* rework filesystem hardening
- removed a lot duplicated code by using a loop
- added new hardening options for /tmp
- added new options "passno" and "dump" for every filesystem.
currently ansible changed that values to 0 for every fs
new default depends on fstype, can be overwriten in config
- removed default fstype in config
the type will now be autodetected, can be overwriten in config
- mount src setting is now optional
the source will now be autodetected, can be overwriten in config
- it will be now checked, if it is really a mount
- changed fs reload to handler
- removed check os_auditd_enabled on /var/log/audit
Signed-off-by: divialth <[email protected]>
* fix lint errors
Signed-off-by: divialth <[email protected]>
* implemented the name suggestions
Signed-off-by: divialth <[email protected]>
Signed-off-by: divialth <[email protected]>
add option to whitelist specific user that need a .netrc file in there home dirs
add test for .netrc files if option os_netrc_enabled is false
Signed-off-by: Philipp Funk <[email protected]>
Signed-off-by: Philipp Funk <[email protected]>
Co-authored-by: Philipp Funk <[email protected]>
* Only run harding if /var/log/audit exists
Signed-off-by: GitHub <[email protected]>
* Update roles/os_hardening/tasks/minimize_access.yml
* add more conditionals to when auditd show be hardened
Signed-off-by: Sebastian Gumprich <[email protected]>
* add more tests to the os-hardening vm tests
Signed-off-by: Sebastian Gumprich <[email protected]>
* Revert "add more tests to the os-hardening vm tests"
This reverts commit c05fe8b520.
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
* first testing with tasks and variables
Signed-off-by: Ludwig Bayerlein <[email protected]>
* update variables for dir options
Signed-off-by: Ludwig Bayerlein <[email protected]>
* updated permissions and defaults
Signed-off-by: Ludwig Bayerlein <[email protected]>
* fix home dir permissions
Signed-off-by: Ludwig Bayerlein <[email protected]>
* updated tasks with useful variables
Signed-off-by: Ludwig Bayerlein <[email protected]>
* reorder tasks. first remount, then manage fstab and fix permissions on directories. Renaming task names with mountpoints (slashes)
Signed-off-by: Ludwig Bayerlein <[email protected]>
* shorten tasks with list items
Signed-off-by: Ludwig Bayerlein <[email protected]>
* change defaults for /boot directory, because its a bad behaviour, if ansible changes boot entries with a default value
Signed-off-by: Ludwig Bayerlein <[email protected]>
* Update documentation for new parameters to manage mountpoints
Signed-off-by: Ludwig Bayerlein <[email protected]>
* Update roles/os_hardening/tasks/minimize_access.yml
Co-authored-by: Sebastian Gumprich <[email protected]>
Signed-off-by: Ludwig Bayerlein <[email protected]>
* Update roles/os_hardening/tasks/minimize_access.yml
Co-authored-by: Sebastian Gumprich <[email protected]>
Signed-off-by: Ludwig Bayerlein <[email protected]>
* Fix state on every new task
Signed-off-by: Ludwig Bayerlein <[email protected]>
* loop instead of list
Signed-off-by: Ludwig Bayerlein <[email protected]>
* testing remount with register
Signed-off-by: Ludwig Bayerlein <[email protected]>
* add remounts with loop over all changed folders
Signed-off-by: Ludwig Bayerlein <[email protected]>
* testing and solving trouble with variable names
Signed-off-by: Ludwig Bayerlein <[email protected]>
* optimize default permissions for var-log-audit
Signed-off-by: Ludwig Bayerlein <[email protected]>
* optimize default permissions for var-log-audit
Signed-off-by: Ludwig Bayerlein <[email protected]>
* change to new optimizied permissions of var-log-audit
Signed-off-by: Ludwig Bayerlein <[email protected]>
* fix some defaults in fstab to configure as mounted
Signed-off-by: Ludwig Bayerlein <[email protected]>
* add stat and check, if boot folder exists
Signed-off-by: Ludwig Bayerlein <[email protected]>
Co-authored-by: Ludwig Bayerlein <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Files in this whitelist should not be altered.
Currently this is only relevant for enforcing the gpg check.
Signed-off-by: René Scheibe <[email protected]>
* new function to disable ctrl-alt-del to avooid reboot virtual machines f.e.
Signed-off-by: Ludwig Bayerlein <[email protected]>
* fix variable documentation for ctrlaltdel
Signed-off-by: Ludwig Bayerlein <[email protected]>
* added ctrlaltdel variable for molecule
Signed-off-by: Ludwig Bayerlein <[email protected]>
* optimize ctrlaltdel function with a 'when' query. thanks to rndmh3ro
Signed-off-by: Ludwig Bayerlein <[email protected]>
* fix typo in new file
Co-authored-by: Ludwig Bayerlein <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
The tasks `Change shadow ownership to root and mode to 0600` and `Change
passwd ownership to root and mode to 0644` only handle
`/etc/shadow` and `/etc/passwd` respectively. But there multiple
adjacent files that should be handled with these rules as well:
- `/etc/gshadow`
- `/etc/shadow-`
- `/etc/gshadow-`
- `/etc/group`
- `/etc/shadow-`
- `/etc/group-`
This change adds those files to the rules, so that permissions are
handled in the same way.
Closes: #488
Signed-off-by: Claudius Heine <[email protected]>
* use os_family instead of distribution for debian systems
Signed-off-by: rndmh3ro <[email protected]>
* remove tasks related to rhel6 or debian 6
Signed-off-by: rndmh3ro <[email protected]>
* add rocky linux 8 tests and make sure that all relevant tasks are executed
Signed-off-by: rndmh3ro <[email protected]>
* fix missing quote
Signed-off-by: rndmh3ro <[email protected]>
when our collection is used with tags, the os dependent variables are
not resolved. This task should run every time, so the behaviour is
correct.
Signed-off-by: Martin Schurz <[email protected]>
When `import_tasks` is used, the task `Fetch OS dependent variables`
always runs, even when excluded by an upstream tag.
When `Fetch OS dependent variables` runs while excluded via tags, it
will always fail with the following.
```
fatal: [alpha]: FAILED! => {"msg": "No file was found when using first_found. Use errors='ignore' to allow this task to be skipped if no files are found"}
```
This brings os_hardening's main.yml in line with ssh_hardening's
main.yml, which doesn't have this issue.
Signed-off-by: Colin Adler <[email protected]>
Diego Louzán