Sebastian Gumprich
bb588bd777
linting ( #603 )
...
* linting
Signed-off-by: Sebastian Gumprich <[email protected] [email protected] [email protected] [email protected] https://github.com/ansible/ansible-lint/issues/2522
* use manual line-wrapping because ansible-lint does not support it correctly.
see https://github.com/ansible/ansible-lint/issues/2522
Signed-off-by: Sebastian Gumprich <[email protected] https://github.com/ansible/ansible-lint/issues/2522
Signed-off-by: Sebastian Gumprich <[email protected] [email protected] [email protected] [email protected] [email protected]
2023-01-24 12:40:27 +01:00
Jacob Sievert
ade6deeba2
Updates handlers for new ansible syntax and deprecated options for legacy commands ( #602 )
...
* Update main.yml
fixes the handler file and set new syntax
Signed-off-by: Jacob Sievert <[email protected] [email protected] [email protected]
2022-11-24 08:39:05 +01:00
schurzi
a1b80fe657
adopt all current suggestions from ansible-lint ( #592 )
2022-10-24 09:42:23 +02:00
divialth
fb8b9142c8
rework filesystem hardening ( #555 )
...
* rework filesystem hardening
- removed a lot duplicated code by using a loop
- added new hardening options for /tmp
- added new options "passno" and "dump" for every filesystem.
currently ansible changed that values to 0 for every fs
new default depends on fstype, can be overwriten in config
- removed default fstype in config
the type will now be autodetected, can be overwriten in config
- mount src setting is now optional
the source will now be autodetected, can be overwriten in config
- it will be now checked, if it is really a mount
- changed fs reload to handler
- removed check os_auditd_enabled on /var/log/audit
Signed-off-by: divialth <[email protected] [email protected] [email protected] [email protected]
2022-08-22 11:16:57 +02:00
Sebastian Gumprich
9b50392d8a
fix linting
...
Signed-off-by: Sebastian Gumprich <[email protected]
2022-07-07 16:12:06 +02:00
Sebastian Gumprich
8f22ce788c
Feature coredump ( #513 )
...
* restructure limits-tasks
* disable coredumps in tests
* use notify-task for systemd-reload
Signed-off-by: rndmh3ro <[email protected] [email protected] [email protected]
2021-12-10 22:10:14 +01:00
schurzi
2882a15ee1
Merge pull request #427 from dev-sec/snoopotic-fix/add_auditd_restart_handler
...
add restart-auditd handler after configuration change
2021-03-29 21:15:46 +02:00
Sebastian Gumprich
812c6c5974
skip auditd restart in molecule tests
...
Signed-off-by: Sebastian Gumprich <[email protected]
2021-03-29 10:00:15 +02:00
Sebastian Gumprich
ae68f73965
skip auditd restart in molecule tests
...
Signed-off-by: Sebastian Gumprich <[email protected]
2021-03-29 09:29:37 +02:00
Farid Joubbi
7af432e1cf
Uppercased first letter of task names. ( #422 )
...
Signed-off-by: Farid Joubbi <[email protected]
2021-03-25 13:52:56 +01:00
Sebastian Gumprich
390f7ad6cc
fix linting
...
Signed-off-by: Sebastian Gumprich <[email protected]
2021-03-19 14:46:42 +01:00
Felix Herzog
eca93cc80b
add restart-auditd handler as after configuration change (e.g. of os_auditd_max_log_file_action) you need to restart. Sadly on rhel7 systems you cannot use systemd. And as debian derivates use service as alias and it works I kept it that simple. also adding 'auditd'-tag to make it easy only run that config change if needed.
...
Signed-off-by: Felix Herzog <[email protected]
2021-03-19 14:42:31 +01:00
Sebastian Gumprich
dd3959276b
merge os-hardening role into collection
2020-11-07 22:09:28 +01:00
Sebastian Gumprich