Commit Graph
100 Commits
Author SHA1 Message Date
Martin Schurz 2c18d3afda use if for role detection
Signed-off-by: Martin Schurz <[email protected]>
2023-11-11 15:34:34 +01:00
Martin Schurz e5b8df07e2 use new molecule-plugins
Signed-off-by: Martin Schurz <[email protected]>
2023-04-28 13:48:45 +02:00
Martin Schurz 74c76b8240 correct workflow name and use main version
Signed-off-by: Martin Schurz <[email protected]>
2023-04-16 22:57:44 +02:00
Martin Schurz cd56c017ba add parameter for skipped words
Signed-off-by: Martin Schurz <[email protected]>
2023-04-16 22:54:43 +02:00
Martin Schurz 93ddd4b45e use shared workflow
Signed-off-by: Martin Schurz <[email protected]>
2023-04-16 22:49:53 +02:00
Martin Schurz 7259d6b5fd fix spelling errors
Signed-off-by: Martin Schurz <[email protected]>
2023-04-14 23:51:53 +02:00
Martin Schurz edcada16e4 add spellchecking with codespell
Signed-off-by: Martin Schurz <[email protected]>
2023-04-14 23:34:05 +02:00
Martin Schurz eb47f4dce0 Merge branch 'master' into min_ansible_ver 2023-04-12 22:22:36 +02:00
Martin Schurz bb47300798 remove unneccessary collection include
Signed-off-by: Martin Schurz <[email protected]>
2023-04-12 20:27:35 +02:00
Martin Schurz de0439ed58 remove unneccessary collection include
Signed-off-by: Martin Schurz <[email protected]>
2023-04-12 20:22:22 +02:00
Martin Schurz 6e48f686a9 add fedora to testing
Signed-off-by: Martin Schurz <[email protected]>
2023-04-12 20:21:27 +02:00
Martin Schurz 0014a3be36 update metadata
Signed-off-by: Martin Schurz <[email protected]>
2023-04-12 20:18:29 +02:00
Martin Schurz a186760b45 exclude broken tests
Signed-off-by: Martin Schurz <[email protected]>
2023-04-11 09:51:05 +02:00
Martin Schurz a5a065f880 shorten text
Signed-off-by: Martin Schurz <[email protected]>
2023-04-11 07:49:38 +02:00
Martin Schurz bc9795c215 add noqa for linter
Signed-off-by: Martin Schurz <[email protected]>
2023-04-11 07:37:07 +02:00
Martin Schurz f02f8b9a90 add procps for Debian
Signed-off-by: Martin Schurz <[email protected]>
2023-04-11 07:20:44 +02:00
Martin Schurz 5cc7b8dee3 add waivers for os_hardening
Signed-off-by: Martin Schurz <[email protected]>
2023-04-11 07:17:29 +02:00
Martin Schurz ea922f6dca fix lint error
Signed-off-by: Martin Schurz <[email protected]>
2023-04-10 23:49:52 +02:00
Martin Schurz e43f180112 update waiver path
Signed-off-by: Martin Schurz <[email protected]>
2023-04-10 23:48:52 +02:00
Martin Schurz 001900ac35 require ansible.builtin.user to be at least 2.11 since options are needed
Signed-off-by: Martin Schurz <[email protected]>
2023-04-10 23:42:27 +02:00
Martin Schurz 31c9885610 use docker for inspec-auditor
Signed-off-by: Martin Schurz <[email protected]>
2023-04-10 23:22:41 +02:00
Martin Schurz 4a9d6033eb try docker for inspec-auditor
Signed-off-by: Martin Schurz <[email protected]>
2023-04-10 23:04:46 +02:00
Martin Schurz ebab98930c try docker for inspec-auditor
Signed-off-by: Martin Schurz <[email protected]>
2023-04-10 22:58:28 +02:00
Martin Schurz 5357f9e718 use current version of amazon linux
Signed-off-by: Martin Schurz <[email protected]>
2023-04-10 22:23:48 +02:00
Martin Schurz dd5ad568b3 fix deprecation warnings
Signed-off-by: Martin Schurz <[email protected]>
2023-04-10 20:36:03 +02:00
Martin Schurz 63dc9d3be8 use current amazon linux
Signed-off-by: Martin Schurz <[email protected]>
2023-04-10 19:44:01 +02:00
Martin Schurz 7b69c4bd47 add collection link
Signed-off-by: Martin Schurz <[email protected]>
2023-04-10 11:21:12 +02:00
Martin Schurz e4ecfe2084 add collection to verify
Signed-off-by: Martin Schurz <[email protected]>
2023-04-10 11:03:33 +02:00
Martin Schurz e346c2300f remove unneccessary symlink
Signed-off-by: Martin Schurz <[email protected]>
2023-04-10 11:02:33 +02:00
Martin Schurz 2de009e3b5 use latest runner version
Signed-off-by: Martin Schurz <[email protected]>
2023-04-10 10:28:11 +02:00
schurzi 29f8a2fb78 add testing for OpenBSD and FreeBSD (#642)
* add testing for OpenBSD and FreeBSD

Signed-off-by: Martin Schurz <[email protected]>

* make python work

Signed-off-by: Martin Schurz <[email protected]>

* remove jinja template ...

Signed-off-by: Martin Schurz <[email protected]>

* make verify work

Signed-off-by: Martin Schurz <[email protected]>

* correct verify

Signed-off-by: Martin Schurz <[email protected]>

* correct verify

Signed-off-by: Martin Schurz <[email protected]>

* correct verify

Signed-off-by: Martin Schurz <[email protected]>

* correct verify

Signed-off-by: Martin Schurz <[email protected]>

* use right vm name for connect

Signed-off-by: Martin Schurz <[email protected]>

* add a bit of documentation

Signed-off-by: Martin Schurz <[email protected]>

* remove sudo

Signed-off-by: Martin Schurz <[email protected]>

* add weird OpenSBD workaround

Signed-off-by: Martin Schurz <[email protected]>

* make verify playbook more consistent

Signed-off-by: Martin Schurz <[email protected]>

* rename nonlinux to BSD

Signed-off-by: Martin Schurz <[email protected]>

* use openbsd7 for testing

Signed-off-by: Martin Schurz <[email protected]>

* correct use openbsd7 everywhere

Signed-off-by: Martin Schurz <[email protected]>

* add waivers

Signed-off-by: Martin Schurz <[email protected]>

* update waiver descriptions

Signed-off-by: Martin Schurz <[email protected]>

* use docker for inspec

Signed-off-by: Martin Schurz <[email protected]>

* keep looking right ;)

Signed-off-by: Martin Schurz <[email protected]>

* correct path to waivers

Signed-off-by: Martin Schurz <[email protected]>

* use ephemeral directory in docker

Signed-off-by: Martin Schurz <[email protected]>

* use bsd inspec profile

Signed-off-by: Martin Schurz <[email protected]>

* remove openbsd workaround

Signed-off-by: Martin Schurz <[email protected]>

* re-add openbsd workaround

Signed-off-by: Martin Schurz <[email protected]>

* commit suggestions

Signed-off-by: Martin Schurz <[email protected]>

* add supportet OS to metadata

Signed-off-by: Martin Schurz <[email protected]>

* use current python

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>
2023-03-31 09:50:04 +02:00
schurzi b01f22b4a4 Merge pull request #654 from dev-sec/renovate/geerlingguy.git-3.x
Update dependency geerlingguy.git to v3.0.1
2023-03-31 09:26:49 +02:00
schurzi 0bfd5f7fa0 Merge pull request #653 from dev-sec/renovate/configure
Configure Renovate
2023-03-31 09:15:10 +02:00
Martin Schurz e9fa44c243 remove dependabot
Signed-off-by: Martin Schurz <[email protected]>
2023-03-31 09:12:55 +02:00
Martin Schurz 7456e441fc ignore jenovate in galaxy build
Signed-off-by: Martin Schurz <[email protected]>
2023-03-30 18:09:20 +02:00
Martin Schurz 4c7e189e5d add custom renovate config
Signed-off-by: Martin Schurz <[email protected]>
2023-03-30 18:05:39 +02:00
schurzi 5ed3f399f2 add check mode to molecule tests (#644)
* add check mode to molecule tests

Signed-off-by: Martin Schurz <[email protected]>

* bail on undefined variables

Signed-off-by: Martin Schurz <[email protected]>

* bail on undefined variables

Signed-off-by: Martin Schurz <[email protected]>

* execute tasks in check mode

Signed-off-by: Martin Schurz <[email protected]>

* fix error in check mode on SuSE

Signed-off-by: Martin Schurz <[email protected]>

* use when condition on task

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>
2023-03-09 09:37:59 +01:00
schurzi 6e5621cdc9 simplify MySQL queries for user deletion (#641)
* use rowcount to determine mysql results

Signed-off-by: Martin Schurz <[email protected]>

* use correct list level

Signed-off-by: Martin Schurz <[email protected]>

* remove json_query

Signed-off-by: Martin Schurz <[email protected]>

* remove intermediate vars

Signed-off-by: Martin Schurz <[email protected]>

* add check for count

Signed-off-by: Martin Schurz <[email protected]>

* drop condition, since one result must exist

Signed-off-by: Martin Schurz <[email protected]>

* move rowcount in condition

Signed-off-by: Martin Schurz <[email protected]>

* do loop in ansible to report each deleted user

Signed-off-by: Martin Schurz <[email protected]>

* add idempotency check

Signed-off-by: Martin Schurz <[email protected]>

* additional tests to verify user deletion

Signed-off-by: Martin Schurz <[email protected]>

* actually iterate the whole user list when deleting

Signed-off-by: Martin Schurz <[email protected]>

* fix tests for SuSE

Signed-off-by: Martin Schurz <[email protected]>

* adopt suggestions

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>
2023-03-01 14:19:50 +01:00
schurzi 271414bf44 Merge pull request #639 from dev-sec/dependabot/github_actions/creyD/prettier_action-4.3
Bump creyD/prettier_action from 4.2 to 4.3
2023-02-21 14:08:08 +01:00
schurzi 9b32aca0ca run our CI tests periodically (#634)
* allow multiple instances for os vm tests

Signed-off-by: Martin Schurz <[email protected]>

* add scheduled trigger to all test actions

Signed-off-by: Martin Schurz <[email protected]>

* use different scenario names

Signed-off-by: Martin Schurz <[email protected]>

* use different scenario names

Signed-off-by: Martin Schurz <[email protected]>

* use different scenario names

Signed-off-by: Martin Schurz <[email protected]>

* use username to create uniqe vms

Signed-off-by: Martin Schurz <[email protected]>

* use compatible name

Signed-off-by: Martin Schurz <[email protected]>

* add explaination

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>
2023-02-07 09:27:46 +01:00
schurzi 1ef9171393 remove unneccessary tasks for VM based test (#629)
* add remaining platforms to test

Signed-off-by: Martin Schurz <[email protected]>

* remove unneccessary tasks for test

Signed-off-by: Martin Schurz <[email protected]>

* use current opensuse version

Signed-off-by: Martin Schurz <[email protected]>

* disable sysctl for missing yama in opensuse

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>
2023-02-06 08:37:40 +01:00
schurzi 0705a9cc90 Merge pull request #628 from Normo/add-password-warn-age-option
Set number of warning days before user password expires
2023-02-04 18:21:52 +01:00
schurzi e6bc422f5b Merge pull request #626 from dev-sec/dependabot_labels
do not let dependabot label our prs
2023-01-30 16:21:11 +01:00
schurzi 894c6117a0 Merge pull request #625 from dev-sec/linting_roles
run linting only when files inside roles change
2023-01-30 10:48:22 +01:00
schurzi ee80418496 Merge pull request #618 from dev-sec/deprecate_intitramfs
deprecate rebuilding of initramfs
2023-01-25 23:56:36 +01:00
Martin Schurz 7f8e9919ee add readme
Signed-off-by: Martin Schurz <[email protected]>
2023-01-25 22:30:17 +01:00
schurzi 0e8533049d Merge pull request #620 from dev-sec/molecule_fixes
Fixed problems with running molecule locally with cgroup v2
2023-01-25 13:18:50 +01:00
schurzi 154f862ccd Merge pull request #622 from dev-sec/stop_old_tests
cancel running tests if new commit to branch is made
2023-01-24 13:21:18 +01:00
schurzi 006e3bf75b Merge pull request #601 from dev-sec/contribute_dco
add notice to sign-off work to contributor guideline
2022-11-17 13:58:08 +01:00
Martin Schurz 98c645db5f add notice to sign-off work to contributor guideline
Signed-off-by: Martin Schurz <[email protected]>
2022-11-17 13:47:11 +01:00
schurzi d982a89cc1 Merge pull request #598 from dennisse/master
OpenBSD does not support GSSAPI Authentication
2022-11-08 10:26:42 +01:00
schurzi d0407b17c4 Merge pull request #596 from dev-sec/templates
add Ansible specific templates for issues
2022-11-01 18:10:59 +01:00
Martin Schurz 1346e37e14 actually add templates ...
Signed-off-by: Martin Schurz <[email protected]>
2022-10-28 10:26:00 +02:00
schurzi 613fbd82da use github templates for new issues (#595)
Signed-off-by: Martin Schurz <[email protected]>

Signed-off-by: Martin Schurz <[email protected]>
2022-10-28 07:14:58 +02:00
schurzi 99fe8b6969 Merge pull request #594 from dlouzan/fix/type-cast-variables
fix(os_hardening): cast expected int types in pam tasks
2022-10-27 20:43:17 +02:00
Martin Schurz f496b385dd use github templates for new issues
Signed-off-by: Martin Schurz <[email protected]>
2022-10-27 20:41:06 +02:00
schurzi 901923bac2 Merge pull request #588 from dev-sec/support_more_os
Support more os
2022-10-26 10:13:40 +02:00
Martin Schurz c30ef42355 exclude el9 from vm tests
Signed-off-by: Martin Schurz <[email protected]>
2022-10-25 18:59:11 +02:00
schurzi a1b80fe657 adopt all current suggestions from ansible-lint (#592) 2022-10-24 09:42:23 +02:00
schurzi c1cd6c5ac3 change default to allow SFTP (#564)
* change default to allow SFTP

Signed-off-by: Martin Schurz <[email protected]>

* add documentation

Signed-off-by: Martin Schurz <[email protected]>

* diasble sftp for default tests

Signed-off-by: Martin Schurz <[email protected]>

* extend documentation

Signed-off-by: Martin Schurz <[email protected]>

* fix typo

Signed-off-by: Martin Schurz <[email protected]>

* correct ssh version

Signed-off-by: Martin Schurz <[email protected]>

Signed-off-by: Martin Schurz <[email protected]>
2022-08-22 10:03:37 +02:00
schurzi a806ec8598 add posibility to run ssh_hardening as unprivileged user (#561)
* add VM tests for ssh_hardening

Signed-off-by: Martin Schurz <[email protected]>

* remove VM tests from ssh_hardening

Signed-off-by: Martin Schurz <[email protected]>

* run ssh_hardening test as unprivileged user

Signed-off-by: Martin Schurz <[email protected]>

* add link for documentation

Signed-off-by: Martin Schurz <[email protected]>

* use different config

Signed-off-by: Martin Schurz <[email protected]>

* remove become

Signed-off-by: Martin Schurz <[email protected]>

* re-add become

Signed-off-by: Martin Schurz <[email protected]>

* move become into role

Signed-off-by: Martin Schurz <[email protected]>

* indentation

Signed-off-by: Martin Schurz <[email protected]>

* try args apply

Signed-off-by: Martin Schurz <[email protected]>

* fix linting

Signed-off-by: Martin Schurz <[email protected]>

* add documentation

Signed-off-by: Martin Schurz <[email protected]>

Signed-off-by: Martin Schurz <[email protected]>
2022-08-15 13:19:07 +02:00
schurzi b56c801574 add basic support for ubuntu22.04 (#554)
Signed-off-by: Martin Schurz <[email protected]>

Signed-off-by: Martin Schurz <[email protected]>
2022-08-15 13:05:09 +02:00
schurzi e03e435517 Merge pull request #547 from dev-sec/vm_tests
add VM tests for os_hardening
2022-07-11 21:57:21 +02:00
Martin Schurz 27d091e871 reduce testing on vm
Signed-off-by: Martin Schurz <[email protected]>
2022-07-11 16:08:35 +02:00
Martin Schurz c81ce23ed7 disable ctrl+alt+del for vm tests
Signed-off-by: Martin Schurz <[email protected]>
2022-07-11 13:04:14 +02:00
Martin Schurz 72cb97c8d5 remove waivers file from docker test config
Signed-off-by: Martin Schurz <[email protected]>
2022-07-11 12:36:48 +02:00
Martin Schurz edda7075a2 add badge for tests
Signed-off-by: Martin Schurz <[email protected]>
2022-07-11 12:17:34 +02:00
Martin Schurz 0f631c1405 add sysctl exclude
Signed-off-by: Martin Schurz <[email protected]>
2022-07-11 09:39:52 +02:00
Martin Schurz 5d50b5b130 add sysctl exclude
Signed-off-by: Martin Schurz <[email protected]>
2022-07-11 09:32:02 +02:00
Martin Schurz 28baf0d581 add sysctl exclude
Signed-off-by: Martin Schurz <[email protected]>
2022-07-11 09:17:44 +02:00
Martin Schurz 4b519e8b13 add sysctl exclude
Signed-off-by: Martin Schurz <[email protected]>
2022-07-11 09:13:26 +02:00
Martin Schurz 92dc094022 add sysctl exclude
Signed-off-by: Martin Schurz <[email protected]>
2022-07-11 09:05:58 +02:00
Martin Schurz fdc6b333c9 exclude arch
Signed-off-by: Martin Schurz <[email protected]>
2022-07-10 21:30:45 +02:00
Martin Schurz 1825eba27a exclude opensuse
Signed-off-by: Martin Schurz <[email protected]>
2022-07-10 21:08:50 +02:00
Martin Schurz cd45a58683 fix yum gpg-check task
Signed-off-by: Martin Schurz <[email protected]>
2022-07-10 20:22:39 +02:00
Martin Schurz 730510c2a7 add opensuse and arch
Signed-off-by: Martin Schurz <[email protected]>
2022-07-10 15:55:08 +02:00
Martin Schurz fa7f8597d9 fix bug in check for /boot
Signed-off-by: Martin Schurz <[email protected]>
2022-07-10 13:36:19 +02:00
Martin Schurz b6b2d45f09 speedup ansible
Signed-off-by: Martin Schurz <[email protected]>
2022-07-09 15:43:59 +02:00
Martin Schurz 9cfe1f2b9a also harden /boot
Signed-off-by: Martin Schurz <[email protected]>
2022-07-09 15:43:11 +02:00
Martin Schurz e49eacd8ec icrease ressources for test vm
Signed-off-by: Martin Schurz <[email protected]>
2022-07-09 10:42:20 +02:00
Martin Schurz 7535abd882 remove waiver
Signed-off-by: Martin Schurz <[email protected]>
2022-07-09 02:22:35 +02:00
Martin Schurz 400e576984 use correct parameter
Signed-off-by: Martin Schurz <[email protected]>
2022-07-09 01:47:59 +02:00
Martin Schurz 0eddf2872b setup python
Signed-off-by: Martin Schurz <[email protected]>
2022-07-09 01:19:12 +02:00
Martin Schurz 013a554731 force linking
Signed-off-by: Martin Schurz <[email protected]>
2022-07-09 00:59:50 +02:00
Martin Schurz 8f3f724380 call correct molecule task
Signed-off-by: Martin Schurz <[email protected]>
2022-07-09 00:57:26 +02:00
Martin Schurz e742330a41 add testing of os_hardning on vm
Signed-off-by: Martin Schurz <[email protected]>
2022-07-09 00:52:58 +02:00
schurzi dd919b5cf6 Merge pull request #546 from dev-sec/linting
Linting
2022-07-08 18:10:32 +02:00
Martin Schurz 21df60a71f fix includes
Signed-off-by: Martin Schurz <[email protected]>
2022-07-08 17:24:07 +02:00
Martin Schurz 02b9a20fe7 fix release action
Signed-off-by: Martin Schurz <[email protected]>
2022-07-07 12:06:34 +02:00
Martin Schurz f627d2fbfd fix release action
Signed-off-by: Martin Schurz <[email protected]>
2022-07-07 11:27:51 +02:00
Martin Schurz b32ee28a89 use correct version for github-actions-x/commit
Signed-off-by: Martin Schurz <[email protected]>
2022-06-29 15:55:13 +02:00
Martin Schurz 0c8cbb2185 update GitHub action for checkout
there was a new feature introduced to git, that prevents some of our
actions to run. The updated action handles this properly.

https://github.com/actions/checkout/issues/760

Signed-off-by: Martin Schurz <[email protected]>
2022-06-29 15:34:39 +02:00
schurzi 9cf1659742 Merge pull request #541 from dev-sec/doc_update
Improve documentation
2022-05-04 14:25:21 +02:00
Martin Schurz 79fb86d021 fix linter errors
Signed-off-by: Martin Schurz <[email protected]>
2022-05-04 14:12:24 +02:00
Martin Schurz 57944bc56d add ignore to ansible-lint
Signed-off-by: Martin Schurz <[email protected]>
2022-05-04 14:03:33 +02:00
Martin Schurz bff23f82cb update ansible-lint action
Signed-off-by: Martin Schurz <[email protected]>
2022-05-04 13:57:52 +02:00
Martin Schurz 46b436fc9b update description of ssh_client_alive_count
Signed-off-by: Martin Schurz <[email protected]>
2022-05-04 13:48:38 +02:00
Martin Schurz 18d01327eb improve linking to legacy roles
Signed-off-by: Martin Schurz <[email protected]>
2022-05-04 13:44:52 +02:00
schurzi dc22dc33a2 Merge pull request #530 from dev-sec/delete_drafts
delete obsolete release drafts
2022-02-28 10:20:01 +01:00
Martin Schurz 9d00c8ba29 delete old release drafts
Signed-off-by: Martin Schurz <[email protected]>
2022-02-25 20:10:36 +01:00