* add role argument spec for os, ssh, mysql
Signed-off-by: Sebastian Gumprich <[email protected]>
* add role argument spec for os, ssh, mysql
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove variable in variable as it cannot be used in argument spec
Signed-off-by: Sebastian Gumprich <[email protected]>
* fix wrong syntax
* fix spelling errors
Signed-off-by: Sebastian Gumprich <[email protected]>
* cannot use vars before arg-spec validation
Signed-off-by: Sebastian Gumprich <[email protected]>
* yamllint the arg-spec
Signed-off-by: Sebastian Gumprich <[email protected]>
* add back variable
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove redundant setting in tests
* fix descriptions in mysql hardening to betterreflect what they do
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove duplicate empty line
Signed-off-by: Sebastian Gumprich <[email protected]>
* set correct defaults on to ssl options
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove left-over hidepid argument spec
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove license and author infos, this lives in the collection readme
Signed-off-by: Sebastian Gumprich <[email protected]>
* fix styling
Signed-off-by: Sebastian Gumprich <[email protected]>
* update some descriptions and sort them in the readme
Signed-off-by: Sebastian Gumprich <[email protected]>
* some more linting
Signed-off-by: Sebastian Gumprich <[email protected]>
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
* make template overrideable
by referencing the auditd.conf.j2 template, a custom template can be provided to the role.
Signed-off-by: Dennis Lerch <[email protected]>
* extend auditd config
make freq and log_file configurable
implement write_logs with it's default value in order to be able to disable log writing
Signed-off-by: Dennis Lerch <[email protected]>
* Extend README.md documentation by new variables
reorder `os_auditd_log_format` to keep sequence from defaults
Signed-off-by: Dennis Lerch <[email protected]>
---------
Signed-off-by: Dennis Lerch <[email protected]>
* rewrite user home dir hardening
* delete duplicate var that was missed in a merge conflict
Signed-off-by: Sebastian Gumprich <[email protected]>
* linting
Signed-off-by: Sebastian Gumprich <[email protected]>
* add tests for home rewrites
Signed-off-by: Sebastian Gumprich <[email protected]>
* Apply suggestions from code review
Co-authored-by: schurzi <[email protected]>
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: donestefan <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: schurzi <[email protected]>
* Preserve default ownership and dir mode for /var/log on Ubuntu
Signed-off-by: stdtom <[email protected]>
* linting
Signed-off-by: stdtom <[email protected]>
* Define vars for each OS instead of using defaults.
Signed-off-by: stdtom <[email protected]>
* Fix values for os_mnt_var_log_dir_mode and os_mnt_var_log_group
Signed-off-by: stdtom <[email protected]>
Signed-off-by: stdtom <[email protected]>
* rework filesystem hardening
- removed a lot duplicated code by using a loop
- added new hardening options for /tmp
- added new options "passno" and "dump" for every filesystem.
currently ansible changed that values to 0 for every fs
new default depends on fstype, can be overwriten in config
- removed default fstype in config
the type will now be autodetected, can be overwriten in config
- mount src setting is now optional
the source will now be autodetected, can be overwriten in config
- it will be now checked, if it is really a mount
- changed fs reload to handler
- removed check os_auditd_enabled on /var/log/audit
Signed-off-by: divialth <[email protected]>
* fix lint errors
Signed-off-by: divialth <[email protected]>
* implemented the name suggestions
Signed-off-by: divialth <[email protected]>
Signed-off-by: divialth <[email protected]>
add option to whitelist specific user that need a .netrc file in there home dirs
add test for .netrc files if option os_netrc_enabled is false
Signed-off-by: Philipp Funk <[email protected]>
Signed-off-by: Philipp Funk <[email protected]>
Co-authored-by: Philipp Funk <[email protected]>
```
Unable to open /var/log/audit/audit.log (Permission denied)
```
This PR fixes the issue by using the default permission set by auditd (`0700`).
Signed-off-by: Benedikt Böhm <[email protected]>
* first testing with tasks and variables
Signed-off-by: Ludwig Bayerlein <[email protected]>
* update variables for dir options
Signed-off-by: Ludwig Bayerlein <[email protected]>
* updated permissions and defaults
Signed-off-by: Ludwig Bayerlein <[email protected]>
* fix home dir permissions
Signed-off-by: Ludwig Bayerlein <[email protected]>
* updated tasks with useful variables
Signed-off-by: Ludwig Bayerlein <[email protected]>
* reorder tasks. first remount, then manage fstab and fix permissions on directories. Renaming task names with mountpoints (slashes)
Signed-off-by: Ludwig Bayerlein <[email protected]>
* shorten tasks with list items
Signed-off-by: Ludwig Bayerlein <[email protected]>
* change defaults for /boot directory, because its a bad behaviour, if ansible changes boot entries with a default value
Signed-off-by: Ludwig Bayerlein <[email protected]>
* Update documentation for new parameters to manage mountpoints
Signed-off-by: Ludwig Bayerlein <[email protected]>
* Update roles/os_hardening/tasks/minimize_access.yml
Co-authored-by: Sebastian Gumprich <[email protected]>
Signed-off-by: Ludwig Bayerlein <[email protected]>
* Update roles/os_hardening/tasks/minimize_access.yml
Co-authored-by: Sebastian Gumprich <[email protected]>
Signed-off-by: Ludwig Bayerlein <[email protected]>
* Fix state on every new task
Signed-off-by: Ludwig Bayerlein <[email protected]>
* loop instead of list
Signed-off-by: Ludwig Bayerlein <[email protected]>
* testing remount with register
Signed-off-by: Ludwig Bayerlein <[email protected]>
* add remounts with loop over all changed folders
Signed-off-by: Ludwig Bayerlein <[email protected]>
* testing and solving trouble with variable names
Signed-off-by: Ludwig Bayerlein <[email protected]>
* optimize default permissions for var-log-audit
Signed-off-by: Ludwig Bayerlein <[email protected]>
* optimize default permissions for var-log-audit
Signed-off-by: Ludwig Bayerlein <[email protected]>
* change to new optimizied permissions of var-log-audit
Signed-off-by: Ludwig Bayerlein <[email protected]>
* fix some defaults in fstab to configure as mounted
Signed-off-by: Ludwig Bayerlein <[email protected]>
* add stat and check, if boot folder exists
Signed-off-by: Ludwig Bayerlein <[email protected]>
Co-authored-by: Ludwig Bayerlein <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Files in this whitelist should not be altered.
Currently this is only relevant for enforcing the gpg check.
Signed-off-by: René Scheibe <[email protected]>
* new function to disable ctrl-alt-del to avooid reboot virtual machines f.e.
Signed-off-by: Ludwig Bayerlein <[email protected]>
* fix variable documentation for ctrlaltdel
Signed-off-by: Ludwig Bayerlein <[email protected]>
* added ctrlaltdel variable for molecule
Signed-off-by: Ludwig Bayerlein <[email protected]>
* optimize ctrlaltdel function with a 'when' query. thanks to rndmh3ro
Signed-off-by: Ludwig Bayerlein <[email protected]>
* fix typo in new file
Co-authored-by: Ludwig Bayerlein <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
* Add CVE-2021-33909 mitigations
kernel.unprivileged_bpf_disabled: 1
kernel.unprivileged_userns_clone: 0
The first one is also used by Tails.
Signed-off-by: Paweł Krawczyk <[email protected]>
* Clean up whitespaces
Signed-off-by: Paweł Krawczyk <[email protected]>
* Add Configuration of password remember
and set default to 60
see Telekom 2021.07-01 SoC 3.01 Req 25 and SoC 3.65 Req46
Signed-off-by: Maik Stuebner <[email protected]>
* set default for password remember back to 5
Signed-off-by: Maik Stuebner <[email protected]>
* readme default for password remember back to 5
Signed-off-by: Maik Stuebner <[email protected]>
* Enabled SYN cookie sysctl.
Signed-off-by: Farid Joubbi <[email protected]>
* Removed SYN cookies from here since it's a default now.
Signed-off-by: Farid Joubbi <[email protected]>
* make auditd 'max_log_file' configurable
Signed-off-by: Thomas Gueldner <[email protected]>
* fix documentation for os_auditd_max_log_file
Signed-off-by: Thomas Gueldner <[email protected]>
* change inclusion of os specific defaults
we now include the os specific options into a separate variable and
merge this with the default ansible namespace, when the corresponding
keys do not already exist (eg. are defined by default oder by user)
Signed-off-by: Martin Schurz <[email protected]>
* simplify check for os specific variables
Signed-off-by: Martin Schurz <[email protected]>
* add test for variable override
Signed-off-by: Martin Schurz <[email protected]>
* move tests to verify stage
Signed-off-by: Martin Schurz <[email protected]>
* correct grep
Signed-off-by: Martin Schurz <[email protected]>
* linting
Signed-off-by: Martin Schurz <[email protected]>
* fix typo
Signed-off-by: Martin Schurz <[email protected]>
* Revert "Merge pull request #351 from sprat/fix-umask"
This reverts commit 9e8e0bc8fb, reversing
changes made to 98c7553016.
Signed-off-by: Martin Schurz <[email protected]>
* move immutable ssh vars to internal vars
Signed-off-by: Martin Schurz <[email protected]>
* move vars to OS files
Signed-off-by: Martin Schurz <[email protected]>
* change default handling for all roles
Signed-off-by: Martin Schurz <[email protected]>
* fix issues
Signed-off-by: Martin Schurz <[email protected]>
* add documentation
Signed-off-by: Martin Schurz <[email protected]>
* Update main.yml
Co-authored-by: Sebastian Gumprich <[email protected]>
Martin Schurz