* add role argument spec for os, ssh, mysql
Signed-off-by: Sebastian Gumprich <[email protected]>
* add role argument spec for os, ssh, mysql
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove variable in variable as it cannot be used in argument spec
Signed-off-by: Sebastian Gumprich <[email protected]>
* fix wrong syntax
* fix spelling errors
Signed-off-by: Sebastian Gumprich <[email protected]>
* cannot use vars before arg-spec validation
Signed-off-by: Sebastian Gumprich <[email protected]>
* yamllint the arg-spec
Signed-off-by: Sebastian Gumprich <[email protected]>
* add back variable
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove redundant setting in tests
* fix descriptions in mysql hardening to betterreflect what they do
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove duplicate empty line
Signed-off-by: Sebastian Gumprich <[email protected]>
* set correct defaults on to ssl options
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove left-over hidepid argument spec
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove license and author infos, this lives in the collection readme
Signed-off-by: Sebastian Gumprich <[email protected]>
* fix styling
Signed-off-by: Sebastian Gumprich <[email protected]>
* update some descriptions and sort them in the readme
Signed-off-by: Sebastian Gumprich <[email protected]>
* some more linting
Signed-off-by: Sebastian Gumprich <[email protected]>
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
* make template overrideable
by referencing the auditd.conf.j2 template, a custom template can be provided to the role.
Signed-off-by: Dennis Lerch <[email protected]>
* extend auditd config
make freq and log_file configurable
implement write_logs with it's default value in order to be able to disable log writing
Signed-off-by: Dennis Lerch <[email protected]>
* Extend README.md documentation by new variables
reorder `os_auditd_log_format` to keep sequence from defaults
Signed-off-by: Dennis Lerch <[email protected]>
---------
Signed-off-by: Dennis Lerch <[email protected]>
* rewrite user home dir hardening
* delete duplicate var that was missed in a merge conflict
Signed-off-by: Sebastian Gumprich <[email protected]>
* linting
Signed-off-by: Sebastian Gumprich <[email protected]>
* add tests for home rewrites
Signed-off-by: Sebastian Gumprich <[email protected]>
* Apply suggestions from code review
Co-authored-by: schurzi <[email protected]>
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: donestefan <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: schurzi <[email protected]>
* rework filesystem hardening
- removed a lot duplicated code by using a loop
- added new hardening options for /tmp
- added new options "passno" and "dump" for every filesystem.
currently ansible changed that values to 0 for every fs
new default depends on fstype, can be overwriten in config
- removed default fstype in config
the type will now be autodetected, can be overwriten in config
- mount src setting is now optional
the source will now be autodetected, can be overwriten in config
- it will be now checked, if it is really a mount
- changed fs reload to handler
- removed check os_auditd_enabled on /var/log/audit
Signed-off-by: divialth <[email protected]>
* fix lint errors
Signed-off-by: divialth <[email protected]>
* implemented the name suggestions
Signed-off-by: divialth <[email protected]>
Signed-off-by: divialth <[email protected]>
add option to whitelist specific user that need a .netrc file in there home dirs
add test for .netrc files if option os_netrc_enabled is false
Signed-off-by: Philipp Funk <[email protected]>
Signed-off-by: Philipp Funk <[email protected]>
Co-authored-by: Philipp Funk <[email protected]>
dev-sec CI