andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,183 Commits 14 Branches 64 Tags
f3a1fcc16a7b3257d8ccf8d4bd288d8a5dd892ae
Commit Graph
377 Commits
Author SHA1 Message Date
Martin Schurz d693a8e200 also use requisite for pwhistory 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-23 08:53:49 +01:00
Martin Schurz 0ac56e4c00 Merge branch 'master' into pwhistory 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-23 08:53:23 +01:00
schurzi 5be13e878f Merge pull request #430 from joubbi/comment 
Remove comments from PAM config file, but keep it in the template
 2021-03-23 08:40:20 +01:00
Farid Joubbi 659e5ada6a Changed to pam_pwhistory.so instead of pam_unix.so for remembering old passwords. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-03-22 22:28:25 +01:00
Farid Joubbi 0010715039 Remove comment from output file, but keep it in the template. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-03-22 19:39:49 +01:00
rndmh3ro 369c2986c6 Prettified Code! 2021-03-22 10:23:03 +00:00
Sebastian Gumprich 02c689eaa0 fix loop for home_directories 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-22 11:18:51 +01:00
Sebastian Gumprichandschurzi bf82736787 Update roles/os_hardening/tasks/user_accounts.yml 
Co-authored-by: schurzi <[email protected]>
 2021-03-22 11:18:51 +01:00
Sebastian Gumprich c86bdcb4c7 linting 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-22 11:18:51 +01:00
Sebastian Gumprich b5ca78a9cd chmod /home directories to 0700 
This is based on https://github.com/dev-sec/ansible-collection-hardening/pull/277
and updated to work with the new collection.

Thanks to @aardbol for this initial implementation!

Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-22 11:18:51 +01:00
Sebastian Gumprich 390f7ad6cc fix linting 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-19 14:46:42 +01:00
Felix Herzog eca93cc80b add restart-auditd handler as after configuration change (e.g. of os_auditd_max_log_file_action) you need to restart. Sadly on rhel7 systems you cannot use systemd. And as debian derivates use service as alias and it works I kept it that simple. also adding 'auditd'-tag to make it easy only run that config change if needed. 
Signed-off-by: Felix Herzog <[email protected]>
 2021-03-19 14:42:31 +01:00
schurzi a64838272c Merge pull request #418 from joubbi/documentation2 
Improve Documentation for sysctl defaults
 2021-03-16 15:49:55 +01:00
Martin Schurz b2dd73d27e remove unneeded tasks 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-15 23:53:40 +01:00
Martin Schurz ec9d7d2cb8 cleanup and typos 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-15 23:39:12 +01:00
Farid Joubbi 97c55d6e55 Documented rationale for sysctl values set. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-03-15 14:01:19 +01:00
Martin Schurz 5f97dffddf Merge branch 'master' into tally 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-11 19:26:37 +01:00
schurzi 103135ce9a fix task naming 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-11 17:21:32 +01:00
Farid Joubbi 4158e0bfb4 Created a list of files/dirs to be looped instead of two tasks per file/dir. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-03-11 16:54:25 +01:00
Farid Joubbi 4bad4779cd Fixed copy-paste error by doing og-rwx instead of numerical. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-02-22 22:13:18 +01:00
Martin Schurz 75fc31b80c remove cracklib 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 19:10:45 +01:00
Farid Joubbi 91a0d62305 Ensure permissions on /etc/crontab are configured. #375 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-02-19 23:19:00 +01:00
Farid Joubbi 60d24db460 Ensure permissions on /etc/crontab are configured. #375 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-02-19 22:40:16 +01:00
schurzi 8e4c22d8d9 remove FQCN from roles in examples (#404) 
Ansible does not work with FQCN and collections sepcified for including
roles. It is currently expecting to only get the role name in this
context.

Verified with Ansible 2.10.5

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-17 11:34:37 +01:00
Martin Schurz dba53718cf sssd is disabled on Amazonlinus 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-16 20:44:28 +01:00
Martin Schurz 4a5fa70507 default faillock to yes 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-16 19:31:51 +01:00
Martin Schurz 64713ce75d add default for new variable 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 11:17:01 +01:00
Martin Schurz ec36bf5b9c document parameter 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 00:22:03 +01:00
Martin Schurz 08aad6e80f add documentation 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 00:13:14 +01:00
Martin Schurz 28c6bf5c66 put force on the right task 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 23:31:24 +01:00
Martin Schurz 26c73ed1c9 fix debian faillock config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 23:13:14 +01:00
Maxim Burgerhout 54c8e6aedb Split off ssh_gssapi_delegation into own variable 
Signed-off-by: Maxim Burgerhout <[email protected]>
 2021-02-14 22:07:33 +01:00
Martin Schurz b9e33091e2 fix problems with auth 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 21:30:35 +01:00
Martin Schurz 7f1765c608 consolidate auth for rhel 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 17:30:02 +01:00
Martin Schurz 30f0839513 add support for rhel8 and sssd 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 12:44:20 +01:00
Martin Schurz 532917d956 remove rhel6 support from pam 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 12:14:54 +01:00
Martin Schurz 04654d0490 correct typo 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 11:19:12 +01:00
Martin Schurz aa166f43fc split debian and rhel pam config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 02:07:25 +01:00
Martin Schurz 19482c319c force create symlink 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-13 19:38:57 +01:00
Martin Schurz fc7fb4fc8a make compatible to authconfig 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-13 18:09:48 +01:00
Maxim Burgerhout 8baab7516e Extend GSSAPI configuration support to ssh_config 
Previously, the ssh_gssapi_support variable only toggled the GSSAPI
settings in sshd_config.

Through this change, setting ssh_gssapi_support to true also enables
support in ssh_config.

It enables both authentication and credential delegation.

Signed-off-by: Maxim Burgerhout <[email protected]>
 2021-02-12 13:10:35 +01:00
Martin Schurz 7282187a90 Merge branch 'master' into tally 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 21:44:55 +01:00
Martin Schurz 157f4fca70 add tasks for faillock on debian 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 21:43:30 +01:00
Sebastian Gumprich 6be31fbc3b do not install mysql python package on target host (#401) 
this package has to be installed on the host that executes the task

Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-02-10 15:57:51 +01:00
Sebastian Gumprich 756839f8f0 make wrong password fail task (#400) 
* make wrong password fail task

Signed-off-by: Sebastian Gumprich <[email protected]>

* add name to fail task

Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-02-10 15:55:08 +01:00
Sebastian Gumprich c55c1f21ed add restart handler variable for mysql role (#399) 
* add restart handler variable for mysql role

Signed-off-by: Sebastian Gumprich <[email protected]>

* add prettierignore file to ignore CHANGELOG

Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-02-10 15:54:57 +01:00
schurzi a98876b350 update ansible-lint to version 5 (#397) 
* add ansible to requirements

Signed-off-by: Martin Schurz <[email protected]>

* trigger run

Signed-off-by: Martin Schurz <[email protected]>

* update noqa for ansible-lint 5

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 13:47:01 +01:00
Martin Schurz 94b9bfc3cd add files for faillock 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 12:49:12 +01:00
Norman Ziegner f035053381 Only set default for ssh host key files when hardening the server (#393) 
Signed-off-by: Norman Ziegner <[email protected]>
 2021-02-09 10:01:41 +01:00
Norman Ziegner 614662b99d Add variable to specify host rsa key size (#394) 
Signed-off-by: Norman Ziegner <[email protected]>
 2021-02-09 09:44:55 +01:00