andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
262 Commits 14 Branches 64 Tags
49d380f00c12fd8b354a2c07d57add8b84be52e0
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Sebastian Gumprich 31d7dbeef4 move variable to right file 2017-08-07 22:12:48 +02:00
Sebastian Gumprich fde065d31b rebasing 2017-08-07 21:57:46 +02:00
Sebastian Gumprich 8f7c7ba84c install modprobe package, 
check for modprobe

use apt and yum instead of package

Revert "use apt and yum instead of package"

This reverts commit 215a97b1867a7a8af5e0e64e9f77181d4c4a5050.

use latest to install kmod

run apt-get update
 2017-08-07 21:56:08 +02:00
Sebastian Gumprich db517e9539 change vars file loading 2017-08-07 21:55:30 +02:00
Sebastian Gumprich e879831819 add passwd vars 2017-08-07 21:55:30 +02:00
Sebastian Gumprich 41feffdc17 add kitchen to os_ignore_user to fix #124 2017-08-07 21:53:56 +02:00
Sebastian Gumprich ef1c718ba7 remove execshield on rhel7 2017-08-07 21:53:56 +02:00
Sebastian Gumprich de6653d9bb add shadow task 2017-08-07 21:53:37 +02:00
Sebastian Gumprich 1303e0c7fe change vars file loading 2017-08-07 21:27:20 +02:00
Sebastian Gumprich 62d20e299f install modprobe package, 
check for modprobe

use apt and yum instead of package

Revert "use apt and yum instead of package"

This reverts commit 215a97b1867a7a8af5e0e64e9f77181d4c4a5050.

use latest to install kmod

run apt-get update
 2017-08-07 14:56:42 +02:00
Sebastian Gumprich 77fae2a742 add passwd vars 2017-08-06 21:37:26 +02:00
Sebastian Gumprich 3d59e80910 Merge branch 'master' of github.com:dev-sec/ansible-os-hardening into passwd 2017-08-06 20:39:52 +02:00
Sebastian Gumprich 846e0c23b3 add kitchen to os_ignore_user to fix #124 2017-08-06 15:43:55 +02:00
Sebastian Gumprich b737463b95 remove execshield on rhel7 2017-08-06 14:56:08 +02:00
Sebastian Gumprich a957fb6245 style update 2017-08-04 22:23:12 +02:00
Sebastian Gumprich 9c77f82899 new task for delete netrc files 2017-08-04 21:55:59 +02:00
Sebastian Gumprich 0466917aaf add shadow task 2017-08-04 21:51:16 +02:00
Sebastian Gumprich bb85a92ff0 remove prelink, package-09 2017-08-04 21:45:33 +02:00
Sebastian Gumprich e0e2b2a601 remove omit param in default() 2017-06-06 16:39:13 +02:00
Sebastian Gumprich 5c48c74f79 add more sysctl settings, allow overwriting 2017-05-07 15:12:31 +02:00
Sebastian Gumprich 83557bb057 update package 2017-04-22 20:50:29 +02:00
Sebastian Gumprich 0ab4db4228 omit empty variables 
omit empty variables when in check-mode or when set_fact is skipped.

Fix #105
 2017-03-01 21:17:41 +01:00
Sebastian Gumprich 334e203f8b install initramfs-tools 
These are not installed by default on debian 8 but needed for module generation.

see: https://github.com/dev-sec/ansible-os-hardening/issues/111
 2017-03-01 21:17:23 +01:00
Sebastian Gumprich 1d48b0d10a change shadow owner in debian systems 2017-03-01 20:58:19 +01:00
Sebastian Gumprich dfc505634b update min ansible version 2017-02-28 21:34:35 +01:00
Sebastian Gumprich 3af185ba8d use new docker images 2017-01-22 16:05:45 +01:00
Sebastian Gumprich 5fc62a7f89 update changelog 2016-10-24 15:34:07 +02:00
Sebastian Gumprich 62a91011dd add comments to variables 2016-10-24 14:11:43 +02:00
Sebastian Gumprich 11c81971e1 fix deprecation warning for undefined error. #99 2016-10-07 21:28:57 +02:00
Sebastian Gumprich ef9d3d8f7f update template 2016-09-27 19:18:17 +02:00
Sebastian Gumprich 723205f8f2 add rhel7 pam_pwquality. fix #73 2016-08-10 21:47:53 +02:00
Sebastian Gumprich f7774d1503 push 3.1 2016-08-03 19:29:07 +02:00
Sebastian Gumprich 53b52bd0fa skip sysctl in docker tests 2016-07-27 13:53:12 +02:00
Sebastian Gumprich d7088cdeb6 remove thorfile, add sudo false, cleanup kitchen.yml 2016-07-26 17:59:07 +02:00
Sebastian Gumprich e436ebe66e Merge pull request #93 from conorsch/support-check-mode 
Supports --check mode
 2016-07-16 19:50:40 +02:00
Sebastian Gumprich accdeecde4 Local testing with Docker 
This PR changes the local testing method to docker by default, making
the tests significantly faster to execute.
 2016-06-28 18:32:33 +02:00
Sebastian Gumprich c5d9770f4a change name of suite 2016-06-28 18:29:56 +02:00
Sebastian Gumprich a6624db99d initial docker testing support 2016-06-28 18:29:30 +02:00
Sebastian Gumprich 371ed47878 Merge pull request #91 from conorsch/support-centos7 
Adds support for CentOS 7
 2016-06-28 18:23:42 +02:00
Sebastian Gumprich f059577d42 Merge pull request #88 from dev-sec/debian8 
debian 8 support
 2016-06-28 17:47:09 +02:00
Sebastian Gumprich cda2d58218 Merge pull request #92 from vivekagr/patch-1 
Fix a formatting issue in readme.
 2016-06-26 21:18:21 +02:00
Sebastian Gumprich 422489f5ca update meta file 2016-06-24 17:42:48 +02:00
Sebastian Gumprich 0999b7b1cf update meta file 2016-06-24 17:36:26 +02:00
Sebastian Gumprich cb54398e9c Merge pull request #89 from conorsch/permit-filemap-config-on-etc-shadow 
Permits overriding permissions on /etc/shadow
 2016-06-13 19:17:27 +02:00
Sebastian Gumprich 1c81e9f146 debian 8 support 
I implemented Debian 8 support (and removed debian 6 support, since its
EOL) as well as making it easier to locally test the role with inspec.
 2016-06-08 17:31:47 +02:00
Sebastian Gumprich b5f4bac9bd update testing method 
use default.yml in repo for testing
consolidate kitchen vars
 2016-05-22 20:06:29 +02:00
Sebastian Gumprich 7746eca682 update readme for dev-sec, make vars a table 2016-05-22 18:18:21 +02:00
Sebastian Gumprich 80e2365687 Merge pull request #85 from fitz123/ufw_manage_defaults 
Ufw manage defaults
 2016-05-22 16:38:30 +02:00
Sebastian Gumprich eaea10b3e7 Merge pull request #81 from fitz123/remove_ugly_red_errors 
replace ignore_errors to failed_when to supress ugly error warnings
 2016-05-19 20:43:16 +02:00
Sebastian Gumprich 87778593d0 Merge pull request #79 from fitz123/ansible_2.0-bare_vars_fix 
fix bare variables usage for loops
 2016-05-19 18:21:56 +02:00
Sebastian Gumprich 13ad1d2664 Merge pull request #75 from hardening-io/release 
Release 3.0.0
 2016-03-13 20:32:38 +01:00
Sebastian Gumprich 827af75e7d release 3.0.0 2016-03-13 20:30:12 +01:00
Sebastian Gumprich 2d97a0872a new release 2016-03-13 20:22:51 +01:00
Sebastian Gumprich c3e9115f75 add webhook again 2016-03-05 21:25:08 +01:00
Sebastian Gumprich ec8519e4ff remove vagrantfile in kitchen.yml 2016-03-05 21:24:15 +01:00
Sebastian Gumprich dfdf722979 add test support for ansible 1.9 and 2.0 2016-03-05 21:19:13 +01:00
Sebastian Gumprich 1b35de9644 Ansible 2.0 support 
This role was tested with Ansible 2.0
 2016-02-24 08:14:41 +01:00
Sebastian Gumprich e9eac79851 remove vars-include line 2016-02-24 08:07:58 +01:00
Sebastian Gumprich 8747be1d0d Move sysctl vars to defaults 2016-02-24 08:07:58 +01:00
Sebastian Gumprich 7d13247984 add webhook for ansible galaxy 
This way the build status is shown on ansible-galaxy.
 2016-02-24 07:54:48 +01:00
Sebastian Gumprich 5587a2343e add debian 8 support. 2016-02-24 07:39:55 +01:00
Sebastian Gumprich 42d333d278 update platforms in meta-file 
this way the match the style used by ansible galaxy.
 2016-02-24 07:39:55 +01:00
Sebastian Gumprich 66f390f7e9 Merge pull request #66 from conorsch/update-include-tags 
Updates "tags" parameters on includes in main.yml
 2016-02-01 19:04:24 +01:00
Sebastian Gumprich 4b4b58c643 make sys_uid and sys_gid configurable 2016-01-31 13:18:29 +01:00
Sebastian Gumprich 7bc186e215 remove whitespace 2016-01-29 23:04:31 +01:00
Sebastian Gumprich a960535611 remove commented task 2016-01-20 21:05:56 +01:00
Sebastian Gumprich 73a8534712 set suid-var to default=omit 
this prevents the task "remove suid/sgid bit from all binaries except in system and user whitelist"
from failing when the suid-var is not set and `os_security_suid_sgid_remove_from_unknown`
is not set either.
See: https://github.com/ansible/ansible/issues/11964
 2016-01-20 21:04:16 +01:00
Sebastian Gumprich 469aa9ce7b Merge pull request #58 from hardening-io/kitchen-inspec 
use inspec as test framework
 2016-01-04 17:35:08 +01:00
Sebastian Gumprich 3078651291 Add apt-file for debian-based systems 2016-01-02 22:19:30 +01:00
Sebastian Gumprich dd60bea3d4 Remove packages with known issues on debian/ubuntu 2016-01-02 22:19:30 +01:00
Sebastian Gumprich 0bba152a01 Expose list of packages to remove as an attribute 2016-01-02 22:19:30 +01:00
Sebastian Gumprich b5bafbf75c Change categories to tags for upcoming ansible 2.0 2015-12-29 15:08:18 +01:00
Sebastian Gumprich 13d056a0db Add SINGLE and PROMPT parameters. 2015-12-20 16:57:02 +01:00
Sebastian Gumprich d377b2bc5f Merge pull request #54 from hardening-io/chris-rock/changelog 
add changelog generator
 2015-12-06 20:44:47 +01:00
Sebastian Gumprich 1e08e56958 Add explicit role-path to kitchen.yml 
Before this PR role path was searched with regex in the docroot.
Now it's explicitly declared.

Also added two gems to gemfile for faster copying to virtualbox
 2015-11-26 23:09:30 +01:00
Sebastian Gumprich 011a18d634 Fix pam passwdqc template 2015-10-25 12:17:34 +01:00
Sebastian Gumprich 057fffa013 Change travis role path 2015-10-21 20:58:55 +02:00
Sebastian Gumprich 7eb8b4f3d3 Change directory layout. fix #48 
This change gets rid of the separate role dir
and puts everything into the root-directory, making
it possible to install the role via ansible galaxy.
 2015-10-21 20:52:46 +02:00
Sebastian Gumprich 0d511b0137 Merge pull request #45 from fitz123/pam_fix 
Fix stuck in case pam files was updated before by force update
 2015-09-30 19:51:49 +02:00
Sebastian Gumprich cd0c69e5ff Merge pull request #44 from fitz123/bug_fix 
Fix nologin shell path, passwdqc options
 2015-09-24 17:27:31 +02:00
Sebastian Gumprich cf756ada2c improved travis-tests to cover more cases 
This change adds more tests in travis to check for different variable
uses.
 2015-09-22 18:31:48 +02:00
Sebastian Gumprich aa5dc8f8cc Update kitchen-ansible, remove separate debian install 
Due to the new kitchen-ansible version it is now
possible to install ansible on all major OS's via a
ansible omnibus script which is provided by
kitchen ansible. There's no more need to separate
the debian tests.
 2015-08-30 18:57:24 +02:00
Sebastian Gumprich c49708d5a2 Merge pull request #37 from hardening-io/update-common 
update common kitchen.yml platforms (ansible), kitchen_debian.yml platforms (ansible)
 2015-08-28 18:36:08 +02:00
Sebastian Gumprich 1ff939db76 Use correct variable and change travis-test 2015-08-14 17:44:12 +00:00
Sebastian Gumprich a1a439d38e Add mode to su-binary task. Fix #38 2015-08-13 21:02:57 +00:00
Sebastian Gumprich 9befb22e13 Change oneliner if-statements to be more readable 2015-08-06 14:00:14 +00:00
Sebastian Gumprich a1425befeb Separate system-vars from editable vars. Fix #34 2015-07-27 20:47:23 +00:00
Sebastian Gumprich b3af021cd9 Create limits.d-directory if it does not exist. 
See [here](https://github.com/hardening-io/chef-os-hardening/issues/84).
 2015-07-13 18:18:13 +00:00
Sebastian Gumprich 3eacdb7a29 Add correct CONTRIB-file 
* Added the correct CONTRIBUTING.MD
* Fixed some typos
* Added Ansible information
 2015-06-26 16:48:56 +00:00
Sebastian Gumprich 30818ad67e Add Ansible Galaxy badge 2015-06-26 16:35:13 +00:00
Sebastian Gumprich 78c8690677 Delete useless file 2015-06-26 14:39:56 +00:00
Sebastian Gumprich 348fb1cc53 Change var to true to remove pkgs by default 2015-06-24 10:21:13 +00:00
Sebastian Gumprich 5e1e2513c5 Update readme, todo, changelog, vars 
* This commit updates the readme in several ways.
* It adds a todo-list and a changelog.
* It deletes unused variables
 2015-06-23 23:58:40 +02:00
Sebastian Gumprich c8d9ac84ef Add module configuration 2015-06-23 23:58:12 +02:00
Sebastian Gumprich f6cf4fcdf5 Fix another sysctl-setting due to new tests 2015-06-23 23:51:18 +02:00
Sebastian Gumprich 8ba37823f9 Fix two sysctl-settings 2015-06-23 23:51:18 +02:00
Sebastian Gumprich 88f4f17786 Added condition to suid/sgid-execution 2015-06-23 17:49:37 +00:00
Sebastian Gumprich 46b50769aa List-cleanup and follow symlinks added 
- This change alters the black- and white-listed list for
suid/sgid-management to be a proper yaml-formatted list.

- Furthermore "follow symlinks" was added to the tasks
that remove suid/sgid because otherwise the suid/sgid
from the link-targets would not be removed.
 2015-06-23 11:01:00 +00:00
Sebastian Gumprich 3a004c90dc Add meta-files for Ansible Galaxy 2015-06-22 16:02:42 +00:00
Sebastian Gumprich a345da0023 Delete authconfig-task on rhel-systems 
The authconfig-task overrides changes we later do on files, so this
task is not necessary and causes some tasks to always change files
 2015-06-19 11:51:23 +02:00