andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,452 Commits 14 Branches 64 Tags
64713ce75de75ccea48d4d6f42d6854bb9a092e8
Commit Graph
132 Commits
Author SHA1 Message Date
fitz123 c49d519b1f sftp_enable option 2015-10-21 22:28:01 +07:00
Florian Heinle e21e62a0dc fix mysql restart not happening because of missing os specific variable 2015-10-17 18:30:56 +02:00
Florian Heinle a5d342a01a Allow whitelisted groups on ssh 
Setting ssh_allow_groups does not work when set since the corresponding if-check tests for the wrong variable
 2015-10-16 19:40:28 +02:00
fitz123 519160b8e7 remove duplicate "update pam" task 2015-10-13 15:37:45 +07:00
fitz123 78fb438a10 Fix stuck in case pam files was updated before by force update 2015-09-30 22:11:37 +07:00
fitz123 893b39181e bugfix. Now option true for PrintLastLog is available again 2015-09-28 06:24:13 +07:00
fitz123 b013986f61 Fix passwdqc default options 2015-09-24 02:51:56 +07:00
fitz123 afa3be1e6a Fix nologin shell path for Oracle and RedHat 2015-09-24 02:16:51 +07:00
fitz123 c5307b36f0 Fix nologin shell path 2015-09-24 00:56:09 +07:00
Christoph Hartmann 9a3af69485 Merge pull request #35 from hardening-io/pam_selinux 
Support for selinux and pam. fix #23
 2015-09-22 19:58:58 +02:00
Sebastian Gumprich d3e01b75d6 Change variable for hmac from server to client 
in the openssh client configuration a server variable was used.
 2015-08-31 21:10:00 +02:00
Sebastian Gumprich 7b5fa53f3a Update kitchen-ansible, remove separate debian install 
Due to the new kitchen-ansible version it is now
possible to install ansible on all major OS's via a
ansible omnibus script which is provided by
kitchen ansible. There's no more need to separate
the debian tests.

Also removed whitespace.
 2015-08-29 14:13:17 +02:00
Sebastian Gumprich adc8462838 Revamp conditionals again 2015-08-17 15:31:45 +00:00
Sebastian Gumprich 7b934e415c Add another conditional 2015-08-17 17:16:17 +00:00
Sebastian Gumprich b17bd65870 Add more conditionals 2015-08-17 17:08:16 +00:00
Sebastian Gumprich 9560f33329 Change last task again 2015-08-17 17:04:47 +00:00
Sebastian Gumprich be38ac75f4 Add selinux-check 2015-08-16 20:37:33 +00:00
Sebastian Gumprich 1ff939db76 Use correct variable and change travis-test 2015-08-14 17:44:12 +00:00
Sebastian Gumprich a1a439d38e Add mode to su-binary task. Fix #38 2015-08-13 21:02:57 +00:00
Sebastian Gumprich c4482cb12e Support for selinux and pam. fix #23 
This change add the following:

- it checks wether selinux is in "Enforcing" mode
- when selinux is enforcing, it copies a new selinux-policy to the host
- this policy allows sshd to read the shadow-file directly, which is forbidden by selinux otherwise
- the policy is then compiled, a package is created and the policy is installed
- when selinux is enforcing, pam is used and the policy is not disabled, it gets removed,
  because its considered a security risk. see here: http://danwalsh.livejournal.com/12333.html
 2015-08-10 21:45:15 +00:00
Sebastian Gumprich ef8c4ada2f Separate ssh client and server ports. Fix #33 
This PR separates the ssh_ports variable into two separate
variables for the ssh-client and ssh-server.
 2015-08-09 11:16:34 +00:00
Christoph Hartmann 950210348f Merge pull request #31 from hardening-io/max_auth_tries 
Make MaxAuthTries configurable
 2015-08-06 23:39:14 -07:00
Sebastian Gumprich 2bc353b7a9 Make MaxAuthTries configurable 2015-08-06 14:20:32 +00:00
Sebastian Gumprich 9befb22e13 Change oneliner if-statements to be more readable 2015-08-06 14:00:14 +00:00
Sebastian Gumprich df8b205a8f Change oneliner if-statements to be more readable 2015-08-06 13:53:33 +00:00
Robin Schneider 10f6544f3c Make ssh client password login configurable. 
Defaults to not allow which might be a bit restrictive.
 2015-08-04 15:17:50 +02:00
Sebastian Gumprich 60e898098d Fix join-filter, jinja-cases, spelling, whitespace 
- the join filter is replaced by '+'
- the if-cases for rhel-based OS'es is simplified
- intendation of complex if-cases
 2015-07-29 20:52:53 +00:00
Sebastian Gumprich bda8d52083 Merge pull request #26 from ypid/role-review 
Fixed role's join-filter, jinja-cases, spelling, whitespace
 2015-07-29 13:27:46 +00:00
Robin Schneider a2f4542a48 Short role review. Fixed role when ssh_client_weak_kex == true. 
* This role uses the Jinja2 `join` filter quite creatively, please fix this. This patch fixes one instance.
* Make full use of Jinja2 features. E.g. use `if ansible_os_family in ['Oracle Linux', 'RedHat']` for example. This patch fixes one instance.
* Fixed spelling.
* Removed whitespace.
 2015-07-28 21:21:32 +02:00
Robin Schneider a8f991bc07 Make it configurable to only harden ssh client/server or both (default). 2015-07-28 20:42:14 +02:00
Sebastian Gumprich a2c483ace8 Separate system-vars from editable vars. 
This change moves variables that can be changed or overridden by the user to the defaults-vars-files, where it belongs.
 2015-07-28 18:07:34 +00:00
Sebastian Gumprich 48fc334f71 Separate system-vars from editable vars 
This change moves variables that can be changed or overridden by the user to the defaults-vars-files, where it belongs.
 2015-07-27 21:04:38 +00:00
Sebastian Gumprich a1425befeb Separate system-vars from editable vars. Fix #34 2015-07-27 20:47:23 +00:00
Sebastian Gumprich daf8e4c45b Add documentation for testing, change value in vars 2015-07-18 20:57:58 +00:00
Sebastian Gumprich b3af021cd9 Create limits.d-directory if it does not exist. 
See [here](https://github.com/hardening-io/chef-os-hardening/issues/84).
 2015-07-13 18:18:13 +00:00
Sebastian Gumprich dab153eb56 INITIAL 2015-07-02 18:32:22 +00:00
Christoph Hartmann 75dbf1cae6 Merge pull request #30 from hardening-io/CL_RM_TODO 
Update readme, todo, changelog, vars
 2015-06-24 06:40:28 -07:00
Sebastian Gumprich 348fb1cc53 Change var to true to remove pkgs by default 2015-06-24 10:21:13 +00:00
Sebastian Gumprich 5e1e2513c5 Update readme, todo, changelog, vars 
* This commit updates the readme in several ways.
* It adds a todo-list and a changelog.
* It deletes unused variables
 2015-06-23 23:58:40 +02:00
Sebastian Gumprich c8d9ac84ef Add module configuration 2015-06-23 23:58:12 +02:00
Christoph Hartmann ac4754ff16 Merge pull request #29 from hardening-io/suid_fix 
List-cleanup and follow symlinks added
 2015-06-23 14:57:25 -07:00
Sebastian Gumprich f6cf4fcdf5 Fix another sysctl-setting due to new tests 2015-06-23 23:51:18 +02:00
Sebastian Gumprich 8ba37823f9 Fix two sysctl-settings 2015-06-23 23:51:18 +02:00
Sebastian Gumprich 88f4f17786 Added condition to suid/sgid-execution 2015-06-23 17:49:37 +00:00
Sebastian Gumprich 46b50769aa List-cleanup and follow symlinks added 
- This change alters the black- and white-listed list for
suid/sgid-management to be a proper yaml-formatted list.

- Furthermore "follow symlinks" was added to the tasks
that remove suid/sgid because otherwise the suid/sgid
from the link-targets would not be removed.
 2015-06-23 11:01:00 +00:00
Christoph Hartmann 10267eb509 Merge pull request #23 from hardening-io/remove_authconfig 
Delete authconfig-task on rhel-systems
 2015-06-20 02:01:39 -07:00
Sebastian Gumprich a345da0023 Delete authconfig-task on rhel-systems 
The authconfig-task overrides changes we later do on files, so this
task is not necessary and causes some tasks to always change files
 2015-06-19 11:51:23 +02:00
Sebastian Gumprich e4c6436163 Add missing rhosts-include task 2015-06-19 11:51:09 +02:00
Christoph Hartmann 71c7042163 Merge pull request #24 from hardening-io/result_override 
Use changed_when to avoid changed tasks
 2015-06-19 02:48:08 -07:00
Sebastian Gumprich 1005cc133a Add ignore-vars. Change nologin-shell dep. on OS 2015-06-18 18:14:08 +00:00