Merge pull request #106 from dev-sec/skip_fail

omit empty variables

.gitignore

@@ -1,14 +1,3 @@
-README.pdf
-README.html
-shared_test_repo/
-test/integration
 .kitchen
-coverage
-Vagrantfile.erb
-
-Gemfile.lock
-Berksfile.lock
-
-ansible.cfg
 hosts
-default.yml
+Gemfile.lock

.kitchen.vagrant.yml

@@ -0,0 +1,80 @@
+---
+driver:
+  name: vagrant
+  driver_config:
+    http_proxy: <%= ENV['http_proxy'] || nil %>
+    https_proxy: <%= ENV['https_proxy'] || nil %>
+  vagrantfiles:
+    - kitchen_vagrant_block.rb
+
+provisioner:
+  name: ansible_playbook
+  hosts: all
+  require_ansible_repo: false
+  require_ansible_omnibus: true
+  require_chef_for_busser: false
+  require_ruby_for_busser: false
+  ansible_verbose: true
+  roles_path: ../ansible-os-hardening/
+  playbook: default.yml
+  http_proxy: <%= ENV['http_proxy'] || nil %>
+  https_proxy: <%= ENV['https_proxy'] || nil %>
+
+transport:
+  max_ssh_sessions: 5
+
+platforms:
+- name: ubuntu-12.04
+  driver_config:
+    box: opscode-ubuntu-12.04
+    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-12.04_chef-provisionerless.box
+- name: ubuntu-14.04
+  driver_config:
+    box: opscode-ubuntu-14.04
+    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-14.04_chef-provisionerless.box
+- name: ubuntu-16.04
+  driver_config:
+    box: opscode-ubuntu-16.04
+    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-16.04_chef-provisionerless.box
+- name: centos-6.4
+  driver_config:
+    box: opscode-centos-6.4
+    box_url: https://opscode-vm.s3.amazonaws.com/vagrant/opscode_centos-6.4_provisionerless.box
+- name: centos-6.5
+  driver_config:
+    box: opscode-centos-6.5
+    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-6.5_chef-provisionerless.box
+- name: centos-6.8
+  driver_config:
+    box: bento/centos-6.8
+- name: centos-7
+  driver_config:
+    box: bento/centos-7.2
+- name: oracle-6.4
+  driver_config:
+    box: oracle-6.4
+    box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel64-64.box
+- name: oracle-6.5
+  driver_config:
+    box: oracle-6.5
+    box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel65-64.box
+- name: oracle-7
+  driver_config:
+    box: boxcutter/ol72
+- name: debian-7
+  driver_config:
+    box: debian-7
+    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-7.8_chef-provisionerless.box
+- name: debian-8
+  driver_config:
+    box: debian-8
+    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-8.1_chef-provisionerless.box
+
+verifier:
+  name: inspec
+  sudo: true
+  inspec_tests:
+    - https://github.com/dev-sec/linux-baseline/
+
+suites:
+- name: os

.kitchen.yml

@@ -1,66 +1,77 @@
 ---
 driver:
-  name: vagrant
+  name: docker
+  use_sudo: false
+  privileged: true
+  http_proxy: <%= ENV['http_proxy'] || nil %>
+  https_proxy: <%= ENV['https_proxy'] || nil %>
+
+transport:
+  max_ssh_sessions: 5
+
 provisioner:
   name: ansible_playbook
-  test_repo_uri: https://github.com/hardening-io/tests-os-hardening.git
   hosts: all
   require_ansible_repo: false
-  require_ansible_omnibus: true
   require_chef_for_busser: false
   require_ruby_for_busser: false
+  ansible_verbose: true
+  ansible_diff: true
+  hosts: all
+  roles_path: ../ansible-os-hardening/
+  http_proxy: <%= ENV['http_proxy'] || nil %>
+  https_proxy: <%= ENV['https_proxy'] || nil %>
+  playbook: default.yml
+  ansible_extra_flags:
+    - "--skip-tags=sysctl"
+
 platforms:
-- name: ubuntu-12.04
-  driver_config:
-    box: opscode-ubuntu-12.04
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-12.04_chef-provisionerless.box
-- name: ubuntu-14.04
-  driver_config:
-    box: opscode-ubuntu-14.04
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-14.04_chef-provisionerless.box
-- name: centos-6.4
-  driver_config:
-    box: opscode-centos-6.4
-    box_url: https://opscode-vm.s3.amazonaws.com/vagrant/opscode_centos-6.4_provisionerless.box
-- name: centos-6.5
-  driver_config:
-    box: opscode-centos-6.5
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-6.5_chef-provisionerless.box
-- name: oracle-6.4
-  driver_config:
-    box: oracle-6.4
-    box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel64-64.box
-- name: oracle-6.5
-  driver_config:
-    box: oracle-6.5
-    box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel65-64.box
-- name: debian-6
-  driver_config:
-    box: debian-6
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-6.0.10_chef-provisionerless.box
-- name: debian-7
-  driver_config:
-    box: debian-7
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-7.8_chef-provisionerless.box
-- name: debian-8
-  driver_config:
-    box: debian-8
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-8.1_chef-provisionerless.box
+- name: centos6-ansible-latest
+  driver:
+    image: rndmh3ro/docker-centos6-ansible:latest
+    platform: centos
+- name: centos7-ansible-latest
+  driver:
+    image: rndmh3ro/docker-centos7-ansible:latest
+    platform: centos
+- name: oracle6-ansible-latest
+  driver:
+    image: rndmh3ro/docker-oracle6-ansible:latest
+    platform: centos
+- name: oracle7-ansible-latest
+  driver:
+    image: rndmh3ro/docker-oracle7-ansible:latest
+    platform: centos
+- name: ubuntu1204-ansible-latest
+  driver:
+    image: rndmh3ro/docker-ubuntu1204-ansible:latest
+    platform: ubuntu
+- name: ubuntu1404-ansible-latest
+  driver:
+    image: rndmh3ro/docker-ubuntu1404-ansible:latest
+    platform: ubuntu
+- name: ubuntu1604-ansible-latest
+  driver:
+    image: rndmh3ro/docker-ubuntu1604-ansible:latest
+    platform: ubuntu
+- name: debian7-ansible-latest
+  driver:
+    image: rndmh3ro/docker-debian7-ansible:latest
+    platform: debian
+- name: debian8-ansible-latest
+  driver:
+    image: rndmh3ro/docker-debian8-ansible:latest
+    platform: debian
+- name: debian9-ansible-latest
+  driver:
+    image: rndmh3ro/docker-debian9-ansible:latest
+    platform: debian
+
 verifier:
   name: inspec
+  sudo: true
+  inspec_tests:
+    - https://github.com/dev-sec/tests-os-hardening
+
 suites:
-- name: ansible_1.9
-  hosts: all
-  ansible_verbose: true
-  ansible_diff: true
-  roles_path: ../ansible-os-hardening/
-  provisioner:
-    playbook: test/integration/playbooks/default.yml
-    ansible_version: 1.9.4
-- name: ansible_latest
-  hosts: all
-  ansible_verbose: true
-  ansible_diff: true
-  roles_path: ../ansible-os-hardening/
-  provisioner:
-    playbook: test/integration/playbooks/default.yml
+- name: os

.travis.yml

@@ -1,23 +1,65 @@
 ---
-notifications:
-  webhooks: https://galaxy.ansible.com/api/v1/notifications/
-language: python
-python: "2.7"
+services: docker
 
 env:
-  - ANSIBLE_VERSION=latest
-  - ANSIBLE_VERSION=1.9.4
+  - distro: centos6
+    version: latest
+    init: /sbin/init
+
+  - distro: centos7
+    init: /usr/lib/systemd/systemd
+    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
+    version: latest
+
+  - distro: oracle6
+    version: latest
+    init: /sbin/init
+
+  - distro: oracle7
+    init: /usr/lib/systemd/systemd
+    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
+    version: latest
+
+  - distro: ubuntu1604
+    version: latest
+    init: /lib/systemd/systemd
+    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
+
+  - distro: ubuntu1404
+    version: latest
+    init: /sbin/init
+
+  - distro: ubuntu1204
+    version: latest
+    init: /sbin/init
+
+  - distro: debian7
+    version: latest
+    init: /sbin/init
+
+  - distro: debian8
+    version: latest
+    init: /sbin/init
+
+  - distro: debian9
+    version: latest
+    init: /lib/systemd/systemd
+    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
 
 before_install:
- - sudo apt-get update -qq
- - sudo apt-get install -qq python-apt python-pycurl
-install:
-  - if [ "$ANSIBLE_VERSION" = "latest" ]; then pip install ansible; else pip install ansible==$ANSIBLE_VERSION; fi
-  - echo -e 'localhost ansible_connection=local' > spec/inventory
-  - echo -e '[defaults]\nroles_path = ../\nhostfile = ./spec/inventory' > ansible.cfg
+  # Pull container
+  - 'docker pull rndmh3ro/docker-${distro}-ansible:${version}'
 
 script:
-  - ansible-playbook --syntax-check spec/travis.yml
-  - ansible-playbook --sudo -v --diff spec/travis.yml --skip-tags "sysctl" --extra-vars "os_security_users_allow=change_user os_security_kernel_enable_core_dump=true os_security_suid_sgid_remove_from_unknown=true"
-  - ansible-playbook --sudo -v --diff spec/travis.yml --tags "pam" --extra-vars "os_auth_pam_passwdqc_enable=false"
-  - ansible-playbook --sudo -v --diff spec/travis.yml --skip-tags "sysctl" --extra-vars "os_security_users_allow=change_user"
+  - container_id=$(mktemp)
+  # Run container in detached state.
+  - 'docker run --detach --volume="${PWD}":/etc/ansible/roles/ansible-os-hardening:ro ${run_opts} rndmh3ro/docker-${distro}-ansible:${version} "${init}" > "${container_id}"'
+
+  # Test role.
+  - 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-os-hardening/default.yml --skip-tags "sysctl"'
+
+  # Verify role
+  - 'inspec exec https://github.com/dev-sec/linux-baseline/ -t docker://$(cat ${container_id}) --controls=os-01 os-02 os-03 os-04 os-05 os-06 os-07 package-01 package-02 package-03 package-04 package-05 package-06'
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

CHANGELOG.md

@@ -1,97 +1,150 @@
 # Change Log
 
-## [3.0.0](https://github.com/hardening-io/ansible-os-hardening/tree/HEAD)
-
-[Full Changelog](https://github.com/hardening-io/ansible-os-hardening/compare/2.0.0...HEAD)
-
-**Implemented enhancements:**
-
-- update platforms in meta-file [\#69](https://github.com/hardening-io/ansible-os-hardening/pull/69) ([rndmh3ro](https://github.com/rndmh3ro))
-- add webhook for ansible galaxy [\#68](https://github.com/hardening-io/ansible-os-hardening/pull/68) ([rndmh3ro](https://github.com/rndmh3ro))
-- Move sysctl vars to defaults [\#67](https://github.com/hardening-io/ansible-os-hardening/pull/67) ([rndmh3ro](https://github.com/rndmh3ro))
-- make sys\_uid and sys\_gid configurable [\#62](https://github.com/hardening-io/ansible-os-hardening/pull/62) ([rndmh3ro](https://github.com/rndmh3ro))
-- Ansible 2.0 support [\#59](https://github.com/hardening-io/ansible-os-hardening/pull/59) ([rndmh3ro](https://github.com/rndmh3ro))
-- use inspec as test framework [\#58](https://github.com/hardening-io/ansible-os-hardening/pull/58) ([chris-rock](https://github.com/chris-rock))
-- Packages as attributes [\#57](https://github.com/hardening-io/ansible-os-hardening/pull/57) ([rndmh3ro](https://github.com/rndmh3ro))
-- Change categories to tags for upcoming ansible 2.0 [\#56](https://github.com/hardening-io/ansible-os-hardening/pull/56) ([rndmh3ro](https://github.com/rndmh3ro))
-- Add SINGLE and PROMPT parameters. [\#55](https://github.com/hardening-io/ansible-os-hardening/pull/55) ([rndmh3ro](https://github.com/rndmh3ro))
-- add changelog generator [\#54](https://github.com/hardening-io/ansible-os-hardening/pull/54) ([chris-rock](https://github.com/chris-rock))
+## [3.2.0](https://github.com/dev-sec/ansible-os-hardening/tree/3.2.0) (2016-10-24)
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.1.0...3.2.0)
 
 **Fixed bugs:**
 
-- Updates "tags" parameters on includes in main.yml [\#66](https://github.com/hardening-io/ansible-os-hardening/pull/66) ([conorsch](https://github.com/conorsch))
-- Suid set def var, fix \#64 [\#63](https://github.com/hardening-io/ansible-os-hardening/pull/63) ([rndmh3ro](https://github.com/rndmh3ro))
-- ERROR! Include tasks should not specify tags in more than one way [\#60](https://github.com/hardening-io/ansible-os-hardening/pull/60) ([fitz123](https://github.com/fitz123))
-
-**Closed issues:**
-
-- Hardening fails on Centos 7.1 at task 'remove suid/sgid bit from all binaries except in system and user whitelist' [\#72](https://github.com/hardening-io/ansible-os-hardening/issues/72)
-- ansible 2.0 | "remove suid/sgid" task fails [\#64](https://github.com/hardening-io/ansible-os-hardening/issues/64)
-- Custom sysctl [\#50](https://github.com/hardening-io/ansible-os-hardening/issues/50)
-
-## [2.0.0](https://github.com/hardening-io/ansible-os-hardening/tree/2.0.0) (2015-11-28)
-[Full Changelog](https://github.com/hardening-io/ansible-os-hardening/compare/1.0.0...2.0.0)
-
-**Closed issues:**
-
-- Fix directory structure. [\#48](https://github.com/hardening-io/ansible-os-hardening/issues/48)
-- pam auth update error [\#47](https://github.com/hardening-io/ansible-os-hardening/issues/47)
+- CentOS 7 selinux dependencies [\#102](https://github.com/dev-sec/ansible-os-hardening/issues/102)
+- ubuntu xenial warning during activate gpg-check for yum-repos [\#99](https://github.com/dev-sec/ansible-os-hardening/issues/99)
+- rhel\_system\_auth.j2 is still using pam\_passwdqc.so for CentOS 7 [\#98](https://github.com/dev-sec/ansible-os-hardening/issues/98)
+- Enable pam\_pwquality in rhel-family \> 7 [\#73](https://github.com/dev-sec/ansible-os-hardening/issues/73)
+- "irc" user always changed after reboot [\#53](https://github.com/dev-sec/ansible-os-hardening/issues/53)
 
 **Merged pull requests:**
 
-- Add explicit role-path to kitchen.yml [\#52](https://github.com/hardening-io/ansible-os-hardening/pull/52) ([rndmh3ro](https://github.com/rndmh3ro))
-- Fix pam passwdqc template [\#51](https://github.com/hardening-io/ansible-os-hardening/pull/51) ([rndmh3ro](https://github.com/rndmh3ro))
-- New dir layout [\#49](https://github.com/hardening-io/ansible-os-hardening/pull/49) ([rndmh3ro](https://github.com/rndmh3ro))
-- remove duplicate "update pam" task [\#46](https://github.com/hardening-io/ansible-os-hardening/pull/46) ([fitz123](https://github.com/fitz123))
-- Fix stuck in case pam files was updated before by force update [\#45](https://github.com/hardening-io/ansible-os-hardening/pull/45) ([fitz123](https://github.com/fitz123))
-- Fix nologin shell path [\#44](https://github.com/hardening-io/ansible-os-hardening/pull/44) ([fitz123](https://github.com/fitz123))
-- improved travis-tests to cover more cases [\#42](https://github.com/hardening-io/ansible-os-hardening/pull/42) ([rndmh3ro](https://github.com/rndmh3ro))
+- update template [\#101](https://github.com/dev-sec/ansible-os-hardening/pull/101) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix deprecation warning for undefined error. \#99 [\#100](https://github.com/dev-sec/ansible-os-hardening/pull/100) ([rndmh3ro](https://github.com/rndmh3ro))
+- add rhel7 pam\_pwquality. fix \#73 [\#94](https://github.com/dev-sec/ansible-os-hardening/pull/94) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [3.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/3.1.0) (2016-08-03)
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.1...3.1.0)
+
+## [3.1](https://github.com/dev-sec/ansible-os-hardening/tree/3.1) (2016-07-27)
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.0.0...3.1)
+
+**Implemented enhancements:**
+
+- Supports --check mode [\#93](https://github.com/dev-sec/ansible-os-hardening/pull/93) ([conorsch](https://github.com/conorsch))
+- Adds support for CentOS 7 [\#91](https://github.com/dev-sec/ansible-os-hardening/pull/91) ([conorsch](https://github.com/conorsch))
+- Docker [\#90](https://github.com/dev-sec/ansible-os-hardening/pull/90) ([rndmh3ro](https://github.com/rndmh3ro))
+- debian 8 support [\#88](https://github.com/dev-sec/ansible-os-hardening/pull/88) ([rndmh3ro](https://github.com/rndmh3ro))
+- Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-os-hardening/pull/85) ([fitz123](https://github.com/fitz123))
+- replace ignore\_errors to failed\_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) ([fitz123](https://github.com/fitz123))
+- fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-os-hardening/pull/79) ([fitz123](https://github.com/fitz123))
+
+**Fixed bugs:**
+
+- Centos 7.1 fails at  \[Change various sysctl-settings on rhel-hosts...\] [\#74](https://github.com/dev-sec/ansible-os-hardening/issues/74)
+- Hardening fails on Centos 7.1 at task 'minimize access' [\#71](https://github.com/dev-sec/ansible-os-hardening/issues/71)
 
-## [1.0.0](https://github.com/hardening-io/ansible-os-hardening/tree/1.0.0) (2015-09-01)
 **Closed issues:**
 
-- ansible-os-hardening/tasks/minimize\_access.yml [\#38](https://github.com/hardening-io/ansible-os-hardening/issues/38)
-- Role configuration. vars/main.yml? [\#34](https://github.com/hardening-io/ansible-os-hardening/issues/34)
-- Sysctl reloading [\#18](https://github.com/hardening-io/ansible-os-hardening/issues/18)
-- Add conditions for disabling of ip forwarding [\#15](https://github.com/hardening-io/ansible-os-hardening/issues/15)
-- Disable System Accounts [\#6](https://github.com/hardening-io/ansible-os-hardening/issues/6)
+- Permissions on /etc/shadow can lock out GUI users [\#86](https://github.com/dev-sec/ansible-os-hardening/issues/86)
+- network related sysctl rewritten by ufw in ubuntu  [\#82](https://github.com/dev-sec/ansible-os-hardening/issues/82)
+- ansible \>= 2.0 complains: Using bare variables is deprecated [\#78](https://github.com/dev-sec/ansible-os-hardening/issues/78)
+- Norm-Audit-Hardening-Audit [\#76](https://github.com/dev-sec/ansible-os-hardening/issues/76)
 
 **Merged pull requests:**
 
-- Update kitchen-ansible, remove separate debian install [\#40](https://github.com/hardening-io/ansible-os-hardening/pull/40) ([rndmh3ro](https://github.com/rndmh3ro))
-- Add mode to su-binary task. Fix \#38 [\#39](https://github.com/hardening-io/ansible-os-hardening/pull/39) ([rndmh3ro](https://github.com/rndmh3ro))
-- update common kitchen.yml platforms \(ansible\), kitchen\_debian.yml platforms \(ansible\) [\#37](https://github.com/hardening-io/ansible-os-hardening/pull/37) ([chris-rock](https://github.com/chris-rock))
-- Change oneliner if-statements to be more readable [\#36](https://github.com/hardening-io/ansible-os-hardening/pull/36) ([rndmh3ro](https://github.com/rndmh3ro))
-- Separate system-vars from editable vars. Fix \#34 [\#35](https://github.com/hardening-io/ansible-os-hardening/pull/35) ([rndmh3ro](https://github.com/rndmh3ro))
-- Create limits.d-directory if it does not exist. [\#33](https://github.com/hardening-io/ansible-os-hardening/pull/33) ([rndmh3ro](https://github.com/rndmh3ro))
-- Add correct CONTRIB-file [\#32](https://github.com/hardening-io/ansible-os-hardening/pull/32) ([rndmh3ro](https://github.com/rndmh3ro))
-- Add Ansible Galaxy badge [\#31](https://github.com/hardening-io/ansible-os-hardening/pull/31) ([rndmh3ro](https://github.com/rndmh3ro))
--  Update readme, todo, changelog, vars [\#30](https://github.com/hardening-io/ansible-os-hardening/pull/30) ([rndmh3ro](https://github.com/rndmh3ro))
-- List-cleanup and follow symlinks added [\#29](https://github.com/hardening-io/ansible-os-hardening/pull/29) ([rndmh3ro](https://github.com/rndmh3ro))
-- Add module configuration [\#28](https://github.com/hardening-io/ansible-os-hardening/pull/28) ([rndmh3ro](https://github.com/rndmh3ro))
-- Fix two sysctl-settings [\#27](https://github.com/hardening-io/ansible-os-hardening/pull/27) ([rndmh3ro](https://github.com/rndmh3ro))
-- Add meta-files for Ansible Galaxy [\#26](https://github.com/hardening-io/ansible-os-hardening/pull/26) ([rndmh3ro](https://github.com/rndmh3ro))
-- Disable System Accounts. Fix \#6 [\#25](https://github.com/hardening-io/ansible-os-hardening/pull/25) ([rndmh3ro](https://github.com/rndmh3ro))
-- Use changed\_when to avoid changed tasks [\#24](https://github.com/hardening-io/ansible-os-hardening/pull/24) ([rndmh3ro](https://github.com/rndmh3ro))
-- Delete authconfig-task on rhel-systems [\#23](https://github.com/hardening-io/ansible-os-hardening/pull/23) ([rndmh3ro](https://github.com/rndmh3ro))
-- Add missing rhosts-include task [\#21](https://github.com/hardening-io/ansible-os-hardening/pull/21) ([rndmh3ro](https://github.com/rndmh3ro))
-- Change sysctl-task. Fix \#18 [\#20](https://github.com/hardening-io/ansible-os-hardening/pull/20) ([rndmh3ro](https://github.com/rndmh3ro))
-- Add travis-support [\#17](https://github.com/hardening-io/ansible-os-hardening/pull/17) ([rndmh3ro](https://github.com/rndmh3ro))
-- Add conditions for various tasks. Fix \#15 [\#16](https://github.com/hardening-io/ansible-os-hardening/pull/16) ([rndmh3ro](https://github.com/rndmh3ro))
-- fix configuration of playbook path [\#14](https://github.com/hardening-io/ansible-os-hardening/pull/14) ([chris-rock](https://github.com/chris-rock))
-- Make tasks clearer [\#13](https://github.com/hardening-io/ansible-os-hardening/pull/13) ([rndmh3ro](https://github.com/rndmh3ro))
-- Add remove suid/sgid function [\#12](https://github.com/hardening-io/ansible-os-hardening/pull/12) ([rndmh3ro](https://github.com/rndmh3ro))
-- Add task to remove unused repos and pkgs [\#11](https://github.com/hardening-io/ansible-os-hardening/pull/11) ([rndmh3ro](https://github.com/rndmh3ro))
-- Edit README to fit to os-hardening [\#10](https://github.com/hardening-io/ansible-os-hardening/pull/10) ([rndmh3ro](https://github.com/rndmh3ro))
-- ignore RAs on Ipv6 [\#9](https://github.com/hardening-io/ansible-os-hardening/pull/9) ([rndmh3ro](https://github.com/rndmh3ro))
-- Repair debian install script [\#8](https://github.com/hardening-io/ansible-os-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
-- Separate tasks into multiple smaller files [\#7](https://github.com/hardening-io/ansible-os-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
-- Enable gpg-check on all yum-repositories [\#5](https://github.com/hardening-io/ansible-os-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
-- Change playbook-path to accomodate test-repo [\#4](https://github.com/hardening-io/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
-- treat securetty config as an array [\#3](https://github.com/hardening-io/ansible-os-hardening/pull/3) ([arlimus](https://github.com/arlimus))
-- Add Securetty-support [\#2](https://github.com/hardening-io/ansible-os-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
-- Add profile.conf configuration [\#1](https://github.com/hardening-io/ansible-os-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix a formatting issue in readme. [\#92](https://github.com/dev-sec/ansible-os-hardening/pull/92) ([vivekagr](https://github.com/vivekagr))
+- Permits overriding permissions on /etc/shadow [\#89](https://github.com/dev-sec/ansible-os-hardening/pull/89) ([conorsch](https://github.com/conorsch))
+
+## [3.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/3.0.0) (2016-03-13)
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/2.0.0...3.0.0)
+
+**Implemented enhancements:**
+
+- update platforms in meta-file [\#69](https://github.com/dev-sec/ansible-os-hardening/pull/69) ([rndmh3ro](https://github.com/rndmh3ro))
+- add webhook for ansible galaxy [\#68](https://github.com/dev-sec/ansible-os-hardening/pull/68) ([rndmh3ro](https://github.com/rndmh3ro))
+- Move sysctl vars to defaults [\#67](https://github.com/dev-sec/ansible-os-hardening/pull/67) ([rndmh3ro](https://github.com/rndmh3ro))
+- make sys\_uid and sys\_gid configurable [\#62](https://github.com/dev-sec/ansible-os-hardening/pull/62) ([rndmh3ro](https://github.com/rndmh3ro))
+- Ansible 2.0 support [\#59](https://github.com/dev-sec/ansible-os-hardening/pull/59) ([rndmh3ro](https://github.com/rndmh3ro))
+- use inspec as test framework [\#58](https://github.com/dev-sec/ansible-os-hardening/pull/58) ([chris-rock](https://github.com/chris-rock))
+- Packages as attributes [\#57](https://github.com/dev-sec/ansible-os-hardening/pull/57) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change categories to tags for upcoming ansible 2.0 [\#56](https://github.com/dev-sec/ansible-os-hardening/pull/56) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add SINGLE and PROMPT parameters. [\#55](https://github.com/dev-sec/ansible-os-hardening/pull/55) ([rndmh3ro](https://github.com/rndmh3ro))
+- add changelog generator [\#54](https://github.com/dev-sec/ansible-os-hardening/pull/54) ([chris-rock](https://github.com/chris-rock))
+
+**Fixed bugs:**
+
+- Updates "tags" parameters on includes in main.yml [\#66](https://github.com/dev-sec/ansible-os-hardening/pull/66) ([conorsch](https://github.com/conorsch))
+- Suid set def var, fix \#64 [\#63](https://github.com/dev-sec/ansible-os-hardening/pull/63) ([rndmh3ro](https://github.com/rndmh3ro))
+- ERROR! Include tasks should not specify tags in more than one way [\#60](https://github.com/dev-sec/ansible-os-hardening/pull/60) ([fitz123](https://github.com/fitz123))
+
+**Closed issues:**
+
+- Hardening fails on Centos 7.1 at task 'remove suid/sgid bit from all binaries except in system and user whitelist' [\#72](https://github.com/dev-sec/ansible-os-hardening/issues/72)
+- ansible 2.0 | "remove suid/sgid" task fails [\#64](https://github.com/dev-sec/ansible-os-hardening/issues/64)
+- Custom sysctl [\#50](https://github.com/dev-sec/ansible-os-hardening/issues/50)
+
+**Merged pull requests:**
+
+- Release 3.0.0 [\#75](https://github.com/dev-sec/ansible-os-hardening/pull/75) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [2.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/2.0.0) (2015-11-28)
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/1.0.0...2.0.0)
+
+**Closed issues:**
+
+- Fix directory structure. [\#48](https://github.com/dev-sec/ansible-os-hardening/issues/48)
+- pam auth update error [\#47](https://github.com/dev-sec/ansible-os-hardening/issues/47)
+
+**Merged pull requests:**
+
+- Add explicit role-path to kitchen.yml [\#52](https://github.com/dev-sec/ansible-os-hardening/pull/52) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix pam passwdqc template [\#51](https://github.com/dev-sec/ansible-os-hardening/pull/51) ([rndmh3ro](https://github.com/rndmh3ro))
+- New dir layout [\#49](https://github.com/dev-sec/ansible-os-hardening/pull/49) ([rndmh3ro](https://github.com/rndmh3ro))
+- remove duplicate "update pam" task [\#46](https://github.com/dev-sec/ansible-os-hardening/pull/46) ([fitz123](https://github.com/fitz123))
+- Fix stuck in case pam files was updated before by force update [\#45](https://github.com/dev-sec/ansible-os-hardening/pull/45) ([fitz123](https://github.com/fitz123))
+- Fix nologin shell path [\#44](https://github.com/dev-sec/ansible-os-hardening/pull/44) ([fitz123](https://github.com/fitz123))
+- improved travis-tests to cover more cases [\#42](https://github.com/dev-sec/ansible-os-hardening/pull/42) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [1.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/1.0.0) (2015-09-01)
+**Closed issues:**
+
+- ansible-os-hardening/tasks/minimize\_access.yml [\#38](https://github.com/dev-sec/ansible-os-hardening/issues/38)
+- Role configuration. vars/main.yml? [\#34](https://github.com/dev-sec/ansible-os-hardening/issues/34)
+- Sysctl reloading [\#18](https://github.com/dev-sec/ansible-os-hardening/issues/18)
+- Add conditions for disabling of ip forwarding [\#15](https://github.com/dev-sec/ansible-os-hardening/issues/15)
+- Disable System Accounts [\#6](https://github.com/dev-sec/ansible-os-hardening/issues/6)
+
+**Merged pull requests:**
+
+- Update kitchen-ansible, remove separate debian install [\#40](https://github.com/dev-sec/ansible-os-hardening/pull/40) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add mode to su-binary task. Fix \#38 [\#39](https://github.com/dev-sec/ansible-os-hardening/pull/39) ([rndmh3ro](https://github.com/rndmh3ro))
+- update common kitchen.yml platforms \(ansible\), kitchen\_debian.yml platforms \(ansible\) [\#37](https://github.com/dev-sec/ansible-os-hardening/pull/37) ([chris-rock](https://github.com/chris-rock))
+- Change oneliner if-statements to be more readable [\#36](https://github.com/dev-sec/ansible-os-hardening/pull/36) ([rndmh3ro](https://github.com/rndmh3ro))
+- Separate system-vars from editable vars. Fix \#34 [\#35](https://github.com/dev-sec/ansible-os-hardening/pull/35) ([rndmh3ro](https://github.com/rndmh3ro))
+- Create limits.d-directory if it does not exist. [\#33](https://github.com/dev-sec/ansible-os-hardening/pull/33) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add correct CONTRIB-file [\#32](https://github.com/dev-sec/ansible-os-hardening/pull/32) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add Ansible Galaxy badge [\#31](https://github.com/dev-sec/ansible-os-hardening/pull/31) ([rndmh3ro](https://github.com/rndmh3ro))
+-  Update readme, todo, changelog, vars [\#30](https://github.com/dev-sec/ansible-os-hardening/pull/30) ([rndmh3ro](https://github.com/rndmh3ro))
+- List-cleanup and follow symlinks added [\#29](https://github.com/dev-sec/ansible-os-hardening/pull/29) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add module configuration [\#28](https://github.com/dev-sec/ansible-os-hardening/pull/28) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix two sysctl-settings [\#27](https://github.com/dev-sec/ansible-os-hardening/pull/27) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add meta-files for Ansible Galaxy [\#26](https://github.com/dev-sec/ansible-os-hardening/pull/26) ([rndmh3ro](https://github.com/rndmh3ro))
+- Disable System Accounts. Fix \#6 [\#25](https://github.com/dev-sec/ansible-os-hardening/pull/25) ([rndmh3ro](https://github.com/rndmh3ro))
+- Use changed\_when to avoid changed tasks [\#24](https://github.com/dev-sec/ansible-os-hardening/pull/24) ([rndmh3ro](https://github.com/rndmh3ro))
+- Delete authconfig-task on rhel-systems [\#23](https://github.com/dev-sec/ansible-os-hardening/pull/23) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add missing rhosts-include task [\#21](https://github.com/dev-sec/ansible-os-hardening/pull/21) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change sysctl-task. Fix \#18 [\#20](https://github.com/dev-sec/ansible-os-hardening/pull/20) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add travis-support [\#17](https://github.com/dev-sec/ansible-os-hardening/pull/17) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add conditions for various tasks. Fix \#15 [\#16](https://github.com/dev-sec/ansible-os-hardening/pull/16) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix configuration of playbook path [\#14](https://github.com/dev-sec/ansible-os-hardening/pull/14) ([chris-rock](https://github.com/chris-rock))
+- Make tasks clearer [\#13](https://github.com/dev-sec/ansible-os-hardening/pull/13) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add remove suid/sgid function [\#12](https://github.com/dev-sec/ansible-os-hardening/pull/12) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add task to remove unused repos and pkgs [\#11](https://github.com/dev-sec/ansible-os-hardening/pull/11) ([rndmh3ro](https://github.com/rndmh3ro))
+- Edit README to fit to os-hardening [\#10](https://github.com/dev-sec/ansible-os-hardening/pull/10) ([rndmh3ro](https://github.com/rndmh3ro))
+- ignore RAs on Ipv6 [\#9](https://github.com/dev-sec/ansible-os-hardening/pull/9) ([rndmh3ro](https://github.com/rndmh3ro))
+- Repair debian install script [\#8](https://github.com/dev-sec/ansible-os-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
+- Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-os-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
+- Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-os-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-os-hardening/pull/3) ([arlimus](https://github.com/arlimus))
+- Add Securetty-support [\#2](https://github.com/dev-sec/ansible-os-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-os-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))
 
 
 
-\* *This Change Log was automatically generated by [github_changelog_generator](https://github.com/skywinder/Github-Changelog-Generator)*
+\* *This Change Log was automatically generated by [github_changelog_generator](https://github.com/skywinder/Github-Changelog-Generator)*

Gemfile

@@ -2,31 +2,15 @@
 
 source 'https://rubygems.org'
 
-group :test do
-  gem 'rake'
-  gem 'foodcritic', '~> 4.0'
-  gem 'thor-foodcritic'
-  gem 'coveralls',  require: false
-end
-
-group :development do
-  gem 'guard'
-  gem 'guard-rspec'
-  gem 'guard-kitchen'
-end
-
 group :integration do
   gem 'test-kitchen', '~> 1.0'
   gem 'kitchen-ansible'
   gem 'kitchen-vagrant'
-  gem 'kitchen-inspec', '~> 0.9'
+  gem 'kitchen-inspec'
   gem 'kitchen-sharedtests', '~> 0.2.0'
   gem 'kitchen-sync'
   gem 'kitchen-transport-rsync'
-end
-
-group :openstack do
-  gem 'kitchen-openstack'
+  gem 'kitchen-docker'
 end
 
 group :tools do

README.md

@@ -1,6 +1,6 @@
 # os-hardening (Ansible Role)
 
-[![Build Status](http://img.shields.io/travis/hardening-io/ansible-os-hardening.svg)][1]
+[![Build Status](http://img.shields.io/travis/dev-sec/ansible-os-hardening.svg)][1]
 [![Gitter Chat](https://badges.gitter.im/Join%20Chat.svg)][2]
 [![Ansible Galaxy](https://img.shields.io/badge/galaxy-os--hardening-660198.svg)][3]
 
@@ -27,30 +27,37 @@ It will not:
 
 ## Requirements
 
-* Ansible
+* Ansible 2.2.1
 
 ## Variables
 
-* `os_desktop_enable: false` -  true if this is a desktop system, ie Xorg, KDE/GNOME/Unity/etc
-* `os_env_extra_user_paths: []` - add additional paths to the user's `PATH` variable (default is empty).
-* `os_env_umask: "027"`
-* `os_auth_pw_max_age: 60` - maximum password age
-* `os_auth_pw_min_age: 7` - minimum password age (before allowing any other password change)
-* `os_auth_retries: 5` - the maximum number of authentication attempts, before the account is locked for some time
-* `os_auth_lockout_time: 600` - time in seconds that needs to pass, if the account was locked due to too many failed authentication attempts
-* `os_auth_timeout: 60` - authentication timeout in seconds, so login will exit if this time passes
-* `os_auth_allow_homeless: false` - true if to allow users without home to login
-* `os_auth_pam_passwdqc_enable: true` - true if you want to use strong password checking in PAM using passwdqc
-* `os_auth_pam_passwdqc_options: "min=disabled,disabled,16,12,8"` - set to any option line (as a string) that you want to pass to passwdqc
-* `os_security_users_allow: []` - list of things, that a user is allowed to do. May contain: `change_user`
-* `os_security_kernel_enable_module_loading: true` - true if you want to allowed to change kernel modules once the system is running (eg `modprobe`, `rmmod`)
-* `os_security_kernel_enable_sysrq: false`
-* `os_security_kernel_enable_core_dump: false`
-* `os_security_suid_sgid_enforce: true` - true if you want to reduce SUID/SGID bits. There is already a list of items which are searched for configured, but you can also add your own
-* `os_security_suid_sgid_blacklist: []` - a list of paths which should have their SUID/SGID bits removed
-* `os_security_suid_sgid_whitelist: []` - a list of paths which should not have their SUID/SGID bits altered
-* `os_security_suid_sgid_remove_from_unknown: false` - true if you want to remove SUID/SGID bits from any file, that is not explicitly configured in a `blacklist`. This will make every Ansible-run search through the mounted filesystems looking for SUID/SGID bits that are not configured in the default and user blacklist. If it finds an SUID/SGID bit, it will be removed, unless this file is in your `whitelist`.
-* `os_security_packages_clean': true` - removes packages with known issues. See section packages.
+| Name           | Default Value | Description                        |
+| -------------- | ------------- | -----------------------------------|
+| `os_desktop_enable`| false |  true if this is a desktop system, ie Xorg, KDE/GNOME/Unity/etc|
+| `os_env_extra_user_paths`| [] | add additional paths to the user's `PATH` variable (default is empty).|
+| `os_env_umask`| 027| set default permissions for new files to `750` |
+| `os_auth_pw_max_age`| 60 | maximum password age (set to `99999` to effectively disable it) |
+| `os_auth_pw_min_age`| 7 | minimum password age (before allowing any other password change)|
+| `os_auth_retries`| 5 | the maximum number of authentication attempts, before the account is locked for some time|
+| `os_auth_lockout_time`| 600 | time in seconds that needs to pass, if the account was locked due to too many failed authentication attempts|
+| `os_auth_timeout`| 60 | authentication timeout in seconds, so login will exit if this time passes|
+| `os_auth_allow_homeless`| false | true if to allow users without home to login|
+| `os_auth_pam_passwdqc_enable`| true | true if you want to use strong password checking in PAM using passwdqc|
+| `os_auth_pam_passwdqc_options`| "min=disabled,disabled,16,12,8" | set to any option line (as a string) that you want to pass to passwdqc|
+| `os_security_users_allow`| [] | list of things, that a user is allowed to do. May contain `change_user`.
+| `os_security_kernel_enable_module_loading`| true | true if you want to allowed to change kernel modules once the system is running (eg `modprobe`, `rmmod`)|
+| `os_security_kernel_enable_sysrq`| false | sysrq is a 'magical' key combo you can hit which the kernel will respond to regardless of whatever else it is doing, unless it is completely locked up. |
+| `os_security_kernel_enable_core_dump`| false | kernel is crashing or otherwise misbehaving and a kernel core dump is created |
+| `os_security_suid_sgid_enforce`| true | true if you want to reduce SUID/SGID bits. There is already a list of items which are searched for configured, but you can also add your own|
+| `os_security_suid_sgid_blacklist`| [] | a list of paths which should have their SUID/SGID bits removed|
+| `os_security_suid_sgid_whitelist`| [] | a list of paths which should not have their SUID/SGID bits altered|
+| `os_security_suid_sgid_remove_from_unknown`| false | true if you want to remove SUID/SGID bits from any file, that is not explicitly configured in a `blacklist`. This will make every Ansible-run search through the mounted filesystems looking for SUID/SGID bits that are not configured in the default and user blacklist. If it finds an SUID/SGID bit, it will be removed, unless this file is in your `whitelist`.|
+| `os_security_packages_clean'`| true | removes packages with known issues. See section packages.|
+| `ufw_manage_defaults` | true | true means apply all settings with `ufw_` prefix|
+| `ufw_ipt_sysctl` | '' | by default it disables IPT_SYSCTL in /etc/default/ufw. If you want to overwrite /etc/sysctl.conf values using ufw - set it to your sysctl dictionary, for example `/etc/ufw/sysctl.conf`
+| `ufw_default_input_policy` | DROP | set default input policy of ufw to `DROP` |
+| `ufw_default_output_policy` | ACCEPT | set default output policy of ufw to `ACCEPT` |
+| `ufw_default_forward_policy` | DROP| set default forward policy of ufw to `DROP` |
 
 ## Packages
 
@@ -67,7 +74,7 @@ We remove the following packages:
 
     - hosts: localhost
       roles:
-        - hardening.os-hardening
+        - dev-sec.os-hardening
 
 
 ## Changing sysctl variables
@@ -78,7 +85,7 @@ So for example if you want to change the IPv4 traffic forwarding variable to `1`
 ```
     - hosts: localhost
       roles:
-        - hardening.os-hardening
+        - dev-sec.os-hardening
       vars:
         sysctl_config:
           # Disable IPv4 traffic forwarding.
@@ -130,7 +137,9 @@ Alternatively you can change Ansible's [hash-behaviour](https://docs.ansible.com
 
 ## Local Testing
 
-For local testing you can use vagrant and Virtualbox of VMWare to run tests locally. You will have to install Virtualbox and Vagrant on your system. See [Vagrant Downloads](http://downloads.vagrantup.com/) for a vagrant package suitable for your system. For all our tests we use `test-kitchen`. If you are not familiar with `test-kitchen` please have a look at [their guide](http://kitchen.ci/docs/getting-started).
+The preferred way of locally testing the role is to use Docker. You will have to install Docker on your system. See [Get started](https://docs.docker.com/) for a Docker package suitable to for your system.
+
+You can also use vagrant and Virtualbox or VMWare to run tests locally. You will have to install Virtualbox and Vagrant on your system. See [Vagrant Downloads](http://downloads.vagrantup.com/) for a vagrant package suitable for your system. For all our tests we use `test-kitchen`. If you are not familiar with `test-kitchen` please have a look at [their guide](http://kitchen.ci/docs/getting-started).
 
 Next install test-kitchen:
 
@@ -138,10 +147,10 @@ Next install test-kitchen:
 # Install dependencies
 gem install bundler
 bundle install
+```
 
-# Fetch tests
-bundle exec thor kitchen:fetch-remote-tests
-
+### Testing with Docker
+```
 # fast test on one machine
 bundle exec kitchen test default-ubuntu-1204
 
@@ -153,8 +162,19 @@ bundle exec kitchen create default-ubuntu-1204
 bundle exec kitchen converge default-ubuntu-1204
 ```
 
-For more information see [test-kitchen](http://kitchen.ci/docs/getting-started)
+### Testing with Virtualbox
+```
+# fast test on one machine
+KITCHEN_YAML=".kitchen.vagrant.yml" bundle exec kitchen test default-ubuntu-1204
 
+# test on all machines
+KITCHEN_YAML=".kitchen.vagrant.yml" bundle exec kitchen test
+
+# for development
+KITCHEN_YAML=".kitchen.vagrant.yml" bundle exec kitchen create default-ubuntu-1204
+KITCHEN_YAML=".kitchen.vagrant.yml" bundle exec kitchen converge default-ubuntu-1204
+```
+For more information see [test-kitchen](http://kitchen.ci/docs/getting-started)
 
 ## Contributors + Kudos
 
@@ -189,6 +209,6 @@ See the License for the specific language governing permissions and
 limitations under the License.
 
 
-[1]: http://travis-ci.org/hardening-io/ansible-os-hardening
-[2]: https://gitter.im/hardening-io/general
-[3]: https://galaxy.ansible.com/list#/roles/4248
+[1]: http://travis-ci.org/dev-sec/ansible-os-hardening
+[2]: https://gitter.im/dev-sec/general
+[3]: https://galaxy.ansible.com/dev-sec/os-hardening

Thorfile

@@ -1,10 +0,0 @@
-# encoding: utf-8
-
-require 'bundler'
-require 'bundler/setup'
-require 'thor/foodcritic'
-
-require 'kitchen_sharedtests'
-require 'kitchen/sharedtests_thor_tasks'
-
-Kitchen::SharedtestsThorTasks.new

ansible.cfg

@@ -0,0 +1,15 @@
+# config file for ansible -- http://ansible.com/
+# ==============================================
+
+# nearly all parameters can be overridden in ansible-playbook 
+# or with command line flags. ansible will read ANSIBLE_CONFIG,
+# ansible.cfg in the current working directory, .ansible.cfg in
+# the home directory or /etc/ansible/ansible.cfg, whichever it
+# finds first
+
+[defaults]
+ansible_managed = Ansible managed: {file} modified on %Y-%m-%d by {uid} on {host}
+
+# additional paths to search for roles in, colon separated
+roles_path    = ../
+

default.yml

@@ -0,0 +1,20 @@
+---
+- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+  hosts: localhost
+  roles:
+    - ansible-os-hardening
+  vars:
+    os_security_users_allow: change_user
+    os_security_kernel_enable_core_dump: false
+    os_security_suid_sgid_remove_from_unknown: true
+    os_auth_pam_passwdqc_enable: false
+    os_desktop_enable: true
+    os_env_extra_user_paths: ['/home']
+    os_auth_allow_homeless: true
+    os_security_suid_sgid_blacklist: ['/bin/umount']
+    os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
+
+- name: wrapper playbook for kitchen testing "ansible-os-hardening"
+  hosts: localhost
+  roles:
+    - ansible-os-hardening

defaults/main.yml

@@ -8,7 +8,8 @@ os_auth_lockout_time: 600 # 10min
 os_auth_timeout: 60
 os_auth_allow_homeless: false
 os_auth_pam_passwdqc_enable: true
-os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8'
+os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8' # used in RHEL6
+os_auth_pam_pwquality_options: 'try_first_pass retry=3 type=' # used in RHEL7
 os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]
 os_auth_uid_min: 1000
 os_auth_gid_min: 1000
@@ -40,6 +41,23 @@ os_security_init_prompt: true
 # Require root password for single user mode. (rhel, centos)
 os_security_init_single: false
 
+# Apply ufw defaults
+ufw_manage_defaults: true
+
+# Empty variable disables IPT_SYSCTL in /etc/default/ufw
+# by default in Ubuntu it set to: /etc/ufw/sysctl.conf
+# CAUTION
+# if you enable it - it'll overwrite /etc/sysctl.conf file, managed by hardening framework
+ufw_ipt_sysctl: ''
+
+# Default ufw variables
+ufw_default_input_policy: 'DROP'
+ufw_default_output_policy: 'ACCEPT'
+ufw_default_forward_policy: 'DROP'
+ufw_default_application_policy: 'SKIP'
+ufw_manage_builtins: 'no'
+ufw_ipt_modules: 'nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns'
+
 # CAUTION
 # If you want to overwrite sysctl-variables,
 # you have to overwrite the *whole* dict, or else only the single overwritten will be actually used.

kitchen_vagrant_block.rb

@@ -0,0 +1,5 @@
+# This is a Vagrant block to allow proxy settings to be carried into Kitchen
+# You need this for all of yum/apt etc. to work!
+
+Vagrant.configure(2) do |config|
+end

meta/main.yml

@@ -1,24 +1,22 @@
 ---
 galaxy_info:
   author: "Sebastian Gumprich"
-  description: 'This Ansible playbook provides numerous security-related configurations, providing all-round base protection.'
+  description: 'This Ansible role provides numerous security-related configurations, providing all-round base protection.'
   company: Hardening Framework Team
   license: Apache License 2.0
-  min_ansible_version: '1.9'
+  min_ansible_version: '2.2.1'
   platforms:
     - name: EL
       versions:
         - 6
-    - name: Oracle Linux
-      versions:
-        - 6
+        - 7
     - name: Ubuntu
       versions:
         - precise
         - trusty
+        - xenial
     - name: Debian
       versions:
-        - squeeze
         - wheezy
         - jessie
   galaxy_tags:

spec/travis.yml

@@ -1,3 +0,0 @@
-- hosts: localhost
-  roles:
-    - ansible-os-hardening

tasks/main.yml

@@ -35,10 +35,9 @@
   tags: rhosts
 
 - include: yum.yml
-  when: ansible_os_family == 'RedHat' or ansible_os_family == 'Oracle Linux'
+  when: ansible_os_family == 'RedHat'
   tags: yum
 
 - include: apt.yml
   when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
   tags: apt
-

tasks/minimize_access.yml

@@ -1,17 +1,25 @@
 ---
-- name: minimize access
-  file: path='{{item}}' mode='go-w' recurse=yes
+# Using a two-pass approach for checking directories in order to support symlinks.
+- name: find directories for minimizing access
+  stat:
+    path: "{{ item }}"
+  register: minimize_access_directories
   with_items:
     - '/usr/local/sbin'
     - '/usr/local/bin'
     - '/usr/sbin'
-    - '/usr/bin' 
+    - '/usr/bin'
     - '/sbin'
     - '/bin'
     - '{{os_env_extra_user_paths}}'
 
+- name: minimize access
+  file: path='{{item.stat.path}}' mode='go-w' recurse=yes
+  when: item.stat.isdir
+  with_items: "{{ minimize_access_directories.results }}"
+
 - name: change shadow ownership to root and mode to 0600 | DTAG SEC Req 3.21-7
-  file: dest='/etc/shadow' owner=root group=root mode=0600
+  file: dest='/etc/shadow' owner={{ os_shadow_perms.owner }} group={{ os_shadow_perms.group }} mode={{ os_shadow_perms.mode }}
 
 - name: change su-binary to only be accessible to user and group root
   file: dest='/bin/su' owner=root group=root mode=0750

tasks/pam.yml

@@ -12,14 +12,14 @@
 
 - name: remove pam ccreds on Redhat systems
   yum: name='{{os_packages_pam_ccreds}}' state=absent
-  when: ansible_os_family == 'RedHat' or ansible_os_family == 'Oracle Linux'
+  when: ansible_os_family == 'RedHat'
 
 - name: remove pam_cracklib, because it does not play nice with passwdqc
   apt: name='{{os_packages_pam_cracklib}}' state=absent
   when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and os_auth_pam_passwdqc_enable
 
 - name: install the package for strong password checking
-  apt: name='{{os_packages_pam_passwdqc}}' state='installed'
+  apt: name='{{os_packages_pam_passwdqc}}' state='installed' update_cache='yes'
   when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and os_auth_pam_passwdqc_enable
 
 - name: configure passwdqc
@@ -31,7 +31,7 @@
   when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable
 
 - name: install tally2
-  apt: name='libpam-modules' state=installed
+  apt: name='libpam-modules' state='installed'
   when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable and os_auth_retries > 0
 
 - name: configure tally2
@@ -43,16 +43,16 @@
   when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable and os_auth_retries == 0
 
 - name: remove pam_cracklib, because it does not play nice with passwdqc
-  yum: name='{{os_packages_pam_cracklib}}' state=absent
-  when: (ansible_distribution == 'RedHat' or ansible_distribution == 'Oracle Linux') and os_auth_pam_passwdqc_enable
+  yum: name='{{os_packages_pam_cracklib}}' state='absent'
+  when: (ansible_os_family == 'RedHat' and ansible_distribution_version < '7') and os_auth_pam_passwdqc_enable
 
 - name: install the package for strong password checking
   yum: name='{{os_packages_pam_passwdqc}}' state='installed'
-  when: (ansible_distribution == 'RedHat' or ansible_distribution == 'Oracle Linux') and os_auth_pam_passwdqc_enable
+  when: (ansible_os_family == 'RedHat' and ansible_distribution_version < '7') and os_auth_pam_passwdqc_enable
 
 - name: remove passwdqc
   yum: name='{{os_packages_pam_passwdqc}}' state='absent'
-  when: (ansible_distribution == 'RedHat' or ansible_distribution == 'Oracle Linux') and not os_auth_pam_passwdqc_enable
+  when: ansible_os_family == 'RedHat' and not os_auth_pam_passwdqc_enable
 
 - name: configure passwdqc and tally via central system-auth confic
   template: src='rhel_system_auth.j2' dest='/etc/pam.d/system-auth-ac' mode=0640 owner=root group=root

tasks/rhosts.yml

@@ -2,11 +2,12 @@
 - name: Get user accounts | DTAG SEC Req 3.21-4
   command: "awk -F: '{print $1}' /etc/passwd"
   changed_when: False
+  check_mode: no
   register: users
 
 - name: delete rhosts-files from system | DTAG SEC Req 3.21-4
   file: dest='~{{ item }}/.rhosts' state=absent
-  with_items: users.stdout_lines
+  with_items: '{{ users.stdout_lines | default(omit) }}'
 
 - name: delete hosts.equiv from system | DTAG SEC Req 3.21-4
   file: dest='/etc/hosts.equiv' state=absent

tasks/suid_sgid.yml

@@ -1,7 +1,7 @@
 ---
 - name: remove suid/sgid bit from binaries in blacklist
   file: path='{{item}}' mode='a-s' state=file follow=yes
-  ignore_errors: true
+  failed_when: false
   with_items:
     - '{{ os_security_suid_sgid_system_blacklist }}'
     - '{{ os_security_suid_sgid_blacklist }}'

tasks/sysctl.yml

@@ -6,6 +6,10 @@
   template: src='rhel_sysconfig_init.j2' dest='/etc/sysconfig/init' owner=root group=root mode=0544
   when: ansible_distribution == 'RedHat' or ansible_distribution == 'Fedora' or ansible_distribution == 'CentOS'
 
+- name: install initramfs-tools
+  apt: name='initramfs-tools' state=installed update_cache=true
+  when: ansible_os_family == 'Debian' and os_security_kernel_enable_module_loading
+
 - name: rebuild initramfs with starting pack of modules, if module loading at runtime is disabled
   template: src='modules.j2' dest='/etc/initramfs-tools/modules' owner=root group=root mode=0440
   when: ansible_os_family == 'Debian' and os_security_kernel_enable_module_loading
@@ -23,15 +27,19 @@
     state: present
     reload: yes
     ignoreerrors: yes
-  with_dict: sysctl_config
+  with_dict: '{{ sysctl_config }}'
 
 - name: Change various sysctl-settings on rhel-hosts, look at the sysctl-vars file for documentation
   sysctl:
     name: '{{ item.key }}'
     value: '{{ item.value }}'
-    sysctl_set: yes
     state: present
     reload: yes
     ignoreerrors: yes
-  with_dict: sysctl_rhel_config
+  with_dict: '{{ sysctl_rhel_config }}'
   when: ansible_distribution == 'RedHat' or ansible_distribution == 'Fedora' or ansible_distribution == 'CentOS'
+
+- name: Apply ufw defaults
+  template: src="ufw.j2" dest=/etc/default/ufw
+  when: ufw_manage_defaults and (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu')
+  tags: ufw

tasks/user_accounts.yml

@@ -3,6 +3,7 @@
 - name: get UID_MIN from login.defs
   shell: awk '/^\s*UID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs removes=/etc/login.defs
   register: uid_min
+  check_mode: no
   changed_when: False
 
 - name: calculate UID_MAX from UID_MIN by substracting 1
@@ -18,15 +19,17 @@
   when: not uid_min
 
 - name: get all system accounts
-  command: awk -F'':'' '{ if ( $3 <= {{uid_max|quote}} ) print $1}' /etc/passwd removes=/etc/passwd 
+  command: awk -F'':'' '{ if ( $3 <= {{uid_max|quote}} ) print $1}' /etc/passwd removes=/etc/passwd
   changed_when: False
+  check_mode: no
   register: sys_accs
 
-- name: remove always ignored system accounts from list 
+- name: remove always ignored system accounts from list
   set_fact:
     sys_accs_cond: '{{sys_accs.stdout_lines | difference(os_always_ignore_users) }}'
+  check_mode: no
 
 - name: change system accounts not on the user provided ignore-list
-  user: name='{{ item }}' shell='{{os_nologin_shell_path}}' password='*'
+  user: name='{{item}}' shell='{{os_nologin_shell_path}}' password='*'
   with_items:
-    - '{{sys_accs_cond | difference(os_ignore_users) }}'
+    - '{{sys_accs_cond | default(omit) | difference(os_ignore_users) }}'

tasks/yum.yml

@@ -16,11 +16,14 @@
   stat: path='/etc/yum/pluginconf.d/rhnplugin.conf'
   register: rhnplugin_file
 
+  # for the "default([])" see here:
+  # https://github.com/dev-sec/ansible-os-hardening/issues/99 and
+  # https://stackoverflow.com/questions/37067827/ansible-deprecation-warning-for-undefined-variable-despite-when-clause
 - name: activate gpg-check for yum-repos
   replace: dest='{{item}}' regexp='^\s*gpgcheck=0' replace='gpgcheck=1'
   with_items:
-    - '{{ yum_repos.stdout_lines }}'
     - '/etc/yum.conf'
+    - '{{ yum_repos.stdout_lines| default([]) }}'
 
 - name: activate gpg-check for yum rhn if it exists
   replace: dest='/etc/yum/pluginconf.d/rhnplugin.conf' regexp='^\s*gpgcheck=0' replace='gpgcheck=1'

templates/rhel_system_auth.j2

@@ -19,11 +19,16 @@ account     sufficient    pam_succeed_if.so uid < 500 quiet
 account     required      pam_permit.so
 
 {% if os_auth_pam_passwdqc_enable %}
+  {%- if ansible_os_family == 'RedHat' and ansible_distribution_version >= '7' %}
+password    required      pam_pwquality.so {{os_auth_pam_pwquality_options}}
+  {%- else %}
 password    requisite     pam_passwdqc.so {{os_auth_pam_passwdqc_options}}
+  {%- endif %}
 {% else %}
 password    requisite     pam_cracklib.so try_first_pass retry=3 type=
 {% endif %}
 
+
 # NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
 # NSA 2.3.3.6 Limit Password Reuse
 password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5

templates/ufw.j2

@@ -0,0 +1,44 @@
+# /etc/default/ufw
+#
+
+# Set to yes to apply rules to support IPv6 (no means only IPv6 on loopback
+# accepted). You will need to 'disable' and then 'enable' the firewall for
+# the changes to take affect.
+IPV6={{ 'no' if sysctl_config['net.ipv6.conf.all.disable_ipv6'] is defined and sysctl_config['net.ipv6.conf.all.disable_ipv6'] == 1 else 'yes' }}
+
+# Set the default input policy to ACCEPT, DROP, or REJECT. Please note that if
+# you change this you will most likely want to adjust your rules.
+DEFAULT_INPUT_POLICY="{{ ufw_default_input_policy }}"
+
+# Set the default output policy to ACCEPT, DROP, or REJECT. Please note that if
+# you change this you will most likely want to adjust your rules.
+DEFAULT_OUTPUT_POLICY="{{ ufw_default_output_policy }}"
+
+# Set the default forward policy to ACCEPT, DROP or REJECT.  Please note that
+# if you change this you will most likely want to adjust your rules
+DEFAULT_FORWARD_POLICY="{{ ufw_default_forward_policy }}"
+
+# Set the default application policy to ACCEPT, DROP, REJECT or SKIP. Please
+# note that setting this to ACCEPT may be a security risk. See 'man ufw' for
+# details
+DEFAULT_APPLICATION_POLICY="{{ ufw_default_application_policy }}"
+
+# By default, ufw only touches its own chains. Set this to 'yes' to have ufw
+# manage the built-in chains too. Warning: setting this to 'yes' will break
+# non-ufw managed firewall rules
+MANAGE_BUILTINS="{{ ufw_manage_builtins }}"
+
+#
+# IPT backend
+#
+# only enable if using iptables backend and want to overwrite /etc/sysctl.conf
+{% if ufw_ipt_sysctl == '' %}#{% endif %}IPT_SYSCTL={{ ufw_ipt_sysctl }}
+
+# Extra connection tracking modules to load. Complete list can be found in
+# net/netfilter/Kconfig of your kernel source. Some common modules:
+# nf_conntrack_irc, nf_nat_irc: DCC (Direct Client to Client) support
+# nf_conntrack_netbios_ns: NetBIOS (samba) client support
+# nf_conntrack_pptp, nf_nat_pptp: PPTP over stateful firewall/NAT
+# nf_conntrack_ftp, nf_nat_ftp: active FTP support
+# nf_conntrack_tftp, nf_nat_tftp: TFTP support (server side)
+IPT_MODULES="{{ ufw_ipt_modules }}"

vars/Debian.yml

@@ -4,3 +4,11 @@ os_packages_pam_cracklib: 'libpam-cracklib'
 passwdqc_path: '/usr/share/pam-configs/passwdqc'
 tally2_path: '/usr/share/pam-configs/tally2'
 os_nologin_shell_path: '/usr/sbin/nologin'
+
+# Different distros use different standards for /etc/shadow perms, e.g.
+# RHEL derivatives use root:root 0600, whereas Debian-based use root:shadow 0640.
+# You must provide key/value pairs for owner, group, and mode if overriding.
+os_shadow_perms:
+  owner: root
+  group: shadow
+  mode: "0640"

vars/Oracle Linux.yml

@@ -2,3 +2,11 @@ os_packages_pam_ccreds:  'pam_ccreds'
 os_packages_pam_passwdqc:  'pam_passwdqc'
 os_packages_pam_cracklib:  'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'
+
+# Different distros use different standards for /etc/shadow perms, e.g.
+# RHEL derivatives use root:root 0600, whereas Debian-based use root:shadow 0640.
+# You must provide key/value pairs for owner, group, and mode if overriding.
+os_shadow_perms:
+  owner: root
+  group: root
+  mode: "0600"

vars/RedHat.yml

@@ -1,4 +1,12 @@
-os_packages_pam_ccreds:  'pam_ccreds'
-os_packages_pam_passwdqc:  'pam_passwdqc'
-os_packages_pam_cracklib:  'pam_cracklib'
+os_packages_pam_ccreds: 'pam_ccreds'
+os_packages_pam_passwdqc: 'pam_passwdqc'
+os_packages_pam_cracklib: 'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'
+
+# Different distros use different standards for /etc/shadow perms, e.g.
+# RHEL derivatives use root:root 0600, whereas Debian-based use root:shadow 0640.
+# You must provide key/value pairs for owner, group, and mode if overriding.
+os_shadow_perms:
+  owner: root
+  group: root
+  mode: "0600"