Commit Graph
25 Commits
Author SHA1 Message Date
schurziandSebastian Gumprich a75e2c028b change inclusion of os specific defaults (#353)
* change inclusion of os specific defaults

we now include the os specific options into a separate variable and
merge this with the default ansible namespace, when the corresponding
keys do not already exist (eg. are defined by default oder by user)

Signed-off-by: Martin Schurz <[email protected]>

* simplify check for os specific variables

Signed-off-by: Martin Schurz <[email protected]>

* add test for variable override

Signed-off-by: Martin Schurz <[email protected]>

* move tests to verify stage

Signed-off-by: Martin Schurz <[email protected]>

* correct grep

Signed-off-by: Martin Schurz <[email protected]>

* linting

Signed-off-by: Martin Schurz <[email protected]>

* fix typo

Signed-off-by: Martin Schurz <[email protected]>

* Revert "Merge pull request #351 from sprat/fix-umask"

This reverts commit 9e8e0bc8fb, reversing
changes made to 98c7553016.

Signed-off-by: Martin Schurz <[email protected]>

* move immutable ssh vars to internal vars

Signed-off-by: Martin Schurz <[email protected]>

* move vars to OS files

Signed-off-by: Martin Schurz <[email protected]>

* change default handling for all roles

Signed-off-by: Martin Schurz <[email protected]>

* fix issues

Signed-off-by: Martin Schurz <[email protected]>

* add documentation

Signed-off-by: Martin Schurz <[email protected]>

* Update main.yml

Co-authored-by: Sebastian Gumprich <[email protected]>
2020-12-20 20:46:57 +01:00
schurzi 9e8e0bc8fb Merge pull request #351 from sprat/fix-umask
make the os_env_umask variable usable
2020-12-16 10:39:11 +01:00
schurzi 257504f156 add SuSE support (#328)
Signed-off-by: Martin Schurz <[email protected]>
2020-10-15 08:27:23 +02:00
schurziandSebastian Gumprich c954b8af8f Improve Documentation (#315)
* improve formatting

Signed-off-by: Martin Schurz <[email protected]>

* add limitation for vm.mmap_rnd_bits to documentation

Signed-off-by: Martin Schurz <[email protected]>

* Apply suggestions from code review

Co-authored-by: Sebastian Gumprich <[email protected]>
Signed-off-by: Martin Schurz <[email protected]>

Co-authored-by: Sebastian Gumprich <[email protected]>
2020-10-02 20:48:18 +02:00
schurzi 9394688158 use touch for 10.hardcore.conf to avoid problems with dry-run (#314)
Signed-off-by: Martin Schurz <[email protected]>
2020-10-02 20:43:35 +02:00
schurzi e266decde8 use ansible dhparam module (#32)
* use ansible dhparam module
2020-08-28 12:35:52 +02:00
schurzi 57f7a15b51 imove chmod to end because of generated files (#31)
Signed-off-by: Martin Schurz <[email protected]>
2020-08-24 11:22:33 +02:00
schurzi 3028b5ddc7 fix linting issues (#30)
* fix linting issues

Signed-off-by: Martin Schurz <[email protected]>

* set file permissions

Signed-off-by: Martin Schurz <[email protected]>
2020-08-24 10:45:13 +02:00
schurzi c69e7efb11 Merge pull request #49 from dev-sec/collection
Fix linting errors and simplivy vars-handling
2020-08-23 18:42:09 +02:00
schurzi a82e1a7a9f fix litner errors (#322)
* fix litner errors

Signed-off-by: Martin Schurz <[email protected]>

* make linter more happy

Signed-off-by: Martin Schurz <[email protected]>
2020-08-22 18:14:54 +02:00
schurzi b37c2ddb69 Merge pull request #303 from dev-sec/arch_support
Arch support
2020-08-22 15:21:18 +02:00
schurzi 4ddbbb2a61 fix linting for molecule (#301)
Signed-off-by: Martin Schurz <[email protected]>
2020-08-22 08:53:44 +02:00
schurzi 989f7b0e1e Merge pull request #300 from danielkubat/master
define file permissions explicitly
2020-08-19 00:05:51 +02:00
schurzi 56f6cd0337 Merge pull request #296 from dev-sec/fedora
fix fedora build
2020-08-16 20:17:15 +02:00
schurzi aaece07fe0 Merge pull request #321 from dev-sec/fedora
use systemd in fedora
2020-08-16 20:16:53 +02:00
Martin Schurz 5cf53b215f add separate option for controlling motd via pam
makes it possible to set different values for motd via sshd and pam.
Also create a backup file of pam configuration, to allow user to restore
the previous settings.

Signed-off-by: Martin Schurz <[email protected]>
2020-08-08 18:14:38 +02:00
schurzi b3d7acee44 Merge pull request #48 from dev-sec/kitchen_travis
update testing
2020-08-07 20:04:50 +02:00
schurzi eaeca04d96 do not blacklist used filesystems (#289)
* add additional check for efi

some systems seem to require vfat because of efi, despite not exposing a
/sys/firmware/efi directory.

Signed-off-by: Martin Schurz <[email protected]>

* make linter happy

Signed-off-by: Martin Schurz <[email protected]>

* rework check to check for all used filesystems

so we don't break existing mounts with our configuration

Signed-off-by: Martin Schurz <[email protected]>

* do not check this on el6

Signed-off-by: Martin Schurz <[email protected]>

* add comment to clarify

Signed-off-by: Martin Schurz <[email protected]>
2020-08-07 08:59:46 +02:00
schurzi 387fc472bd improve testing (#287)
* fix problem with package_facts on SuSE

SuSE Linux does not work with ansibel module packet_facts, so we need to
exclude this task there.

Signed-off-by: Martin Schurz <[email protected]>

* fix local docker tests for all distributions

Signed-off-by: Martin Schurz <[email protected]>

* fix local vagrant tests for all distributions

Signed-off-by: Martin Schurz <[email protected]>

* simplify travis tests

Signed-off-by: Martin Schurz <[email protected]>

* fix opensuse in travis

Signed-off-by: Martin Schurz <[email protected]>

* add fixes for suse

Signed-off-by: Martin Schurz <[email protected]>

* add special case for suse docker

Signed-off-by: Martin Schurz <[email protected]>
2020-08-03 15:55:27 +02:00
Martin Schurz 04f731a08c fix local kitchen tests
somehow a "real" linux needs different options than WSL. This is now
also working on debian 10

Signed-off-by: Martin Schurz <[email protected]>
2020-07-28 09:12:43 +02:00
schurzi 9b14f64f67 Merge pull request #317 from aqw/umask
fix sftp_umask; store as literal not octal
2020-07-28 08:59:12 +02:00
Martin Schurz 18be974509 remove crypto.yml
move include tasks to hardening.yml and remove intermediate crypto.yml

Signed-off-by: Martin Schurz <[email protected]>
2020-07-09 12:56:39 +02:00
Martin Schurz 5e47ffae35 split crypto.yml in several playbooks
preserve the version ordering of defaults and group all tasks according
to base configuration variable (cipthers, hostkeys, kex and macs)

Signed-off-by: Martin Schurz <[email protected]>
2020-07-09 11:46:23 +02:00
Martin Schurz 83263cf8ce add blocks to crypto.yml checks
moved the check for user supplied settings to block head and reversed
order of assignments to compensate for the missing check on the set
variable

Signed-off-by: Martin Schurz <[email protected]>
2020-07-09 00:30:45 +02:00
Martin Schurz 9d56e9c6dd fix typo in hardening.yml
Signed-off-by: Martin Schurz <[email protected]>
2020-07-08 22:42:32 +02:00