Merge branch 'support_more_os' into test_crypto_lib

test crypto changes from ssh-baseline
Signed-off-by: Sebastian Gumprich <[email protected]>
2022-10-21 09:46:30 +02:00 · 2022-10-21 09:41:17 +02:00 · 2022-10-20 14:31:47 +02:00 · 2022-10-20 14:31:47 +02:00 · 2022-10-20 14:31:47 +02:00 · 2022-10-20 14:31:47 +02:00
22 changed files with 22 additions and 211 deletions
@@ -26,7 +26,10 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
+          - centosstream8
+          - centosstream9
          - rocky8
+          - rocky9
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
@@ -25,7 +25,10 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
+          - centosstream8
+          - centosstream9
          - rocky8
+          - rocky9
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
@@ -25,7 +25,10 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
+          - centosstream8
+          - centosstream9
          - rocky8
+          - rocky9
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
@@ -25,7 +25,10 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
+          - centosstream8
+          - centosstream9
          - rocky8
+          - rocky9
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
@@ -25,7 +25,10 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
+          - centosstream8
+          - centosstream9
          - rocky8
+          - rocky9
          - fedora
          - ubuntu1804
          - ubuntu2004
@@ -25,7 +25,10 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
+          - centosstream8
+          - centosstream9
          - rocky8
+          - rocky9
          - fedora
          - ubuntu1804
          - ubuntu2004
@@ -42,7 +42,7 @@
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"

    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/simplify_crypto.zip"
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -1,9 +0,0 @@
---
-mysql_daemon: mariadb
-mysql_hardening_mysql_conf_file: '/etc/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'mysql'
@@ -1,9 +0,0 @@
---
-mysql_daemon: mariadb
-mysql_hardening_mysql_conf_file: '/etc/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'mysql'
@@ -1,10 +0,0 @@
---
-mysql_daemon: mysql
-
-mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'adm'
@@ -1,10 +0,0 @@
---
-mysql_daemon: mysql
-
-mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'adm'
@@ -1,10 +0,0 @@
---
-mysql_daemon: mysql
-
-mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'adm'
@@ -33,7 +33,7 @@ os_auth_sub_gid_min: 100000
 os_auth_sub_gid_max: 600100000
 os_auth_sub_gid_count: 65536

-os_auth_pam_sssd_enable: false
+os_auth_pam_sssd_enable: true

 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
@@ -1,45 +0,0 @@
---
-
-os_packages_pam_ccreds: 'pam_ccreds'
-os_nologin_shell_path: '/sbin/nologin'
-
-# Different distros use different standards for /etc/shadow perms, e.g.
-# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
-# You must provide key/value pairs for owner, group, and mode if overriding.
-os_shadow_perms:
-  owner: root
-  group: root
-  mode: '0000'
-
-os_passwd_perms:
-  owner: root
-  group: root
-  mode: '0644'
-
-os_env_umask: '077'
-
-os_auth_uid_min: 1000
-os_auth_uid_max: 60000
-os_auth_gid_min: 1000
-os_auth_gid_max: 60000
-os_auth_sys_uid_min: 201
-os_auth_sys_uid_max: 999
-os_auth_sys_gid_min: 201
-os_auth_sys_gid_max: 999
-os_auth_sub_uid_min: 100000
-os_auth_sub_uid_max: 600100000
-os_auth_sub_uid_count: 65536
-os_auth_sub_gid_min: 100000
-os_auth_sub_gid_max: 600100000
-os_auth_sub_gid_count: 65536
-
-os_auth_pam_sssd_enable: true
-
-# defaults for useradd
-os_useradd_mail_dir: /var/spool/mail
-os_useradd_create_home: true
-
-modprobe_package: 'module-init-tools'
-auditd_package: 'audit'
-
-hidepid_option: '2'  # allowed values: 0, 1, 2
@@ -1,45 +0,0 @@
---
-
-os_packages_pam_ccreds: 'pam_ccreds'
-os_nologin_shell_path: '/sbin/nologin'
-
-# Different distros use different standards for /etc/shadow perms, e.g.
-# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
-# You must provide key/value pairs for owner, group, and mode if overriding.
-os_shadow_perms:
-  owner: root
-  group: root
-  mode: '0000'
-
-os_passwd_perms:
-  owner: root
-  group: root
-  mode: '0644'
-
-os_env_umask: '077'
-
-os_auth_uid_min: 1000
-os_auth_uid_max: 60000
-os_auth_gid_min: 1000
-os_auth_gid_max: 60000
-os_auth_sys_uid_min: 201
-os_auth_sys_uid_max: 999
-os_auth_sys_gid_min: 201
-os_auth_sys_gid_max: 999
-os_auth_sub_uid_min: 100000
-os_auth_sub_uid_max: 600100000
-os_auth_sub_uid_count: 65536
-os_auth_sub_gid_min: 100000
-os_auth_sub_gid_max: 600100000
-os_auth_sub_gid_count: 65536
-
-os_auth_pam_sssd_enable: true
-
-# defaults for useradd
-os_useradd_mail_dir: /var/spool/mail
-os_useradd_create_home: true
-
-modprobe_package: 'module-init-tools'
-auditd_package: 'audit'
-
-hidepid_option: '2'  # allowed values: 0, 1, 2
@@ -1,23 +0,0 @@
---
-sshd_path: /usr/sbin/sshd
-ssh_host_keys_dir: '/etc/ssh'
-sshd_service_name: sshd
-ssh_owner: root
-ssh_group: root
-ssh_host_keys_owner: 'root'
-ssh_host_keys_group: 'ssh_keys'
-ssh_selinux_packages:
-  - policycoreutils-python-utils
-  - checkpolicy
-
-# true if SSH support Kerberos
-ssh_kerberos_support: true
-
-# true if SSH has PAM support
-ssh_pam_support: true
-
-sshd_moduli_file: '/etc/ssh/moduli'
-
-# disable CRYPTO_POLICY to take settings from sshd configuration
-# see: https://access.redhat.com/solutions/4410591
-sshd_disable_crypto_policy: true
@@ -1,23 +0,0 @@
---
-sshd_path: /usr/sbin/sshd
-ssh_host_keys_dir: '/etc/ssh'
-sshd_service_name: sshd
-ssh_owner: root
-ssh_group: root
-ssh_host_keys_owner: 'root'
-ssh_host_keys_group: 'ssh_keys'
-ssh_selinux_packages:
-  - policycoreutils-python-utils
-  - checkpolicy
-
-# true if SSH support Kerberos
-ssh_kerberos_support: true
-
-# true if SSH has PAM support
-ssh_pam_support: true
-
-sshd_moduli_file: '/etc/ssh/moduli'
-
-# disable CRYPTO_POLICY to take settings from sshd configuration
-# see: https://access.redhat.com/solutions/4410591
-sshd_disable_crypto_policy: true
@@ -7,7 +7,7 @@ ssh_group: root
 ssh_host_keys_owner: 'root'
 ssh_host_keys_group: 'ssh_keys'
 ssh_selinux_packages:
-  - policycoreutils-python
+  - policycoreutils-python-utils
  - checkpolicy

 # true if SSH support Kerberos
@@ -7,7 +7,7 @@ ssh_group: root
 ssh_host_keys_owner: 'root'
 ssh_host_keys_group: 'ssh_keys'
 ssh_selinux_packages:
-  - python3-policycoreutils
+  - policycoreutils-python
  - checkpolicy

 # true if SSH support Kerberos
@@ -1,23 +0,0 @@
---
-sshd_path: /usr/sbin/sshd
-ssh_host_keys_dir: '/etc/ssh'
-sshd_service_name: sshd
-ssh_owner: root
-ssh_group: root
-ssh_host_keys_owner: 'root'
-ssh_host_keys_group: 'ssh_keys'
-ssh_selinux_packages:
-  - python3-policycoreutils
-  - checkpolicy
-
-# true if SSH support Kerberos
-ssh_kerberos_support: true
-
-# true if SSH has PAM support
-ssh_pam_support: true
-
-sshd_moduli_file: '/etc/ssh/moduli'
-
-# disable CRYPTO_POLICY to take settings from sshd configuration
-# see: https://access.redhat.com/solutions/4410591
-sshd_disable_crypto_policy: true
Author	SHA1	Message	Date
Sebastian Gumprich	a03ed7a771	Merge branch 'support_more_os' into test_crypto_lib	2022-10-21 09:46:30 +02:00
Sebastian Gumprich	b771f52af1	test crypto changes from ssh-baseline Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-21 09:41:17 +02:00
Sebastian Gumprich	2bd0a0feae	simplify OS-vars files Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-20 14:31:47 +02:00
Sebastian Gumprich	561b59baee	add ssh-vars for new OS Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-20 14:31:47 +02:00
Sebastian Gumprich	d3b403436f	add mysql-vars for new OS	2022-10-20 14:31:47 +02:00
Sebastian Gumprich	fc0a90608e	add support for centos stream 8 and 9, rocky 9 Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-20 14:31:47 +02:00