Commit Graph
12 Commits
Author SHA1 Message Date
89138be4ec Rewrite system account detection and hardening and create tests (#621)
* rewrite system account detection and hardening

* resolve failures created when resolving merge conflicts

Signed-off-by: Sebastian Gumprich <[email protected]>

* add tests for shell removal tasks

Signed-off-by: Sebastian Gumprich <[email protected]>

* Update molecule/os_hardening/prepare.yml

Signed-off-by: Martin Schurz <[email protected]>

* split tasks for locking and setting shell

Signed-off-by: Martin Schurz <[email protected]>

* fix some more linting

Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Sebastian Gumprich <[email protected]>
Signed-off-by: Martin Schurz <[email protected]>
Co-authored-by: donestefan <[email protected]>
Co-authored-by: schurzi <[email protected]>
2023-01-27 11:01:03 +01:00
Sebastian Gumprich bb588bd777 linting (#603)
* linting

Signed-off-by: Sebastian Gumprich <[email protected]>

* more linting

Signed-off-by: Sebastian Gumprich <[email protected]>

* change line length issues

Signed-off-by: Sebastian Gumprich <[email protected]>

* replace yes with true in tasks

Signed-off-by: Sebastian Gumprich <[email protected]>

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

Signed-off-by: Sebastian Gumprich <[email protected]>

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

Signed-off-by: Sebastian Gumprich <[email protected]>

* add exception for task

Signed-off-by: Sebastian Gumprich <[email protected]>

* remove trailing whitespace

* add back deleted params

Signed-off-by: Sebastian Gumprich <[email protected]>

* add back deleted params

Signed-off-by: Sebastian Gumprich <[email protected]>

* add back tasks

Signed-off-by: Sebastian Gumprich <[email protected]>
2023-01-24 12:40:27 +01:00
Dennis Eriksen 4df95e3733 OpenBSD does not set distributiuon_major_version (#597)
This role fails with `The task includes an option with an undefined variable` on OpenBSD because `distributiuon_major_version` is not set on OpenBSD.

We should either default to "" if the variable is not set, or remove `vars/OpenBSD.yml`. I would prefer the former :)

Signed-off-by: Dennis Eriksen <[email protected]>

Signed-off-by: Dennis Eriksen <[email protected]>
2022-11-04 12:00:55 +01:00
Benedikt Böhm 802bad48e6 do not manage trusted user ca keys if none exist (#580)
Signed-off-by: Benedikt Böhm <[email protected]>

Signed-off-by: Benedikt Böhm <[email protected]>
2022-10-20 14:44:14 +02:00
rndmh3ro cf17f80374 skip linting on special task
Signed-off-by: rndmh3ro <[email protected]>
2021-08-15 20:16:56 +02:00
schurzi 29e10e5c3b add tag always to os dependent vars task (#456)
when our collection is used with tags, the os dependent variables are
not resolved. This task should run every time, so the behaviour is
correct.

Signed-off-by: Martin Schurz <[email protected]>
2021-06-29 13:07:25 +02:00
Sina Tak Tehrani 4313d6fbfb fixed a typo in comments (#439)
Signed-off-by: Sina Tak Tehrani <[email protected]>
2021-04-09 08:15:11 +02:00
Farid Joubbi 7af432e1cf Uppercased first letter of task names. (#422)
Signed-off-by: Farid Joubbi <[email protected]>
2021-03-25 13:52:56 +01:00
Norman Ziegner f035053381 Only set default for ssh host key files when hardening the server (#393)
Signed-off-by: Norman Ziegner <[email protected]>
2021-02-09 10:01:41 +01:00
schurziandSebastian Gumprich a75e2c028b change inclusion of os specific defaults (#353)
* change inclusion of os specific defaults

we now include the os specific options into a separate variable and
merge this with the default ansible namespace, when the corresponding
keys do not already exist (eg. are defined by default oder by user)

Signed-off-by: Martin Schurz <[email protected]>

* simplify check for os specific variables

Signed-off-by: Martin Schurz <[email protected]>

* add test for variable override

Signed-off-by: Martin Schurz <[email protected]>

* move tests to verify stage

Signed-off-by: Martin Schurz <[email protected]>

* correct grep

Signed-off-by: Martin Schurz <[email protected]>

* linting

Signed-off-by: Martin Schurz <[email protected]>

* fix typo

Signed-off-by: Martin Schurz <[email protected]>

* Revert "Merge pull request #351 from sprat/fix-umask"

This reverts commit 9e8e0bc8fb, reversing
changes made to 98c7553016.

Signed-off-by: Martin Schurz <[email protected]>

* move immutable ssh vars to internal vars

Signed-off-by: Martin Schurz <[email protected]>

* move vars to OS files

Signed-off-by: Martin Schurz <[email protected]>

* change default handling for all roles

Signed-off-by: Martin Schurz <[email protected]>

* fix issues

Signed-off-by: Martin Schurz <[email protected]>

* add documentation

Signed-off-by: Martin Schurz <[email protected]>

* Update main.yml

Co-authored-by: Sebastian Gumprich <[email protected]>
2020-12-20 20:46:57 +01:00
Sylvain Prat 43ec139d24 Fix #348: make ssh configuration files paths configurable (#350)
Signed-off-by: Sylvain Prat <[email protected]>
2020-12-16 19:24:44 +01:00
Sebastian Gumprich a46642ee92 merge ssh-hardening role into collection 2020-11-07 21:46:45 +01:00