Ansible can open multiple connections and it's possible for a new socket
to open before activation is fully disabled, leaving a zombie sshd
process. At least that is the guess. Ubuntu 24.04 suffers from this.
Reload the configuration after disabling socket activation to not enable
it again.
Signed-off-by: Tatu Argillander <[email protected]>
* ci: disable injecting facts as own vars in the main namespace
Signed-off-by: Norman Ziegner <[email protected]>
* Consistently access facts via the ansible_facts.* namespace
Signed-off-by: Norman Ziegner <[email protected]>
---------
Signed-off-by: Norman Ziegner <[email protected]>
* os_hardening: disable systemd audit logging
disable audit logging via systemd-journald when enabling auditd
as this leads to duplicate logs in the journal or even /var/log/messages
depending on the configuration
Signed-off-by: Christoph Sieber <[email protected]>
* Don't disable systemd-journald-audit.socket on Suse
it seems the socket doesn't exist on this OS
Signed-off-by: Christoph Sieber <[email protected]>
---------
Signed-off-by: Christoph Sieber <[email protected]>
Co-authored-by: Christoph Sieber <[email protected]>
* Write sysctl config to separate file
Write our sysctl config to separate file, since newer distributions no longer use the global /etc/sysctl.conf file. All older distributions seem to already support reading from /etc/sysctl.d so this should be no breaking change.
* Add support for current versions of Debian and EL
Signed-off-by: Martin Schurz <[email protected]>
* Add conditions for EL8
Signed-off-by: Martin Schurz <[email protected]>
* Fix Audit in AlmaLinux
Signed-off-by: Martin Schurz <[email protected]>
* Fix broken SSH host key config in rhel/almalinux 10
Signed-off-by: Jonathan Wright <[email protected]>
* Generate SSH Keys on EL10
Signed-off-by: Martin Schurz <[email protected]>
* Generate SSH Keys for tests via Systemd
Signed-off-by: Martin Schurz <[email protected]>
* Fixup tests
Signed-off-by: Martin Schurz <[email protected]>
* Remove auditd conditions
Signed-off-by: Martin Schurz <[email protected]>
* Add path to audit handler
Signed-off-by: Martin Schurz <[email protected]>
* Install init scripts
Signed-off-by: Martin Schurz <[email protected]>
* Update main README
---------
Signed-off-by: Martin Schurz <[email protected]>
Signed-off-by: Jonathan Wright <[email protected]>
Co-authored-by: Jonathan Wright <[email protected]>
Signed-off-by: Martin Schurz <[email protected]>
Make changes portable
Signed-off-by: Martin Schurz <[email protected]>
Make changes portable
Signed-off-by: Martin Schurz <[email protected]>
Make changes portable
Signed-off-by: Martin Schurz <[email protected]>
Make changes portable
Signed-off-by: Martin Schurz <[email protected]>
Make changes portable
Signed-off-by: Martin Schurz <[email protected]>
Make changes portable
Signed-off-by: Martin Schurz <[email protected]>
Make changes portable
Signed-off-by: Martin Schurz <[email protected]>
* Provide granular noop for shh configuration
We would like to have more fine grained options on applying or not specific configurations.
This commit let the user choose to noop some configuration with a few new
boolean variables.
Motivation for theses options are we may configure ourselves some (ssh host key
regeneration in a templating system) or we are not ready for others (ssh_kex
will break dist-upgrades, letting the operator without ssh).
Signed-off-by: seven beep <[email protected]>
* Provide granula noop for ssh configuration
We would like to have more fine grained options on applying or not specific configurations.
This commit let the user choose to disable configurations for `ssh_host_key_config`,
`ssh_ciphers_config`, `ssh_host_key_config`, `ssh_macs_config` by setting them
to False.
Motivation for theses options are we may configure ourselves some (ssh host key
regeneration in a templating system) or we are not ready for others (ssh_kex
will break dist-upgrades, letting the operator without ssh).
Signed-off-by: seven beep <[email protected]>
---------
Signed-off-by: seven beep <[email protected]>
ssh_permit_tunnel needs quotes otherwise we will end up with an error:
```
TASK [devsec.hardening.ssh_hardening : Create sshd_config and set permissions to root/600] **********************************************************************************************************************
fatal: [vampdock02]: FAILED! => {"changed": false, "checksum": "fe6b74e30b1a653f83c2cbe1dd1332c14bd55833", "exit_status": 255, "msg": "failed to validate", "stderr": "/home/debian/.ansible/tmp/ansible-tmp-1728530891.493071-72386-149151737175948/source line 123: bad PermitTunnel argument True\r\n", "stderr_lines": ["/home/debian/.ansible/tmp/ansible-tmp-1728530891.493071-72386-149151737175948/source line 123: bad PermitTunnel argument True"], "stdout": "", "stdout_lines": []}
```
Tatu Argillander