test ctrl alt del disablement in molecule

Signed-off-by: Sebastian Gumprich <[email protected]>
2023-04-28 15:39:17 +02:00
31 changed files with 44 additions and 156 deletions
@@ -12,6 +12,3 @@ exclude_paths:
 mock_roles:
  - geerlingguy.git
  - nginxinc.nginx
-
-skip_list:
-  - var-naming[no-role-prefix]
@@ -45,7 +45,6 @@ jobs:
          - ubuntu2204
          - debian10
          - debian11
-          - debian12
          # - amazon  # geerlingguy.mysql does not support fedora
          # - arch  # geerlingguy.mysql does not support arch
          - opensuse_tumbleweed
@@ -44,7 +44,6 @@ jobs:
          - ubuntu2204
          - debian10
          - debian11
-          - debian12
          - amazon2023
          # - arch  # needs to be fixed
          # - opensuse_tumbleweed  # needs to be fixed
@@ -39,14 +39,12 @@ jobs:
          - centosstream9
          - rocky8
          - rocky9
-          - fedora37
-          - fedora38
+          - fedora
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
          - debian10
          - debian11
-          - debian12
          - amazon2023
          - opensuse_tumbleweed
          - arch
@@ -39,14 +39,13 @@ jobs:
          - centos9s
          - rocky8
          - rocky9
+          - fedora36
          - fedora37
-          - fedora38
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
          - debian10
          - debian11
-          - debian12
          - opensuse15
          # - arch  # needs fix for audit
    steps:
@@ -39,14 +39,12 @@ jobs:
          - centosstream9
          - rocky8
          - rocky9
-          - fedora37
-          - fedora38
+          - fedora
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
          - debian10
          - debian11
-          - debian12
          - amazon2023
          - arch
          # - opensuse_tumbleweed  # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
@@ -39,14 +39,12 @@ jobs:
          - centosstream9
          - rocky8
          - rocky9
-          - fedora37
-          - fedora38
+          - fedora
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
          - debian10
          - debian11
-          - debian12
          - amazon2023
          - arch
          # - opensuse_tumbleweed  # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
@@ -1,32 +1,15 @@
 # Changelog

-## [8.8.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.8.0) (2023-06-20)
+## [8.7.1](https://github.com/dev-sec/ansible-collection-hardening/tree/8.7.1) (2023-04-28)

-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.7.0...8.8.0)
-
-**Implemented enhancements:**
-
- Add support for Fedora 38 [\#671](https://github.com/dev-sec/ansible-collection-hardening/issues/671)
- feat: explicitly support Fedora 37 and 38 [\#682](https://github.com/dev-sec/ansible-collection-hardening/pull/682) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([nejch](https://github.com/nejch))
- Replace ssh\_keys group with root, where applicable and use less permissive file mode [\#677](https://github.com/dev-sec/ansible-collection-hardening/pull/677) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
- Add oddjob mkhomedir option rhel pam [\#675](https://github.com/dev-sec/ansible-collection-hardening/pull/675) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([imp1sh](https://github.com/imp1sh))
-
-**Fixed bugs:**
-
- Error: No file was found when using first\_found on Ubuntu 20.04 [\#676](https://github.com/dev-sec/ansible-collection-hardening/issues/676)
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.7.0...8.7.1)

 **Closed issues:**

-  `Ensure permissions on mysql-logfile are correct` chokes when `log_error` is set to `stderr` [\#673](https://github.com/dev-sec/ansible-collection-hardening/issues/673)
- TASK TASK FAILED: \[devsec.hardening.os\_hardening : Set password ageing for existing regular \(non-system, non-root\) accounts\]  [\#670](https://github.com/dev-sec/ansible-collection-hardening/issues/670)
- After os\_hardening ssh not working  [\#663](https://github.com/dev-sec/ansible-collection-hardening/issues/663)
 - Unsupported parameters for \(ansible.builtin.user\) module [\#650](https://github.com/dev-sec/ansible-collection-hardening/issues/650)

 **Merged pull requests:**

- setting gets ignored [\#680](https://github.com/dev-sec/ansible-collection-hardening/pull/680) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
- add var-naming\[no-role-prefix\] to skip-list [\#679](https://github.com/dev-sec/ansible-collection-hardening/pull/679) ([rndmh3ro](https://github.com/rndmh3ro))
- expand on check conditions for non-file locations of logs [\#674](https://github.com/dev-sec/ansible-collection-hardening/pull/674) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([whysthatso](https://github.com/whysthatso))
 - use new molecule-plugins [\#667](https://github.com/dev-sec/ansible-collection-hardening/pull/667) ([schurzi](https://github.com/schurzi))
 - add spellchecking with codespell [\#662](https://github.com/dev-sec/ansible-collection-hardening/pull/662) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))

@@ -11,13 +11,13 @@
 This collection provides battle tested hardening for:

 - Linux operating systems:
-  - CentOS 7/8/9
-  - Rocky Linux 8/9
-  - Debian 10/11/12
+  - CentOS 7
+  - Rocky Linux 8
+  - Debian 10/11
  - Ubuntu 18.04/20.04/22.04
  - Amazon Linux (some roles supported)
  - Arch Linux (some roles supported)
-  - Fedora 37/38 (some roles supported)
+  - Fedora (some roles supported)
  - Suse Tumbleweed (some roles supported)
 - MySQL
  - MariaDB >= 5.5.65, >= 10.1.45, >= 10.3.17
@@ -33,6 +33,7 @@
    os_netrc_enabled: false
    os_ignore_users: ["shell_sys_acc"]
    os_ignore_home_folder_users: ["user_with_777_home"]
+    os_ctrlaltdel_disabled: true
    sysctl_config:
      net.ipv4.ip_forward: 0
      net.ipv6.conf.all.forwarding: 0
@@ -7,10 +7,6 @@
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
-    - name: set ansible_python_interpreter to "/usr/bin/python3"
-      set_fact:
-        ansible_python_interpreter: "/usr/bin/python3"
-
    - name: include verification tasks
      ansible.builtin.include_tasks:
        file: "{{ item }}"
@@ -1,17 +1,9 @@
 ---
-
- name: install pip
-  package:
-    name:
-      - python3-pip
-      - python3-setuptools
-    state: present
-
- name: install pam-tester
-  ansible.builtin.pip:
-    name: pam-tester
-    state: present
-    executable: /usr/bin/pip3
+- name: download pam-tester
+  get_url:
+    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
+    dest: /bin/pam-tester
+    mode: 0555

 - name: set password for test
  set_fact:
@@ -31,7 +23,7 @@

 - name: check successful login with correct password
  shell:
-    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -39,7 +31,7 @@

 - name: check unsuccessful login with incorrect password
  shell:
-    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -48,7 +40,7 @@

 - name: check unsuccessful login, with correct password (lockout)
  shell:
-    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail"
+    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -60,7 +52,7 @@

 - name: check successful login
  shell:
-    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -21,3 +21,4 @@
    os_yum_repo_file_whitelist: ['foo.repo']
    os_mnt_boot_enabled: true
    os_mnt_boot_src: "/dev/vda1"
+    os_ctrlaltdel_disabled: true
@@ -1,15 +1,9 @@
 ---
- name: install pip
-  package:
-    name:
-      - python3-pip
-      - python3-setuptools
-    state: present
-
- name: install pam-tester
-  ansible.builtin.pip:
-    name: pam-tester
-    state: present
+- name: download pam-tester
+  get_url:
+    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
+    dest: /bin/pam-tester
+    mode: 0555

 - name: set password for test
  set_fact:
@@ -27,11 +27,7 @@
    owner: "{{ mysql_hardening_user }}"
    group: "{{ mysql_hardening_group }}"
    mode: "0640"
-  when:
-    - item is defined
-    - item != ""
-    - item != "stderr"
-    - item != "stdout"
+  when: item is defined and item != ""
  loop:
    - "{{ mysql_settings.settings.log_error }}"
    - '{{ mysql_hardening_log_file | default("") }}'
@@ -134,9 +134,6 @@ We know that this is the case on Raspberry Pi.
 - `os_auth_pam_sssd_enable`
  - Default: `false` (on RHEL8/CentOS8/Fedora `true`)
  - Description: activate PAM auth support for sssd
- `os_auth_pam_oddjob_mkhomedir`
-  - Default: `false`
-  - Description: Enables automatic homedir e.g. in FreeIPA environments
 - `os_security_users_allow`
  - Default: `[]`
  - Description: list of things, that a user is allowed to do. May contain `change_user`.
@@ -9,7 +9,6 @@ os_auth_retries: 5
 os_auth_lockout_time: 600 # Seconds (600 = 10min)
 os_auth_timeout: 60
 os_auth_allow_homeless: false
-os_auth_pam_oddjob_mkhomedir: false
 os_auth_pam_passwdqc_enable: true
 os_auth_pam_passwdqc_options: min=disabled,disabled,16,12,8 # Used in Debian
 os_auth_pam_pwquality_options: try_first_pass retry=3 authtok_type= # Used in RHEL7 and RHEL8
@@ -47,9 +47,6 @@ password    required      pam_deny.so
 session     optional      pam_keyinit.so revoke
 session     required      pam_limits.so
 -session    optional      pam_systemd.so
-{% if (os_auth_pam_oddjob_mkhomedir | bool) %}
-session     optional      pam_oddjob_mkhomedir.so
-{% endif %}
 session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
 session     required      pam_unix.so
 {% if (os_auth_pam_sssd_enable | bool) %}
@@ -8,6 +8,16 @@
    force: false
    regenerate: partial_idempotence

+# In RHEL and Fedora, the 'ssh_keys' group is the group owner of the host private SSH keys.
+# Since the openssh_keypair module needs to read the key to provide idempotency, we need to set ownership and group based on specific OS vars.
+- name: Change host private key ownership, group and permissions
+  ansible.builtin.file:
+    path: "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
+    owner: "{{ ssh_host_keys_owner }}"
+    group: "{{ ssh_host_keys_group }}"
+    mode: "0640"
+  when: ansible_facts.os_family == 'RedHat'
+
 - name: Set hostkeys according to openssh-version if openssh >= 5.3
  ansible.builtin.set_fact:
    ssh_host_key_files:
@@ -28,11 +38,3 @@
      - "{{ ssh_host_keys_dir }}/ssh_host_ecdsa_key"
      - "{{ ssh_host_keys_dir }}/ssh_host_ed25519_key"
  when: sshd_version is version('6.3', '>=')
-
- name: Change host private key ownership, group and permissions
-  ansible.builtin.file:
-    path: "{{ item }}"
-    owner: "{{ ssh_host_keys_owner }}"
-    group: "{{ ssh_host_keys_group }}"
-    mode: "{{ ssh_host_keys_mode }}"
-  loop: "{{ ssh_host_key_files }}"
@@ -1,12 +1,11 @@
 ---
 sshd_path: /usr/sbin/sshd
-ssh_host_keys_dir: /etc/ssh
+ssh_host_keys_dir: '/etc/ssh'
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root
-ssh_host_keys_owner: root
-ssh_host_keys_group: ssh_keys
-ssh_host_keys_mode: "0600"
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'ssh_keys'
 ssh_selinux_packages:
  - policycoreutils-python
  - checkpolicy
@@ -17,7 +16,7 @@ ssh_kerberos_support: true
 # true if SSH has PAM support
 ssh_pam_support: true

-sshd_moduli_file: /etc/ssh/moduli
+sshd_moduli_file: '/etc/ssh/moduli'

 # disable CRYPTO_POLICY to take settings from sshd configuration
 # see: https://access.redhat.com/solutions/4410591
@@ -6,7 +6,6 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: root
-ssh_host_keys_mode: "0600"

 # true if SSH support Kerberos
 ssh_kerberos_support: true
@@ -6,7 +6,6 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: root
-ssh_host_keys_mode: "0600"
 ssh_selinux_packages:
  - policycoreutils-python
  - checkpolicy
@@ -5,8 +5,7 @@ sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
-ssh_host_keys_group: root
-ssh_host_keys_mode: "0600"
+ssh_host_keys_group: ssh_keys
 ssh_selinux_packages:
  - python3-policycoreutils
  - checkpolicy
@@ -1,24 +0,0 @@
---
-sshd_path: /usr/sbin/sshd
-ssh_host_keys_dir: /etc/ssh
-sshd_service_name: sshd
-ssh_owner: root
-ssh_group: root
-ssh_host_keys_owner: root
-ssh_host_keys_group: ssh_keys
-ssh_host_keys_mode: "0600"
-ssh_selinux_packages:
-  - python3-policycoreutils
-  - checkpolicy
-
-# true if SSH support Kerberos
-ssh_kerberos_support: true
-
-# true if SSH has PAM support
-ssh_pam_support: true
-
-sshd_moduli_file: /etc/ssh/moduli
-
-# disable CRYPTO_POLICY to take settings from sshd configuration
-# see: https://access.redhat.com/solutions/4410591
-sshd_disable_crypto_policy: true
@@ -5,8 +5,7 @@ sshd_service_name: sshd
 ssh_owner: root
 ssh_group: wheel
 ssh_host_keys_owner: root
-ssh_host_keys_group: wheel
-ssh_host_keys_mode: "0600"
+ssh_host_keys_group: root

 # true if SSH support Kerberos
 ssh_kerberos_support: true
@@ -5,8 +5,7 @@ sshd_service_name: sshd
 ssh_owner: root
 ssh_group: wheel
 ssh_host_keys_owner: root
-ssh_host_keys_group: wheel
-ssh_host_keys_mode: "0600"
+ssh_host_keys_group: root

 # true if SSH support Kerberos
 ssh_kerberos_support: false
@@ -6,7 +6,6 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: ssh_keys
-ssh_host_keys_mode: "0600"
 ssh_selinux_packages:
  - policycoreutils-python-utils
  - checkpolicy
@@ -6,7 +6,6 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: ssh_keys
-ssh_host_keys_mode: "0600"
 ssh_selinux_packages:
  - policycoreutils-python
  - checkpolicy
@@ -1,24 +0,0 @@
---
-sshd_path: /usr/sbin/sshd
-ssh_host_keys_dir: /etc/ssh
-sshd_service_name: sshd
-ssh_owner: root
-ssh_group: root
-ssh_host_keys_owner: root
-ssh_host_keys_group: root
-ssh_host_keys_mode: "0600"
-ssh_selinux_packages:
-  - policycoreutils-python-utils
-  - checkpolicy
-
-# true if SSH support Kerberos
-ssh_kerberos_support: true
-
-# true if SSH has PAM support
-ssh_pam_support: true
-
-sshd_moduli_file: /etc/ssh/moduli
-
-# disable CRYPTO_POLICY to take settings from sshd configuration
-# see: https://access.redhat.com/solutions/4410591
-sshd_disable_crypto_policy: true
@@ -6,7 +6,6 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: root
-ssh_host_keys_mode: "0600"

 # true if SSH support Kerberos
 ssh_kerberos_support: true
@@ -6,7 +6,6 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: root
-ssh_host_keys_mode: "0600"

 # true if SSH support Kerberos
 ssh_kerberos_support: true