andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,846 Commits 14 Branches 64 Tags
681898bd969c38710cf6cc6be92843fdb7a862f5
Commit Graph
1846 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dennis Eriksen 681898bd96 OpenBSD does not support GSSAPIAuthentication 
... and freaks out when it is mentioned in the config files. So let's
just remove the GSSAPI-stuff.

Signed-off-by: Dennis Eriksen <[email protected]>
 2022-11-08 09:12:18 +01:00
dev-sec CI e32d550e9b update changelog 2022-11-04 11:03:08 +00:00
Dennis Eriksen 4df95e3733 OpenBSD does not set distributiuon_major_version (#597) 
This role fails with `The task includes an option with an undefined variable` on OpenBSD because `distributiuon_major_version` is not set on OpenBSD.

We should either default to "" if the variable is not set, or remove `vars/OpenBSD.yml`. I would prefer the former :)

Signed-off-by: Dennis Eriksen <[email protected]>

Signed-off-by: Dennis Eriksen <[email protected]>
 2022-11-04 12:00:55 +01:00
dev-sec CI 05205eb413 update changelog 2022-11-01 17:13:21 +00:00
schurzi d0407b17c4 Merge pull request #596 from dev-sec/templates 
add Ansible specific templates for issues
 2022-11-01 18:10:59 +01:00
Martin Schurz 1346e37e14 actually add templates ... 
Signed-off-by: Martin Schurz <[email protected]>
 2022-10-28 10:26:00 +02:00
dev-sec CI c2ee3105c7 update changelog 2022-10-28 05:16:41 +00:00
schurzi 613fbd82da use github templates for new issues (#595) 
Signed-off-by: Martin Schurz <[email protected]>

Signed-off-by: Martin Schurz <[email protected]>
 2022-10-28 07:14:58 +02:00
dev-sec CI 9530615d5f update galaxy.yml with new version 2022-10-27 18:48:57 +00:00
dev-sec CI 24d0153815 update changelog 2022-10-27 18:46:03 +00:00
schurzi 99fe8b6969 Merge pull request #594 from dlouzan/fix/type-cast-variables 
fix(os_hardening): cast expected int types in pam tasks
8.3.0 		2022-10-27 20:43:17 +02:00
Martin Schurz f496b385dd use github templates for new issues 
Signed-off-by: Martin Schurz <[email protected]>
 2022-10-27 20:41:06 +02:00
Diego Louzán f8295d5248 fix(os_hardening): cast expected int types in pam tasks 
Signed-off-by: Diego Louzán <[email protected]>
 2022-10-27 16:50:08 +02:00
dev-sec CI a1f75f877b update changelog 2022-10-26 08:33:13 +00:00
schurzi 901923bac2 Merge pull request #588 from dev-sec/support_more_os 
Support more os
 2022-10-26 10:13:40 +02:00
Martin Schurz c30ef42355 exclude el9 from vm tests 
Signed-off-by: Martin Schurz <[email protected]>
 2022-10-25 18:59:11 +02:00
Sebastian Gumprich e2b963d711 change baselines back to master 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-10-25 18:59:11 +02:00
Sebastian Gumprich 414efd6125 use correct centos stream images, try to fix prepare step for debian tests 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-10-25 18:59:11 +02:00
Sebastian Gumprich 87a461fc57 use forked mysql-baseline 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-10-25 18:59:11 +02:00
Sebastian Gumprich dac66f4a88 simplify OS-vars files 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-10-25 18:59:11 +02:00
Sebastian Gumprich 3b8b394f10 add ssh-vars for new OS 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-10-25 18:59:11 +02:00
Sebastian Gumprich b27ffd08b0 add mysql-vars for new OS 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-10-25 18:58:53 +02:00
dev-sec CI 8ee946a537 update changelog 2022-10-24 08:04:42 +00:00
Sebastian Gumprich a176443f22 add support for centos stream 8 and 9, rocky 9 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-10-24 10:03:07 +02:00
Sebastian Gumprich 9d75e3b00e test crypto changes from ssh-baseline 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-10-24 10:03:07 +02:00
schurzi a1b80fe657 adopt all current suggestions from ansible-lint (#592) 2022-10-24 09:42:23 +02:00
dev-sec CI 53be805099 update changelog 2022-10-21 09:07:46 +00:00
donestefan 464d8df8e8 add hardening of root user account(s) (#579) 2022-10-21 11:05:43 +02:00
dev-sec CI f1ea1e52f3 update changelog 2022-10-20 13:00:42 +00:00
Benedikt Böhm 802bad48e6 do not manage trusted user ca keys if none exist (#580) 
Signed-off-by: Benedikt Böhm <[email protected]>

Signed-off-by: Benedikt Böhm <[email protected]>
 2022-10-20 14:44:14 +02:00
dev-sec CI d3acab585e update changelog 2022-09-28 08:54:32 +00:00
Sebastian Gumprich 44489dea5f run tests only on pushes to master or to PRs (#581) 
Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-09-28 10:44:31 +02:00
dev-sec CI 64b5d82c5f update galaxy.yml with new version 2022-09-08 13:03:43 +00:00
dev-sec CI f96c2dd8c9 update changelog 2022-09-08 13:00:02 +00:00
hagenbauer 500cd24beb nginx variables for configuration and owner (#578) 
Signed-off-by: [email protected] <[email protected]>

Signed-off-by: [email protected] <[email protected]>
8.2.0 		2022-09-08 14:58:10 +02:00
dev-sec CI 3835b2a18c update changelog 2022-09-06 14:38:23 +00:00
Simon Baerlocher 883effef82 add centos >8 Support (#573) 
Signed-off-by: Simon Baerlocher <[email protected]>

Signed-off-by: Simon Baerlocher <[email protected]>
 2022-09-06 16:31:43 +02:00
dev-sec CI 9cc0b254f6 update galaxy.yml with new version 2022-08-26 13:11:17 +00:00
dev-sec CI 80960d5703 update changelog 2022-08-26 11:46:34 +00:00
Sebastian Gumprich 9ac01fb358 add always-tag to include so other tags can be used (#569) 
Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-08-26 13:45:05 +02:00
Sebastian Gumprich 11d187e62e update supported OS in meta and fix linting (#572) 
Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
8.1.0 		2022-08-26 13:44:51 +02:00
Sebastian Gumprich fbea75ad18 only run release actions on upstream-repo (#568) 
fixes #566

Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-08-26 09:40:59 +02:00
dev-sec CI 40913a3e6d update changelog 2022-08-26 07:19:56 +00:00
donestefan 38e1c3bbeb fix misleading comment (#571) 
also RHEL6 is not supported anymore
 2022-08-26 09:17:54 +02:00
dev-sec CI d981a4e545 update galaxy.yml with new version 2022-08-22 11:19:25 +00:00
dev-sec CI 627634d95f update changelog 2022-08-22 10:41:10 +00:00
Sebastian Gumprich 720d7786b5 fix typo 8.0.0 2022-08-22 12:39:21 +02:00
Sebastian Gumprich 84412e99c2 fix typo 2022-08-22 11:25:08 +02:00
dev-sec CI 516f4cfb01 update changelog 2022-08-22 09:18:59 +00:00
divialth fb8b9142c8 rework filesystem hardening (#555) 
* rework filesystem hardening

-  removed a lot duplicated code by using a loop
-  added new hardening options for /tmp
-  added new options "passno" and "dump" for every filesystem.
   currently ansible changed that values to 0 for every fs
   new default depends on fstype, can be overwriten in config
-  removed default fstype in config
   the type will now be autodetected,  can be overwriten in config
-  mount src setting is now optional
   the source will now be autodetected,  can be overwriten in config
-  it will be now checked, if it is really a mount
-  changed fs reload to handler
-  removed check os_auditd_enabled on /var/log/audit

Signed-off-by: divialth <[email protected]>

* fix lint errors

Signed-off-by: divialth <[email protected]>

* implemented the name suggestions

Signed-off-by: divialth <[email protected]>

Signed-off-by: divialth <[email protected]>
 2022-08-22 11:16:57 +02:00