* add additional check for efi
some systems seem to require vfat because of efi, despite not exposing a
/sys/firmware/efi directory.
Signed-off-by: Martin Schurz <[email protected]>
* make linter happy
Signed-off-by: Martin Schurz <[email protected]>
* rework check to check for all used filesystems
so we don't break existing mounts with our configuration
Signed-off-by: Martin Schurz <[email protected]>
* do not check this on el6
Signed-off-by: Martin Schurz <[email protected]>
* add comment to clarify
Signed-off-by: Martin Schurz <[email protected]>
* fix problem with package_facts on SuSE
SuSE Linux does not work with ansibel module packet_facts, so we need to
exclude this task there.
Signed-off-by: Martin Schurz <[email protected]>
* fix local docker tests for all distributions
Signed-off-by: Martin Schurz <[email protected]>
* fix local vagrant tests for all distributions
Signed-off-by: Martin Schurz <[email protected]>
* simplify travis tests
Signed-off-by: Martin Schurz <[email protected]>
* fix opensuse in travis
Signed-off-by: Martin Schurz <[email protected]>
* add fixes for suse
Signed-off-by: Martin Schurz <[email protected]>
* add special case for suse docker
Signed-off-by: Martin Schurz <[email protected]>
Numbers with leading zeros need to be quoted in Ansible, otherwise they
are interpreted as octal. Which the templating happily writes out in...
decimal.
In this case, sftp_umask 0027 was ending up as 23 in sshd.conf.
Signed-off-by: Alex Waite <[email protected]>
* rework CRYPTO_POLICY handling for fedora
the previous implementation did not handle fedora right. Now we check if
a CRYPTO_POLICY is present regardless of the OS version.
Signed-off-by: Martin Schurz <[email protected]>
* improve tasks for CRYPTO_POLICY
Signed-off-by: Martin Schurz <[email protected]>
* add exception for Archlinux
Signed-off-by: Martin Schurz <[email protected]>
* swap conditions
Signed-off-by: Martin Schurz <[email protected]>
* improve local testing
don't use privileged mode, since this grants too much permissions.
Fixes several problems with PAM in test images.
REorder options in kitchen configuration to simplify it.
Signed-off-by: Martin Schurz <[email protected]>
* check all controls in travis
Signed-off-by: Martin Schurz <[email protected]>
* set env vars in travis correctly
according to documentation: https://docs.travis-ci.com/user/environment-variables/
Signed-off-by: Martin Schurz <[email protected]>
* add arch linux to local tests
Signed-off-by: Martin Schurz <[email protected]>
* shorten travis config
Signed-off-by: Martin Schurz <[email protected]>
* use correct init command for containers
Signed-off-by: Martin Schurz <[email protected]>
* try privileged again
Signed-off-by: Martin Schurz <[email protected]>
* arch seems to like privilege
Signed-off-by: Martin Schurz <[email protected]>
* add testing for CentOS8
Adds testing environments for CentOS8 to local Kitchen and remote Travis
tests. Currently only local Kitchen Docker tests are verified.
Signed-off-by: Martin Schurz <[email protected]>
* disable system wide CRYPTO_POLICY on RHEL8+
by default sshd will not use the crypto settings from sshd_config. To
make the settings effective we need to disable the system wide
CRYPTO_POLICY.
see: https://access.redhat.com/solutions/4410591
Signed-off-by: Martin Schurz <[email protected]>
* Set volume variable for travis tests to use cgroups mount where needed
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Add section called "Changing the default port and idempotency" and reference to role ssh-hardening-fallback, a wrapper around this role which implements a fallback to port 22 when the configured port is unreachable.
Signed-off-by: Nuno Godinho <[email protected]>
preserve the version ordering of defaults and group all tasks according
to base configuration variable (cipthers, hostkeys, kex and macs)
Signed-off-by: Martin Schurz <[email protected]>
schurzi