andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,518 Commits 14 Branches 64 Tags
b5ca78a9cd19c9a66103df4b2e853a6c60b4b7b7
Commit Graph
51 Commits
Author SHA1 Message Date
Sebastian Gumprich b5ca78a9cd chmod /home directories to 0700 
This is based on https://github.com/dev-sec/ansible-collection-hardening/pull/277
and updated to work with the new collection.

Thanks to @aardbol for this initial implementation!

Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-22 11:18:51 +01:00
schurzi a64838272c Merge pull request #418 from joubbi/documentation2 
Improve Documentation for sysctl defaults
 2021-03-16 15:49:55 +01:00
Martin Schurz b2dd73d27e remove unneeded tasks 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-15 23:53:40 +01:00
Martin Schurz ec9d7d2cb8 cleanup and typos 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-15 23:39:12 +01:00
Farid Joubbi 97c55d6e55 Documented rationale for sysctl values set. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-03-15 14:01:19 +01:00
Martin Schurz 5f97dffddf Merge branch 'master' into tally 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-11 19:26:37 +01:00
schurzi 103135ce9a fix task naming 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-11 17:21:32 +01:00
Farid Joubbi 4158e0bfb4 Created a list of files/dirs to be looped instead of two tasks per file/dir. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-03-11 16:54:25 +01:00
Farid Joubbi 4bad4779cd Fixed copy-paste error by doing og-rwx instead of numerical. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-02-22 22:13:18 +01:00
Martin Schurz 75fc31b80c remove cracklib 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 19:10:45 +01:00
Farid Joubbi 91a0d62305 Ensure permissions on /etc/crontab are configured. #375 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-02-19 23:19:00 +01:00
Farid Joubbi 60d24db460 Ensure permissions on /etc/crontab are configured. #375 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-02-19 22:40:16 +01:00
schurzi 8e4c22d8d9 remove FQCN from roles in examples (#404) 
Ansible does not work with FQCN and collections sepcified for including
roles. It is currently expecting to only get the role name in this
context.

Verified with Ansible 2.10.5

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-17 11:34:37 +01:00
Martin Schurz dba53718cf sssd is disabled on Amazonlinus 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-16 20:44:28 +01:00
Martin Schurz 4a5fa70507 default faillock to yes 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-16 19:31:51 +01:00
Martin Schurz ec36bf5b9c document parameter 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 00:22:03 +01:00
Martin Schurz 08aad6e80f add documentation 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 00:13:14 +01:00
Martin Schurz 28c6bf5c66 put force on the right task 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 23:31:24 +01:00
Martin Schurz 26c73ed1c9 fix debian faillock config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 23:13:14 +01:00
Martin Schurz b9e33091e2 fix problems with auth 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 21:30:35 +01:00
Martin Schurz 7f1765c608 consolidate auth for rhel 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 17:30:02 +01:00
Martin Schurz 30f0839513 add support for rhel8 and sssd 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 12:44:20 +01:00
Martin Schurz 532917d956 remove rhel6 support from pam 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 12:14:54 +01:00
Martin Schurz 04654d0490 correct typo 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 11:19:12 +01:00
Martin Schurz aa166f43fc split debian and rhel pam config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 02:07:25 +01:00
Martin Schurz 19482c319c force create symlink 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-13 19:38:57 +01:00
Martin Schurz fc7fb4fc8a make compatible to authconfig 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-13 18:09:48 +01:00
Martin Schurz 7282187a90 Merge branch 'master' into tally 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 21:44:55 +01:00
Martin Schurz 157f4fca70 add tasks for faillock on debian 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 21:43:30 +01:00
schurzi a98876b350 update ansible-lint to version 5 (#397) 
* add ansible to requirements

Signed-off-by: Martin Schurz <[email protected]>

* trigger run

Signed-off-by: Martin Schurz <[email protected]>

* update noqa for ansible-lint 5

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 13:47:01 +01:00
Martin Schurz 94b9bfc3cd add files for faillock 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 12:49:12 +01:00
Martin Schurz 3ad4fbab0e add guard for tally debian unstable 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 11:18:50 +01:00
Martin Schurz ebbf6855e8 add rhel faillock config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 10:51:16 +01:00
Martin Schurz b210df1233 re-add debian tally config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 10:51:03 +01:00
Martin Schurz a55a4d2024 remove pam_tally2 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 08:09:43 +01:00
Martin Schurz 0600cdae75 add "role" to comment 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-20 11:23:40 +01:00
Farid Joubbi 254b62d980 Added comment on top of template about which role modified the resulting file. https://github.com/dev-sec/ansible-collection-hardening/issues/345 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-01-19 14:05:33 +01:00
Farid Joubbi d01abb44c0 Syncookie (#372) 
* Enabled SYN cookie sysctl.

Signed-off-by: Farid Joubbi <[email protected]>

* Removed SYN cookies from here since it's a default now.

Signed-off-by: Farid Joubbi <[email protected]>
 2021-01-15 09:56:29 +01:00
schurzi 16a41412bb check for correct cpu vendor in initramfs-tools (#374) 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-12 06:31:13 +01:00
Farid Joubbi 5675589e01 Sorted sysctl values and lists in READMEs alphabetically (No functional changes). (#371) 
* Add s's for consistency.

Signed-off-by: Farid Joubbi <[email protected]>

* Sort lists alphabetically.

Signed-off-by: Farid Joubbi <[email protected]>

* Sorted sysctl_config alphabetically.

Signed-off-by: Farid Joubbi <[email protected]>

* Sort removed protocols.

Signed-off-by: Farid Joubbi <[email protected]>

* Added dots in variable descriptions for the sake of consistency.

Signed-off-by: Farid Joubbi <[email protected]>

* Added dots in variable descriptions for the sake of consistency.

Signed-off-by: Farid Joubbi <[email protected]>
 2021-01-08 20:45:50 +01:00
tgueldner-mms e8e552f3ae make auditd 'max_log_file' configurable (#370) 
* make auditd 'max_log_file' configurable

Signed-off-by: Thomas Gueldner <[email protected]>

* fix documentation for os_auditd_max_log_file

Signed-off-by: Thomas Gueldner <[email protected]>
 2021-01-08 13:23:58 +01:00
schurzi b4ca950122 set hidepid=0 on RHEL/CentOS 7 (#369) 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-03 12:53:08 +01:00
schurziandSebastian Gumprich a75e2c028b change inclusion of os specific defaults (#353) 
* change inclusion of os specific defaults

we now include the os specific options into a separate variable and
merge this with the default ansible namespace, when the corresponding
keys do not already exist (eg. are defined by default oder by user)

Signed-off-by: Martin Schurz <[email protected]>

* simplify check for os specific variables

Signed-off-by: Martin Schurz <[email protected]>

* add test for variable override

Signed-off-by: Martin Schurz <[email protected]>

* move tests to verify stage

Signed-off-by: Martin Schurz <[email protected]>

* correct grep

Signed-off-by: Martin Schurz <[email protected]>

* linting

Signed-off-by: Martin Schurz <[email protected]>

* fix typo

Signed-off-by: Martin Schurz <[email protected]>

* Revert "Merge pull request #351 from sprat/fix-umask"

This reverts commit 9e8e0bc8fb, reversing
changes made to 98c7553016.

Signed-off-by: Martin Schurz <[email protected]>

* move immutable ssh vars to internal vars

Signed-off-by: Martin Schurz <[email protected]>

* move vars to OS files

Signed-off-by: Martin Schurz <[email protected]>

* change default handling for all roles

Signed-off-by: Martin Schurz <[email protected]>

* fix issues

Signed-off-by: Martin Schurz <[email protected]>

* add documentation

Signed-off-by: Martin Schurz <[email protected]>

* Update main.yml

Co-authored-by: Sebastian Gumprich <[email protected]>
 2020-12-20 20:46:57 +01:00
Sylvain Prat ea471b38b7 Fix #344: make the os_env_umask variable usable again 
Signed-off-by: Sylvain Prat <[email protected]>
 2020-12-15 21:31:51 +01:00
Sebastian Gumprich f2804c7c19 Merge branch 'master' into collection 2020-11-11 21:08:54 +01:00
Sebastian Gumprich d857830979 minor readme fixes 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2020-11-09 20:49:07 +01:00
rndmh3ro c94d973527 Prettified Code! 2020-11-08 10:20:25 +00:00
Sebastian Gumprich c8ada5c13c Merge branch 'migrate_os' into collection 2020-11-08 11:18:38 +01:00
Sebastian Gumprich dd3959276b merge os-hardening role into collection 2020-11-07 22:09:28 +01:00
Sebastian Gumprich 598f7183f8 remove os submodule 2020-11-07 21:49:25 +01:00