Merge pull request #143 from dev-sec/martians

add missing sysctl parameter

.kitchen.vagrant.yml

@@ -24,47 +24,36 @@ transport:
   max_ssh_sessions: 5
 
 platforms:
-- name: ubuntu-14.04
+- name: ubuntu14.04
   driver_config:
     box: opscode-ubuntu-14.04
     box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-14.04_chef-provisionerless.box
-- name: ubuntu-16.04
+- name: ubuntu16.04
   driver_config:
     box: opscode-ubuntu-16.04
     box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-16.04_chef-provisionerless.box
-- name: centos-6.4
+- name: centos6
   driver_config:
-    box: opscode-centos-6.4
-    box_url: https://opscode-vm.s3.amazonaws.com/vagrant/opscode_centos-6.4_provisionerless.box
-- name: centos-6.5
+    box: bento/centos-6.9
+- name: centos7
   driver_config:
-    box: opscode-centos-6.5
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-6.5_chef-provisionerless.box
-- name: centos-6.8
-  driver_config:
-    box: bento/centos-6.8
-- name: centos-7
-  driver_config:
-    box: bento/centos-7.2
-- name: oracle-6.4
-  driver_config:
-    box: oracle-6.4
-    box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel64-64.box
-- name: oracle-6.5
+    box: bento/centos-7.3
+- name: oracle6
   driver_config:
     box: oracle-6.5
     box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel65-64.box
-- name: oracle-7
+- name: oracle7
   driver_config:
     box: boxcutter/ol72
-- name: debian-7
+- name: debian7
   driver_config:
-    box: debian-7
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-7.8_chef-provisionerless.box
-- name: debian-8
+    box: bento/debian-7.11
+- name: debian8
   driver_config:
-    box: debian-8
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-8.1_chef-provisionerless.box
+    box: bento/debian-8.8
+- name: debian9
+  driver_config:
+    box: bento/debian-9.0
 
 verifier:
   name: inspec

.travis.yml

@@ -15,10 +15,13 @@ env:
     version: latest
     init: /sbin/init
 
-  - distro: oracle7
-    init: /usr/lib/systemd/systemd
-    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
-    version: latest
+# oracle 7 does not support ansible 2.4 yet
+# check oracle-epel if it is supported
+# http://yum.oracle.com/repo/OracleLinux/OL7/developer_EPEL/x86_64/index.html
+#  - distro: oracle7
+#    init: /usr/lib/systemd/systemd
+#    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
+#    version: latest
 
   - distro: ubuntu1604
     version: latest

CHANGELOG.md

@@ -1,11 +1,37 @@
 # Change Log
 
+## [4.2.0](https://github.com/dev-sec/ansible-os-hardening/tree/4.2.0) (2017-08-08)
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.1.0...4.2.0)
+
+**Implemented enhancements:**
+
+- add modprobe template, control os-10 [\#138](https://github.com/dev-sec/ansible-os-hardening/pull/138) ([rndmh3ro](https://github.com/rndmh3ro))
+- new task for delete netrc files, control os-09 [\#137](https://github.com/dev-sec/ansible-os-hardening/pull/137) ([rndmh3ro](https://github.com/rndmh3ro))
+- add passwd task, control os-03 [\#136](https://github.com/dev-sec/ansible-os-hardening/pull/136) ([rndmh3ro](https://github.com/rndmh3ro))
+- remove prelink package, control package-09 [\#135](https://github.com/dev-sec/ansible-os-hardening/pull/135) ([rndmh3ro](https://github.com/rndmh3ro))
+- style update [\#134](https://github.com/dev-sec/ansible-os-hardening/pull/134) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-os-hardening/pull/130) ([fazlearefin](https://github.com/fazlearefin))
+
+**Fixed bugs:**
+
+- Why is rsync removed? [\#141](https://github.com/dev-sec/ansible-os-hardening/issues/141)
+- playbook makes OS undetectable [\#124](https://github.com/dev-sec/ansible-os-hardening/issues/124)
+- Centos7/RHEL7: Exec shield is enabled by default and not manageable anymore by sysctl.conf [\#118](https://github.com/dev-sec/ansible-os-hardening/issues/118)
+- Remove rsync from package blacklist [\#142](https://github.com/dev-sec/ansible-os-hardening/pull/142) ([duk3luk3](https://github.com/duk3luk3))
+
+**Merged pull requests:**
+
+- remove execshield sysctl-parameter on rhel7 [\#119](https://github.com/dev-sec/ansible-os-hardening/pull/119) ([rndmh3ro](https://github.com/rndmh3ro))
+
 ## [4.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/4.1.0) (2017-06-27)
 [Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.0.0...4.1.0)
 
 **Fixed bugs:**
 
 - Change system accounts not on the user provided ignore-list items are not JSON serializable [\#125](https://github.com/dev-sec/ansible-os-hardening/issues/125)
+- Could not find gem 'ruby \(\>= 2.1.0\)' [\#116](https://github.com/dev-sec/ansible-os-hardening/issues/116)
+- The task sysctl fails when /etc/initramfs-tools is not present [\#111](https://github.com/dev-sec/ansible-os-hardening/issues/111)
+- Deprecation warning always\_run [\#103](https://github.com/dev-sec/ansible-os-hardening/issues/103)
 
 **Closed issues:**
 
@@ -30,9 +56,6 @@
 
 - The role fails when conditionally included [\#105](https://github.com/dev-sec/ansible-os-hardening/issues/105)
 - omit empty variables [\#106](https://github.com/dev-sec/ansible-os-hardening/pull/106) ([rndmh3ro](https://github.com/rndmh3ro))
-- Could not find gem 'ruby \(\>= 2.1.0\)' [\#116](https://github.com/dev-sec/ansible-os-hardening/issues/116)
-- The task sysctl fails when /etc/initramfs-tools is not present [\#111](https://github.com/dev-sec/ansible-os-hardening/issues/111)
-- Deprecation warning always\_run [\#103](https://github.com/dev-sec/ansible-os-hardening/issues/103)
 
 **Closed issues:**
 

README.md

@@ -29,6 +29,12 @@ It will not:
 
 * Ansible 2.2.1
 
+
+## Warning
+
+If you're using inspec to test your machines after applying this role, please make sure to add the connecting user to the `os_ignore_users`-variable.
+Otherwise inspec will fail. For more information, see [issue #124](https://github.com/dev-sec/ansible-os-hardening/issues/124).
+
 ## Variables
 
 | Name           | Default Value | Description                        |
@@ -46,7 +52,6 @@ It will not:
 | `os_auth_pam_passwdqc_options`| "min=disabled,disabled,16,12,8" | set to any option line (as a string) that you want to pass to passwdqc|
 | `os_security_users_allow`| [] | list of things, that a user is allowed to do. May contain `change_user`.
 | `os_security_kernel_enable_module_loading`| true | true if you want to allowed to change kernel modules once the system is running (eg `modprobe`, `rmmod`)|
-| `os_security_kernel_enable_sysrq`| false | sysrq is a 'magical' key combo you can hit which the kernel will respond to regardless of whatever else it is doing, unless it is completely locked up. |
 | `os_security_kernel_enable_core_dump`| false | kernel is crashing or otherwise misbehaving and a kernel core dump is created |
 | `os_security_suid_sgid_enforce`| true | true if you want to reduce SUID/SGID bits. There is already a list of items which are searched for configured, but you can also add your own|
 | `os_security_suid_sgid_blacklist`| [] | a list of paths which should have their SUID/SGID bits removed|
@@ -84,6 +89,8 @@ We disable the following filesystems, because they're most likely not used:
  * "udf"
  * "vfat"
 
+To prevent some of the filesystems from being disabled, add them to the `os_filesystem_whitelist` variable.
+
 ## Example Playbook
 
     - hosts: localhost

default.yml

@@ -18,6 +18,7 @@
     os_auth_allow_homeless: true
     os_security_suid_sgid_blacklist: ['/bin/umount']
     os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
+    os_filesystem_whitelist: ['vfat']
     sysctl_config:
       net.ipv4.ip_forward: 0
       net.ipv6.conf.all.forwarding: 0

defaults/main.yml

@@ -1,6 +1,5 @@
 os_desktop_enable: false
 os_env_extra_user_paths: []
-os_env_umask: '027'
 os_auth_pw_max_age: 60
 os_auth_pw_min_age: 7 # discourage password cycling
 os_auth_retries: 5
@@ -11,12 +10,6 @@ os_auth_pam_passwdqc_enable: true
 os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8' # used in RHEL6
 os_auth_pam_pwquality_options: 'try_first_pass retry=3 type=' # used in RHEL7
 os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]
-os_auth_uid_min: 1000
-os_auth_gid_min: 1000
-os_auth_sys_uid_min: 100
-os_auth_sys_uid_max: 999
-os_auth_sys_gid_min: 100
-os_auth_sys_gid_max: 999
 
 os_chfn_restrict: ''
 # may contain: change_user
@@ -127,6 +120,7 @@ sysctl_config:
 
   # log martian packets | sysctl-17
   net.ipv4.conf.all.log_martians: 1
+  net.ipv4.conf.default.log_martians: 1
 
   # ipv6 config
   # Disable acceptance of IPv6 router solicitations messages | sysctl-21
@@ -179,6 +173,59 @@ sysctl_config:
   # Virtual memory regions protection | sysctl-32
   kernel.randomize_va_space: 2
 
+  kernel.core_uses_pid: 1
+
+  # When an attacker is trying to exploit the local kernel, it is often
+  # helpful to be able to examine where in memory the kernel, modules,
+  # and data structures live. As such, kernel addresses should be treated
+  # as sensitive information.
+  #
+  # Many files and interfaces contain these addresses (e.g. /proc/kallsyms,
+  # /proc/modules, etc), and this setting can censor the addresses. A value
+  # of "0" allows all users to see the kernel addresses. A value of "1"
+  # limits visibility to the root user, and "2" blocks even the root user.
+  kernel.kptr_restrict: 1
+
+  # The PTRACE system is used for debugging.  With it, a single user process
+  # can attach to any other dumpable process owned by the same user.  In the
+  # case of malicious software, it is possible to use PTRACE to access
+  # credentials that exist in memory (re-using existing SSH connections,
+  # extracting GPG agent information, etc).
+  #
+  # A PTRACE scope of "0" is the more permissive mode.  A scope of "1" limits
+  # PTRACE only to direct child processes (e.g. "gdb name-of-program" and
+  # "strace -f name-of-program" work, but gdb's "attach" and "strace -fp $PID"
+  # do not).  The PTRACE scope is ignored when a user has CAP_SYS_PTRACE, so
+  # "sudo strace -fp $PID" will work as before.  For more details see:
+  # https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening#ptrace
+  #
+  # For applications launching crash handlers that need PTRACE, exceptions can
+  # be registered by the debugee by declaring in the segfault handler
+  # specifically which process will be using PTRACE on the debugee:
+  #   prctl(PR_SET_PTRACER, debugger_pid, 0, 0, 0);
+  #
+  # In general, PTRACE is not needed for the average running Ubuntu system.
+  # To that end, the default is to set the PTRACE scope to "1".  This value
+  # may not be appropriate for developers or servers with only admin accounts.
+  # kernel.yama.ptrace_scope = 1
+  kernel.yama.ptrace_scope: 1
+
+  # Protect the zero page of memory from userspace mmap to prevent kernel
+  # NULL-dereference attacks against potential future kernel security
+  # vulnerabilities.  (Added in kernel 2.6.23.)
+  #
+  # While this default is built into the Ubuntu kernel, there is no way to
+  # restore the kernel default if the value is changed during runtime; for
+  # example via package removal (e.g. wine, dosemu).  Therefore, this value
+  # is reset to the secure default each time the sysctl values are loaded.
+  vm.mmap_min_addr: 65536
+          
+  # These settings eliminate an entire class of security vulnerability:
+  # time-of-check-time-of-use cross-privilege attacks using guessable
+  # filenames (generally seen as "/tmp file race" vulnerabilities).
+  fs.protected_hardlinks: 1
+  fs.protected_symlinks: 1
+
 # Do not delete the following line or otherwise the playbook will fail
 # at task 'create a combined sysctl-dict if overwrites are defined'
 sysctl_overwrite:
@@ -194,3 +241,5 @@ os_unused_filesystems:
   - "udf"
   - "vfat"
 
+# whitelist for used filesystems
+os_filesystem_whitelist: []

tasks/limits.yml

@@ -1,19 +1,35 @@
 ---
 
-- name: create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
+- block:
+  - name: create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
+    file:
+      path: '/etc/security/limits.d'
+      owner: 'root'
+      group: 'root'
+      mode: '0755'
+      state: 'directory'
+      
+  - name: create aditional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
+    pam_limits:
+      dest: '/etc/security/limits.d/10.hardcore.conf'
+      domain: '*'
+      limit_type: hard
+      limit_item: core
+      value: 0
+      comment: Prevent core dumps for all users. These are usually only needed by developers and may contain sensitive information
+      
+  - name: set 10.hardcore.conf perms to 0400 and root ownership
+    file:
+      path: /etc/security/limits.d/10.hardcore.conf
+      owner: 'root'
+      group: 'root'
+      mode: '0440'
+  
+  when: 'not os_security_kernel_enable_core_dump'
+
+- name: remove 10.hardcore.conf config file
   file:
-    path: '/etc/security/limits.d'
-    owner: 'root'
-    group: 'root'
-    mode: '0755'
-    state: 'directory'
-  when: 'os_security_kernel_enable_core_dump'
+    path: /etc/security/limits.d/10.hardcore.conf
+    state: absent
 
-- name: create sane limits.conf | sysctl-31a, sysctl-31b
-  template:
-    src: 'limits.conf.j2'
-    dest: '/etc/security/limits.d/10.hardcore.conf'
-    owner: 'root'
-    group: 'root'
-    mode: '0440'
   when: 'os_security_kernel_enable_core_dump'

tasks/main.yml

@@ -20,7 +20,7 @@
   tags: login_defs
 
 - include: minimize_access.yml
-  tags: minimize_acces
+  tags: minimize_access
 
 - include: modprobe.yml
   tags: modprobe

tasks/profile.yml

@@ -1,5 +1,5 @@
 ---
-- name: create profile.conf
+- name: add pinerolo_profile.sh to profile.d
   template:
     src: 'profile.conf.j2'
     dest: '/etc/profile.d/pinerolo_profile.sh'
@@ -7,3 +7,9 @@
     group: 'root'
     mode: '0750'
   when: not os_security_kernel_enable_core_dump
+  
+- name: remove pinerolo_profile.sh from profile.d
+  file:
+    path: /etc/profile.d/pinerolo_profile.sh
+    state: absent
+  when: os_security_kernel_enable_core_dump

tasks/user_accounts.yml

@@ -40,5 +40,6 @@
     name: '{{ item }}'
     shell: '{{ os_nologin_shell_path }}'
     password: '*'
+    createhome: False
   with_flattened:
     - '{{ sys_accs_cond | default([]) | difference(os_ignore_users) | list }}'

templates/limits.conf.j2

@@ -1,3 +0,0 @@
-# {{ ansible_managed | comment }}
-# Prevent core dumps for all users. These are usually only needed by developers and may contain sensitive information.
-* hard core 0

templates/modprobe.j2

@@ -1,5 +1,5 @@
-# {{ ansible_managed | comment }}
+{{ ansible_managed | comment }}
 
-{% for fs in os_unused_filesystems %}
+{% for fs in os_unused_filesystems | difference(os_filesystem_whitelist) %}
 install {{fs}} /bin/true
 {% endfor %}

templates/ufw.j2

@@ -9,25 +9,25 @@ IPV6={{ 'no' if sysctl_config['net.ipv6.conf.all.disable_ipv6'] is defined and s
 
 # Set the default input policy to ACCEPT, DROP, or REJECT. Please note that if
 # you change this you will most likely want to adjust your rules.
-DEFAULT_INPUT_POLICY='{{ ufw_default_input_policy }}'
+DEFAULT_INPUT_POLICY="{{ ufw_default_input_policy }}"
 
 # Set the default output policy to ACCEPT, DROP, or REJECT. Please note that if
 # you change this you will most likely want to adjust your rules.
-DEFAULT_OUTPUT_POLICY='{{ ufw_default_output_policy }}'
+DEFAULT_OUTPUT_POLICY="{{ ufw_default_output_policy }}"
 
 # Set the default forward policy to ACCEPT, DROP or REJECT.  Please note that
 # if you change this you will most likely want to adjust your rules
-DEFAULT_FORWARD_POLICY='{{ ufw_default_forward_policy }}'
+DEFAULT_FORWARD_POLICY="{{ ufw_default_forward_policy }}"
 
 # Set the default application policy to ACCEPT, DROP, REJECT or SKIP. Please
 # note that setting this to ACCEPT may be a security risk. See 'man ufw' for
 # details
-DEFAULT_APPLICATION_POLICY='{{ ufw_default_application_policy }}'
+DEFAULT_APPLICATION_POLICY="{{ ufw_default_application_policy }}"
 
 # By default, ufw only touches its own chains. Set this to 'yes' to have ufw
 # manage the built-in chains too. Warning: setting this to 'yes' will break
 # non-ufw managed firewall rules
-MANAGE_BUILTINS='{{ ufw_manage_builtins }}'
+MANAGE_BUILTINS="{{ ufw_manage_builtins }}"
 
 #
 # IPT backend
@@ -42,4 +42,4 @@ MANAGE_BUILTINS='{{ ufw_manage_builtins }}'
 # nf_conntrack_pptp, nf_nat_pptp: PPTP over stateful firewall/NAT
 # nf_conntrack_ftp, nf_nat_ftp: active FTP support
 # nf_conntrack_tftp, nf_nat_tftp: TFTP support (server side)
-IPT_MODULES='{{ ufw_ipt_modules }}'
+IPT_MODULES="{{ ufw_ipt_modules }}"

vars/Debian.yml

@@ -8,7 +8,7 @@ os_nologin_shell_path: '/usr/sbin/nologin'
 modprobe_package: 'kmod'
 
 # Different distros use different standards for /etc/shadow perms, e.g.
-# RHEL derivatives use root:root 0600, whereas Debian-based use root:shadow 0640.
+# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
 # You must provide key/value pairs for owner, group, and mode if overriding.
 os_shadow_perms:
   owner: root
@@ -19,3 +19,12 @@ os_passwd_perms:
   owner: root
   group: root
   mode: '0644'
+
+os_env_umask: '027'
+
+os_auth_uid_min: 1000
+os_auth_gid_min: 1000
+os_auth_sys_uid_min: 100
+os_auth_sys_uid_max: 999
+os_auth_sys_gid_min: 100
+os_auth_sys_gid_max: 999

vars/Oracle Linux.yml

@@ -4,14 +4,23 @@ os_packages_pam_cracklib:  'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'
 
 # Different distros use different standards for /etc/shadow perms, e.g.
-# RHEL derivatives use root:root 0600, whereas Debian-based use root:shadow 0640.
+# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
 # You must provide key/value pairs for owner, group, and mode if overriding.
 os_shadow_perms:
   owner: root
   group: root
-  mode: '0600'
+  mode: '0000'
 
 os_passwd_perms:
   owner: root
   group: root
   mode: '0644'
+
+os_env_umask: '077'
+
+os_auth_uid_min: 1000
+os_auth_gid_min: 1000
+os_auth_sys_uid_min: 201
+os_auth_sys_uid_max: 999
+os_auth_sys_gid_min: 201
+os_auth_sys_gid_max: 999

vars/RedHat.yml

@@ -8,14 +8,23 @@ os_packages_pam_cracklib: 'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'
 
 # Different distros use different standards for /etc/shadow perms, e.g.
-# RHEL derivatives use root:root 0600, whereas Debian-based use root:shadow 0640.
+# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
 # You must provide key/value pairs for owner, group, and mode if overriding.
 os_shadow_perms:
   owner: root
   group: root
-  mode: '0600'
+  mode: '0000'
 
 os_passwd_perms:
   owner: root
   group: root
   mode: '0644'
+
+os_env_umask: '077'
+
+os_auth_uid_min: 1000
+os_auth_gid_min: 1000
+os_auth_sys_uid_min: 201
+os_auth_sys_uid_max: 999
+os_auth_sys_gid_min: 201
+os_auth_sys_gid_max: 999