andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,518 Commits 14 Branches 64 Tags
b5ca78a9cd19c9a66103df4b2e853a6c60b4b7b7
Commit Graph
166 Commits
Author SHA1 Message Date
Sebastian Gumprich b5ca78a9cd chmod /home directories to 0700 
This is based on https://github.com/dev-sec/ansible-collection-hardening/pull/277
and updated to work with the new collection.

Thanks to @aardbol for this initial implementation!

Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-22 11:18:51 +01:00
schurzi a64838272c Merge pull request #418 from joubbi/documentation2 
Improve Documentation for sysctl defaults
 2021-03-16 15:49:55 +01:00
Martin Schurz b2dd73d27e remove unneeded tasks 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-15 23:53:40 +01:00
Martin Schurz ec9d7d2cb8 cleanup and typos 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-15 23:39:12 +01:00
Farid Joubbi 97c55d6e55 Documented rationale for sysctl values set. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-03-15 14:01:19 +01:00
Martin Schurz 5f97dffddf Merge branch 'master' into tally 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-11 19:26:37 +01:00
schurzi 103135ce9a fix task naming 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-11 17:21:32 +01:00
Farid Joubbi 4158e0bfb4 Created a list of files/dirs to be looped instead of two tasks per file/dir. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-03-11 16:54:25 +01:00
Farid Joubbi 4bad4779cd Fixed copy-paste error by doing og-rwx instead of numerical. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-02-22 22:13:18 +01:00
Martin Schurz 75fc31b80c remove cracklib 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 19:10:45 +01:00
Farid Joubbi 91a0d62305 Ensure permissions on /etc/crontab are configured. #375 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-02-19 23:19:00 +01:00
Farid Joubbi 60d24db460 Ensure permissions on /etc/crontab are configured. #375 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-02-19 22:40:16 +01:00
schurzi 8e4c22d8d9 remove FQCN from roles in examples (#404) 
Ansible does not work with FQCN and collections sepcified for including
roles. It is currently expecting to only get the role name in this
context.

Verified with Ansible 2.10.5

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-17 11:34:37 +01:00
Martin Schurz dba53718cf sssd is disabled on Amazonlinus 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-16 20:44:28 +01:00
Martin Schurz 4a5fa70507 default faillock to yes 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-16 19:31:51 +01:00
Martin Schurz 64713ce75d add default for new variable 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 11:17:01 +01:00
Martin Schurz ec36bf5b9c document parameter 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 00:22:03 +01:00
Martin Schurz 08aad6e80f add documentation 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 00:13:14 +01:00
Martin Schurz 28c6bf5c66 put force on the right task 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 23:31:24 +01:00
Martin Schurz 26c73ed1c9 fix debian faillock config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 23:13:14 +01:00
Maxim Burgerhout 54c8e6aedb Split off ssh_gssapi_delegation into own variable 
Signed-off-by: Maxim Burgerhout <[email protected]>
 2021-02-14 22:07:33 +01:00
Martin Schurz b9e33091e2 fix problems with auth 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 21:30:35 +01:00
Martin Schurz 7f1765c608 consolidate auth for rhel 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 17:30:02 +01:00
Martin Schurz 30f0839513 add support for rhel8 and sssd 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 12:44:20 +01:00
Martin Schurz 532917d956 remove rhel6 support from pam 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 12:14:54 +01:00
Martin Schurz 04654d0490 correct typo 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 11:19:12 +01:00
Martin Schurz aa166f43fc split debian and rhel pam config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 02:07:25 +01:00
Martin Schurz 19482c319c force create symlink 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-13 19:38:57 +01:00
Martin Schurz fc7fb4fc8a make compatible to authconfig 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-13 18:09:48 +01:00
Maxim Burgerhout 8baab7516e Extend GSSAPI configuration support to ssh_config 
Previously, the ssh_gssapi_support variable only toggled the GSSAPI
settings in sshd_config.

Through this change, setting ssh_gssapi_support to true also enables
support in ssh_config.

It enables both authentication and credential delegation.

Signed-off-by: Maxim Burgerhout <[email protected]>
 2021-02-12 13:10:35 +01:00
Martin Schurz 7282187a90 Merge branch 'master' into tally 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 21:44:55 +01:00
Martin Schurz 157f4fca70 add tasks for faillock on debian 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 21:43:30 +01:00
Sebastian Gumprich 6be31fbc3b do not install mysql python package on target host (#401) 
this package has to be installed on the host that executes the task

Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-02-10 15:57:51 +01:00
Sebastian Gumprich 756839f8f0 make wrong password fail task (#400) 
* make wrong password fail task

Signed-off-by: Sebastian Gumprich <[email protected]>

* add name to fail task

Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-02-10 15:55:08 +01:00
Sebastian Gumprich c55c1f21ed add restart handler variable for mysql role (#399) 
* add restart handler variable for mysql role

Signed-off-by: Sebastian Gumprich <[email protected]>

* add prettierignore file to ignore CHANGELOG

Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-02-10 15:54:57 +01:00
schurzi a98876b350 update ansible-lint to version 5 (#397) 
* add ansible to requirements

Signed-off-by: Martin Schurz <[email protected]>

* trigger run

Signed-off-by: Martin Schurz <[email protected]>

* update noqa for ansible-lint 5

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 13:47:01 +01:00
Martin Schurz 94b9bfc3cd add files for faillock 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 12:49:12 +01:00
Norman Ziegner f035053381 Only set default for ssh host key files when hardening the server (#393) 
Signed-off-by: Norman Ziegner <[email protected]>
 2021-02-09 10:01:41 +01:00
Norman Ziegner 614662b99d Add variable to specify host rsa key size (#394) 
Signed-off-by: Norman Ziegner <[email protected]>
 2021-02-09 09:44:55 +01:00
Martin Schurz 3ad4fbab0e add guard for tally debian unstable 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 11:18:50 +01:00
Martin Schurz ebbf6855e8 add rhel faillock config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 10:51:16 +01:00
Martin Schurz b210df1233 re-add debian tally config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 10:51:03 +01:00
Martin Schurz a55a4d2024 remove pam_tally2 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 08:09:43 +01:00
schurzi 4b0819349d use fqcn for community.crypto.openssh_keypair module (#389) 
tihis fixes a problem with Ansible 2.9 where the default openssh_keypair
is not supporting every option we need

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-05 19:44:23 +01:00
Maximilian Praeger 4399d3f885 removed: unneccessary conditional 
Signed-off-by: Maximilian Praeger <[email protected]>
 2021-01-22 07:24:54 +01:00
Maximilian Praeger 6b55b9619c added: comment for HostCertificate 
Signed-off-by: Maximilian Praeger <[email protected]>
 2021-01-22 07:24:54 +01:00
Maximilian Praeger 8f7bae533c fixed: add empty line after HostCertificate loop 
Signed-off-by: Maximilian Praeger <[email protected]>
 2021-01-22 07:24:54 +01:00
Maximilian Praeger 9853c7ea45 added: defaults for ssh_host_certificates 
Signed-off-by: Maximilian Praeger <[email protected]>
 2021-01-22 07:24:54 +01:00
Maximilian Praeger 6e9247bde3 added: support for HostCertificate in sshd conf file 
Signed-off-by: Maximilian Praeger <[email protected]>
 2021-01-22 07:24:53 +01:00
Sina Tak Tehrani ef31838fa2 Regenerate RSA key with size 4096 bits (#376) 
* regenerate RSA key with size 4096 bits

Signed-off-by: Sina Tak Tehrani <[email protected]>

* fixed lint problem

Signed-off-by: Sina Tak Tehrani <[email protected]>

* fixed E301 lint error

Signed-off-by: Sina Tak Tehrani <[email protected]>

* added host keys related vars

Signed-off-by: Sina Tak Tehrani <[email protected]>

* used openssh_keypair module

Signed-off-by: Sina Tak Tehrani <[email protected]>

* changed RSA private key mode to 0640

Signed-off-by: Sina Tak Tehrani <[email protected]>

* specified condition to prevent wrong file mode on debian-based OS

Signed-off-by: Sina Tak Tehrani <[email protected]>
 2021-01-21 13:38:48 +01:00