andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,363 Commits 14 Branches 64 Tags
dfdbeaa24770a8edfdcb8f1475bff1316b900e97
Commit Graph
205 Commits
Author SHA1 Message Date
Martin Schurz dfdbeaa247 minor fixups 
Signed-off-by: Martin Schurz <[email protected]>
 2025-02-07 19:57:21 +01:00
schurzi 0bd061c02d Prettified Code! 2024-12-23 12:05:29 +00:00
Martin Schurz b7f0bdd81f Add docs 
Signed-off-by: Martin Schurz <[email protected]>
 2024-12-23 00:53:32 +01:00
Martin Schurz e13bb0fcae Use correct os_family for Suse ... 
Signed-off-by: Martin Schurz <[email protected]>
 2024-12-22 22:23:40 +01:00
Martin Schurz e8cf61bd3c Make changes portable 
Signed-off-by: Martin Schurz <[email protected]>

Make changes portable

Signed-off-by: Martin Schurz <[email protected]>

Make changes portable

Signed-off-by: Martin Schurz <[email protected]>

Make changes portable

Signed-off-by: Martin Schurz <[email protected]>

Make changes portable

Signed-off-by: Martin Schurz <[email protected]>

Make changes portable

Signed-off-by: Martin Schurz <[email protected]>

Make changes portable

Signed-off-by: Martin Schurz <[email protected]>

Make changes portable

Signed-off-by: Martin Schurz <[email protected]>
 2024-12-22 22:23:38 +01:00
Martin Schurz 4b05df756c fix errors 
Signed-off-by: Martin Schurz <[email protected]>
 2024-12-22 18:58:39 +01:00
Martin Schurz fba07a4d41 MOdify PAM to allow SSH Key logins with locked passwords 
Signed-off-by: Martin Schurz <[email protected]>
 2024-12-22 18:51:18 +01:00
dev-sec CI 8d336bcdfa update os_hardening readme 2024-10-22 07:18:45 +00:00
Martin Schurz f70a74f99f Add variable to set name_format for auditd 
Signed-off-by: Martin Schurz <[email protected]>
 2024-10-22 08:46:23 +02:00
rndmh3ro 8619b26b75 Prettified Code! 2024-10-13 19:42:40 +00:00
dev-sec CI 08dfeedbc0 update os_hardening readme 2024-10-13 18:15:50 +00:00
rndmh3ro cfd4536868 Prettified Code! 2024-10-13 10:35:08 +00:00
dev-sec CI ba1991b4c1 update os_hardening readme 2024-10-10 11:39:00 +00:00
rndmh3ro d6d2624e4d Prettified Code! 2024-10-09 12:40:26 +00:00
Sebastian Gumprich 62947a6ea2 fix(docs): add 'become: true' to example playbooks. fix #787 (#804) 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2024-10-09 14:40:08 +02:00
schurzi 437546f4a9 Prettified Code! 2024-10-05 07:48:38 +00:00
dev-sec CI 5ef0c42d64 update os_hardening readme 2024-10-04 13:22:42 +00:00
Martin Schurz 2e3d5e916b Remove unused files and variables 
Signed-off-by: Martin Schurz <[email protected]>
 2024-10-04 13:29:16 +02:00
dev-sec CI c5935d38e5 update os_hardening readme 2024-08-06 11:11:58 +00:00
schurzi 69ab9e47ad Update Debian compatibility (#784) 
* Update Ubuntu compatability

Signed-off-by: Martin Schurz <[email protected]>

* reload systemd when disabling ssh socket

Signed-off-by: Martin Schurz <[email protected]>

* manage systemd files

Signed-off-by: Martin Schurz <[email protected]>

* Create privsep directory for Debian

Signed-off-by: Martin Schurz <[email protected]>

* Use working Ubuntu 24.04 image for vm tests

Signed-off-by: Martin Schurz <[email protected]>

* Remove deprecated Debian 10

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>
 2024-08-06 13:11:32 +02:00
schurzi 2ff44f2145 Prettified Code! 2024-07-28 11:45:51 +00:00
Martin Schurz f23d5d8eaf Remove deprecated rebuild of initrd 
Signed-off-by: Martin Schurz <[email protected]>
 2024-07-28 13:17:49 +02:00
dev-sec CI c068979b91 update os_hardening readme 2024-06-24 08:41:24 +00:00
rndmh3ro 26ecb3f5ea Prettified Code! 2024-06-04 08:16:33 +00:00
Sebastian Gumprich 85aa1b22b3 do not force type of ssh_gateway_ports (#765) 
* do not force type of gatewayports-var

this way it can be a bool or a string. we also now test for it

Signed-off-by: Sebastian Gumprich <[email protected]>

* replace yum with dnf

Signed-off-by: Sebastian Gumprich <[email protected]>

---------

Signed-off-by: Sebastian Gumprich <[email protected]>
 2024-05-31 12:20:00 +02:00
dev-sec CI eb972f63f7 update os_hardening readme 2024-05-31 09:42:33 +00:00
Sebastian Gumprich 296f46cc80 centos7 is eol, remove it (#767) 
* centos7 is eol, remove it

Signed-off-by: Sebastian Gumprich <[email protected]>

* change workflow to update readmes when meta/main.yml is changed

Signed-off-by: Sebastian Gumprich <[email protected]>

* remove mention of centos 7 from readme

Signed-off-by: Sebastian Gumprich <[email protected]>

---------

Signed-off-by: Sebastian Gumprich <[email protected]>
 2024-05-31 11:25:01 +02:00
Sebastian Gumprich f3a1fcc16a fix spelling 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2024-05-30 15:01:33 +02:00
schurzi 72eb74a85f Prettified Code! 2024-01-15 13:51:25 +00:00
Sebastian Gumprich e5cc9bbf43 restructure readme to move known problems up top 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2024-01-12 09:30:48 +01:00
Martin Schurz 422fb940a9 manually fix remaining problems 
Signed-off-by: Martin Schurz <[email protected]>
 2023-12-06 15:27:21 +01:00
Martin Schurz 54f9ef42a1 don't try to restart audit in check mode 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-22 00:45:38 +01:00
Martin Schurz 25acb76c05 reload systemd after installation 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-21 23:59:22 +01:00
Martin Schurz 0f6b8e4a3a use full service name for handler 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-21 23:04:41 +01:00
Martin Schurz 20dd04c9cb split notify, add tmp options for arch 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-21 21:58:58 +01:00
Martin Schurz 60d10811d4 add separate handlers for audit restart 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-21 21:45:05 +01:00
Aki Kanellis a15159d072 Make disabling unused filesystems idempotent 
The `os_unused_filesystems` was lacking sorting, making the task not
idempotent. This was especially apparent and random in Molecule tests
when this collection was added as a dependency.

Signed-off-by: Aki Kanellis <[email protected]>
 2023-11-19 19:57:31 +00:00
dev-sec CI 1b69855d51 update os_hardening readme 2023-11-16 14:20:47 +00:00
schurzi 0371a2690b Prettified Code! 2023-11-16 11:35:10 +00:00
Martin Schurz adda83572a fix mixup, add custom test badge 
Signed-off-by: Martin Schurz <[email protected]>
 2023-11-16 12:10:41 +01:00
schurzi 3d98cbf67b add testing and support for current versions of Fedora and FreeBSD (#709) 
* add testing and support for current versions of Fedora and FreeBSD

Signed-off-by: Martin Schurz <[email protected]>

* add waivers for FreeBSD

Signed-off-by: Martin Schurz <[email protected]>

* use original fedora images

Signed-off-by: Martin Schurz <[email protected]>

* also harden /home mount

Signed-off-by: Martin Schurz <[email protected]>

* also harden /tmp mount

Signed-off-by: Martin Schurz <[email protected]>

* test mock efi directory

Signed-off-by: Martin Schurz <[email protected]>

* remove mock

Signed-off-by: Martin Schurz <[email protected]>

* umount efi

Signed-off-by: Martin Schurz <[email protected]>

* add /tmp to special mountpoints

Signed-off-by: Martin Schurz <[email protected]>

* set options for /tmp mount

Signed-off-by: Martin Schurz <[email protected]>

* create /tmp mount

Signed-off-by: Martin Schurz <[email protected]>

* create /tmp mount and mount it ...

Signed-off-by: Martin Schurz <[email protected]>

* make fewer changes to default test run

Signed-off-by: Martin Schurz <[email protected]>

* use correct Ansible var

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>
 2023-11-16 09:14:03 +01:00
schurzi da017fa880 Gather facts when os_hardening role is executed with tags (#708) 
* Gather facts when os_hardening role is executed with tags

Signed-off-by: Martin Schurz <[email protected]>

* better when condition

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>
 2023-11-01 15:54:52 +01:00
dev-sec CI ac7ef8aae6 update os_hardening readme 2023-10-26 08:43:45 +00:00
rndmh3ro a08a057f7b Prettified Code! 2023-10-23 10:24:09 +00:00
Sebastian Gumprich 787ac9bd54 fix some wrong defaults and types in the readmes (#703) 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-10-23 12:23:49 +02:00
Nejc Habjan 35d87aa678 Fix typo in login.defs.j2 
Signed-off-by: Nejc Habjan <[email protected]>
 2023-10-08 14:15:16 +02:00
rndmh3ro 965c9326d0 Prettified Code! 2023-08-24 13:22:18 +00:00
Sebastian Gumprich 9c5b619149 fix descrptions in readme (#693) 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-08-24 15:21:57 +02:00
Thibault Soubiran f602bc621a feat: customize user paths default. Resolves: #689 (#692) 
Signed-off-by: Thibault Soubiran <[email protected]>
 2023-08-24 14:02:23 +02:00
rndmh3ro c1a0bcbe9d Prettified Code! 2023-08-07 12:31:26 +00:00