makes it possible to set different values for motd via sshd and pam.
Also create a backup file of pam configuration, to allow user to restore
the previous settings.
Signed-off-by: Martin Schurz <[email protected]>
Numbers with leading zeros need to be quoted in Ansible, otherwise they
are interpreted as octal. Which the templating happily writes out in...
decimal.
In this case, sftp_umask 0027 was ending up as 23 in sshd.conf.
Signed-off-by: Alex Waite <[email protected]>
* rework CRYPTO_POLICY handling for fedora
the previous implementation did not handle fedora right. Now we check if
a CRYPTO_POLICY is present regardless of the OS version.
Signed-off-by: Martin Schurz <[email protected]>
* improve tasks for CRYPTO_POLICY
Signed-off-by: Martin Schurz <[email protected]>
* add exception for Archlinux
Signed-off-by: Martin Schurz <[email protected]>
* swap conditions
Signed-off-by: Martin Schurz <[email protected]>
* improve local testing
don't use privileged mode, since this grants too much permissions.
Fixes several problems with PAM in test images.
REorder options in kitchen configuration to simplify it.
Signed-off-by: Martin Schurz <[email protected]>
* check all controls in travis
Signed-off-by: Martin Schurz <[email protected]>
* set env vars in travis correctly
according to documentation: https://docs.travis-ci.com/user/environment-variables/
Signed-off-by: Martin Schurz <[email protected]>
* add arch linux to local tests
Signed-off-by: Martin Schurz <[email protected]>
* shorten travis config
Signed-off-by: Martin Schurz <[email protected]>
* use correct init command for containers
Signed-off-by: Martin Schurz <[email protected]>
* try privileged again
Signed-off-by: Martin Schurz <[email protected]>
* arch seems to like privilege
Signed-off-by: Martin Schurz <[email protected]>
* add testing for CentOS8
Adds testing environments for CentOS8 to local Kitchen and remote Travis
tests. Currently only local Kitchen Docker tests are verified.
Signed-off-by: Martin Schurz <[email protected]>
* disable system wide CRYPTO_POLICY on RHEL8+
by default sshd will not use the crypto settings from sshd_config. To
make the settings effective we need to disable the system wide
CRYPTO_POLICY.
see: https://access.redhat.com/solutions/4410591
Signed-off-by: Martin Schurz <[email protected]>
* Set volume variable for travis tests to use cgroups mount where needed
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Add section called "Changing the default port and idempotency" and reference to role ssh-hardening-fallback, a wrapper around this role which implements a fallback to port 22 when the configured port is unreachable.
Signed-off-by: Nuno Godinho <[email protected]>
Sebastian Gumprich