andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,883 Commits 14 Branches 64 Tags
83a0a9242b3cf5df7347f6eb0373e42c1bd4d167
Commit Graph
1883 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
mmitnyan 83a0a9242b Support for Amazon Linux 2 (#624) 
Signed-off-by: Manuel Mitnyan <[email protected]>

Signed-off-by: Manuel Mitnyan <[email protected]>
 2023-01-25 09:12:25 +01:00
dev-sec CI fdd0bfc72a update changelog 2023-01-24 13:27:02 +00:00
schurzi 154f862ccd Merge pull request #622 from dev-sec/stop_old_tests 
cancel running tests if new commit to branch is made
 2023-01-24 13:21:18 +01:00
Sebastian Gumprich db4bd32767 cancel running tests if new commit to branch is made 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-24 13:08:04 +01:00
dev-sec CI 85271c2375 update changelog 2023-01-24 12:01:58 +00:00
Sebastian Gumprich bb588bd777 linting (#603) 
* linting

Signed-off-by: Sebastian Gumprich <[email protected]>

* more linting

Signed-off-by: Sebastian Gumprich <[email protected]>

* change line length issues

Signed-off-by: Sebastian Gumprich <[email protected]>

* replace yes with true in tasks

Signed-off-by: Sebastian Gumprich <[email protected]>

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

Signed-off-by: Sebastian Gumprich <[email protected]>

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

Signed-off-by: Sebastian Gumprich <[email protected]>

* add exception for task

Signed-off-by: Sebastian Gumprich <[email protected]>

* remove trailing whitespace

* add back deleted params

Signed-off-by: Sebastian Gumprich <[email protected]>

* add back deleted params

Signed-off-by: Sebastian Gumprich <[email protected]>

* add back tasks

Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-24 12:40:27 +01:00
dev-sec CI a94168c84f update changelog 2023-01-23 09:52:21 +00:00
DonEstefanschurziDonEstefanSebastian GumprichSebastian Gumprich
 		674be6dc6f apply password age settings to exisiting regular users (#582) 
* apply password age settings to regular users

* add tests for password ageing

Signed-off-by: Sebastian Gumprich <[email protected]>

* add debugging vars

Signed-off-by: Sebastian Gumprich <[email protected]>

* add tests for password ageing

Signed-off-by: Sebastian Gumprich <[email protected]>

* add tests for password ageing

Signed-off-by: Sebastian Gumprich <[email protected]>

* Apply suggestions from code review

Co-authored-by: schurzi <[email protected]>

* add additional condtion for regular users

Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: DonEstefan <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: schurzi <[email protected]>
 2023-01-23 10:50:05 +01:00
dev-sec CI c1080de135 update changelog 2023-01-23 08:37:51 +00:00
stdtom 9d2c68ef2f Preserve default ownership and dir mode for /var/log on Ubuntu (#615) 
* Preserve default ownership and dir mode for /var/log on Ubuntu

Signed-off-by: stdtom <[email protected]>

* linting

Signed-off-by: stdtom <[email protected]>

* Define vars for each OS instead of using defaults.

Signed-off-by: stdtom <[email protected]>

* Fix values for os_mnt_var_log_dir_mode and os_mnt_var_log_group

Signed-off-by: stdtom <[email protected]>

Signed-off-by: stdtom <[email protected]>
 2023-01-23 09:34:41 +01:00
dev-sec CI c0b9c87dc1 update changelog 2023-01-19 12:47:40 +00:00
Sebastian Gumprich 142782bad6 add diff to molecule 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-19 13:46:16 +01:00
rndmh3ro b3fbfcedbe Prettified Code! 2023-01-19 12:45:51 +00:00
Paweł KrawczykPaweł KrawczykSebastian Gumprich
 		88ef3cf3af Parametrize more auditd.conf options (#535) 
* Parametrize more auditd.conf options

* Parametrize more auditd.conf options

* Add `os_auditd` options

* Add os_auditd_log_group

* Add os_auditd_log_group

Co-authored-by: Paweł Krawczyk <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
 2023-01-19 13:45:24 +01:00
dev-sec CI ca25f50ba6 update changelog 2023-01-12 11:56:07 +00:00
richardlock a82942a63a Add support for /etc/auditd.conf num_logs to go with max_log_file_action. (#617) 
Signed-off-by: Richard Lock <[email protected]>

Signed-off-by: Richard Lock <[email protected]>
 2023-01-12 12:52:48 +01:00
dev-sec CI fc060376ac update changelog 2022-12-24 09:43:18 +00:00
dependabot[bot] 16f78bc6be Bump actions/setup-python from 1 to 4 (#611) 
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 1 to 4.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v1...v4)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2022-12-24 10:28:54 +01:00
dev-sec CI 764472ae33 update galaxy.yml with new version 2022-12-19 08:43:22 +00:00
dependabot[bot] 395091c41d Bump creyD/prettier_action from 3.1 to 4.2 (#610) 
Bumps [creyD/prettier_action](https://github.com/creyD/prettier_action) from 3.1 to 4.2.
- [Release notes](https://github.com/creyD/prettier_action/releases)
- [Commits](https://github.com/creyD/prettier_action/compare/v3.1...v4.2)

---
updated-dependencies:
- dependency-name: creyD/prettier_action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2022-12-17 19:53:05 +01:00
dev-sec CI 0a589e5f51 update changelog 2022-12-17 18:49:42 +00:00
John Losito 9d0cc42039 Check for github action updates daily (#609) 
Signed-off-by: John Losito <[email protected]>

Signed-off-by: John Losito <[email protected]>
8.4.0 		2022-12-17 19:48:02 +01:00
dev-sec CI 5a7783defe update changelog 2022-12-07 07:55:29 +00:00
Sebastian Gumprichandschurzi be0642bcfb add verify-task to check if mysql is running and enabled (#608) 
* add verify-task to check if mysql is running and enabled

Signed-off-by: Sebastian Gumprich <[email protected]>

* Update molecule/mysql_hardening/verify_tasks/service.yml

Co-authored-by: schurzi <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: schurzi <[email protected]>
 2022-12-07 08:49:07 +01:00
dev-sec CI b0454fade2 update changelog 2022-11-30 15:15:52 +00:00
DonEstefananddonestefan bb3c63e321 fix IPv6 hardening (#607) 
Signed-off-by: DonEstefan <[email protected]>

Signed-off-by: DonEstefan <[email protected]>
Co-authored-by: donestefan <[email protected]>
 2022-11-30 16:13:25 +01:00
dev-sec CI d3e6df3dbf update changelog 2022-11-29 14:11:39 +00:00
Sebastian GumprichandFlorian Goth e66c2eb6bb Add OpenSUSE support (#605) 
* Add variables for mariadb on opensuse

Signed-off-by: Florian Goth <[email protected]>

* enable pipeline

Signed-off-by: Florian Goth <[email protected]>

* add a note about the reuirement of the jmespath library.

Signed-off-by: Florian Goth <[email protected]>

* Use python3 on opensuse

Signed-off-by: Florian Goth <[email protected]>

* fix my yml.

Signed-off-by: Florian Goth <[email protected]>

* use right ansible variable

Signed-off-by: Florian Goth <[email protected]>

* Suse requires python-rpm

Signed-off-by: Florian Goth <[email protected]>

* try zypper

Signed-off-by: Florian Goth <[email protected]>

* python-xml

Signed-off-by: Florian Goth <[email protected]>

* another try at fixing the install

Signed-off-by: Florian Goth <[email protected]>

* fix my yml

Signed-off-by: Florian Goth <[email protected]>

* another try

Signed-off-by: Florian Goth <[email protected]>

* another try

Signed-off-by: Florian Goth <[email protected]>

* another try now with rpm.

Signed-off-by: Florian Goth <[email protected]>

* fix my yml...

Signed-off-by: Florian Goth <[email protected]>

* typo

Signed-off-by: Florian Goth <[email protected]>

* do the test for Suse on the shell and not in ansible

Signed-off-by: Florian Goth <[email protected]>

* specify to use bash

Signed-off-by: Florian Goth <[email protected]>

* specify to use bash

* try the removes keyword of builtin.shell

Signed-off-by: Florian Goth <[email protected]>

* fix ansible syntax

Signed-off-by: Florian Goth <[email protected]>

* fix zypper syntax

Signed-off-by: Florian Goth <[email protected]>

* ensure pymysql is present

Signed-off-by: Florian Goth <[email protected]>

* set ansible python interpreter in converge-step, too

Signed-off-by: Sebastian Gumprich <[email protected]>

* move install task to prepare

Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Florian Goth <[email protected]>
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Florian Goth <[email protected]>
 2022-11-29 15:09:27 +01:00
dev-sec CI 61e92aaaf6 update changelog 2022-11-24 07:41:20 +00:00
Jacob Sievert ade6deeba2 Updates handlers for new ansible syntax and deprecated options for legacy commands (#602) 
* Update main.yml

fixes the handler file and set new syntax

Signed-off-by: Jacob Sievert <[email protected]>

* changes command module from legacy to builtin.

Signed-off-by: Jacob Sievert <[email protected]>

Signed-off-by: Jacob Sievert <[email protected]>
 2022-11-24 08:39:05 +01:00
dev-sec CI 66f5c6b131 update changelog 2022-11-23 12:51:31 +00:00
Cristian Baldi 7d1da63c94 Allow ssh_allow_tcp_forwarding to be a boolean (#600) 
* Allow ssh_allow_tcp_forwarding to be a boolean

Signed-off-by: Cristian Baldi <[email protected]>

* Update documentation related to ssh_allow_tcp_forwarding

Signed-off-by: Cristian Baldi <[email protected]>

Signed-off-by: Cristian Baldi <[email protected]>
 2022-11-23 13:45:01 +01:00
dev-sec CI 03f3974f37 update changelog 2022-11-17 13:01:02 +00:00
schurzi 006e3bf75b Merge pull request #601 from dev-sec/contribute_dco 
add notice to sign-off work to contributor guideline
 2022-11-17 13:58:08 +01:00
Martin Schurz 98c645db5f add notice to sign-off work to contributor guideline 
Signed-off-by: Martin Schurz <[email protected]>
 2022-11-17 13:47:11 +01:00
dev-sec CI dd97a90b65 update changelog 2022-11-08 09:29:35 +00:00
schurzi d982a89cc1 Merge pull request #598 from dennisse/master 
OpenBSD does not support GSSAPI Authentication
 2022-11-08 10:26:42 +01:00
Dennis Eriksen 681898bd96 OpenBSD does not support GSSAPIAuthentication 
... and freaks out when it is mentioned in the config files. So let's
just remove the GSSAPI-stuff.

Signed-off-by: Dennis Eriksen <[email protected]>
 2022-11-08 09:12:18 +01:00
dev-sec CI e32d550e9b update changelog 2022-11-04 11:03:08 +00:00
Dennis Eriksen 4df95e3733 OpenBSD does not set distributiuon_major_version (#597) 
This role fails with `The task includes an option with an undefined variable` on OpenBSD because `distributiuon_major_version` is not set on OpenBSD.

We should either default to "" if the variable is not set, or remove `vars/OpenBSD.yml`. I would prefer the former :)

Signed-off-by: Dennis Eriksen <[email protected]>

Signed-off-by: Dennis Eriksen <[email protected]>
 2022-11-04 12:00:55 +01:00
dev-sec CI 05205eb413 update changelog 2022-11-01 17:13:21 +00:00
schurzi d0407b17c4 Merge pull request #596 from dev-sec/templates 
add Ansible specific templates for issues
 2022-11-01 18:10:59 +01:00
Martin Schurz 1346e37e14 actually add templates ... 
Signed-off-by: Martin Schurz <[email protected]>
 2022-10-28 10:26:00 +02:00
dev-sec CI c2ee3105c7 update changelog 2022-10-28 05:16:41 +00:00
schurzi 613fbd82da use github templates for new issues (#595) 
Signed-off-by: Martin Schurz <[email protected]>

Signed-off-by: Martin Schurz <[email protected]>
 2022-10-28 07:14:58 +02:00
dev-sec CI 9530615d5f update galaxy.yml with new version 2022-10-27 18:48:57 +00:00
dev-sec CI 24d0153815 update changelog 2022-10-27 18:46:03 +00:00
schurzi 99fe8b6969 Merge pull request #594 from dlouzan/fix/type-cast-variables 
fix(os_hardening): cast expected int types in pam tasks
8.3.0 		2022-10-27 20:43:17 +02:00
Martin Schurz f496b385dd use github templates for new issues 
Signed-off-by: Martin Schurz <[email protected]>
 2022-10-27 20:41:06 +02:00
Diego Louzán f8295d5248 fix(os_hardening): cast expected int types in pam tasks 
Signed-off-by: Diego Louzán <[email protected]>
 2022-10-27 16:50:08 +02:00