andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,446 Commits 14 Branches 64 Tags
ec97936cce7efb951e4cb8b82477d445c35efe50
Commit Graph
79 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Sebastian Gumprich bd721317d2 try to fix IS_ROLE 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-11-11 15:34:34 +01:00
Sebastian Gumprich 92e6cad463 try to fix IS_ROLE 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-11-11 15:34:34 +01:00
Sebastian Gumprich 66adae0faa try to fix IS_ROLE 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-11-11 15:34:34 +01:00
Sebastian Gumprich dc583422bc try to fix IS_ROLE 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-11-11 15:34:33 +01:00
Sebastian Gumprich 4c5a5deec6 try to fix IS_ROLE 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-11-11 15:34:33 +01:00
Sebastian Gumprich a6892904bf try to fix IS_ROLE 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-11-11 15:34:33 +01:00
Sebastian Gumprich 0675167cb2 do not create role for now! 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-11-11 15:34:33 +01:00
Sebastian Gumprich 8d5143b5d7 try to fix IS_ROLE 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-11-11 15:34:33 +01:00
Sebastian Gumprich 0bf528d83b do not try to drop roles in mysql hardening 
There's a new feature in mariadb 10.1 (https://mariadb.org/grant-to-public-in-mariadb/) and mysql 8 (need to verify).

    MariaDB has quite a complex privilege system. Most of it is based on the SQL Standard spec; however we do have some specific MariaDB extensions. GRANT ... TO PUBLIC (MDEV-5215) is a standard feature that is now available as a preview in MariaDB 10.11.0. It is related to ROLES and DEFAULT ROLE, but it covers a different use case.

    ROLES are effectively “privilege packages” that you can enable and disable as a user. One can also set which “privilege package” will be enabled at connect time by setting a DEFAULT ROLE per user. This is all quite useful, however it is missing one key feature. For a DBA, it would be quite useful to state only once that all users need to have a certain set of privileges. This is where GRANT ... TO PUBLIC comes in.

Some more information here: https://mariadb.org/wp-content/uploads/2018/07/MariaDB-Roles-Tampere-Unconference-2018.pdf

This role is shown as a user, it has however a new is_role-flag.

MariaDB [(none)]> select user, host, is_role from mysql.user;
+-----------------------+-----------+---------+
| User                  | Host      | is_role |
+-----------------------+-----------+---------+
| mariadb.sys           | localhost | N       |
| root                  | localhost | N       |
| mysql                 | localhost | N       |
| PUBLIC                |           | Y       |
| monitoring            | %         | N       |
| monitoring            | localhost | N       |
| galera_mariadb_backup | %         | N       |
+-----------------------+-----------+---------+

Since this "user" does not have a password or authentication_string, the ansible-role tries to delete it but fails.

Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-11-11 15:34:33 +01:00
Sebastian Gumprich bfedba6907 do not let dependabot label our prs 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-30 16:20:35 +01:00
Sebastian Gumprich 330a1eb94d run linting only when files inside roles change 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-30 10:23:25 +01:00
Sebastian Gumprich a75b339526 fix more linting errors 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-27 11:27:35 +01:00
Sebastian Gumprich a1028c7504 deprecate initramfs 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-25 13:07:37 +01:00
Sebastian Gumprich db4bd32767 cancel running tests if new commit to branch is made 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-24 13:08:04 +01:00
Sebastian Gumprich 281d706660 add waiver to not test mounts 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-24 13:03:04 +01:00
Sebastian Gumprich d386bf36d2 Revert "manage tmp dir in tests" 
This reverts commit 966f2fe137.
 2023-01-24 12:53:39 +01:00
Sebastian Gumprich 966f2fe137 manage tmp dir in tests 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-24 12:36:09 +01:00
Sebastian Gumprich fa2e90c6f2 mount cgroup rw, as suse seems to need it 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-23 15:59:06 +01:00
Sebastian Gumprich ed1cb1c2a7 add cgroupns: host mode to molecule 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-23 15:59:06 +01:00
Sebastian Gumprich a0d11faa8a Fixed problems with running molecule locally with cgroup v2 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-23 15:59:06 +01:00
Sebastian Gumprich 142782bad6 add diff to molecule 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2023-01-19 13:46:16 +01:00
Sebastian Gumprich e2b963d711 change baselines back to master 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-10-25 18:59:11 +02:00
Sebastian Gumprich 414efd6125 use correct centos stream images, try to fix prepare step for debian tests 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-10-25 18:59:11 +02:00
Sebastian Gumprich 87a461fc57 use forked mysql-baseline 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-10-25 18:59:11 +02:00
Sebastian Gumprich dac66f4a88 simplify OS-vars files 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-10-25 18:59:11 +02:00
Sebastian Gumprich 3b8b394f10 add ssh-vars for new OS 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-10-25 18:59:11 +02:00
Sebastian Gumprich b27ffd08b0 add mysql-vars for new OS 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-10-25 18:58:53 +02:00
Sebastian Gumprich a176443f22 add support for centos stream 8 and 9, rocky 9 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-10-24 10:03:07 +02:00
Sebastian Gumprich 9d75e3b00e test crypto changes from ssh-baseline 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-10-24 10:03:07 +02:00
Sebastian Gumprich 73f84ae2a9 fix wrong indentation 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-07-08 16:04:37 +02:00
Sebastian Gumprich bf372f8493 rename tasks file and remove redundant 'verify' 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-07-08 16:04:24 +02:00
Sebastian Gumprich ef89d52f98 remove duplicate file 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-07-07 16:22:10 +02:00
Sebastian Gumprich 9b50392d8a fix linting 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-07-07 16:12:06 +02:00
Sebastian Gumprich 215c50709b tempt 2022-07-07 15:34:28 +02:00
Sebastian Gumprich a8fdf2de0a fix linting errors 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-07-07 14:59:39 +02:00
Sebastian Gumprich 3f50b6e94b update os-hardening readme with os_ignore_users 
fixes #542

Signed-off-by: Sebastian Gumprich <[email protected]>
 2022-05-30 13:29:45 +02:00
Sebastian Gumprich 45711874e6 test release workflow with labels 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-29 07:46:06 +02:00
Sebastian Gumprich 8c89d78f44 move jmespath installation into github workflow 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich d6a99c995e use fqcn for mysql tasks 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich 5ed100b7ea try to install jmespath on github host 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich c6febf3249 fix linting 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich 7d68c6036c use single ansible fact to delete user 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich d4a4faa16d fix syntax of mysql queries 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich e1f0efb220 move mysql install to prepare step to create a password-less user 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich 73cdd973d7 remove custom tests as we have inspec tests 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich 5e7a0a60f1 fix linting 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich c3b954a2ab add new tasks to delete users without passwords 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich 2fb54bd224 remove secure-auth param if mysql => 8.0.3 
Signed-off-by: Sebastian Gumprich <[email protected]>

install collection in molecule

Signed-off-by: Sebastian Gumprich <[email protected]>

remove deprecated ubuntu 16.04 from tests

Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-01 13:20:58 +02:00
Sebastian Gumprich 458dfa2b6a use cinc exec supermarket instead of github 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-29 16:16:03 +02:00
Sebastian Gumprich 812c6c5974 skip auditd restart in molecule tests 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-29 10:00:15 +02:00
Sebastian Gumprich ae68f73965 skip auditd restart in molecule tests 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-29 09:29:37 +02:00
Sebastian Gumprich 02c689eaa0 fix loop for home_directories 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-22 11:18:51 +01:00
Sebastian Gumprich c86bdcb4c7 linting 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-22 11:18:51 +01:00
Sebastian Gumprich b5ca78a9cd chmod /home directories to 0700 
This is based on https://github.com/dev-sec/ansible-collection-hardening/pull/277
and updated to work with the new collection.

Thanks to @aardbol for this initial implementation!

Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-22 11:18:51 +01:00
Sebastian Gumprich 6c805f6ca9 add support for using a proxy to test with molecule 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-19 15:52:19 +01:00
Sebastian Gumprich 8cb6732882 add support for using a proxy to test with molecule 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-19 15:45:06 +01:00
Sebastian Gumprich 390f7ad6cc fix linting 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-19 14:46:42 +01:00
Sebastian Gumprich 98c7553016 remove trailing blank lines 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2020-12-15 20:09:29 +01:00
Sebastian Gumprich 44424474b8 fix package install in tests 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2020-07-06 09:27:15 +02:00
Sebastian Gumprich 25367c6777 make mysql daemon enabling configurable 2018-02-12 13:42:43 +01:00
Sebastian Gumprich 1be18692d8 change init path on amazon 2018-01-12 11:23:04 +01:00
Sebastian Gumprich cc01c4e461 change init path on amazon 2018-01-12 11:17:51 +01:00
Sebastian Gumprich bcc155e68d add amazon linux to travis and kitchen 2018-01-12 10:55:28 +01:00
Sebastian Gumprich 6d81e33515 move defaults to os-specific vars 2018-01-02 18:53:49 +01:00
Sebastian Gumprich 9bf929b1ef update MACs 2017-12-27 11:49:40 +01:00
Sebastian Gumprich 2170eac4ba fix lineending 2017-12-27 10:40:18 +01:00
Sebastian Gumprich 92a23e19ee remove merge conflict line 2017-12-23 15:08:52 +01:00
Sebastian Gumprich c7a4720f04 add spaces to variable 2017-08-09 08:04:18 +02:00
Sebastian Gumprich e01a478858 remove useless check 2017-08-07 18:48:34 +02:00
Sebastian Gumprich cf3bbb3dd4 add conditional check 2017-08-07 15:08:12 +02:00
Sebastian Gumprich a1a1371a83 update readme 2017-08-05 21:58:29 +02:00
Sebastian Gumprich 8df021d3b5 update spaces, bools, trues 2017-08-05 21:43:28 +02:00
Sebastian Gumprich 5eec48b138 update changelog 2017-08-03 10:24:25 +02:00
Sebastian Gumprich aeb61c7b09 more bools 2017-07-28 10:27:27 +02:00
Sebastian Gumprich 6c39725bc9 add bool checks to all relevant variables 2017-07-25 12:59:40 +02:00
Sebastian Gumprich cb8f952a86 update changelog 2017-06-28 16:00:41 +02:00
Sebastian Gumprich 0b8e42c5c6 remove 12.04 support 2017-06-27 15:03:22 +02:00
Sebastian Gumprich f8b8dfe85d update travis to test debian 8 2017-03-02 14:11:38 +01:00
Sebastian Gumprich aac6f60c7e Remove small dh primes 
Thanks to debops!
https://github.com/debops/ansible-sshd/
 2017-03-02 13:32:25 +01:00