andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,182 Commits 14 Branches 64 Tags
4cb67edbe5a523d7e38f1824a828f05a04645b36
Commit Graph
96 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
schurzi 4f66ec4c26 Merge pull request #760 from siemens/ci/permissions 
ci: define permissions for enforce-labels workflow
 2024-05-09 12:31:28 +02:00
schurzi 02ad7664ea Merge pull request #744 from dev-sec/fix_openbsd 
Always update Vagrant Boxes before using
 2024-02-05 10:05:06 +01:00
Martin Schurz b0dff13204 add comment 
Signed-off-by: Martin Schurz <[email protected]>
 2024-02-05 10:04:51 +01:00
Martin Schurz bb9358e2fb free space on /boot 
Signed-off-by: Martin Schurz <[email protected]>
 2024-02-05 07:20:27 +01:00
Martin Schurz 3ba52e59e2 remove update tasks, since we use updated images 
Signed-off-by: Martin Schurz <[email protected]>
 2024-02-05 01:19:34 +01:00
Martin Schurz e54c541d3b add more excluded packages 
Signed-off-by: Martin Schurz <[email protected]>
 2024-02-04 23:34:53 +01:00
Martin Schurz a0abefbc29 use loop for package names 
Signed-off-by: Martin Schurz <[email protected]>
 2024-02-04 21:50:41 +01:00
Martin Schurz 898bf73178 Block kernel update 
Signed-off-by: Martin Schurz <[email protected]>
 2024-02-04 20:41:51 +01:00
Martin Schurz 4a25f72076 Skip update if box is not present 
Signed-off-by: Martin Schurz <[email protected]>
 2024-02-04 16:11:28 +01:00
Martin Schurz 7a76975d01 Skip update if box is not present 
Signed-off-by: Martin Schurz <[email protected]>
 2024-02-04 15:55:31 +01:00
Martin Schurz 063f3190b8 Always update Vagrant Boxes before using 
Signed-off-by: Martin Schurz <[email protected]>
 2024-02-04 15:42:09 +01:00
Martin Schurz 4c4721c32f Use Python3 for OpenBSD tests 
Signed-off-by: Martin Schurz <[email protected]>
 2024-02-04 14:26:42 +01:00
schurzi 9865223b8f Merge pull request #743 from dev-sec/docker_rm 
Remove Docker containers on self-hosted runner after tests
 2024-02-04 11:42:15 +01:00
Martin Schurz 11cf72b7e2 Remove Docker containers on self-hosted runner after tests 
Signed-off-by: Martin Schurz <[email protected]>
 2024-02-04 10:54:22 +01:00
schurzi 94a49a4916 Merge pull request #739 from dev-sec/restruct_vars 
restructure readme to move known problems up top
 2024-01-15 14:51:08 +01:00
schurzi e7bad430f2 Merge pull request #733 from dev-sec/renovate/actions-setup-python-5.x 
Update actions/setup-python action to v5
 2023-12-10 11:10:36 +01:00
schurzi d93c7401cf Merge pull request #728 from dev-sec/renovate/ansible-core-2.x 
Update dependency ansible-core to v2.16.1
 2023-12-09 21:25:04 +01:00
Martin Schurz d8c9ac71ec fix assertion 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-09 19:14:41 +01:00
schurzi b9a0e65e19 Merge pull request #730 from dev-sec/labeler5 
update labeler to new config format
 2023-12-07 09:32:28 +01:00
schurzi e37f01df26 Merge pull request #732 from dev-sec/lintall 
Update ansible-lint action and revise configuration to scan all Ansible code
 2023-12-07 09:32:12 +01:00
Martin Schurz 1f0d2d5b73 add noconfirm 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-06 21:29:02 +01:00
Martin Schurz 5843b03449 add prepare for archlinux 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-06 20:29:43 +01:00
Martin Schurz bf51b96a0b add prepare for archlinux 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-06 20:21:49 +01:00
Martin Schurz 4bc5725836 hold grub updates in vm 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-06 17:51:39 +01:00
Martin Schurz 62340c79c6 re-add mysql config directory because it is needed by some os 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-06 16:33:31 +01:00
Martin Schurz bc8b5f60f4 remove mysql config directory creation 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-06 16:08:31 +01:00
Martin Schurz dff224f4c4 correct typo 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-06 15:57:08 +01:00
Martin Schurz 422fb940a9 manually fix remaining problems 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-06 15:27:21 +01:00
Martin Schurz 7e33ea0bae use ansible-lint to autofix problems 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-06 14:37:09 +01:00
Martin Schurz 5381a23a4a fix paste error 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-06 11:38:49 +01:00
Martin Schurz e00716df62 fix lint findings 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-06 11:36:08 +01:00
Martin Schurz 6ce8b68650 adjust exclude paths 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-06 11:11:21 +01:00
Martin Schurz f4500457fa extend action triggers 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-06 11:09:24 +01:00
Martin Schurz 2bbfe2dd6b exclude waiver files 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-06 11:07:43 +01:00
Martin Schurz db437c79f5 extend action triggers 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-06 11:00:22 +01:00
Martin Schurz 099145c9b3 remove excludes 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-06 10:58:26 +01:00
Martin Schurz 9862676ecf use new ansible-lint action 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-06 10:57:45 +01:00
Martin Schurz 6ef52a125d use base branch 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-05 21:46:15 +01:00
Martin Schurz bde286fe47 update config 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-05 21:42:01 +01:00
Martin Schurz a58fc24301 use correct tag 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-05 21:38:36 +01:00
Martin Schurz 12240fea63 test labler 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-05 21:37:36 +01:00
Martin Schurz 82a0188b8c update labeler to new config format 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-05 21:31:37 +01:00
schurzi 508b993570 Merge pull request #722 from dev-sec/arch_audit 
support restarts of audit service on Arch linux
 2023-11-24 13:36:18 +01:00
Martin Schurz 54f9ef42a1 don't try to restart audit in check mode 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-22 00:45:38 +01:00
Martin Schurz 25acb76c05 reload systemd after installation 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-21 23:59:22 +01:00
Martin Schurz 0f6b8e4a3a use full service name for handler 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-21 23:04:41 +01:00
Martin Schurz 571cec1a5c re-add vm tests 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-21 22:12:50 +01:00
Martin Schurz 20dd04c9cb split notify, add tmp options for arch 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-21 21:58:58 +01:00
Martin Schurz 60d10811d4 add separate handlers for audit restart 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-21 21:45:05 +01:00
Martin Schurz 84c43c0550 limit tests to some distros 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-21 21:27:23 +01:00
schurzi f9a1cab023 Merge pull request #721 from dev-sec/python_version 
pin Ansible to always let Renovate update to the most current version in our tests
 2023-11-21 16:38:21 +01:00
Martin Schurz f15ff3fc83 remove unneeded mysql vars 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-21 16:37:50 +01:00
Martin Schurz aae720c977 update python version for all tests 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-21 12:23:49 +01:00
Martin Schurz c3b9245900 fix for mysql role 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-21 12:22:47 +01:00
Martin Schurz 5c5f2ce446 remove the base ansible package 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-21 12:22:47 +01:00
Martin Schurz 7b32deca17 pin the right ansible package 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-21 12:22:47 +01:00
Martin Schurz e2c2d0d5e2 pin Ansible version 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-21 12:22:47 +01:00
Martin Schurz addbbd32cf run tests on update of dependencied 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-21 12:22:47 +01:00
Martin Schurz 01cc9c811f update python versions for testing 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-21 12:22:47 +01:00
schurzi e98d766c6c Merge pull request #718 from akikanellis/fix-disabling-filesystems-idempotency 
Restore idempotency for disabling unused filesystems with Ansible 2.16.0
 2023-11-21 12:20:42 +01:00
Martin Schurz adda83572a fix mixup, add custom test badge 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-16 12:10:41 +01:00
Martin Schurz 01bde49fbc update badges 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-16 11:30:38 +01:00
schurzi 3d98cbf67b add testing and support for current versions of Fedora and FreeBSD (#709) 
* add testing and support for current versions of Fedora and FreeBSD

Signed-off-by: Martin Schurz <[email protected]>

* add waivers for FreeBSD

Signed-off-by: Martin Schurz <[email protected]>

* use original fedora images

Signed-off-by: Martin Schurz <[email protected]>

* also harden /home mount

Signed-off-by: Martin Schurz <[email protected]>

* also harden /tmp mount

Signed-off-by: Martin Schurz <[email protected]>

* test mock efi directory

Signed-off-by: Martin Schurz <[email protected]>

* remove mock

Signed-off-by: Martin Schurz <[email protected]>

* umount efi

Signed-off-by: Martin Schurz <[email protected]>

* add /tmp to special mountpoints

Signed-off-by: Martin Schurz <[email protected]>

* set options for /tmp mount

Signed-off-by: Martin Schurz <[email protected]>

* create /tmp mount

Signed-off-by: Martin Schurz <[email protected]>

* create /tmp mount and mount it ...

Signed-off-by: Martin Schurz <[email protected]>

* make fewer changes to default test run

Signed-off-by: Martin Schurz <[email protected]>

* use correct Ansible var

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>
 2023-11-16 09:14:03 +01:00
schurzi 15f2de8b44 fix os ci (#711) 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-12 20:45:30 +01:00
schurzi 57d2d524b3 add temporary fix for nginx ci tests (#710) 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-12 12:41:15 +01:00
Martin Schurz 655cb49630 add note to temporary fix 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-12 10:00:33 +01:00
Martin Schurz 3c73f8ab1d use release version of inspec profile again 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:47:00 +01:00
Martin Schurz 8e97184d5e test wirth modified inspec profile 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:39:20 +01:00
Martin Schurz 7437f68c86 onece more ... 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:37:26 +01:00
Martin Schurz bf177add07 one last time ... 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:37:26 +01:00
Martin Schurz fb22b242fe better compare for utf8 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:37:25 +01:00
Martin Schurz 0c8c96a535 collate for opensuse 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:37:25 +01:00
Martin Schurz 99784726f8 drop role after test for inspec 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:37:25 +01:00
Martin Schurz 2f5360225b extend role check 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:37:25 +01:00
Martin Schurz fdf7bbd7be correct hostname in test 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:37:25 +01:00
Martin Schurz ee1fec3d3e correct indentation 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:37:25 +01:00
Martin Schurz 35df355248 add tests for roles 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:37:25 +01:00
Martin Schurz ec8811acdf use like to coerce collation 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:37:25 +01:00
Martin Schurz 6681e0b319 correct query 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:37:25 +01:00
Martin Schurz 79dc1d5474 check mode for status var 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:37:25 +01:00
Martin Schurz 219ec1938b try symlink fix 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:37:25 +01:00
Martin Schurz 336861838a try local path 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:37:25 +01:00
Martin Schurz b07ac77223 test removing requirements 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:37:25 +01:00
Martin Schurz 665edd5157 re-add working directories 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:37:25 +01:00
Martin Schurz 8f516018b6 trigger workflow 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:37:25 +01:00
Martin Schurz 4756a620f2 reduce dir dependencies 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:37:02 +01:00
Martin Schurz c59a4d4e48 fix role path 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:36:26 +01:00
Martin Schurz 216b56f468 lint 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:36:26 +01:00
Martin Schurz 36715017d7 use separate task for role detection 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-11 15:36:26 +01:00
schurzi da017fa880 Gather facts when os_hardening role is executed with tags (#708) 
* Gather facts when os_hardening role is executed with tags

Signed-off-by: Martin Schurz <[email protected]>

* better when condition

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>
 2023-11-01 15:54:52 +01:00
schurzi 90ca33466e Merge pull request #696 from dev-sec/renovate/actions-checkout-4.x 
chore(deps): update actions/checkout action to v4
 2023-10-20 10:33:08 +02:00
schurzi 9c2f12561a update links to new Ansible Galaxy (#702) 
* update links to new Ansible Galaxy

Signed-off-by: Martin Schurz <[email protected]>

* remove dead link

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>
 2023-10-16 20:56:13 +02:00
schurzi dae8487ab3 Merge pull request #700 from nejch/chore/template-typo 
Fix typo in login.defs.j2
 2023-10-08 21:04:58 +02:00
schurzi ed5aefad3e Merge pull request #667 from dev-sec/molecule_update 
use new molecule-plugins
 2023-04-28 14:05:46 +02:00
schurzi 1cce7bca9a Merge pull request #662 from dev-sec/codespell 
add spellchecking with codespell
 2023-04-17 09:47:53 +02:00
schurzi 4a21ec0234 Merge pull request #656 from dev-sec/update_Tests 
Update test environment
 2023-04-12 22:21:49 +02:00