andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,565 Commits 14 Branches 64 Tags
6e24797d2f518a5a57c1f2e89d74de595612a4d2
Commit Graph
98 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
schurzi 6e24797d2f Merge pull request #423 from dev-sec/drop_users_wo_passwords 
add new tasks to delete mysql users without passwords
 2021-04-01 22:04:59 +02:00
schurzi add303f2be Merge pull request #437 from BenjaminBoehm/bugfix/ssh-kex-sntrup-openssh8.5 
Fix ssh kex [email protected] for openssh >= 8.5
 2021-04-01 21:13:50 +02:00
schurzi fdadb78080 Merge pull request #438 from dev-sec/remove_depracted_secure-auth 
remove secure-auth param if mysql >= 8.0.3
 2021-04-01 21:07:04 +02:00
schurzi 2882a15ee1 Merge pull request #427 from dev-sec/snoopotic-fix/add_auditd_restart_handler 
add restart-auditd handler after configuration change
 2021-03-29 21:15:46 +02:00
schurzi 0f424469be Merge pull request #432 from joubbi/authtok_type 
os_auth_pam_pwquality_options: Changed type to authtok_type
 2021-03-23 22:01:40 +01:00
schurzi a45eee2204 Merge pull request #431 from joubbi/pwhistory 
Use pam_pwhistory.so instead of pam_unix.so for remembering old passwords
 2021-03-23 09:59:11 +01:00
Martin Schurz d693a8e200 also use requisite for pwhistory 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-23 08:53:49 +01:00
Martin Schurz 0ac56e4c00 Merge branch 'master' into pwhistory 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-23 08:53:23 +01:00
schurzi 5be13e878f Merge pull request #430 from joubbi/comment 
Remove comments from PAM config file, but keep it in the template
 2021-03-23 08:40:20 +01:00
schurzi 69193fe249 Merge pull request #428 from dev-sec/harden_user_home_dires 
Harden user home dirs
 2021-03-22 12:49:48 +01:00
schurzi 876cdab430 Merge pull request #429 from dev-sec/proxy 
add support for using a proxy to test with molecule
 2021-03-21 13:18:03 +01:00
schurzi a64838272c Merge pull request #418 from joubbi/documentation2 
Improve Documentation for sysctl defaults
 2021-03-16 15:49:55 +01:00
schurzi 8706246309 Merge pull request #421 from schurzi/imprel 
Improve Release Action
 2021-03-16 11:26:21 +01:00
Martin Schurz cd4925d411 checkout master between 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-16 11:07:21 +01:00
Martin Schurz d1b8e7d7a3 update paths 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-16 11:00:40 +01:00
Martin Schurz 19d5a17a99 remove second call to changelog generator 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-16 10:56:17 +01:00
schurzi 976f83e88b Merge pull request #420 from dev-sec/fqcn_docs 
remove FQCN from roles in examples
 2021-03-16 10:14:03 +01:00
schurzi 74c729404b Merge pull request #392 from dev-sec/tally 
restructure PAM handling and update for currently supported Linux distributions
 2021-03-16 00:10:36 +01:00
Martin Schurz b2dd73d27e remove unneeded tasks 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-15 23:53:40 +01:00
Martin Schurz ec9d7d2cb8 cleanup and typos 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-15 23:39:12 +01:00
Martin Schurz 5f97dffddf Merge branch 'master' into tally 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-11 19:26:37 +01:00
schurzi 0b945536e2 Merge pull request #405 from joubbi/crontab 
Ensure permissions on cron files and directories are configured
 2021-03-11 17:44:26 +01:00
Martin Schurz 75fc31b80c remove cracklib 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 19:10:45 +01:00
Martin Schurz 10841ced62 case sensitive 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 18:29:55 +01:00
Martin Schurz 335df545fb correct version 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 18:15:33 +01:00
Martin Schurz 6d2c92d4ab correct locale 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 18:14:59 +01:00
Martin Schurz 3334000b97 set locale for test 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 17:45:46 +01:00
Martin Schurz 26d84b5f84 use custom /tmp dir 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 16:46:41 +01:00
Martin Schurz 9b6f313065 move pam tests up 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 15:54:03 +01:00
Martin Schurz 23071a183c add testcases for PAM 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 15:42:13 +01:00
schurzi 8e4c22d8d9 remove FQCN from roles in examples (#404) 
Ansible does not work with FQCN and collections sepcified for including
roles. It is currently expecting to only get the role name in this
context.

Verified with Ansible 2.10.5

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-17 11:34:37 +01:00
Martin Schurz dba53718cf sssd is disabled on Amazonlinus 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-16 20:44:28 +01:00
Martin Schurz 4a5fa70507 default faillock to yes 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-16 19:31:51 +01:00
Martin Schurz 75683161a5 remove FQCN from roles in examples 
Ansible does not work with FQCN and collections sepcified for including
roles. It is currently expecting to only get the role name in this
context.

Verified with Ansible 2.10.5

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 11:26:59 +01:00
schurzi 5d55d29fe2 Merge pull request #403 from wzzrd/gssapi_client_support 
Extend GSSAPI configuration support to ssh_config
 2021-02-15 11:23:57 +01:00
Martin Schurz 64713ce75d add default for new variable 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 11:17:01 +01:00
Martin Schurz ec36bf5b9c document parameter 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 00:22:03 +01:00
Martin Schurz 08aad6e80f add documentation 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 00:13:14 +01:00
Martin Schurz 28c6bf5c66 put force on the right task 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 23:31:24 +01:00
Martin Schurz 26c73ed1c9 fix debian faillock config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 23:13:14 +01:00
Martin Schurz b9e33091e2 fix problems with auth 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 21:30:35 +01:00
Martin Schurz 7f1765c608 consolidate auth for rhel 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 17:30:02 +01:00
Martin Schurz 30f0839513 add support for rhel8 and sssd 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 12:44:20 +01:00
Martin Schurz 532917d956 remove rhel6 support from pam 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 12:14:54 +01:00
Martin Schurz 04654d0490 correct typo 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 11:19:12 +01:00
Martin Schurz aa166f43fc split debian and rhel pam config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 02:07:25 +01:00
Martin Schurz 19482c319c force create symlink 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-13 19:38:57 +01:00
Martin Schurz fc7fb4fc8a make compatible to authconfig 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-13 18:09:48 +01:00
Martin Schurz 7282187a90 Merge branch 'master' into tally 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 21:44:55 +01:00
Martin Schurz 157f4fca70 add tasks for faillock on debian 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 21:43:30 +01:00
schurzi a98876b350 update ansible-lint to version 5 (#397) 
* add ansible to requirements

Signed-off-by: Martin Schurz <[email protected]>

* trigger run

Signed-off-by: Martin Schurz <[email protected]>

* update noqa for ansible-lint 5

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 13:47:01 +01:00
schurzi 2b39258d47 Merge pull request #395 from Normo/update-galaxy-version 
fix galaxy action to update local galaxy.yml
 2021-02-10 12:56:53 +01:00
Martin Schurz 75a8aca905 fix galaxy action to update local galaxy.yml 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 12:53:02 +01:00
Martin Schurz 94b9bfc3cd add files for faillock 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 12:49:12 +01:00
Martin Schurz 3ad4fbab0e add guard for tally debian unstable 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 11:18:50 +01:00
Martin Schurz ebbf6855e8 add rhel faillock config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 10:51:16 +01:00
Martin Schurz b210df1233 re-add debian tally config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 10:51:03 +01:00
Martin Schurz a55a4d2024 remove pam_tally2 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 08:09:43 +01:00
schurzi 30f03bc124 Merge pull request #390 from dev-sec/fix_docs 
fix minimum required ansible version in docs
 2021-02-05 20:40:42 +01:00
Martin Schurz c6114278a1 fix minimum required ansible version in docs 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-05 20:39:04 +01:00
schurzi 4b0819349d use fqcn for community.crypto.openssh_keypair module (#389) 
tihis fixes a problem with Ansible 2.9 where the default openssh_keypair
is not supporting every option we need

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-05 19:44:23 +01:00
schurzi 9db01d5fbe Merge pull request #386 from dev-sec/changelog_gen_v1 
use version tag for changelog action
 2021-02-02 11:00:11 +01:00
Martin Schurz e4b0801d22 use version tag for changelog action 
Referencing actions by the short SHA will be deprecated soon

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-02 10:58:52 +01:00
schurzi 8a1064ded4 make release workflow manually runnable (#384) 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-22 13:57:20 +01:00
schurzi 6e84f53a75 run labeler workflow with higher privileges (#383) 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-22 12:34:59 +01:00
schurzi 7a560b3d38 remove issue labels from changelog (#382) 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-22 12:34:51 +01:00
schurzi 66feb7c2ad Merge pull request #380 from mpraeger/feature/host_certificates 
add Support for OpenSSH HostCertificate config option
 2021-01-22 10:43:32 +01:00
schurzi f010b9a17e Merge pull request #378 from joubbi/iwashere 
Added comment on top of templates about which role manages the file
 2021-01-20 11:42:38 +01:00
Martin Schurz 0600cdae75 add "role" to comment 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-20 11:23:40 +01:00
schurzi 16a41412bb check for correct cpu vendor in initramfs-tools (#374) 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-12 06:31:13 +01:00
schurzi d83ad9e6a9 Merge pull request #368 from dev-sec/max_startups 
reduce maximum unauthenticated ssh sessions
 2021-01-11 20:49:29 +01:00
schurzi b4ca950122 set hidepid=0 on RHEL/CentOS 7 (#369) 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-03 12:53:08 +01:00
Martin Schurz 168af7fb6f reduce maximum unauthenticated ssh sessions 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-03 00:21:26 +01:00
schurziandSebastian Gumprich a75e2c028b change inclusion of os specific defaults (#353) 
* change inclusion of os specific defaults

we now include the os specific options into a separate variable and
merge this with the default ansible namespace, when the corresponding
keys do not already exist (eg. are defined by default oder by user)

Signed-off-by: Martin Schurz <[email protected]>

* simplify check for os specific variables

Signed-off-by: Martin Schurz <[email protected]>

* add test for variable override

Signed-off-by: Martin Schurz <[email protected]>

* move tests to verify stage

Signed-off-by: Martin Schurz <[email protected]>

* correct grep

Signed-off-by: Martin Schurz <[email protected]>

* linting

Signed-off-by: Martin Schurz <[email protected]>

* fix typo

Signed-off-by: Martin Schurz <[email protected]>

* Revert "Merge pull request #351 from sprat/fix-umask"

This reverts commit 9e8e0bc8fb, reversing
changes made to 98c7553016.

Signed-off-by: Martin Schurz <[email protected]>

* move immutable ssh vars to internal vars

Signed-off-by: Martin Schurz <[email protected]>

* move vars to OS files

Signed-off-by: Martin Schurz <[email protected]>

* change default handling for all roles

Signed-off-by: Martin Schurz <[email protected]>

* fix issues

Signed-off-by: Martin Schurz <[email protected]>

* add documentation

Signed-off-by: Martin Schurz <[email protected]>

* Update main.yml

Co-authored-by: Sebastian Gumprich <[email protected]>
 2020-12-20 20:46:57 +01:00
schurzi 9e8e0bc8fb Merge pull request #351 from sprat/fix-umask 
make the os_env_umask variable usable
 2020-12-16 10:39:11 +01:00
schurzi 257504f156 add SuSE support (#328) 
Signed-off-by: Martin Schurz <[email protected]>
 2020-10-15 08:27:23 +02:00
schurziandSebastian Gumprich c954b8af8f Improve Documentation (#315) 
* improve formatting

Signed-off-by: Martin Schurz <[email protected]>

* add limitation for vm.mmap_rnd_bits to documentation

Signed-off-by: Martin Schurz <[email protected]>

* Apply suggestions from code review

Co-authored-by: Sebastian Gumprich <[email protected]>
Signed-off-by: Martin Schurz <[email protected]>

Co-authored-by: Sebastian Gumprich <[email protected]>
 2020-10-02 20:48:18 +02:00
schurzi 9394688158 use touch for 10.hardcore.conf to avoid problems with dry-run (#314) 
Signed-off-by: Martin Schurz <[email protected]>
 2020-10-02 20:43:35 +02:00
schurzi e266decde8 use ansible dhparam module (#32) 
* use ansible dhparam module
 2020-08-28 12:35:52 +02:00
schurzi 57f7a15b51 imove chmod to end because of generated files (#31) 
Signed-off-by: Martin Schurz <[email protected]>
 2020-08-24 11:22:33 +02:00
schurzi 3028b5ddc7 fix linting issues (#30) 
* fix linting issues

Signed-off-by: Martin Schurz <[email protected]>

* set file permissions

Signed-off-by: Martin Schurz <[email protected]>
 2020-08-24 10:45:13 +02:00
schurzi c69e7efb11 Merge pull request #49 from dev-sec/collection 
Fix linting errors and simplivy vars-handling
 2020-08-23 18:42:09 +02:00
schurzi a82e1a7a9f fix litner errors (#322) 
* fix litner errors

Signed-off-by: Martin Schurz <[email protected]>

* make linter more happy

Signed-off-by: Martin Schurz <[email protected]>
 2020-08-22 18:14:54 +02:00
schurzi b37c2ddb69 Merge pull request #303 from dev-sec/arch_support 
Arch support
 2020-08-22 15:21:18 +02:00
schurzi 4ddbbb2a61 fix linting for molecule (#301) 
Signed-off-by: Martin Schurz <[email protected]>
 2020-08-22 08:53:44 +02:00
schurzi 989f7b0e1e Merge pull request #300 from danielkubat/master 
define file permissions explicitly
 2020-08-19 00:05:51 +02:00
schurzi 56f6cd0337 Merge pull request #296 from dev-sec/fedora 
fix fedora build
 2020-08-16 20:17:15 +02:00
schurzi aaece07fe0 Merge pull request #321 from dev-sec/fedora 
use systemd in fedora
 2020-08-16 20:16:53 +02:00
Martin Schurz 5cf53b215f add separate option for controlling motd via pam 
makes it possible to set different values for motd via sshd and pam.
Also create a backup file of pam configuration, to allow user to restore
the previous settings.

Signed-off-by: Martin Schurz <[email protected]>
 2020-08-08 18:14:38 +02:00
schurzi b3d7acee44 Merge pull request #48 from dev-sec/kitchen_travis 
update testing
 2020-08-07 20:04:50 +02:00
schurzi eaeca04d96 do not blacklist used filesystems (#289) 
* add additional check for efi

some systems seem to require vfat because of efi, despite not exposing a
/sys/firmware/efi directory.

Signed-off-by: Martin Schurz <[email protected]>

* make linter happy

Signed-off-by: Martin Schurz <[email protected]>

* rework check to check for all used filesystems

so we don't break existing mounts with our configuration

Signed-off-by: Martin Schurz <[email protected]>

* do not check this on el6

Signed-off-by: Martin Schurz <[email protected]>

* add comment to clarify

Signed-off-by: Martin Schurz <[email protected]>
 2020-08-07 08:59:46 +02:00
schurzi 387fc472bd improve testing (#287) 
* fix problem with package_facts on SuSE

SuSE Linux does not work with ansibel module packet_facts, so we need to
exclude this task there.

Signed-off-by: Martin Schurz <[email protected]>

* fix local docker tests for all distributions

Signed-off-by: Martin Schurz <[email protected]>

* fix local vagrant tests for all distributions

Signed-off-by: Martin Schurz <[email protected]>

* simplify travis tests

Signed-off-by: Martin Schurz <[email protected]>

* fix opensuse in travis

Signed-off-by: Martin Schurz <[email protected]>

* add fixes for suse

Signed-off-by: Martin Schurz <[email protected]>

* add special case for suse docker

Signed-off-by: Martin Schurz <[email protected]>
 2020-08-03 15:55:27 +02:00
Martin Schurz 04f731a08c fix local kitchen tests 
somehow a "real" linux needs different options than WSL. This is now
also working on debian 10

Signed-off-by: Martin Schurz <[email protected]>
 2020-07-28 09:12:43 +02:00
schurzi 9b14f64f67 Merge pull request #317 from aqw/umask 
fix sftp_umask; store as literal not octal
 2020-07-28 08:59:12 +02:00
Martin Schurz 18be974509 remove crypto.yml 
move include tasks to hardening.yml and remove intermediate crypto.yml

Signed-off-by: Martin Schurz <[email protected]>
 2020-07-09 12:56:39 +02:00
Martin Schurz 5e47ffae35 split crypto.yml in several playbooks 
preserve the version ordering of defaults and group all tasks according
to base configuration variable (cipthers, hostkeys, kex and macs)

Signed-off-by: Martin Schurz <[email protected]>
 2020-07-09 11:46:23 +02:00
Martin Schurz 83263cf8ce add blocks to crypto.yml checks 
moved the check for user supplied settings to block head and reversed
order of assignments to compensate for the missing check on the set
variable

Signed-off-by: Martin Schurz <[email protected]>
 2020-07-09 00:30:45 +02:00
Martin Schurz 9d56e9c6dd fix typo in hardening.yml 
Signed-off-by: Martin Schurz <[email protected]>
 2020-07-08 22:42:32 +02:00