Merge pull request #530 from dev-sec/delete_drafts

delete obsolete release drafts

.github/workflows/ansible-lint.yml

@@ -30,6 +30,8 @@ jobs:
         # override-deps: |
         #   ansible==2.9
         #   ansible-lint==4.2.0
+        override-deps: |
+           rich>=9.5.1,<11.0.0
         # [optional]
         # Arguments to be passed to the ansible-lint
 

.github/workflows/mysql_hardening.yml

@@ -23,7 +23,6 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
-          - centos8
           - rocky8
           - ubuntu1804
           - ubuntu2004

.github/workflows/nginx_hardening.yml

@@ -23,7 +23,6 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
-          - centos8
           - rocky8
           - ubuntu1804
           - ubuntu2004

.github/workflows/os_hardening.yml

@@ -23,7 +23,6 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
-          - centos8
           - rocky8
           - ubuntu1804
           - ubuntu2004

.github/workflows/release.yml

@@ -66,6 +66,11 @@ jobs:
         with:
           path: ./CHANGELOGRELEASE.md
 
+      - name: Delete old drafts
+        uses: hugo19941994/[email protected]
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Create Release draft
         id: create_release
         uses: actions/create-release@v1

.github/workflows/ssh_hardening.yml

@@ -23,7 +23,6 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
-          - centos8
           - rocky8
           - fedora
           - ubuntu1804

.github/workflows/ssh_hardening_custom_tests.yml

@@ -23,7 +23,6 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
-          - centos8
           - rocky8
           - fedora
           - ubuntu1804

CHANGELOG.md

@@ -1,5 +1,61 @@
 # Changelog
 
+## [7.14.2](https://github.com/dev-sec/ansible-collection-hardening/tree/7.14.2) (2022-02-21)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.1...7.14.2)
+
+**Fixed bugs:**
+
+- debian 9's nginx doesn't support tls1.3 [\#526](https://github.com/dev-sec/ansible-collection-hardening/pull/526) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Change permissions of the tmout.sh file [\#520](https://github.com/dev-sec/ansible-collection-hardening/pull/520) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([abejotaR](https://github.com/abejotaR))
+
+**Closed issues:**
+
+- No such file directory error triggered by the  kernel.unpriviliged\_userns\_clone configuration. [\#514](https://github.com/dev-sec/ansible-collection-hardening/issues/514)
+
+**Merged pull requests:**
+
+- add waivers to skip controls [\#529](https://github.com/dev-sec/ansible-collection-hardening/pull/529) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- remove centos8 tests [\#525](https://github.com/dev-sec/ansible-collection-hardening/pull/525) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.14.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.14.1) (2022-02-18)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.0...7.14.1)
+
+**Fixed bugs:**
+
+- move sysctls to debian specific vars [\#524](https://github.com/dev-sec/ansible-collection-hardening/pull/524) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Closed issues:**
+
+- Error when using the ssh\_hardening role [\#519](https://github.com/dev-sec/ansible-collection-hardening/issues/519)
+
+## [7.14.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.14.0) (2021-12-16)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.13.2...7.14.0)
+
+**Implemented enhancements:**
+
+- Add option to set timeout in seconds to logout users [\#516](https://github.com/dev-sec/ansible-collection-hardening/pull/516) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lbayerlein](https://github.com/lbayerlein))
+- add feature to disable coredump to limit task [\#511](https://github.com/dev-sec/ansible-collection-hardening/pull/511) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lbayerlein](https://github.com/lbayerlein))
+- change hidepid mount task state to mounted [\#510](https://github.com/dev-sec/ansible-collection-hardening/pull/510) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([alegrey91](https://github.com/alegrey91))
+- prettify nginx options [\#509](https://github.com/dev-sec/ansible-collection-hardening/pull/509) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Update nginx\_add\_header README to match default [\#506](https://github.com/dev-sec/ansible-collection-hardening/pull/506) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([duffn](https://github.com/duffn))
+- Updated dh\_params to 4096 [\#501](https://github.com/dev-sec/ansible-collection-hardening/pull/501) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([ksaadDE](https://github.com/ksaadDE))
+
+**Fixed bugs:**
+
+- Duplication of sysctl default parameter fs.protected\_hardlinks and fs.protected\_symlinks [\#502](https://github.com/dev-sec/ansible-collection-hardening/issues/502)
+- Fix duplicate sysctl config in fs [\#505](https://github.com/dev-sec/ansible-collection-hardening/pull/505) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([tekicat](https://github.com/tekicat))
+
+**Merged pull requests:**
+
+- Feature coredump [\#513](https://github.com/dev-sec/ansible-collection-hardening/pull/513) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.13.2](https://github.com/dev-sec/ansible-collection-hardening/tree/7.13.2) (2021-11-23)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.13.1...7.13.2)
+
 ## [7.13.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.13.1) (2021-11-23)
 
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.13.0...7.13.1)

galaxy.yml

@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 7.12.0
+version: 7.14.1
 readme: README.md
 authors:
   - dev-sec <[email protected]>

molecule/os_hardening/converge.yml

@@ -16,7 +16,7 @@
         name: os_hardening
   vars:
     os_security_users_allow: change_user
-    os_security_kernel_enable_core_dump: true
+    os_security_kernel_enable_core_dump: false
     os_security_suid_sgid_remove_from_unknown: true
     os_auth_pam_passwdqc_enable: false
     os_auth_lockout_time: 15

molecule/os_hardening/verify.yml

@@ -55,7 +55,7 @@
       shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
 
     - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit  --waiver-file waivers.yaml https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
       register: test_results
       changed_when: false
       ignore_errors: true

molecule/os_hardening/waivers.yaml

@@ -0,0 +1,3 @@
+os-14:
+  run: false
+  justification: "not yet implemented"

roles/nginx_hardening/README.md

@@ -61,8 +61,8 @@ It works with the following nginx-roles, including, but not limited to:
   - Default: `default 5`
   - Description: Sets the shared memory zone and the maximum allowed number of connections for a given key value.
 - [nginx_add_header][]
-  - Default: `[ "X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"" ]`
-  - Description:Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307.
+  - Default: `[ "X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"", Content-Security-Policy \"script-src 'self'; object-src 'self'\" ]`
+  - Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307.
 - [nginx_ssl_protocols][]
   - Default: `TLSv1.2`
   - Description: Specifies the SSL protocol which should be used.

roles/nginx_hardening/defaults/main.yml

@@ -11,19 +11,18 @@ nginx_client_header_timeout: "10"
 nginx_send_timeout: "10"
 nginx_limit_conn_zone: "$binary_remote_addr zone=default:10m"
 nginx_limit_conn: "default 5"
-nginx_add_header: [
-# vvoid clickjacking
-"X-Frame-Options SAMEORIGIN",
-# disable content-type sniffing
-"X-Content-Type-Options nosniff",
-# XSS filter
-"X-XSS-Protection \"1; mode=block\"",
-"Strict-Transport-Security max-age=15768000",
-"Content-Security-Policy \"script-src 'self'; object-src 'self'\"" ]
+nginx_add_header:
+  # avoid clickjacking
+  - X-Frame-Options SAMEORIGIN
+  # disable content-type sniffing
+  - X-Content-Type-Options nosniff
+  # XSS filter
+  - X-XSS-Protection "1; mode=block"
+  - Strict-Transport-Security max-age=15768000
+  - Content-Security-Policy "script-src 'self'; object-src 'self'"
 
 nginx_set_cookie_flag: "* HttpOnly secure"
 nginx_ssl_prefer_server_ciphers: "on"
-nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
 nginx_ssl_ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
 nginx_ssl_session_tickets: "off"
-nginx_dh_size: "2048"
+nginx_dh_size: "4096"

roles/nginx_hardening/tasks/main.yml

@@ -1,4 +1,27 @@
 ---
+- name: Fetch OS dependent variables
+  include_vars:
+    file: '{{ item }}'
+    name: 'os_vars'
+  with_first_found:
+    - files:
+        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - '{{ ansible_facts.distribution }}.yml'
+        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - '{{ ansible_facts.os_family }}.yml'
+      skip: true
+  tags: always
+
+# we only override variables with our default, if they have not been specified already
+# by default the lookup functions finds all varnames containing the string, therefore
+# we add ^ and $ to denote start and end of string, so this returns only exact matches
+- name: Set OS dependent variables, if not already defined by user  # noqa var-naming
+  set_fact:
+    '{{ item.key }}': '{{ item.value }}'
+  when: "not lookup('varnames', '^' + item.key + '$')"
+  with_dict: '{{ os_vars }}'
+  tags: always
+
 - name: Create additional configuration
   template:
     src: "hardening.conf.j2"

roles/nginx_hardening/vars/Amazon.yml

@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"

roles/nginx_hardening/vars/Archlinux.yml

@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"

roles/nginx_hardening/vars/Debian.yml

@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"

roles/nginx_hardening/vars/Debian_9.yml

@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2"

roles/nginx_hardening/vars/Fedora.yml

@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"

roles/nginx_hardening/vars/RedHat.yml

@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"

roles/nginx_hardening/vars/Suse.yml

@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"

roles/nginx_hardening/vars/main.yml

@@ -1 +0,0 @@
----

roles/os_hardening/README.md

@@ -250,6 +250,9 @@ We know that this is the case on Raspberry Pi.
 - `os_profile_enabled`
   - Default: `true`
   - Description: Set to false to disable installing and configuring profile.
+- `os_security_auto_logout`
+  - Default: `0`
+  - Description: Set timeout in seconds for logout users automatically after time. Setting this to `0` disables the timeout.
 - `os_securetty_enabled`
   - Default: `true`
   - Description: Set to false to disable installing and configuring securetty.

roles/os_hardening/defaults/main.yml

@@ -70,6 +70,12 @@ sysctl_config:
   fs.protected_hardlinks: 1
   fs.protected_symlinks: 1
 
+  # For more info on the following settings see: https://www.kernel.org/doc/html/latest/admin-guide/sysctl/fs.html
+  # Restrict FIFO special device creation behavior
+  fs.protected_fifos: 1
+  # Restrict regular files creation behavior
+  fs.protected_regular: 2
+
   # Prevent core dumps with SUID. These are usually only
   # needed by developers and may contain sensitive information. | sysctl-31
   fs.suid_dumpable: 0
@@ -282,24 +288,6 @@ sysctl_config:
   vm.mmap_rnd_bits: 32
   vm.mmap_rnd_compat_bits: 16
 
-  # Disable unprivileged users from loading eBPF programs into the kernel.
-  # One of mitigations against CVE-2021-33909. | Tail-2
-  kernel.unprivileged_bpf_disabled: 1
-
-  # Reduce attack surface by disabling unprivileged user namespaces.
-  # Mitigates CVE-2021-33909 and other exploits.
-  kernel.unprivileged_userns_clone: 0
-
-  # For more info on the following settings see: https://www.kernel.org/doc/html/latest/admin-guide/sysctl/fs.html
-  # Restrict FIFO special device creation behavior
-  fs.protected_fifos: 1
-  # Restrict hardlink creation behavior
-  fs.protected_hardlinks: 1
-  # Restrict regular files creation behavior
-  fs.protected_regular: 2
-  # Restrict symlink following behavior
-  fs.protected_symlinks: 1
-
 # Do not delete the following line or otherwise the playbook will fail
 # at task 'create a combined sysctl-dict if overwrites are defined'
 sysctl_overwrite:
@@ -368,6 +356,9 @@ os_profile_enabled: true
 # Set to false to disable installing and configuring securetty.
 os_securetty_enabled: true
 
+# Set timeout in seconds for logout users automatically after time. Setting this to `0` disables the timeout.
+os_security_auto_logout: 0
+
 # Set to false to disable installing and configuring sysctl.
 os_sysctl_enabled: true
 

roles/os_hardening/handlers/main.yml

@@ -7,3 +7,7 @@
     cmd: 'service auditd restart'  # rhel: see: https://access.redhat.com/solutions/2664811
     warn: false  # sadly 'service' module fails in that case also by using 'use: service'
   when: molecule_yml is not defined  # restarting auditd in a container does not work
+
+- name: Reload systemd
+  systemd:
+    daemon_reload: yes

roles/os_hardening/tasks/limits.yml

@@ -1,5 +1,6 @@
 ---
-- block:
+- name: disable coredumps
+  block:
   - name: Create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
     file:
       path: '/etc/security/limits.d'
@@ -27,10 +28,38 @@
       modification_time: preserve
       access_time: preserve
 
+  - name: create coredump.conf.d-directory if it does not exist
+    file:
+      path: '/etc/systemd/coredump.conf.d'
+      owner: root
+      group: root
+      mode: 0755
+      state: directory
+    when: ansible_service_mgr == "systemd"
+
+  - name: create custom.conf for disabling coredumps
+    template:
+      src: 'etc/systemd/coredump.conf.d/coredumps.conf.j2'
+      dest: '/etc/systemd/coredump.conf.d/custom.conf'
+      owner: root
+      group: root
+      mode: 0644
+    when: ansible_service_mgr == "systemd"
+    notify: Reload systemd
+
   when: not os_security_kernel_enable_core_dump | bool
 
-- name: Remove 10.hardcore.conf config file
-  file:
-    path: /etc/security/limits.d/10.hardcore.conf
-    state: absent
+- name: enable coredumps
+  block:
+  - name: Remove coredump.conf.d directory with files
+    file:
+      path: /etc/systemd/coredump.conf.d
+      state: absent
+    when: ansible_service_mgr == "systemd"
+    notify: Reload systemd
+
+  - name: Remove 10.hardcore.conf config file
+    file:
+      path: /etc/security/limits.d/10.hardcore.conf
+      state: absent
   when: os_security_kernel_enable_core_dump | bool

roles/os_hardening/tasks/minimize_access.yml

@@ -79,4 +79,4 @@
     src: proc
     fstype: proc
     opts: '{{ proc_mnt_options }}'
-    state: present
+    state: mounted

roles/os_hardening/tasks/profile.yml

@@ -13,3 +13,11 @@
     path: /etc/profile.d/pinerolo_profile.sh
     state: absent
   when: os_security_kernel_enable_core_dump | bool
+
+- name: Add autologout to profile env
+  template:
+    src: 'etc/profile.d/tmout.sh.j2'
+    dest: '/etc/profile.d/tmout.sh'
+    owner: 'root'
+    group: 'root'
+    mode: '0644'

roles/os_hardening/tasks/sysctl.yml

@@ -43,6 +43,17 @@
 
 - name: Change sysctls
   block:
+    - name: Create a combined sysctl-dict if os-dependent sysctls are defined
+      set_fact:
+        sysctl_config: '{{ sysctl_config | combine(sysctl_custom_config) }}'
+      when: sysctl_custom_config | default()
+
+    # sysctl_rhel_config is kept for backwards-compatibility. use sysctl_custom_config instead
+    - name: Create a combined sysctl-dict if os-dependent sysctls are defined
+      set_fact:
+        sysctl_config: '{{ sysctl_config | combine(sysctl_rhel_config) }}'
+      when: sysctl_rhel_config | default()
+
     - name: Create a combined sysctl-dict if overwrites are defined
       set_fact:
         sysctl_config: '{{ sysctl_config | combine(sysctl_overwrite) }}'
@@ -57,17 +68,6 @@
         reload: true
         ignoreerrors: true
       with_dict: '{{ sysctl_config }}'
-
-    - name: Change various sysctl-settings on Amazon Linux, look at the sysctl-vars file for documentation
-      sysctl:
-        name: '{{ item.key }}'
-        value: '{{ item.value }}'
-        state: present
-        reload: true
-        ignoreerrors: true
-      with_dict: '{{ sysctl_rhel_config }}'
-      when: ansible_facts.distribution == 'Amazon'
-
   when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']
 
 - name: Apply ufw defaults

roles/os_hardening/templates/etc/profile.d/tmout.sh.j2

@@ -0,0 +1,3 @@
+# Logout Timeout
+export TMOUT={{ os_security_auto_logout }}
+readonly TMOUT

roles/os_hardening/templates/etc/systemd/coredump.conf.d/coredumps.conf.j2

@@ -0,0 +1,2 @@
+[Coredump]
+Storage=none

roles/os_hardening/vars/Amazon.yml

@@ -45,8 +45,4 @@ auditd_package: 'audit'
 # system accounts that do not get their login disabled and pasword changed
 os_always_ignore_users: ['root', 'sync', 'shutdown', 'halt', 'ec2-user']
 
-sysctl_rhel_config:
-  # ExecShield protection against buffer overflows
-  kernel.exec-shield: 1
-
 hidepid_option: '2'  # allowed values: 0, 1, 2

roles/os_hardening/vars/Archlinux.yml

@@ -33,3 +33,9 @@ modprobe_package: 'kmod'
 auditd_package: 'audit'
 
 hidepid_option: '2'  # allowed values: 0, 1, 2
+
+sysctl_custom_config:
+  # Mitigation of vulnerability CVE-2021-33909
+  kernel.unprivileged_userns_clone: 0
+  # Mitigation of vulnerability CVE-2021-33910
+  kernel.unprivileged_bpf_disabled: 1

roles/os_hardening/vars/Debian.yml

@@ -43,3 +43,9 @@ tally2_path: '/usr/share/pam-configs/tally2'
 passwdqc_path: '/usr/share/pam-configs/passwdqc'
 
 hidepid_option: '2'  # allowed values: 0, 1, 2
+
+sysctl_custom_config:
+  # Mitigation of vulnerability CVE-2021-33909
+  kernel.unprivileged_userns_clone: 0
+  # Mitigation of vulnerability CVE-2021-33910
+  kernel.unprivileged_bpf_disabled: 1