andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,821 Commits 14 Branches 64 Tags
a1b80fe657e26d4da032a0554058dbd6a31e8a25
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
schurzi a1b80fe657 adopt all current suggestions from ansible-lint (#592) 2022-10-24 09:42:23 +02:00
schurzi c1cd6c5ac3 change default to allow SFTP (#564) 
* change default to allow SFTP

Signed-off-by: Martin Schurz <[email protected]>

* add documentation

Signed-off-by: Martin Schurz <[email protected]>

* diasble sftp for default tests

Signed-off-by: Martin Schurz <[email protected]>

* extend documentation

Signed-off-by: Martin Schurz <[email protected]>

* fix typo

Signed-off-by: Martin Schurz <[email protected]>

* correct ssh version

Signed-off-by: Martin Schurz <[email protected]>

Signed-off-by: Martin Schurz <[email protected]>
 2022-08-22 10:03:37 +02:00
schurzi a806ec8598 add posibility to run ssh_hardening as unprivileged user (#561) 
* add VM tests for ssh_hardening

Signed-off-by: Martin Schurz <[email protected]>

* remove VM tests from ssh_hardening

Signed-off-by: Martin Schurz <[email protected]>

* run ssh_hardening test as unprivileged user

Signed-off-by: Martin Schurz <[email protected]>

* add link for documentation

Signed-off-by: Martin Schurz <[email protected]>

* use different config

Signed-off-by: Martin Schurz <[email protected]>

* remove become

Signed-off-by: Martin Schurz <[email protected]>

* re-add become

Signed-off-by: Martin Schurz <[email protected]>

* move become into role

Signed-off-by: Martin Schurz <[email protected]>

* indentation

Signed-off-by: Martin Schurz <[email protected]>

* try args apply

Signed-off-by: Martin Schurz <[email protected]>

* fix linting

Signed-off-by: Martin Schurz <[email protected]>

* add documentation

Signed-off-by: Martin Schurz <[email protected]>

Signed-off-by: Martin Schurz <[email protected]>
 2022-08-15 13:19:07 +02:00
schurzi b56c801574 add basic support for ubuntu22.04 (#554) 
Signed-off-by: Martin Schurz <[email protected]>

Signed-off-by: Martin Schurz <[email protected]>
 2022-08-15 13:05:09 +02:00
schurzi e03e435517 Merge pull request #547 from dev-sec/vm_tests 
add VM tests for os_hardening
 2022-07-11 21:57:21 +02:00
Martin Schurz 27d091e871 reduce testing on vm 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-11 16:08:35 +02:00
Martin Schurz c81ce23ed7 disable ctrl+alt+del for vm tests 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-11 13:04:14 +02:00
Martin Schurz 72cb97c8d5 remove waivers file from docker test config 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-11 12:36:48 +02:00
Martin Schurz edda7075a2 add badge for tests 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-11 12:17:34 +02:00
Martin Schurz 0f631c1405 add sysctl exclude 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-11 09:39:52 +02:00
Martin Schurz 5d50b5b130 add sysctl exclude 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-11 09:32:02 +02:00
Martin Schurz 28baf0d581 add sysctl exclude 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-11 09:17:44 +02:00
Martin Schurz 4b519e8b13 add sysctl exclude 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-11 09:13:26 +02:00
Martin Schurz 92dc094022 add sysctl exclude 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-11 09:05:58 +02:00
Martin Schurz fdc6b333c9 exclude arch 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-10 21:30:45 +02:00
Martin Schurz 1825eba27a exclude opensuse 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-10 21:08:50 +02:00
Martin Schurz cd45a58683 fix yum gpg-check task 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-10 20:22:39 +02:00
Martin Schurz 730510c2a7 add opensuse and arch 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-10 15:55:08 +02:00
Martin Schurz fa7f8597d9 fix bug in check for /boot 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-10 13:36:19 +02:00
Martin Schurz b6b2d45f09 speedup ansible 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-09 15:43:59 +02:00
Martin Schurz 9cfe1f2b9a also harden /boot 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-09 15:43:11 +02:00
Martin Schurz e49eacd8ec icrease ressources for test vm 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-09 10:42:20 +02:00
Martin Schurz 7535abd882 remove waiver 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-09 02:22:35 +02:00
Martin Schurz 400e576984 use correct parameter 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-09 01:47:59 +02:00
Martin Schurz 0eddf2872b setup python 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-09 01:19:12 +02:00
Martin Schurz 013a554731 force linking 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-09 00:59:50 +02:00
Martin Schurz 8f3f724380 call correct molecule task 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-09 00:57:26 +02:00
Martin Schurz e742330a41 add testing of os_hardning on vm 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-09 00:52:58 +02:00
schurzi dd919b5cf6 Merge pull request #546 from dev-sec/linting 
Linting
 2022-07-08 18:10:32 +02:00
Martin Schurz 21df60a71f fix includes 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-08 17:24:07 +02:00
Martin Schurz 02b9a20fe7 fix release action 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-07 12:06:34 +02:00
Martin Schurz f627d2fbfd fix release action 
Signed-off-by: Martin Schurz <[email protected]>
 2022-07-07 11:27:51 +02:00
Martin Schurz b32ee28a89 use correct version for github-actions-x/commit 
Signed-off-by: Martin Schurz <[email protected]>
 2022-06-29 15:55:13 +02:00
Martin Schurz 0c8cbb2185 update GitHub action for checkout 
there was a new feature introduced to git, that prevents some of our
actions to run. The updated action handles this properly.

https://github.com/actions/checkout/issues/760

Signed-off-by: Martin Schurz <[email protected]>
 2022-06-29 15:34:39 +02:00
schurzi 9cf1659742 Merge pull request #541 from dev-sec/doc_update 
Improve documentation
 2022-05-04 14:25:21 +02:00
Martin Schurz 79fb86d021 fix linter errors 
Signed-off-by: Martin Schurz <[email protected]>
 2022-05-04 14:12:24 +02:00
Martin Schurz 57944bc56d add ignore to ansible-lint 
Signed-off-by: Martin Schurz <[email protected]>
 2022-05-04 14:03:33 +02:00
Martin Schurz bff23f82cb update ansible-lint action 
Signed-off-by: Martin Schurz <[email protected]>
 2022-05-04 13:57:52 +02:00
Martin Schurz 46b436fc9b update description of ssh_client_alive_count 
Signed-off-by: Martin Schurz <[email protected]>
 2022-05-04 13:48:38 +02:00
Martin Schurz 18d01327eb improve linking to legacy roles 
Signed-off-by: Martin Schurz <[email protected]>
 2022-05-04 13:44:52 +02:00
schurzi dc22dc33a2 Merge pull request #530 from dev-sec/delete_drafts 
delete obsolete release drafts
 2022-02-28 10:20:01 +01:00
Martin Schurz 9d00c8ba29 delete old release drafts 
Signed-off-by: Martin Schurz <[email protected]>
 2022-02-25 20:10:36 +01:00
schurzi 9be3a0520b Merge pull request #526 from dev-sec/nginx_debian_9_tls 
debian 9's nginx doesn't support tls1.3
 2022-02-21 11:49:34 +01:00
schurzi 49b93dc89c Merge pull request #525 from dev-sec/remove_centos_8 
remove centos8 tests
 2022-02-21 11:39:09 +01:00
schurzi 82be5db515 Merge pull request #510 from alegrey91/master 
change hidepid mount task state to mounted
 2021-11-30 10:22:24 +01:00
schurzi ad43f908df prettify nginx options (#509) 
Signed-off-by: Martin Schurz <[email protected]>
 2021-11-29 10:25:43 +01:00
schurzi cb3574ed56 Merge pull request #501 from ksaadDE/patch-3 
Updated dh_params to 4096
 2021-11-28 11:38:39 +01:00
schurzi b0393a12ce Merge pull request #470 from ksaadDE/patch-2 
Add TLSv1.3 to nginx default configuration
 2021-11-15 19:41:49 +01:00
schurzi ff939a2b4c Merge pull request #499 from darxriggs/improvement-arch-linux 
Improve testing: install packages on Arch Linux
 2021-11-07 22:21:58 +01:00
schurzi 12c1f3dd78 Merge pull request #491 from dev-sec/recreate_tests 
revive old tests with custom ssh settings
 2021-10-25 11:12:10 +02:00
schurzi c1974282b1 add old role names to tags in Galaxy (#495) 
We deprecated our roles in Ansible Galaxy the deprecation link contains
a search keyword with the role name and our new collection should be
found, if someone clicks this link.

Signed-off-by: Martin Schurz <[email protected]>
 2021-10-24 12:39:16 +02:00
schurzi 08b0fd14f4 Merge pull request #494 from dev-sec/sysctl-34 
implement sysctl-34 - link protection settings
 2021-10-24 11:21:14 +02:00
schurzi ff37289879 Merge pull request #493 from dev-sec/rndmh3ro-patch-1 
update minimum ansible version for roles
 2021-10-24 11:09:37 +02:00
schurzi 215c8042ad Merge pull request #490 from dev-sec/change_baseline_urlsa 
change baseline urls to full zip-url
 2021-10-18 21:04:05 +02:00
schurzi d7eb00f4b7 Merge pull request #475 from dev-sec/ansible_lint 
use Ansible lint in separate task
 2021-08-15 22:53:41 +02:00
schurzi 430e6c366f Merge pull request #469 from dev-sec/rndmh3ro-patch-1 
fix license in galaxy
 2021-07-23 12:04:59 +02:00
schurzi b24ee631cb fix double space 2021-07-23 12:04:45 +02:00
schurzi 5618655ce5 Merge pull request #465 from dev-sec/rndmh3ro-patch-1 
update metadata to include community.mysql deps
 2021-07-13 16:07:27 +02:00
schurzi 29e10e5c3b add tag always to os dependent vars task (#456) 
when our collection is used with tags, the os dependent variables are
not resolved. This task should run every time, so the behaviour is
correct.

Signed-off-by: Martin Schurz <[email protected]>
 2021-06-29 13:07:25 +02:00
schurzi 2597854735 Merge pull request #449 from lduesing/enable_ipv6 
Removed sysctl that tries to disable IPv6
 2021-05-24 21:12:14 +02:00
schurzi eb28ebe298 Merge pull request #448 from dev-sec/limit_labels 
limit changelog labels to role names
 2021-05-05 23:01:12 +02:00
Martin Schurz 8dbeae7b39 limit changelog labels to role names 
Signed-off-by: Martin Schurz <[email protected]>
 2021-05-05 22:53:20 +02:00
schurzi 66b0fa28e5 Merge pull request #446 from rndmh3ro/fixing 
add back labels to changelog
 2021-05-05 21:06:41 +02:00
schurzi 6e24797d2f Merge pull request #423 from dev-sec/drop_users_wo_passwords 
add new tasks to delete mysql users without passwords
 2021-04-01 22:04:59 +02:00
schurzi add303f2be Merge pull request #437 from BenjaminBoehm/bugfix/ssh-kex-sntrup-openssh8.5 
Fix ssh kex [email protected] for openssh >= 8.5
 2021-04-01 21:13:50 +02:00
schurzi fdadb78080 Merge pull request #438 from dev-sec/remove_depracted_secure-auth 
remove secure-auth param if mysql >= 8.0.3
 2021-04-01 21:07:04 +02:00
schurzi 2882a15ee1 Merge pull request #427 from dev-sec/snoopotic-fix/add_auditd_restart_handler 
add restart-auditd handler after configuration change
 2021-03-29 21:15:46 +02:00
schurzi 0f424469be Merge pull request #432 from joubbi/authtok_type 
os_auth_pam_pwquality_options: Changed type to authtok_type
 2021-03-23 22:01:40 +01:00
schurzi a45eee2204 Merge pull request #431 from joubbi/pwhistory 
Use pam_pwhistory.so instead of pam_unix.so for remembering old passwords
 2021-03-23 09:59:11 +01:00
Martin Schurz d693a8e200 also use requisite for pwhistory 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-23 08:53:49 +01:00
Martin Schurz 0ac56e4c00 Merge branch 'master' into pwhistory 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-23 08:53:23 +01:00
schurzi 5be13e878f Merge pull request #430 from joubbi/comment 
Remove comments from PAM config file, but keep it in the template
 2021-03-23 08:40:20 +01:00
schurzi 69193fe249 Merge pull request #428 from dev-sec/harden_user_home_dires 
Harden user home dirs
 2021-03-22 12:49:48 +01:00
schurzi 876cdab430 Merge pull request #429 from dev-sec/proxy 
add support for using a proxy to test with molecule
 2021-03-21 13:18:03 +01:00
schurzi a64838272c Merge pull request #418 from joubbi/documentation2 
Improve Documentation for sysctl defaults
 2021-03-16 15:49:55 +01:00
schurzi 8706246309 Merge pull request #421 from schurzi/imprel 
Improve Release Action
 2021-03-16 11:26:21 +01:00
Martin Schurz cd4925d411 checkout master between 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-16 11:07:21 +01:00
Martin Schurz d1b8e7d7a3 update paths 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-16 11:00:40 +01:00
Martin Schurz 19d5a17a99 remove second call to changelog generator 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-16 10:56:17 +01:00
schurzi 976f83e88b Merge pull request #420 from dev-sec/fqcn_docs 
remove FQCN from roles in examples
 2021-03-16 10:14:03 +01:00
schurzi 74c729404b Merge pull request #392 from dev-sec/tally 
restructure PAM handling and update for currently supported Linux distributions
 2021-03-16 00:10:36 +01:00
Martin Schurz b2dd73d27e remove unneeded tasks 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-15 23:53:40 +01:00
Martin Schurz ec9d7d2cb8 cleanup and typos 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-15 23:39:12 +01:00
Martin Schurz 5f97dffddf Merge branch 'master' into tally 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-11 19:26:37 +01:00
schurzi 0b945536e2 Merge pull request #405 from joubbi/crontab 
Ensure permissions on cron files and directories are configured
 2021-03-11 17:44:26 +01:00
Martin Schurz 75fc31b80c remove cracklib 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 19:10:45 +01:00
Martin Schurz 10841ced62 case sensitive 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 18:29:55 +01:00
Martin Schurz 335df545fb correct version 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 18:15:33 +01:00
Martin Schurz 6d2c92d4ab correct locale 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 18:14:59 +01:00
Martin Schurz 3334000b97 set locale for test 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 17:45:46 +01:00
Martin Schurz 26d84b5f84 use custom /tmp dir 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 16:46:41 +01:00
Martin Schurz 9b6f313065 move pam tests up 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 15:54:03 +01:00
Martin Schurz 23071a183c add testcases for PAM 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 15:42:13 +01:00
schurzi 8e4c22d8d9 remove FQCN from roles in examples (#404) 
Ansible does not work with FQCN and collections sepcified for including
roles. It is currently expecting to only get the role name in this
context.

Verified with Ansible 2.10.5

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-17 11:34:37 +01:00
Martin Schurz dba53718cf sssd is disabled on Amazonlinus 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-16 20:44:28 +01:00
Martin Schurz 4a5fa70507 default faillock to yes 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-16 19:31:51 +01:00
Martin Schurz 75683161a5 remove FQCN from roles in examples 
Ansible does not work with FQCN and collections sepcified for including
roles. It is currently expecting to only get the role name in this
context.

Verified with Ansible 2.10.5

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 11:26:59 +01:00
schurzi 5d55d29fe2 Merge pull request #403 from wzzrd/gssapi_client_support 
Extend GSSAPI configuration support to ssh_config
 2021-02-15 11:23:57 +01:00
Martin Schurz 64713ce75d add default for new variable 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 11:17:01 +01:00
Martin Schurz ec36bf5b9c document parameter 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 00:22:03 +01:00