* make template overrideable
by referencing the auditd.conf.j2 template, a custom template can be provided to the role.
Signed-off-by: Dennis Lerch <[email protected]>
* extend auditd config
make freq and log_file configurable
implement write_logs with it's default value in order to be able to disable log writing
Signed-off-by: Dennis Lerch <[email protected]>
* Extend README.md documentation by new variables
reorder `os_auditd_log_format` to keep sequence from defaults
Signed-off-by: Dennis Lerch <[email protected]>
---------
Signed-off-by: Dennis Lerch <[email protected]>
* add check mode to molecule tests
Signed-off-by: Martin Schurz <[email protected]>
* bail on undefined variables
Signed-off-by: Martin Schurz <[email protected]>
* bail on undefined variables
Signed-off-by: Martin Schurz <[email protected]>
* execute tasks in check mode
Signed-off-by: Martin Schurz <[email protected]>
* fix error in check mode on SuSE
Signed-off-by: Martin Schurz <[email protected]>
* use when condition on task
Signed-off-by: Martin Schurz <[email protected]>
---------
Signed-off-by: Martin Schurz <[email protected]>
* add remaining platforms to test
Signed-off-by: Martin Schurz <[email protected]>
* remove unneccessary tasks for test
Signed-off-by: Martin Schurz <[email protected]>
* use current opensuse version
Signed-off-by: Martin Schurz <[email protected]>
* disable sysctl for missing yama in opensuse
Signed-off-by: Martin Schurz <[email protected]>
---------
Signed-off-by: Martin Schurz <[email protected]>
* rewrite user home dir hardening
* delete duplicate var that was missed in a merge conflict
Signed-off-by: Sebastian Gumprich <[email protected]>
* linting
Signed-off-by: Sebastian Gumprich <[email protected]>
* add tests for home rewrites
Signed-off-by: Sebastian Gumprich <[email protected]>
* Apply suggestions from code review
Co-authored-by: schurzi <[email protected]>
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: donestefan <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: schurzi <[email protected]>
* Preserve default ownership and dir mode for /var/log on Ubuntu
Signed-off-by: stdtom <[email protected]>
* linting
Signed-off-by: stdtom <[email protected]>
* Define vars for each OS instead of using defaults.
Signed-off-by: stdtom <[email protected]>
* Fix values for os_mnt_var_log_dir_mode and os_mnt_var_log_group
Signed-off-by: stdtom <[email protected]>
Signed-off-by: stdtom <[email protected]>
* Update main.yml
fixes the handler file and set new syntax
Signed-off-by: Jacob Sievert <[email protected]>
* changes command module from legacy to builtin.
Signed-off-by: Jacob Sievert <[email protected]>
Signed-off-by: Jacob Sievert <[email protected]>
* rework filesystem hardening
- removed a lot duplicated code by using a loop
- added new hardening options for /tmp
- added new options "passno" and "dump" for every filesystem.
currently ansible changed that values to 0 for every fs
new default depends on fstype, can be overwriten in config
- removed default fstype in config
the type will now be autodetected, can be overwriten in config
- mount src setting is now optional
the source will now be autodetected, can be overwriten in config
- it will be now checked, if it is really a mount
- changed fs reload to handler
- removed check os_auditd_enabled on /var/log/audit
Signed-off-by: divialth <[email protected]>
* fix lint errors
Signed-off-by: divialth <[email protected]>
* implemented the name suggestions
Signed-off-by: divialth <[email protected]>
Signed-off-by: divialth <[email protected]>
add option to whitelist specific user that need a .netrc file in there home dirs
add test for .netrc files if option os_netrc_enabled is false
Signed-off-by: Philipp Funk <[email protected]>
Signed-off-by: Philipp Funk <[email protected]>
Co-authored-by: Philipp Funk <[email protected]>
* Include Debian 11 into Molecule test suites (#527)
Signed-off-by: Daya Adianto <[email protected]>
* Fix Ansible Lint GitHub Action version (#527)
Signed-off-by: Daya Adianto <[email protected]>
* Update .gitignore
Signed-off-by: Daya Adianto <[email protected]>
* mysql_hardening: Use Python 3 as Ansible interpreter (#527)
Signed-off-by: Daya Adianto <[email protected]>
* Note Debian 11 support for os_hardening & nginx_hardening (#527)
Signed-off-by: Daya Adianto <[email protected]>
* Fix lint issues & Ansible Lint configuration in CI
Signed-off-by: Daya Adianto <[email protected]>
* Try to fix YAML lint issues, again
Re-ordered YAML comments at the end of `.yamllint` file.
Signed-off-by: Daya Adianto <[email protected]>
* rm debian9 from tests, add debian 11 where missing
Signed-off-by: Sebastian Gumprich <[email protected]>
* fix mysql molecule tests
Signed-off-by: Sebastian Gumprich <[email protected]>
Signed-off-by: Daya Adianto <[email protected]>
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
```
Unable to open /var/log/audit/audit.log (Permission denied)
```
This PR fixes the issue by using the default permission set by auditd (`0700`).
Signed-off-by: Benedikt Böhm <[email protected]>
* Only run harding if /var/log/audit exists
Signed-off-by: GitHub <[email protected]>
* Update roles/os_hardening/tasks/minimize_access.yml
* add more conditionals to when auditd show be hardened
Signed-off-by: Sebastian Gumprich <[email protected]>
* add more tests to the os-hardening vm tests
Signed-off-by: Sebastian Gumprich <[email protected]>
* Revert "add more tests to the os-hardening vm tests"
This reverts commit c05fe8b520.
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Dennis Lerch