andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
361 Commits 14 Branches 64 Tags
b9acd71ececa2b33ee5357b020d4b042061d58e3
Commit Graph
361 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Sebastian Gumprich 7fdd7b4bb8 Merge pull request #106 from dev-sec/skip_fail 
omit empty variables
4.0.0 		2017-03-14 18:32:22 +01:00
Sebastian Gumprich 7f1415f339 Merge pull request #114 from dev-sec/fix_111 
install initramfs-tools
 2017-03-14 18:32:16 +01:00
Sebastian Gumprich 0ab4db4228 omit empty variables 
omit empty variables when in check-mode or when set_fact is skipped.

Fix #105
 2017-03-01 21:17:41 +01:00
Sebastian Gumprich 334e203f8b install initramfs-tools 
These are not installed by default on debian 8 but needed for module generation.

see: https://github.com/dev-sec/ansible-os-hardening/issues/111
 2017-03-01 21:17:23 +01:00
Sebastian Gumprich a9095928ac Merge pull request #117 from dev-sec/shadow_owner 
change shadow owner in debian systems
 2017-03-01 21:15:47 +01:00
Sebastian Gumprich 1d48b0d10a change shadow owner in debian systems 2017-03-01 20:58:19 +01:00
Sebastian Gumprich 987a3331f0 Merge pull request #110 from dev-sec/docker 
use new Docker images
 2017-03-01 20:31:08 +01:00
Sebastian Gumprich dfc505634b update min ansible version 2017-02-28 21:34:35 +01:00
Sebastian Gumprich 3af185ba8d use new docker images 2017-01-22 16:05:45 +01:00
Sebastian Gumprich 0779022a6e Merge pull request #113 from tyrken/rhel7 
Rhel7
 2017-01-20 16:42:00 +01:00
Tristan Keen 1cacbf4256 Support RHEL7 password quality and HTTP(S) proxies 
Oracle Linux -> OracleLinux in both ansible_os_family and ansible_distribution: https://github.com/ansible/ansible/pull/10789
(Note - older versions before latest 1.9 had the name including a space - but I can see PR to drop 1.9 support is in progress)

pam_pwfamily (the supposed package to install to get password complexity checking in RHEL7) doesn't seem to exist.
There is a libpwquality package that provides /usr/lib64/security/pam_pwquality.so, but that is installed by default according to a RHEL support case answer.
 2017-01-19 15:13:48 +00:00
Sebastian Gumprich a8f8cd083a Update README.md 2017-01-09 07:24:57 +01:00
Sebastian Gumprich 1e57cb64a2 Merge pull request #104 from ypid/fix/role_description 
Don’t refer to this role as "playbook" in the role description
 2016-12-03 18:33:47 +01:00
Robin Schneider c934a01c15 Don’t refer to this role as "playbook" in the role description 
Finishes work done by @rndmh3ro in #97

Closes: #97
 2016-12-03 11:36:11 +01:00
Sebastian Gumprich 5fc62a7f89 update changelog 2016-10-24 15:34:07 +02:00
Christoph Hartmann 6505157c62 Merge pull request #101 from dev-sec/update_pwqual 
update template
3.2.0 		2016-10-24 14:16:13 +02:00
Sebastian Gumprich 62a91011dd add comments to variables 2016-10-24 14:11:43 +02:00
Christoph Hartmann fa59170f37 Merge pull request #100 from dev-sec/deprec_warn 
fix deprecation warning for undefined error. #99
 2016-10-24 10:54:08 +02:00
Sebastian Gumprich 11c81971e1 fix deprecation warning for undefined error. #99 2016-10-07 21:28:57 +02:00
Sebastian Gumprich ef9d3d8f7f update template 2016-09-27 19:18:17 +02:00
Christoph Hartmann ca0bd549ff Merge pull request #94 from dev-sec/pam_pwquality 
add rhel7 pam_pwquality. fix #73
 2016-09-05 18:37:23 +02:00
Sebastian Gumprich 723205f8f2 add rhel7 pam_pwquality. fix #73 2016-08-10 21:47:53 +02:00
Sebastian Gumprich f7774d1503 push 3.1 3.1.0 2016-08-03 19:29:07 +02:00
Patrick Münch 6f7293e330 Merge pull request #90 from dev-sec/docker 
Docker
 2016-07-27 19:21:42 +02:00
Sebastian Gumprich 53b52bd0fa skip sysctl in docker tests 2016-07-27 13:53:12 +02:00
Sebastian Gumprich d7088cdeb6 remove thorfile, add sudo false, cleanup kitchen.yml 2016-07-26 17:59:07 +02:00
Sebastian Gumprich e436ebe66e Merge pull request #93 from conorsch/support-check-mode 
Supports --check mode
 2016-07-16 19:50:40 +02:00
Conor Schaefer d31bbfc457 Supports --check mode 
By setting always_run=true on a few read-only tasks that are used to
register variables, we add support for dry runs of the role via the
--check flag to ansible-playbook. The role now completes without error
in dry-run mode, which is very useful when onboarding new hosts to the
role.
 2016-07-15 13:37:36 -07:00
Sebastian Gumprich accdeecde4 Local testing with Docker 
This PR changes the local testing method to docker by default, making
the tests significantly faster to execute.
 2016-06-28 18:32:33 +02:00
Sebastian Gumprich c5d9770f4a change name of suite 2016-06-28 18:29:56 +02:00
Sebastian Gumprich a6624db99d initial docker testing support 2016-06-28 18:29:30 +02:00
Sebastian Gumprich 371ed47878 Merge pull request #91 from conorsch/support-centos7 
Adds support for CentOS 7
 2016-06-28 18:23:42 +02:00
Sebastian Gumprich f059577d42 Merge pull request #88 from dev-sec/debian8 
debian 8 support
 2016-06-28 17:47:09 +02:00
Sebastian Gumprich cda2d58218 Merge pull request #92 from vivekagr/patch-1 
Fix a formatting issue in readme.
 2016-06-26 21:18:21 +02:00
Vivek Agarwal e04ef11c05 Fix a formatting issue in readme. 2016-06-27 00:24:46 +05:30
Conor Schaefer 12053b21ae Removes sysctl_set parameter from RHEL sysctl task 
It appears that the sysctl_set parameter overrides ignorerrors. Since we
fully expect `kernel.exec_shield` to be handled differently on CentOS
7+, where it is is no longer configurable, let's preserve the
functionality provided by ignorerrors.
 2016-06-25 22:43:41 -07:00
Conor Schaefer ef28e7d01e Supports minimizing access on symlinked system dirs 
Uses a two-pass approach that inspects all target directories, then only
operates on the true "directories," skipping the symlinks, if any. Using
the "recurse=true" parameter ensures that the suid/sgid modifications
are applied to files as well as directories.
 2016-06-25 22:43:41 -07:00
Conor Schaefer 52163263a7 Adds CentOS 7.2 box to kitchen.yml 2016-06-25 22:43:41 -07:00
Sebastian Gumprich 422489f5ca update meta file 2016-06-24 17:42:48 +02:00
Sebastian Gumprich 0999b7b1cf update meta file 2016-06-24 17:36:26 +02:00
Sebastian Gumprich cb54398e9c Merge pull request #89 from conorsch/permit-filemap-config-on-etc-shadow 
Permits overriding permissions on /etc/shadow
 2016-06-13 19:17:27 +02:00
Conor Schaefer d4261388b5 Permits overriding permissions on /etc/shadow 
To support a variety of distros, some of which recommend root:root 0600
permissions on the shadow file (RHEL-based) and others root:shadow
0640 (Debian-based), allow users to override the /etc/shadow owner,
group, and mode via a dict var.
 2016-06-10 19:31:33 -07:00
Sebastian Gumprich 1c81e9f146 debian 8 support 
I implemented Debian 8 support (and removed debian 6 support, since its
EOL) as well as making it easier to locally test the role with inspec.
 2016-06-08 17:31:47 +02:00
Sebastian Gumprich b5f4bac9bd update testing method 
use default.yml in repo for testing
consolidate kitchen vars
 2016-05-22 20:06:29 +02:00
Sebastian Gumprich 7746eca682 update readme for dev-sec, make vars a table 2016-05-22 18:18:21 +02:00
Sebastian Gumprich 80e2365687 Merge pull request #85 from fitz123/ufw_manage_defaults 
Ufw manage defaults
 2016-05-22 16:38:30 +02:00
fitz123 2f7a97fbc7 fix task fail in case 'net.ipv6.conf.all.disable_ipv6' is not defined in sysctl_config dict 2016-05-21 12:42:16 +07:00
fitz123 0f8937c9b0 all ufw variables included into defaults file 2016-05-21 12:17:39 +07:00
fitz123 08da4091c2 tag for ufw task changed to 'ufw' 2016-05-21 12:17:06 +07:00
fitz123 e34775bdaa ufw_manage_defaults README 2016-05-20 03:35:43 +07:00