-30 20:01:02 +02:00
Sebastian Gumprich 6b87da3063 Add myslq-python install to travis 2015-08-30 19:58:15 +02:00
Sebastian Gumprich 2c9b868889 Exclude tags in travis file 2015-08-30 19:55:30 +02:00
Sebastian Gumprich c540ba2fe5 Use correct ansible-playbook in travis file 2015-08-30 19:53:19 +02:00
Sebastian Gumprich 46ec321fd4 Update kitchen-ansible, remove separate debian install 
Due to the new kitchen-ansible version it is now
possible to install ansible on all major OS's via a
ansible omnibus script which is provided by
kitchen ansible. There's no more need to separate
the debian tests.
 2015-08-30 19:48:46 +02:00
Sebastian Gumprich aa5dc8f8cc Update kitchen-ansible, remove separate debian install 
Due to the new kitchen-ansible version it is now
possible to install ansible on all major OS's via a
ansible omnibus script which is provided by
kitchen ansible. There's no more need to separate
the debian tests.
 2015-08-30 18:57:24 +02:00
Sebastian Gumprich be279bdb6b Update README 
Remove the debian-part in testing.
 2015-08-30 18:54:27 +02:00
Sebastian Gumprich 7b5fa53f3a Update kitchen-ansible, remove separate debian install 
Due to the new kitchen-ansible version it is now
possible to install ansible on all major OS's via a
ansible omnibus script which is provided by
kitchen ansible. There's no more need to separate
the debian tests.

Also removed whitespace.
 2015-08-29 14:13:17 +02:00
Sebastian Gumprich c54d37b29a Merge pull request #3 from hardening-io/update-common 
update common kitchen.yml platforms (ansible), kitchen_debian.yml platforms (ansible)
 2015-08-28 18:37:50 +02:00
Sebastian Gumprich b6f22299d4 Merge pull request #32 from hardening-io/update-common 
update common kitchen.yml platforms (ansible), kitchen_debian.yml platforms (ansible)
 2015-08-28 18:37:31 +02:00
Sebastian Gumprich c49708d5a2 Merge pull request #37 from hardening-io/update-common 
update common kitchen.yml platforms (ansible), kitchen_debian.yml platforms (ansible)
 2015-08-28 18:36:08 +02:00
Sebastian Gumprich adc8462838 Revamp conditionals again 2015-08-17 15:31:45 +00:00
Sebastian Gumprich 7b934e415c Add another conditional 2015-08-17 17:16:17 +00:00
Sebastian Gumprich b17bd65870 Add more conditionals 2015-08-17 17:08:16 +00:00
Sebastian Gumprich 9560f33329 Change last task again 2015-08-17 17:04:47 +00:00
Sebastian Gumprich be38ac75f4 Add selinux-check 2015-08-16 20:37:33 +00:00
Sebastian Gumprich 1ff939db76 Use correct variable and change travis-test 2015-08-14 17:44:12 +00:00
Sebastian Gumprich a1a439d38e Add mode to su-binary task. Fix #38 2015-08-13 21:02:57 +00:00
Sebastian Gumprich c4482cb12e Support for selinux and pam. fix #23 
This change add the following:

- it checks wether selinux is in "Enforcing" mode
- when selinux is enforcing, it copies a new selinux-policy to the host
- this policy allows sshd to read the shadow-file directly, which is forbidden by selinux otherwise
- the policy is then compiled, a package is created and the policy is installed
- when selinux is enforcing, pam is used and the policy is not disabled, it gets removed,
  because its considered a security risk. see here: http://danwalsh.livejournal.com/12333.html
 2015-08-10 21:45:15 +00:00
Christoph Hartmann 90c72503bb fetch new repo data before we install anything 2015-08-09 17:43:09 -07:00
Christoph Hartmann f23b88f237 set system ruby path 2015-08-09 17:38:50 -07:00
Christoph Hartmann 5a63cafe09 update common kitchen.yml platforms (ansible), kitchen_debian.yml platforms (ansible) 
updating common files with changes that are configured in the profiles: kitchen.yml platforms (ansible), kitchen_debian.yml platforms (ansible)
 2015-08-09 17:38:50 -07:00
Christoph Hartmann fb1f395db5 update common kitchen.yml platforms (ansible), kitchen_debian.yml platforms (ansible) 
updating common files with changes that are configured in the profiles: kitchen.yml platforms (ansible), kitchen_debian.yml platforms (ansible)
 2015-08-09 17:38:50 -07:00
Christoph Hartmann 7e14a43694 Merge pull request #34 from hardening-io/separate_ssh_ports 
Separate ssh client and server ports. Fix #33
 2015-08-09 16:19:09 -07:00
Sebastian Gumprich ef8c4ada2f Separate ssh client and server ports. Fix #33 
This PR separates the ssh_ports variable into two separate
variables for the ssh-client and ssh-server.
 2015-08-09 11:16:34 +00:00
Christoph Hartmann 5d9f852ce3 update common kitchen.yml platforms (ansible), kitchen_debian.yml platforms (ansible) 
updating common files with changes that are configured in the profiles: kitchen.yml platforms (ansible), kitchen_debian.yml platforms (ansible)
 2015-08-07 01:10:35 -07:00
Christoph Hartmann e68e325943 update common kitchen.yml platforms (ansible), kitchen_debian.yml platforms (ansible) 
updating common files with changes that are configured in the profiles: kitchen.yml platforms (ansible), kitchen_debian.yml platforms (ansible)
 2015-08-07 01:10:26 -07:00
Christoph Hartmann 936f6c287a Merge branch 'master' of github.com:hardening-io/ansible-ssh-hardening into update-common 2015-08-06 23:45:24 -07:00
Christoph Hartmann 3f485a8164 update common kitchen.yml platforms (ansible), kitchen_debian.yml platforms (ansible) 
updating common files with changes that are configured in the profiles: kitchen.yml platforms (ansible), kitchen_debian.yml platforms (ansible)
 2015-08-06 23:45:17 -07:00
Christoph Hartmann 3862773e3d Merge pull request #2 from hardening-io/separate_vars 
Separate system-vars from editable vars.
 2015-08-06 23:44:47 -07:00
Christoph Hartmann 950210348f Merge pull request #31 from hardening-io/max_auth_tries 
Make MaxAuthTries configurable
 2015-08-06 23:39:14 -07:00
Christoph Hartmann 4dcf55311a Merge pull request #30 from hardening-io/if_constructs 
Change oneliner if-statements to be more readable
 2015-08-06 23:38:42 -07:00
Christoph Hartmann 914edb2aec Merge pull request #36 from hardening-io/if_constructs 
Change oneliner if-statements to be more readable
 2015-08-06 23:37:24 -07:00
Christoph Hartmann 00e652bb29 update common kitchen.yml platforms (ansible), kitchen_debian.yml platforms (ansible) 
updating common files with changes that are configured in the profiles: kitchen.yml platforms (ansible), kitchen_debian.yml platforms (ansible)
 2015-08-06 23:36:12 -07:00
Sebastian Gumprich 2bc353b7a9 Make MaxAuthTries configurable 2015-08-06 14:20:32 +00:00
Sebastian Gumprich 9befb22e13 Change oneliner if-statements to be more readable 2015-08-06 14:00:14 +00:00
Sebastian Gumprich df8b205a8f Change oneliner if-statements to be more readable 2015-08-06 13:53:33 +00:00
Christoph Hartmann 3a79dab5d8 Merge pull request #29 from ypid/make-client-pw-auth-configurable 
Make ssh client password login configurable.
 2015-08-04 09:17:45 -07:00
Robin Schneider 10f6544f3c Make ssh client password login configurable. 
Defaults to not allow which might be a bit restrictive.
 2015-08-04 15:17:50 +02:00
Christoph Hartmann ba7afdf938 Merge pull request #27 from hardening-io/template_case 
Fix join-filter, jinja-cases, intendation
 2015-07-30 02:00:19 -07:00
Sebastian Gumprich 60e898098d Fix join-filter, jinja-cases, spelling, whitespace 
- the join filter is replaced by '+'
- the if-cases for rhel-based OS'es is simplified
- intendation of complex if-cases
 2015-07-29 20:52:53 +00:00
Sebastian Gumprich bda8d52083 Merge pull request #26 from ypid/role-review 
Fixed role's join-filter, jinja-cases, spelling, whitespace
 2015-07-29 13:27:46 +00:00
Robin Schneider a2f4542a48 Short role review. Fixed role when ssh_client_weak_kex == true. 
* This role uses the Jinja2 `join` filter quite creatively, please fix this. This patch fixes one instance.
* Make full use of Jinja2 features. E.g. use `if ansible_os_family in ['Oracle Linux', 'RedHat']` for example. This patch fixes one instance.
* Fixed spelling.
* Removed whitespace.
 2015-07-28 21:21:32 +02:00
Christoph Hartmann ced954f51e Merge pull request #25 from ypid/client-server-disable 
Make it configurable to only harden ssh client/server or both (default).
 2015-07-28 12:18:35 -07:00
Robin Schneider a8f991bc07 Make it configurable to only harden ssh client/server or both (default). 2015-07-28 20:42:14 +02:00
Sebastian Gumprich a2c483ace8 Separate system-vars from editable vars. 
This change moves variables that can be changed or overridden by the user to the defaults-vars-files, where it belongs.
 2015-07-28 18:07:34 +00:00
Christoph Hartmann e0b1068e8c Merge pull request #24 from hardening-io/separate_vars 
Separate system-vars from editable vars
 2015-07-27 13:25:15 -07:00