andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,389 Commits 14 Branches 64 Tags
91424ac209119ba4bdf082a29698c20150009e28
Commit Graph
103 Commits
Author SHA1 Message Date
Farid Joubbi 91424ac209 Improvements of comments in opensshd.conf.j2 #338 (#339) 
* Fixed some comments that had issues. See #338

* Cut some long comments into two rows for easier reading.

Signed-off-by: joubbi <[email protected]>
 2020-12-12 20:35:38 +01:00
szEvEz 13b09a0f23 Improve README for ssh_hardening (#335) 
Signed-off-by: szEvEz <[email protected]>
 2020-11-24 12:29:46 +01:00
Sebastian Gumprich f2804c7c19 Merge branch 'master' into collection 2020-11-11 21:08:54 +01:00
Sebastian Gumprich d857830979 minor readme fixes 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2020-11-09 20:49:07 +01:00
rndmh3ro c94d973527 Prettified Code! 2020-11-08 10:20:25 +00:00
Sebastian Gumprich c8ada5c13c Merge branch 'migrate_os' into collection 2020-11-08 11:18:38 +01:00
Sebastian Gumprich dd3959276b merge os-hardening role into collection 2020-11-07 22:09:28 +01:00
Sebastian Gumprich 598f7183f8 remove os submodule 2020-11-07 21:49:25 +01:00
Sebastian Gumprich 66e88a34d1 Merge branch 'migrate_mysql' into collection 2020-11-07 21:48:11 +01:00
Sebastian Gumprich a10e4d7c1a merge mysql-hardening role into collection 2020-11-07 21:48:10 +01:00
Sebastian Gumprich 51a7fed83d remove mysql submodule 2020-11-07 21:48:06 +01:00
Sebastian Gumprich cc48e4761a Merge branch 'migrate_nginx' into collection 2020-11-07 21:47:46 +01:00
Sebastian Gumprich e406349064 merge nginx-hardening role into collection 2020-11-07 21:47:45 +01:00
Sebastian Gumprich 5aa3701de9 remove nginx submodule 2020-11-07 21:47:43 +01:00
Sebastian Gumprich d49e05f8e8 Merge branch 'migrate_ssh' into collection 2020-11-07 21:46:48 +01:00
Sebastian Gumprich a46642ee92 merge ssh-hardening role into collection 2020-11-07 21:46:45 +01:00
Sebastian Gumprich 4e322edc62 remove ssh submodule 2020-11-07 21:46:32 +01:00
Sebastian Gumprich ac3c12d264 move to collections 2020-11-07 21:19:43 +01:00
Sebastian Gumprich 877449997f New role layout. Fix #6 2016-01-08 17:00:57 +01:00
Sebastian Gumprich ea213d636c Change directory structure. Fix #43 2015-10-27 20:41:36 +01:00
Sebastian Gumprich 7eb8b4f3d3 Change directory layout. fix #48 
This change gets rid of the separate role dir
and puts everything into the root-directory, making
it possible to install the role via ansible galaxy.
 2015-10-21 20:52:46 +02:00
fitz123 c49d519b1f sftp_enable option 2015-10-21 22:28:01 +07:00
Florian Heinle e21e62a0dc fix mysql restart not happening because of missing os specific variable 2015-10-17 18:30:56 +02:00
Florian Heinle a5d342a01a Allow whitelisted groups on ssh 
Setting ssh_allow_groups does not work when set since the corresponding if-check tests for the wrong variable
 2015-10-16 19:40:28 +02:00
fitz123 519160b8e7 remove duplicate "update pam" task 2015-10-13 15:37:45 +07:00
fitz123 78fb438a10 Fix stuck in case pam files was updated before by force update 2015-09-30 22:11:37 +07:00
fitz123 893b39181e bugfix. Now option true for PrintLastLog is available again 2015-09-28 06:24:13 +07:00
fitz123 b013986f61 Fix passwdqc default options 2015-09-24 02:51:56 +07:00
fitz123 afa3be1e6a Fix nologin shell path for Oracle and RedHat 2015-09-24 02:16:51 +07:00
fitz123 c5307b36f0 Fix nologin shell path 2015-09-24 00:56:09 +07:00
Christoph Hartmann 9a3af69485 Merge pull request #35 from hardening-io/pam_selinux 
Support for selinux and pam. fix #23
 2015-09-22 19:58:58 +02:00
Sebastian Gumprich d3e01b75d6 Change variable for hmac from server to client 
in the openssh client configuration a server variable was used.
 2015-08-31 21:10:00 +02:00
Sebastian Gumprich 7b5fa53f3a Update kitchen-ansible, remove separate debian install 
Due to the new kitchen-ansible version it is now
possible to install ansible on all major OS's via a
ansible omnibus script which is provided by
kitchen ansible. There's no more need to separate
the debian tests.

Also removed whitespace.
 2015-08-29 14:13:17 +02:00
Sebastian Gumprich adc8462838 Revamp conditionals again 2015-08-17 15:31:45 +00:00
Sebastian Gumprich 7b934e415c Add another conditional 2015-08-17 17:16:17 +00:00
Sebastian Gumprich b17bd65870 Add more conditionals 2015-08-17 17:08:16 +00:00
Sebastian Gumprich 9560f33329 Change last task again 2015-08-17 17:04:47 +00:00
Sebastian Gumprich be38ac75f4 Add selinux-check 2015-08-16 20:37:33 +00:00
Sebastian Gumprich 1ff939db76 Use correct variable and change travis-test 2015-08-14 17:44:12 +00:00
Sebastian Gumprich a1a439d38e Add mode to su-binary task. Fix #38 2015-08-13 21:02:57 +00:00
Sebastian Gumprich c4482cb12e Support for selinux and pam. fix #23 
This change add the following:

- it checks wether selinux is in "Enforcing" mode
- when selinux is enforcing, it copies a new selinux-policy to the host
- this policy allows sshd to read the shadow-file directly, which is forbidden by selinux otherwise
- the policy is then compiled, a package is created and the policy is installed
- when selinux is enforcing, pam is used and the policy is not disabled, it gets removed,
  because its considered a security risk. see here: http://danwalsh.livejournal.com/12333.html
 2015-08-10 21:45:15 +00:00
Sebastian Gumprich ef8c4ada2f Separate ssh client and server ports. Fix #33 
This PR separates the ssh_ports variable into two separate
variables for the ssh-client and ssh-server.
 2015-08-09 11:16:34 +00:00
Christoph Hartmann 950210348f Merge pull request #31 from hardening-io/max_auth_tries 
Make MaxAuthTries configurable
 2015-08-06 23:39:14 -07:00
Sebastian Gumprich 2bc353b7a9 Make MaxAuthTries configurable 2015-08-06 14:20:32 +00:00
Sebastian Gumprich 9befb22e13 Change oneliner if-statements to be more readable 2015-08-06 14:00:14 +00:00
Sebastian Gumprich df8b205a8f Change oneliner if-statements to be more readable 2015-08-06 13:53:33 +00:00
Robin Schneider 10f6544f3c Make ssh client password login configurable. 
Defaults to not allow which might be a bit restrictive.
 2015-08-04 15:17:50 +02:00
Sebastian Gumprich 60e898098d Fix join-filter, jinja-cases, spelling, whitespace 
- the join filter is replaced by '+'
- the if-cases for rhel-based OS'es is simplified
- intendation of complex if-cases
 2015-07-29 20:52:53 +00:00
Sebastian Gumprich bda8d52083 Merge pull request #26 from ypid/role-review 
Fixed role's join-filter, jinja-cases, spelling, whitespace
 2015-07-29 13:27:46 +00:00
Robin Schneider a2f4542a48 Short role review. Fixed role when ssh_client_weak_kex == true. 
* This role uses the Jinja2 `join` filter quite creatively, please fix this. This patch fixes one instance.
* Make full use of Jinja2 features. E.g. use `if ansible_os_family in ['Oracle Linux', 'RedHat']` for example. This patch fixes one instance.
* Fixed spelling.
* Removed whitespace.
 2015-07-28 21:21:32 +02:00