andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,347 Commits 14 Branches 64 Tags
fba07a4d41575d0c17fd2d715963e2413a21fc20
Commit Graph
199 Commits
Author SHA1 Message Date
Martin Schurz b2dd73d27e remove unneeded tasks 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-15 23:53:40 +01:00
Martin Schurz ec9d7d2cb8 cleanup and typos 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-15 23:39:12 +01:00
Farid Joubbi 97c55d6e55 Documented rationale for sysctl values set. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-03-15 14:01:19 +01:00
Martin Schurz 5f97dffddf Merge branch 'master' into tally 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-11 19:26:37 +01:00
schurzi 103135ce9a fix task naming 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-11 17:21:32 +01:00
Farid Joubbi 4158e0bfb4 Created a list of files/dirs to be looped instead of two tasks per file/dir. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-03-11 16:54:25 +01:00
Farid Joubbi 4bad4779cd Fixed copy-paste error by doing og-rwx instead of numerical. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-02-22 22:13:18 +01:00
Martin Schurz 75fc31b80c remove cracklib 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 19:10:45 +01:00
Farid Joubbi 91a0d62305 Ensure permissions on /etc/crontab are configured. #375 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-02-19 23:19:00 +01:00
Farid Joubbi 60d24db460 Ensure permissions on /etc/crontab are configured. #375 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-02-19 22:40:16 +01:00
schurzi 8e4c22d8d9 remove FQCN from roles in examples (#404) 
Ansible does not work with FQCN and collections sepcified for including
roles. It is currently expecting to only get the role name in this
context.

Verified with Ansible 2.10.5

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-17 11:34:37 +01:00
Martin Schurz dba53718cf sssd is disabled on Amazonlinus 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-16 20:44:28 +01:00
Martin Schurz 4a5fa70507 default faillock to yes 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-16 19:31:51 +01:00
Martin Schurz ec36bf5b9c document parameter 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 00:22:03 +01:00
Martin Schurz 08aad6e80f add documentation 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 00:13:14 +01:00
Martin Schurz 28c6bf5c66 put force on the right task 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 23:31:24 +01:00
Martin Schurz 26c73ed1c9 fix debian faillock config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 23:13:14 +01:00
Martin Schurz b9e33091e2 fix problems with auth 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 21:30:35 +01:00
Martin Schurz 7f1765c608 consolidate auth for rhel 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 17:30:02 +01:00
Martin Schurz 30f0839513 add support for rhel8 and sssd 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 12:44:20 +01:00
Martin Schurz 532917d956 remove rhel6 support from pam 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 12:14:54 +01:00
Martin Schurz 04654d0490 correct typo 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 11:19:12 +01:00
Martin Schurz aa166f43fc split debian and rhel pam config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 02:07:25 +01:00
Martin Schurz 19482c319c force create symlink 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-13 19:38:57 +01:00
Martin Schurz fc7fb4fc8a make compatible to authconfig 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-13 18:09:48 +01:00
Martin Schurz 7282187a90 Merge branch 'master' into tally 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 21:44:55 +01:00
Martin Schurz 157f4fca70 add tasks for faillock on debian 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 21:43:30 +01:00
schurzi a98876b350 update ansible-lint to version 5 (#397) 
* add ansible to requirements

Signed-off-by: Martin Schurz <[email protected]>

* trigger run

Signed-off-by: Martin Schurz <[email protected]>

* update noqa for ansible-lint 5

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 13:47:01 +01:00
Martin Schurz 94b9bfc3cd add files for faillock 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-10 12:49:12 +01:00
Martin Schurz 3ad4fbab0e add guard for tally debian unstable 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 11:18:50 +01:00
Martin Schurz ebbf6855e8 add rhel faillock config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 10:51:16 +01:00
Martin Schurz b210df1233 re-add debian tally config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 10:51:03 +01:00
Martin Schurz a55a4d2024 remove pam_tally2 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-08 08:09:43 +01:00
Martin Schurz 0600cdae75 add "role" to comment 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-20 11:23:40 +01:00
Farid Joubbi 254b62d980 Added comment on top of template about which role modified the resulting file. https://github.com/dev-sec/ansible-collection-hardening/issues/345 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-01-19 14:05:33 +01:00
Farid Joubbi d01abb44c0 Syncookie (#372) 
* Enabled SYN cookie sysctl.

Signed-off-by: Farid Joubbi <[email protected]>

* Removed SYN cookies from here since it's a default now.

Signed-off-by: Farid Joubbi <[email protected]>
 2021-01-15 09:56:29 +01:00
schurzi 16a41412bb check for correct cpu vendor in initramfs-tools (#374) 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-12 06:31:13 +01:00
Farid Joubbi 5675589e01 Sorted sysctl values and lists in READMEs alphabetically (No functional changes). (#371) 
* Add s's for consistency.

Signed-off-by: Farid Joubbi <[email protected]>

* Sort lists alphabetically.

Signed-off-by: Farid Joubbi <[email protected]>

* Sorted sysctl_config alphabetically.

Signed-off-by: Farid Joubbi <[email protected]>

* Sort removed protocols.

Signed-off-by: Farid Joubbi <[email protected]>

* Added dots in variable descriptions for the sake of consistency.

Signed-off-by: Farid Joubbi <[email protected]>

* Added dots in variable descriptions for the sake of consistency.

Signed-off-by: Farid Joubbi <[email protected]>
 2021-01-08 20:45:50 +01:00
tgueldner-mms e8e552f3ae make auditd 'max_log_file' configurable (#370) 
* make auditd 'max_log_file' configurable

Signed-off-by: Thomas Gueldner <[email protected]>

* fix documentation for os_auditd_max_log_file

Signed-off-by: Thomas Gueldner <[email protected]>
 2021-01-08 13:23:58 +01:00
schurzi b4ca950122 set hidepid=0 on RHEL/CentOS 7 (#369) 
Signed-off-by: Martin Schurz <[email protected]>
 2021-01-03 12:53:08 +01:00
schurziandSebastian Gumprich a75e2c028b change inclusion of os specific defaults (#353) 
* change inclusion of os specific defaults

we now include the os specific options into a separate variable and
merge this with the default ansible namespace, when the corresponding
keys do not already exist (eg. are defined by default oder by user)

Signed-off-by: Martin Schurz <[email protected]>

* simplify check for os specific variables

Signed-off-by: Martin Schurz <[email protected]>

* add test for variable override

Signed-off-by: Martin Schurz <[email protected]>

* move tests to verify stage

Signed-off-by: Martin Schurz <[email protected]>

* correct grep

Signed-off-by: Martin Schurz <[email protected]>

* linting

Signed-off-by: Martin Schurz <[email protected]>

* fix typo

Signed-off-by: Martin Schurz <[email protected]>

* Revert "Merge pull request #351 from sprat/fix-umask"

This reverts commit 9e8e0bc8fb, reversing
changes made to 98c7553016.

Signed-off-by: Martin Schurz <[email protected]>

* move immutable ssh vars to internal vars

Signed-off-by: Martin Schurz <[email protected]>

* move vars to OS files

Signed-off-by: Martin Schurz <[email protected]>

* change default handling for all roles

Signed-off-by: Martin Schurz <[email protected]>

* fix issues

Signed-off-by: Martin Schurz <[email protected]>

* add documentation

Signed-off-by: Martin Schurz <[email protected]>

* Update main.yml

Co-authored-by: Sebastian Gumprich <[email protected]>
 2020-12-20 20:46:57 +01:00
Sylvain Prat ea471b38b7 Fix #344: make the os_env_umask variable usable again 
Signed-off-by: Sylvain Prat <[email protected]>
 2020-12-15 21:31:51 +01:00
Sebastian Gumprich f2804c7c19 Merge branch 'master' into collection 2020-11-11 21:08:54 +01:00
Sebastian Gumprich d857830979 minor readme fixes 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2020-11-09 20:49:07 +01:00
rndmh3ro c94d973527 Prettified Code! 2020-11-08 10:20:25 +00:00
Sebastian Gumprich c8ada5c13c Merge branch 'migrate_os' into collection 2020-11-08 11:18:38 +01:00
Sebastian Gumprich dd3959276b merge os-hardening role into collection 2020-11-07 22:09:28 +01:00
Sebastian Gumprich 598f7183f8 remove os submodule 2020-11-07 21:49:25 +01:00
Sebastian Gumprich ac3c12d264 move to collections 2020-11-07 21:19:43 +01:00