Commit Graph
72 Commits
Author SHA1 Message Date
Sebastian Gumprich 02db22f6fc Update minimum ansible version 2025-05-20 12:29:15 +02:00
schurzi 69ab9e47ad Update Debian compatibility (#784)
* Update Ubuntu compatability

Signed-off-by: Martin Schurz <[email protected]>

* reload systemd when disabling ssh socket

Signed-off-by: Martin Schurz <[email protected]>

* manage systemd files

Signed-off-by: Martin Schurz <[email protected]>

* Create privsep directory for Debian

Signed-off-by: Martin Schurz <[email protected]>

* Use working Ubuntu 24.04 image for vm tests

Signed-off-by: Martin Schurz <[email protected]>

* Remove deprecated Debian 10

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>
2024-08-06 13:11:32 +02:00
Martin Schurz f7157dad4f Update to current Fedora releases
Signed-off-by: Martin Schurz <[email protected]>
2024-07-28 17:32:44 +02:00
Sebastian Gumprich 60de0ab50b centos8 stream is eol (#770)
Signed-off-by: Sebastian Gumprich <[email protected]>
2024-06-04 10:10:19 +02:00
Sebastian Gumprich 296f46cc80 centos7 is eol, remove it (#767)
* centos7 is eol, remove it

Signed-off-by: Sebastian Gumprich <[email protected]>

* change workflow to update readmes when meta/main.yml is changed

Signed-off-by: Sebastian Gumprich <[email protected]>

* remove mention of centos 7 from readme

Signed-off-by: Sebastian Gumprich <[email protected]>

---------

Signed-off-by: Sebastian Gumprich <[email protected]>
2024-05-31 11:25:01 +02:00
Martin Schurz adda83572a fix mixup, add custom test badge
Signed-off-by: Martin Schurz <[email protected]>
2023-11-16 12:10:41 +01:00
Martin Schurz 01bde49fbc update badges
Signed-off-by: Martin Schurz <[email protected]>
2023-11-16 11:30:38 +01:00
Sebastian GumprichandSebastian Gumprich ef5e8801e4 add debian 12 support (#684)
* add debian 12 support

Signed-off-by: Sebastian Gumprich <[email protected]>

* temp disable pam-checks

Signed-off-by: Sebastian Gumprich <[email protected]>

* remove debian12 from vagrant tests as there's no box yet

Signed-off-by: Sebastian Gumprich <[email protected]>

* use new pam-tester from pip

Signed-off-by: Sebastian Gumprich <[email protected]>

* use new pam-tester from pip

Signed-off-by: Sebastian Gumprich <[email protected]>

* add setuptoolks to pam-tester install

Signed-off-by: Sebastian Gumprich <[email protected]>

* add setuptoolks to pam-tester install

Signed-off-by: Sebastian Gumprich <[email protected]>

* add setuptoolks to pam-tester install

Signed-off-by: Sebastian Gumprich <[email protected]>

* add setuptoolks to pam-tester install

Signed-off-by: Sebastian Gumprich <[email protected]>

* install pam-tester with python3 and use full path to it

Signed-off-by: Sebastian Gumprich <[email protected]>

* install python3-setupttools in verify-tests

Signed-off-by: Sebastian Gumprich <[email protected]>

* fix path for pam-tester in all tests

Signed-off-by: Sebastian Gumprich <[email protected]>

* set python interpreter to 3 for verify-tests

Signed-off-by: Sebastian Gumprich <[email protected]>

* Revert "set python interpreter to 3 for verify-tests"

This reverts commit 00b6556e33.

* add back accidentally deleted tasks

Signed-off-by: Sebastian Gumprich <[email protected]>

---------

Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
2023-08-04 12:59:40 +02:00
Nejc Habjan dd215ba310 feat: explicitly support Fedora 37 and 38 (#682)
Signed-off-by: Nejc Habjan <[email protected]>
2023-06-12 14:18:32 +02:00
Sebastian Gumprich 720d7786b5 fix typo 2022-08-22 12:39:21 +02:00
Sebastian Gumprich 84412e99c2 fix typo 2022-08-22 11:25:08 +02:00
Sebastian Gumprich 82bb46d7cc update supported OS 2022-08-16 17:21:06 +02:00
eef8708918 Add full support for Debian 11 (#538)
* Include Debian 11 into Molecule test suites (#527)

Signed-off-by: Daya Adianto <[email protected]>

* Fix Ansible Lint GitHub Action version (#527)

Signed-off-by: Daya Adianto <[email protected]>

* Update .gitignore

Signed-off-by: Daya Adianto <[email protected]>

* mysql_hardening: Use Python 3 as Ansible interpreter (#527)

Signed-off-by: Daya Adianto <[email protected]>

* Note Debian 11 support for os_hardening & nginx_hardening (#527)

Signed-off-by: Daya Adianto <[email protected]>

* Fix lint issues & Ansible Lint configuration in CI

Signed-off-by: Daya Adianto <[email protected]>

* Try to fix YAML lint issues, again

Re-ordered YAML comments at the end of `.yamllint` file.

Signed-off-by: Daya Adianto <[email protected]>

* rm debian9 from tests, add debian 11 where missing

Signed-off-by: Sebastian Gumprich <[email protected]>

* fix mysql molecule tests

Signed-off-by: Sebastian Gumprich <[email protected]>

Signed-off-by: Daya Adianto <[email protected]>
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
2022-08-16 15:02:27 +02:00
schurzi b56c801574 add basic support for ubuntu22.04 (#554)
Signed-off-by: Martin Schurz <[email protected]>

Signed-off-by: Martin Schurz <[email protected]>
2022-08-15 13:05:09 +02:00
Martin Schurz edda7075a2 add badge for tests
Signed-off-by: Martin Schurz <[email protected]>
2022-07-11 12:17:34 +02:00
Martin Schurz 18d01327eb improve linking to legacy roles
Signed-off-by: Martin Schurz <[email protected]>
2022-05-04 13:44:52 +02:00
Sebastian Gumprich 72ec118a6d add rocky linux 8 tests and make sure that all relevant tasks are execd (#457)
* add rocky linux 8 tests and make sure that all relevant tasks are executed

Signed-off-by: rndmh3ro <[email protected]>

* fix missing quote

Signed-off-by: rndmh3ro <[email protected]>
2021-06-30 13:09:12 +02:00
Sebastian Gumprich f9bbdb20fe add install instructions 2021-02-25 07:57:55 +01:00
Martin Schurz c6114278a1 fix minimum required ansible version in docs
Signed-off-by: Martin Schurz <[email protected]>
2021-02-05 20:39:04 +01:00
Farid Joubbi 5675589e01 Sorted sysctl values and lists in READMEs alphabetically (No functional changes). (#371)
* Add s's for consistency.

Signed-off-by: Farid Joubbi <[email protected]>

* Sort lists alphabetically.

Signed-off-by: Farid Joubbi <[email protected]>

* Sorted sysctl_config alphabetically.

Signed-off-by: Farid Joubbi <[email protected]>

* Sort removed protocols.

Signed-off-by: Farid Joubbi <[email protected]>

* Added dots in variable descriptions for the sake of consistency.

Signed-off-by: Farid Joubbi <[email protected]>

* Added dots in variable descriptions for the sake of consistency.

Signed-off-by: Farid Joubbi <[email protected]>
2021-01-08 20:45:50 +01:00
Sebastian Gumprich faffddbf31 add a runtime.yml to declare minimum ansible version (#363)
* add a runtime.yml to declare minimum ansible version

Signed-off-by: Sebastian Gumprich <[email protected]>

* add minimum ansible version to reamde

Signed-off-by: Sebastian Gumprich <[email protected]>

* Prettified Code!
2020-12-26 21:27:19 +01:00
Sebastian Gumprich cade17ec30 fix typo 2020-11-11 21:54:31 +01:00
Sebastian Gumprich 6b03886b4b update readme to point to old role
Signed-off-by: Sebastian Gumprich <[email protected]>
2020-11-11 20:44:35 +01:00
rndmh3ro c94d973527 Prettified Code! 2020-11-08 10:20:25 +00:00
Sebastian Gumprich ac3c12d264 move to collections 2020-11-07 21:19:43 +01:00
alegrey91andSebastian Gumprich a8e349913d Mount proc filesystem using hidepid option (#283)
* Added task to mount proc fs using hidepid option

Signed-off-by: alessio <[email protected]>
Signed-off-by: alegrey91 <[email protected]>
Signed-off-by: alessio <[email protected]>

* Removed mount shell command due to ci problem

Signed-off-by: alegrey91 <[email protected]>
Signed-off-by: alessio <[email protected]>

* Added task to create mount point before to add fstab entry

Signed-off-by: alegrey91 <[email protected]>
Signed-off-by: alessio <[email protected]>

* Added check to ensure fstab exist

Signed-off-by: alegrey91 <[email protected]>
Signed-off-by: alessio <[email protected]>

* Modified task title

Signed-off-by: alegrey91 <[email protected]>
Signed-off-by: alessio <[email protected]>

* Fixed typo

Signed-off-by: alegrey91 <[email protected]>
Signed-off-by: alessio <[email protected]>

* Fixed typo

Signed-off-by: alegrey91 <[email protected]>
Signed-off-by: alessio <[email protected]>

* Fixed wrong indented lines

Signed-off-by: alegrey91 <[email protected]>
Signed-off-by: alessio <[email protected]>

* Removed useless tasks and improved variables use

Signed-off-by: alessio <[email protected]>

* removed ansible test tag

Signed-off-by: alessio <[email protected]>

* removed trailing whitespace

Signed-off-by: alessio <[email protected]>

* updated documentation

Signed-off-by: alessio <[email protected]>

* fixed typo

Signed-off-by: alessio <[email protected]>

* Update README.md

* Update vars/main.yml

Co-authored-by: Sebastian Gumprich <[email protected]>
2020-07-21 22:35:50 +02:00
Sebastian Gumprich 990f95807f remove mention of gitter 2020-07-12 09:16:22 +02:00
Sebastian Gumprich 365d7389c7 add selinux options to the readme 2020-05-05 21:28:26 +02:00
Jared Ledvina 908d1faab7 Add kernel parameter information to README (#259)
* Add kernel parameter information to README

Add initial documentation around configuring audit=1 to reduce the inaccuracies in the auditd logs. 
Closes https://github.com/dev-sec/ansible-os-hardening/issues/253

Signed-off-by: Jared Ledvina <[email protected]>

* Cleanup spellinng

Signed-off-by: Jared Ledvina <[email protected]>
2020-01-25 17:08:00 +01:00
Jan Dittberner ce6af914c8 Make max_log_file_action for auditd configurable (#246)
* Make max_log_file_action for auditd configurable

This commit allows to configure the max_log_file_action auf auditd to
avoid filling small /var/log partitions for systems that create many
audit log entries. Or run for a long period of time.

Signed-off-by: Jan Dittberner <[email protected]>

* Add os_auditd_max_log_file_action to README

Signed-off-by: Jan Dittberner <[email protected]>
2019-11-07 16:19:42 +01:00
Jared Ledvina 03faef5a75 Update location of NSA RHEL 5 Guide
closes https://github.com/dev-sec/ansible-os-hardening/issues/227

Updates the URL to the NSA Guide to the Secure Configuration of Red Hat Enterprise Linux 5 (version 4.2)

Signed-off-by: Jared Ledvina <[email protected]>
2019-10-06 00:45:47 -04:00
Sebastian Gumprich 2b037fc1d9 add install instructions to readme 2019-04-29 16:48:52 +02:00
Chris McKee 9108a83a03 Add note about docker under warning
Signed-off-by: Chris McKee <[email protected]>
2019-03-29 01:44:23 +00:00
Ruslan Baratov 8e891f2575 Fix typo
Signed-off-by: Ruslan Baratov <[email protected]>
2019-03-19 19:28:59 +03:00
pmav99 f5ae581d71 [readme] Update documentation link
The old link was no longer valid
2019-01-17 17:06:32 +02:00
John Szivós df13320c73 ensure that permissions to su-binary are not restricted to root user and group only, if os_security_users_allow contains the value change_user 2018-10-11 20:38:02 +02:00
Sebastian Gumprich 67f16f166c add option to disable auditd 2018-09-16 20:56:48 +02:00
Sebastian Gumprich e439904fd0 update minimum ansible version 2018-08-01 21:08:16 +02:00
Tom Carchrae b215e4f6ba comment is wrong/misleading 2018-06-08 08:27:32 -07:00
Sebastian Gumprich 60c26e3b47 Update README.md 2018-04-29 12:48:21 +02:00
Sebastian Gumprich a002e5e6c9 Update README.md 2018-04-29 12:46:52 +02:00
Sebastian Gumprich a4e383795f Update README.md 2018-04-09 21:31:44 +02:00
Sebastian Gumprich 1159eb5f00 Update README.md 2018-03-15 15:59:42 +01:00
Sebastian Gumprich 79aaab36b6 Update README.md 2018-03-15 15:59:21 +01:00
Sebastian Gumprich aa0036a1c1 Update README.md 2018-03-14 17:19:26 +01:00
Thomas Fan 15b0c1726e Update syntax to 2.4 2018-01-23 14:55:36 -05:00
Sebastian Gumprich 19b8788a39 remove unused parameter from readme 2018-01-03 10:43:13 +01:00
Sebastian Gumprich a1727e24e4 Merge pull request #139 from dev-sec/fix_124
update readme
2017-12-23 15:35:34 +01:00
Manuel Prinz d429d53c60 Prevent disabling of filesystems via whitelist 2017-11-01 14:10:15 +01:00
Sebastian Gumprich 62d20e299f install modprobe package,
check for modprobe

use apt and yum instead of package

Revert "use apt and yum instead of package"

This reverts commit 215a97b1867a7a8af5e0e64e9f77181d4c4a5050.

use latest to install kmod

run apt-get update
2017-08-07 14:56:42 +02:00