move sysctls to debian specific vars (#524)

* fix ansible-lint issue

https://github.com/ansible-community/ansible-lint/issues/1795
Signed-off-by: rndmh3ro <[email protected]>

* move 2 sysctls to debian specific

Signed-off-by: rndmh3ro <[email protected]>

* fix ansible-lint issue

https://github.com/ansible-community/ansible-lint/issues/1795
Signed-off-by: rndmh3ro <[email protected]>

* add arch linux sysctls

* simplify sysctl settings

Signed-off-by: rndmh3ro <[email protected]>

* ove overwrite to the bottom to let it acutally overwrite something

Signed-off-by: rndmh3ro <[email protected]>

* fix typo

Signed-off-by: rndmh3ro <[email protected]>

.github/workflows/ansible-lint.yml

@@ -30,6 +30,8 @@ jobs:
         # override-deps: |
         #   ansible==2.9
         #   ansible-lint==4.2.0
+        override-deps: |
+           rich>=9.5.1,<11.0.0
         # [optional]
         # Arguments to be passed to the ansible-lint
 

CHANGELOG.md

@@ -1,6 +1,40 @@
 # Changelog
 
-## [7.13.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.13.0) (2021-11-07)
+## [Unreleased](https://github.com/dev-sec/ansible-collection-hardening/tree/HEAD)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.13.2...HEAD)
+
+**Implemented enhancements:**
+
+- Add option to set timeout in seconds to logout users [\#516](https://github.com/dev-sec/ansible-collection-hardening/pull/516) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lbayerlein](https://github.com/lbayerlein))
+- add feature to disable coredump to limit task [\#511](https://github.com/dev-sec/ansible-collection-hardening/pull/511) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lbayerlein](https://github.com/lbayerlein))
+- change hidepid mount task state to mounted [\#510](https://github.com/dev-sec/ansible-collection-hardening/pull/510) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([alegrey91](https://github.com/alegrey91))
+- prettify nginx options [\#509](https://github.com/dev-sec/ansible-collection-hardening/pull/509) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Update nginx\_add\_header README to match default [\#506](https://github.com/dev-sec/ansible-collection-hardening/pull/506) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([duffn](https://github.com/duffn))
+- Updated dh\_params to 4096 [\#501](https://github.com/dev-sec/ansible-collection-hardening/pull/501) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([ksaadDE](https://github.com/ksaadDE))
+
+**Fixed bugs:**
+
+- Duplication of sysctl default parameter fs.protected\_hardlinks and fs.protected\_symlinks [\#502](https://github.com/dev-sec/ansible-collection-hardening/issues/502)
+- Fix duplicate sysctl config in fs [\#505](https://github.com/dev-sec/ansible-collection-hardening/pull/505) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([tekicat](https://github.com/tekicat))
+
+**Merged pull requests:**
+
+- Feature coredump [\#513](https://github.com/dev-sec/ansible-collection-hardening/pull/513) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.13.2](https://github.com/dev-sec/ansible-collection-hardening/tree/7.13.2) (2021-11-23)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.13.1...7.13.2)
+
+## [7.13.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.13.1) (2021-11-23)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.13.0...7.13.1)
+
+**Closed issues:**
+
+- Unable to use 7.13.0 Release [\#503](https://github.com/dev-sec/ansible-collection-hardening/issues/503)
+
+## [7.13.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.13.0) (2021-11-15)
 
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.12.0...7.13.0)
 
@@ -9,6 +43,8 @@
 - os\_hardening: Provide a whitelist for yum repositories with non-signed RPMs [\#485](https://github.com/dev-sec/ansible-collection-hardening/issues/485)
 - Disable ctrl-alt-del key combination [\#496](https://github.com/dev-sec/ansible-collection-hardening/pull/496) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lbayerlein](https://github.com/lbayerlein))
 - implement sysctl-34 - link protection settings [\#494](https://github.com/dev-sec/ansible-collection-hardening/pull/494) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Add whitelist option for yum repository files [\#487](https://github.com/dev-sec/ansible-collection-hardening/pull/487) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([darxriggs](https://github.com/darxriggs))
+- Add TLSv1.3 to nginx default configuration [\#470](https://github.com/dev-sec/ansible-collection-hardening/pull/470) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([ksaadDE](https://github.com/ksaadDE))
 
 **Closed issues:**
 
@@ -20,7 +56,6 @@
 - add old role names to tags in Galaxy [\#495](https://github.com/dev-sec/ansible-collection-hardening/pull/495) ([schurzi](https://github.com/schurzi))
 - update minimum ansible version for roles [\#493](https://github.com/dev-sec/ansible-collection-hardening/pull/493) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - revive old tests with custom ssh settings [\#491](https://github.com/dev-sec/ansible-collection-hardening/pull/491) ([rndmh3ro](https://github.com/rndmh3ro))
-- Add whitelist option for yum repository files [\#487](https://github.com/dev-sec/ansible-collection-hardening/pull/487) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([darxriggs](https://github.com/darxriggs))
 
 ## [7.12.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.12.0) (2021-10-21)
 

galaxy.yml

@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 7.12.0
+version: 7.14.0
 readme: README.md
 authors:
   - dev-sec <[email protected]>
@@ -17,11 +17,11 @@ tags:
   - nginx
   - mysql
   - openssh
-  - ansible-apache-hardening
-  - mysql-hardening
-  - nginx-hardening
-  - os-hardening
-  - ssh-hardening
+  - apache_hardening
+  - mysql_hardening
+  - nginx_hardening
+  - os_hardening
+  - ssh_hardening
 dependencies:
   ansible.posix: '>=1.0.0'
   community.crypto: '>=1.0.0'

molecule/os_hardening/converge.yml

@@ -16,7 +16,7 @@
         name: os_hardening
   vars:
     os_security_users_allow: change_user
-    os_security_kernel_enable_core_dump: true
+    os_security_kernel_enable_core_dump: false
     os_security_suid_sgid_remove_from_unknown: true
     os_auth_pam_passwdqc_enable: false
     os_auth_lockout_time: 15

roles/nginx_hardening/README.md

@@ -61,8 +61,8 @@ It works with the following nginx-roles, including, but not limited to:
   - Default: `default 5`
   - Description: Sets the shared memory zone and the maximum allowed number of connections for a given key value.
 - [nginx_add_header][]
-  - Default: `[ "X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"" ]`
-  - Description:Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307.
+  - Default: `[ "X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"", Content-Security-Policy \"script-src 'self'; object-src 'self'\" ]`
+  - Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307.
 - [nginx_ssl_protocols][]
   - Default: `TLSv1.2`
   - Description: Specifies the SSL protocol which should be used.

roles/nginx_hardening/defaults/main.yml

@@ -11,19 +11,19 @@ nginx_client_header_timeout: "10"
 nginx_send_timeout: "10"
 nginx_limit_conn_zone: "$binary_remote_addr zone=default:10m"
 nginx_limit_conn: "default 5"
-nginx_add_header: [
-# vvoid clickjacking
-"X-Frame-Options SAMEORIGIN",
-# disable content-type sniffing
-"X-Content-Type-Options nosniff",
-# XSS filter
-"X-XSS-Protection \"1; mode=block\"",
-"Strict-Transport-Security max-age=15768000",
-"Content-Security-Policy \"script-src 'self'; object-src 'self'\"" ]
+nginx_add_header:
+  # avoid clickjacking
+  - X-Frame-Options SAMEORIGIN
+  # disable content-type sniffing
+  - X-Content-Type-Options nosniff
+  # XSS filter
+  - X-XSS-Protection "1; mode=block"
+  - Strict-Transport-Security max-age=15768000
+  - Content-Security-Policy "script-src 'self'; object-src 'self'"
 
 nginx_set_cookie_flag: "* HttpOnly secure"
 nginx_ssl_prefer_server_ciphers: "on"
 nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
 nginx_ssl_ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
 nginx_ssl_session_tickets: "off"
-nginx_dh_size: "2048"
+nginx_dh_size: "4096"

roles/os_hardening/README.md

@@ -250,6 +250,9 @@ We know that this is the case on Raspberry Pi.
 - `os_profile_enabled`
   - Default: `true`
   - Description: Set to false to disable installing and configuring profile.
+- `os_security_auto_logout`
+  - Default: `0`
+  - Description: Set timeout in seconds for logout users automatically after time. Setting this to `0` disables the timeout.
 - `os_securetty_enabled`
   - Default: `true`
   - Description: Set to false to disable installing and configuring securetty.

roles/os_hardening/defaults/main.yml

@@ -70,6 +70,12 @@ sysctl_config:
   fs.protected_hardlinks: 1
   fs.protected_symlinks: 1
 
+  # For more info on the following settings see: https://www.kernel.org/doc/html/latest/admin-guide/sysctl/fs.html
+  # Restrict FIFO special device creation behavior
+  fs.protected_fifos: 1
+  # Restrict regular files creation behavior
+  fs.protected_regular: 2
+
   # Prevent core dumps with SUID. These are usually only
   # needed by developers and may contain sensitive information. | sysctl-31
   fs.suid_dumpable: 0
@@ -282,24 +288,6 @@ sysctl_config:
   vm.mmap_rnd_bits: 32
   vm.mmap_rnd_compat_bits: 16
 
-  # Disable unprivileged users from loading eBPF programs into the kernel.
-  # One of mitigations against CVE-2021-33909. | Tail-2
-  kernel.unprivileged_bpf_disabled: 1
-
-  # Reduce attack surface by disabling unprivileged user namespaces.
-  # Mitigates CVE-2021-33909 and other exploits.
-  kernel.unprivileged_userns_clone: 0
-
-  # For more info on the following settings see: https://www.kernel.org/doc/html/latest/admin-guide/sysctl/fs.html
-  # Restrict FIFO special device creation behavior
-  fs.protected_fifos: 1
-  # Restrict hardlink creation behavior
-  fs.protected_hardlinks: 1
-  # Restrict regular files creation behavior
-  fs.protected_regular: 2
-  # Restrict symlink following behavior
-  fs.protected_symlinks: 1
-
 # Do not delete the following line or otherwise the playbook will fail
 # at task 'create a combined sysctl-dict if overwrites are defined'
 sysctl_overwrite:
@@ -368,6 +356,9 @@ os_profile_enabled: true
 # Set to false to disable installing and configuring securetty.
 os_securetty_enabled: true
 
+# Set timeout in seconds for logout users automatically after time. Setting this to `0` disables the timeout.
+os_security_auto_logout: 0
+
 # Set to false to disable installing and configuring sysctl.
 os_sysctl_enabled: true
 

roles/os_hardening/handlers/main.yml

@@ -7,3 +7,7 @@
     cmd: 'service auditd restart'  # rhel: see: https://access.redhat.com/solutions/2664811
     warn: false  # sadly 'service' module fails in that case also by using 'use: service'
   when: molecule_yml is not defined  # restarting auditd in a container does not work
+
+- name: Reload systemd
+  systemd:
+    daemon_reload: yes

roles/os_hardening/tasks/limits.yml

@@ -1,5 +1,6 @@
 ---
-- block:
+- name: disable coredumps
+  block:
   - name: Create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
     file:
       path: '/etc/security/limits.d'
@@ -27,9 +28,37 @@
       modification_time: preserve
       access_time: preserve
 
+  - name: create coredump.conf.d-directory if it does not exist
+    file:
+      path: '/etc/systemd/coredump.conf.d'
+      owner: root
+      group: root
+      mode: 0755
+      state: directory
+    when: ansible_service_mgr == "systemd"
+
+  - name: create custom.conf for disabling coredumps
+    template:
+      src: 'etc/systemd/coredump.conf.d/coredumps.conf.j2'
+      dest: '/etc/systemd/coredump.conf.d/custom.conf'
+      owner: root
+      group: root
+      mode: 0644
+    when: ansible_service_mgr == "systemd"
+    notify: Reload systemd
+
   when: not os_security_kernel_enable_core_dump | bool
 
-- name: Remove 10.hardcore.conf config file
+- name: enable coredumps
+  block:
+  - name: Remove coredump.conf.d directory with files
+    file:
+      path: /etc/systemd/coredump.conf.d
+      state: absent
+    when: ansible_service_mgr == "systemd"
+    notify: Reload systemd
+
+  - name: Remove 10.hardcore.conf config file
     file:
       path: /etc/security/limits.d/10.hardcore.conf
       state: absent

roles/os_hardening/tasks/minimize_access.yml

@@ -79,4 +79,4 @@
     src: proc
     fstype: proc
     opts: '{{ proc_mnt_options }}'
-    state: present
+    state: mounted

roles/os_hardening/tasks/profile.yml

@@ -13,3 +13,11 @@
     path: /etc/profile.d/pinerolo_profile.sh
     state: absent
   when: os_security_kernel_enable_core_dump | bool
+
+- name: Add autologout to profile env
+  template:
+    src: 'etc/profile.d/tmout.sh.j2'
+    dest: '/etc/profile.d/tmout.sh'
+    owner: 'root'
+    group: 'root'
+    mode: '0750'

roles/os_hardening/tasks/sysctl.yml

@@ -43,6 +43,17 @@
 
 - name: Change sysctls
   block:
+    - name: Create a combined sysctl-dict if os-dependent sysctls are defined
+      set_fact:
+        sysctl_config: '{{ sysctl_config | combine(sysctl_custom_config) }}'
+      when: sysctl_custom_config | default()
+
+    # sysctl_rhel_config is kept for backwards-compatibility. use sysctl_custom_config instead
+    - name: Create a combined sysctl-dict if os-dependent sysctls are defined
+      set_fact:
+        sysctl_config: '{{ sysctl_config | combine(sysctl_rhel_config) }}'
+      when: sysctl_rhel_config | default()
+
     - name: Create a combined sysctl-dict if overwrites are defined
       set_fact:
         sysctl_config: '{{ sysctl_config | combine(sysctl_overwrite) }}'
@@ -57,17 +68,6 @@
         reload: true
         ignoreerrors: true
       with_dict: '{{ sysctl_config }}'
-
-    - name: Change various sysctl-settings on Amazon Linux, look at the sysctl-vars file for documentation
-      sysctl:
-        name: '{{ item.key }}'
-        value: '{{ item.value }}'
-        state: present
-        reload: true
-        ignoreerrors: true
-      with_dict: '{{ sysctl_rhel_config }}'
-      when: ansible_facts.distribution == 'Amazon'
-
   when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']
 
 - name: Apply ufw defaults

roles/os_hardening/templates/etc/profile.d/tmout.sh.j2

@@ -0,0 +1,3 @@
+# Logout Timeout
+export TMOUT={{ os_security_auto_logout }}
+readonly TMOUT

roles/os_hardening/templates/etc/systemd/coredump.conf.d/coredumps.conf.j2

@@ -0,0 +1,2 @@
+[Coredump]
+Storage=none

roles/os_hardening/vars/Amazon.yml

@@ -45,8 +45,4 @@ auditd_package: 'audit'
 # system accounts that do not get their login disabled and pasword changed
 os_always_ignore_users: ['root', 'sync', 'shutdown', 'halt', 'ec2-user']
 
-sysctl_rhel_config:
-  # ExecShield protection against buffer overflows
-  kernel.exec-shield: 1
-
 hidepid_option: '2'  # allowed values: 0, 1, 2

roles/os_hardening/vars/Archlinux.yml

@@ -33,3 +33,9 @@ modprobe_package: 'kmod'
 auditd_package: 'audit'
 
 hidepid_option: '2'  # allowed values: 0, 1, 2
+
+sysctl_custom_config:
+  # Mitigation of vulnerability CVE-2021-33909
+  kernel.unprivileged_userns_clone: 0
+  # Mitigation of vulnerability CVE-2021-33910
+  kernel.unprivileged_bpf_disabled: 1

roles/os_hardening/vars/Debian.yml

@@ -43,3 +43,9 @@ tally2_path: '/usr/share/pam-configs/tally2'
 passwdqc_path: '/usr/share/pam-configs/passwdqc'
 
 hidepid_option: '2'  # allowed values: 0, 1, 2
+
+sysctl_custom_config:
+  # Mitigation of vulnerability CVE-2021-33909
+  kernel.unprivileged_userns_clone: 0
+  # Mitigation of vulnerability CVE-2021-33910
+  kernel.unprivileged_bpf_disabled: 1