* add VM tests for ssh_hardening
Signed-off-by: Martin Schurz <[email protected]>
* remove VM tests from ssh_hardening
Signed-off-by: Martin Schurz <[email protected]>
* run ssh_hardening test as unprivileged user
Signed-off-by: Martin Schurz <[email protected]>
* add link for documentation
Signed-off-by: Martin Schurz <[email protected]>
* use different config
Signed-off-by: Martin Schurz <[email protected]>
* remove become
Signed-off-by: Martin Schurz <[email protected]>
* re-add become
Signed-off-by: Martin Schurz <[email protected]>
* move become into role
Signed-off-by: Martin Schurz <[email protected]>
* indentation
Signed-off-by: Martin Schurz <[email protected]>
* try args apply
Signed-off-by: Martin Schurz <[email protected]>
* fix linting
Signed-off-by: Martin Schurz <[email protected]>
* add documentation
Signed-off-by: Martin Schurz <[email protected]>
Signed-off-by: Martin Schurz <[email protected]>
```
Unable to open /var/log/audit/audit.log (Permission denied)
```
This PR fixes the issue by using the default permission set by auditd (`0700`).
Signed-off-by: Benedikt Böhm <[email protected]>
* Only run harding if /var/log/audit exists
Signed-off-by: GitHub <[email protected]>
* Update roles/os_hardening/tasks/minimize_access.yml
* add more conditionals to when auditd show be hardened
Signed-off-by: Sebastian Gumprich <[email protected]>
* add more tests to the os-hardening vm tests
Signed-off-by: Sebastian Gumprich <[email protected]>
* Revert "add more tests to the os-hardening vm tests"
This reverts commit c05fe8b520.
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
* first testing with tasks and variables
Signed-off-by: Ludwig Bayerlein <[email protected]>
* update variables for dir options
Signed-off-by: Ludwig Bayerlein <[email protected]>
* updated permissions and defaults
Signed-off-by: Ludwig Bayerlein <[email protected]>
* fix home dir permissions
Signed-off-by: Ludwig Bayerlein <[email protected]>
* updated tasks with useful variables
Signed-off-by: Ludwig Bayerlein <[email protected]>
* reorder tasks. first remount, then manage fstab and fix permissions on directories. Renaming task names with mountpoints (slashes)
Signed-off-by: Ludwig Bayerlein <[email protected]>
* shorten tasks with list items
Signed-off-by: Ludwig Bayerlein <[email protected]>
* change defaults for /boot directory, because its a bad behaviour, if ansible changes boot entries with a default value
Signed-off-by: Ludwig Bayerlein <[email protected]>
* Update documentation for new parameters to manage mountpoints
Signed-off-by: Ludwig Bayerlein <[email protected]>
* Update roles/os_hardening/tasks/minimize_access.yml
Co-authored-by: Sebastian Gumprich <[email protected]>
Signed-off-by: Ludwig Bayerlein <[email protected]>
* Update roles/os_hardening/tasks/minimize_access.yml
Co-authored-by: Sebastian Gumprich <[email protected]>
Signed-off-by: Ludwig Bayerlein <[email protected]>
* Fix state on every new task
Signed-off-by: Ludwig Bayerlein <[email protected]>
* loop instead of list
Signed-off-by: Ludwig Bayerlein <[email protected]>
* testing remount with register
Signed-off-by: Ludwig Bayerlein <[email protected]>
* add remounts with loop over all changed folders
Signed-off-by: Ludwig Bayerlein <[email protected]>
* testing and solving trouble with variable names
Signed-off-by: Ludwig Bayerlein <[email protected]>
* optimize default permissions for var-log-audit
Signed-off-by: Ludwig Bayerlein <[email protected]>
* optimize default permissions for var-log-audit
Signed-off-by: Ludwig Bayerlein <[email protected]>
* change to new optimizied permissions of var-log-audit
Signed-off-by: Ludwig Bayerlein <[email protected]>
* fix some defaults in fstab to configure as mounted
Signed-off-by: Ludwig Bayerlein <[email protected]>
* add stat and check, if boot folder exists
Signed-off-by: Ludwig Bayerlein <[email protected]>
Co-authored-by: Ludwig Bayerlein <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
schurzi