* update links to new Ansible Galaxy
Signed-off-by: Martin Schurz <[email protected]>
* remove dead link
Signed-off-by: Martin Schurz <[email protected]>
---------
Signed-off-by: Martin Schurz <[email protected]>
* add role argument spec for os, ssh, mysql
Signed-off-by: Sebastian Gumprich <[email protected]>
* add role argument spec for os, ssh, mysql
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove variable in variable as it cannot be used in argument spec
Signed-off-by: Sebastian Gumprich <[email protected]>
* fix wrong syntax
* fix spelling errors
Signed-off-by: Sebastian Gumprich <[email protected]>
* cannot use vars before arg-spec validation
Signed-off-by: Sebastian Gumprich <[email protected]>
* yamllint the arg-spec
Signed-off-by: Sebastian Gumprich <[email protected]>
* add back variable
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove redundant setting in tests
* fix descriptions in mysql hardening to betterreflect what they do
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove duplicate empty line
Signed-off-by: Sebastian Gumprich <[email protected]>
* set correct defaults on to ssl options
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove left-over hidepid argument spec
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove license and author infos, this lives in the collection readme
Signed-off-by: Sebastian Gumprich <[email protected]>
* fix styling
Signed-off-by: Sebastian Gumprich <[email protected]>
* update some descriptions and sort them in the readme
Signed-off-by: Sebastian Gumprich <[email protected]>
* some more linting
Signed-off-by: Sebastian Gumprich <[email protected]>
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
* make template overrideable
by referencing the auditd.conf.j2 template, a custom template can be provided to the role.
Signed-off-by: Dennis Lerch <[email protected]>
* extend auditd config
make freq and log_file configurable
implement write_logs with it's default value in order to be able to disable log writing
Signed-off-by: Dennis Lerch <[email protected]>
* Extend README.md documentation by new variables
reorder `os_auditd_log_format` to keep sequence from defaults
Signed-off-by: Dennis Lerch <[email protected]>
---------
Signed-off-by: Dennis Lerch <[email protected]>
* add testing for OpenBSD and FreeBSD
Signed-off-by: Martin Schurz <[email protected]>
* make python work
Signed-off-by: Martin Schurz <[email protected]>
* remove jinja template ...
Signed-off-by: Martin Schurz <[email protected]>
* make verify work
Signed-off-by: Martin Schurz <[email protected]>
* correct verify
Signed-off-by: Martin Schurz <[email protected]>
* correct verify
Signed-off-by: Martin Schurz <[email protected]>
* correct verify
Signed-off-by: Martin Schurz <[email protected]>
* correct verify
Signed-off-by: Martin Schurz <[email protected]>
* use right vm name for connect
Signed-off-by: Martin Schurz <[email protected]>
* add a bit of documentation
Signed-off-by: Martin Schurz <[email protected]>
* remove sudo
Signed-off-by: Martin Schurz <[email protected]>
* add weird OpenSBD workaround
Signed-off-by: Martin Schurz <[email protected]>
* make verify playbook more consistent
Signed-off-by: Martin Schurz <[email protected]>
* rename nonlinux to BSD
Signed-off-by: Martin Schurz <[email protected]>
* use openbsd7 for testing
Signed-off-by: Martin Schurz <[email protected]>
* correct use openbsd7 everywhere
Signed-off-by: Martin Schurz <[email protected]>
* add waivers
Signed-off-by: Martin Schurz <[email protected]>
* update waiver descriptions
Signed-off-by: Martin Schurz <[email protected]>
* use docker for inspec
Signed-off-by: Martin Schurz <[email protected]>
* keep looking right ;)
Signed-off-by: Martin Schurz <[email protected]>
* correct path to waivers
Signed-off-by: Martin Schurz <[email protected]>
* use ephemeral directory in docker
Signed-off-by: Martin Schurz <[email protected]>
* use bsd inspec profile
Signed-off-by: Martin Schurz <[email protected]>
* remove openbsd workaround
Signed-off-by: Martin Schurz <[email protected]>
* re-add openbsd workaround
Signed-off-by: Martin Schurz <[email protected]>
* commit suggestions
Signed-off-by: Martin Schurz <[email protected]>
* add supportet OS to metadata
Signed-off-by: Martin Schurz <[email protected]>
* use current python
Signed-off-by: Martin Schurz <[email protected]>
---------
Signed-off-by: Martin Schurz <[email protected]>
* add check mode to molecule tests
Signed-off-by: Martin Schurz <[email protected]>
* bail on undefined variables
Signed-off-by: Martin Schurz <[email protected]>
* bail on undefined variables
Signed-off-by: Martin Schurz <[email protected]>
* execute tasks in check mode
Signed-off-by: Martin Schurz <[email protected]>
* fix error in check mode on SuSE
Signed-off-by: Martin Schurz <[email protected]>
* use when condition on task
Signed-off-by: Martin Schurz <[email protected]>
---------
Signed-off-by: Martin Schurz <[email protected]>
* use rowcount to determine mysql results
Signed-off-by: Martin Schurz <[email protected]>
* use correct list level
Signed-off-by: Martin Schurz <[email protected]>
* remove json_query
Signed-off-by: Martin Schurz <[email protected]>
* remove intermediate vars
Signed-off-by: Martin Schurz <[email protected]>
* add check for count
Signed-off-by: Martin Schurz <[email protected]>
* drop condition, since one result must exist
Signed-off-by: Martin Schurz <[email protected]>
* move rowcount in condition
Signed-off-by: Martin Schurz <[email protected]>
* do loop in ansible to report each deleted user
Signed-off-by: Martin Schurz <[email protected]>
* add idempotency check
Signed-off-by: Martin Schurz <[email protected]>
* additional tests to verify user deletion
Signed-off-by: Martin Schurz <[email protected]>
* actually iterate the whole user list when deleting
Signed-off-by: Martin Schurz <[email protected]>
* fix tests for SuSE
Signed-off-by: Martin Schurz <[email protected]>
* adopt suggestions
Signed-off-by: Martin Schurz <[email protected]>
---------
Signed-off-by: Martin Schurz <[email protected]>
* add remaining platforms to test
Signed-off-by: Martin Schurz <[email protected]>
* remove unneccessary tasks for test
Signed-off-by: Martin Schurz <[email protected]>
* use current opensuse version
Signed-off-by: Martin Schurz <[email protected]>
* disable sysctl for missing yama in opensuse
Signed-off-by: Martin Schurz <[email protected]>
---------
Signed-off-by: Martin Schurz <[email protected]>
* rewrite user home dir hardening
* delete duplicate var that was missed in a merge conflict
Signed-off-by: Sebastian Gumprich <[email protected]>
* linting
Signed-off-by: Sebastian Gumprich <[email protected]>
* add tests for home rewrites
Signed-off-by: Sebastian Gumprich <[email protected]>
* Apply suggestions from code review
Co-authored-by: schurzi <[email protected]>
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: donestefan <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: schurzi <[email protected]>
* Preserve default ownership and dir mode for /var/log on Ubuntu
Signed-off-by: stdtom <[email protected]>
* linting
Signed-off-by: stdtom <[email protected]>
* Define vars for each OS instead of using defaults.
Signed-off-by: stdtom <[email protected]>
* Fix values for os_mnt_var_log_dir_mode and os_mnt_var_log_group
Signed-off-by: stdtom <[email protected]>
Signed-off-by: stdtom <[email protected]>
* add verify-task to check if mysql is running and enabled
Signed-off-by: Sebastian Gumprich <[email protected]>
* Update molecule/mysql_hardening/verify_tasks/service.yml
Co-authored-by: schurzi <[email protected]>
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: schurzi <[email protected]>
* Update main.yml
fixes the handler file and set new syntax
Signed-off-by: Jacob Sievert <[email protected]>
* changes command module from legacy to builtin.
Signed-off-by: Jacob Sievert <[email protected]>
Signed-off-by: Jacob Sievert <[email protected]>
Sebastian Gumprich