Compare commits
6
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Sebastian Gumprich
|
a03ed7a771 | ||
|
Sebastian Gumprich
|
b771f52af1 | ||
|
Sebastian Gumprich
|
2bd0a0feae | ||
|
Sebastian Gumprich
|
561b59baee | ||
|
Sebastian Gumprich
|
d3b403436f | ||
|
Sebastian Gumprich
|
fc0a90608e |
No files matched your search
@@ -1,51 +0,0 @@
|
||||
output_template: |
|
||||
<!-- BEGIN_ANSIBLE_DOCS -->
|
||||
|
||||
## Supported Operating Systems
|
||||
|
||||
{%- for platform in metadata.galaxy_info.platforms %}
|
||||
- {{ platform.name }}
|
||||
{%- if "versions" in platform %}
|
||||
- {{ platform.versions | default([]) | join(', ') }}
|
||||
{%- endif %}
|
||||
{%- endfor %}
|
||||
|
||||
## Role Variables
|
||||
{% for entrypoint in argument_specs.keys() %}
|
||||
{%- set path, options=entrypoint_options[entrypoint][0] -%}
|
||||
{%- for name, details in options.items() |sort() %}
|
||||
- `{{ name }}`
|
||||
- Default: `{{ details.display_default }}`
|
||||
- Description: {{ details.display_description }}
|
||||
- Type: {{ details.display_type }}
|
||||
- Required: {{ details.display_required }}
|
||||
{%- if details.choices %}
|
||||
- Choices:
|
||||
{%- for choice in details.choices %}
|
||||
- {{ choice }}
|
||||
{%- endfor %}
|
||||
{%- endif %}
|
||||
{%- endfor %}
|
||||
{%- endfor %}
|
||||
|
||||
## Dependencies
|
||||
|
||||
{%- if ("dependencies" in metadata) and (metadata.dependencies | length > 0) %}
|
||||
{%- for dependency in metadata.dependencies %}
|
||||
- {{ dependency }}
|
||||
{%- endfor %}
|
||||
{%- else %}
|
||||
|
||||
None.
|
||||
{%- endif %}
|
||||
|
||||
## Example Playbook
|
||||
|
||||
```
|
||||
- hosts: all
|
||||
become: true
|
||||
roles:
|
||||
- name: {{ role }}
|
||||
```
|
||||
|
||||
<!-- END_ANSIBLE_DOCS -->
|
||||
@@ -4,16 +4,14 @@
|
||||
# and not relative to the CWD of execution. CLI arguments passed to the --exclude
|
||||
# option will be parsed relative to the CWD of execution.
|
||||
exclude_paths:
|
||||
- .cache/ # implicit unless exclude_paths is defined in config
|
||||
- .ansible/ # somehow someone decided that the cache directory should be renamed
|
||||
# add all waivers individually, since exclude_files does not support globs
|
||||
- molecule/os_hardening/waivers.yaml
|
||||
- molecule/ssh_hardening_vm/waivers_*.yaml
|
||||
- .cache/ # implicit unless exclude_paths is defined in config
|
||||
- .yamllint
|
||||
- ../molecule/
|
||||
- ../.github/
|
||||
|
||||
skip_list:
|
||||
- fqcn-builtins
|
||||
|
||||
mock_roles:
|
||||
- geerlingguy.git
|
||||
- nginxinc.nginx
|
||||
|
||||
skip_list:
|
||||
- var-naming[no-role-prefix]
|
||||
- meta-runtime[unsupported-version]
|
||||
@@ -0,0 +1,49 @@
|
||||
---
|
||||
name: Bug report
|
||||
about: Create a report to help us improve
|
||||
---
|
||||
|
||||
**Describe the bug**
|
||||
A clear and concise description of what the bug is.
|
||||
|
||||
**Expected behavior**
|
||||
A clear and concise description of what you expected to happen.
|
||||
|
||||
**Actual behavior**
|
||||
|
||||
<!--- Paste verbatim command output between quotes -->
|
||||
|
||||
```paste below
|
||||
|
||||
```
|
||||
|
||||
**Example Playbook**
|
||||
|
||||
<!--- Paste an example playbook that can be used to reproduce the problem between quotes -->
|
||||
|
||||
```paste below
|
||||
|
||||
```
|
||||
|
||||
**OS / Environment**
|
||||
|
||||
<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
|
||||
|
||||
**Ansible Version**
|
||||
|
||||
<!--- Paste verbatim output from "ansible --version" between quotes -->
|
||||
|
||||
```paste below
|
||||
|
||||
```
|
||||
|
||||
**Role Version**
|
||||
|
||||
<!--- Paste version of the role between quotes -->
|
||||
|
||||
```paste below
|
||||
|
||||
```
|
||||
|
||||
**Additional context**
|
||||
Add any other context about the problem here.
|
||||
@@ -1,97 +0,0 @@
|
||||
---
|
||||
# reference: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests
|
||||
name: "Bug report"
|
||||
description: "Create a report to help us improve."
|
||||
labels: [
|
||||
"bug"
|
||||
]
|
||||
body:
|
||||
- type: markdown
|
||||
attributes:
|
||||
value: |
|
||||
Reporting Bugs ld follow some simple rules:
|
||||
|
||||
- **Check**, if you can find similar bugs
|
||||
- **Describe** what is happening and what should happen
|
||||
- **Explain** how to reproduce the problem
|
||||
- **Add** more details and attachments
|
||||
- **Follow up**, if somebody is having questions or needs more details
|
||||
|
||||
- type: textarea
|
||||
id: description
|
||||
attributes:
|
||||
label: "Description"
|
||||
description: Describe the bug
|
||||
placeholder: A clear and concise description of what the bug is.
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: textarea
|
||||
id: reprod
|
||||
attributes:
|
||||
label: "Reproduction steps"
|
||||
render: Shell
|
||||
description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, no need for backticks.
|
||||
value: |
|
||||
...
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: textarea
|
||||
id: currentbehavior
|
||||
attributes:
|
||||
label: "Current Behavior"
|
||||
description: Please describe the results you received
|
||||
value: |
|
||||
...
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: textarea
|
||||
id: expectedbehavior
|
||||
attributes:
|
||||
label: "Expected Behavior"
|
||||
description: Please describe the results you expect
|
||||
value: |
|
||||
...
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: textarea
|
||||
id: os
|
||||
attributes:
|
||||
label: "OS / Environment"
|
||||
value: |
|
||||
Provide all relevant information below, e.g. target OS versions, network device firmware, etc.
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: textarea
|
||||
id: ansible
|
||||
attributes:
|
||||
label: "Ansible Version"
|
||||
render: Shell
|
||||
value: |
|
||||
Paste verbatim output from "ansible --version" between quotes. This will be automatically formatted into code, so no need for backticks.
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: textarea
|
||||
id: collection
|
||||
attributes:
|
||||
label: "Collection Version"
|
||||
render: Shell
|
||||
value: |
|
||||
Paste version of the collection. This will be automatically formatted into code, so no need for backticks.
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: textarea
|
||||
id: additional
|
||||
attributes:
|
||||
label: "Additional information"
|
||||
description: Please add information like the used software versions, outputs of logs, OS information, screenshots, etc. to enhance the report
|
||||
value: |
|
||||
...
|
||||
validations:
|
||||
required: false
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
name: Feature request
|
||||
about: Suggest an idea for this project
|
||||
---
|
||||
|
||||
**Is your feature request related to a problem? Please describe.**
|
||||
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
|
||||
|
||||
**Describe the solution you'd like**
|
||||
A clear and concise description of what you want to happen.
|
||||
|
||||
**Describe alternatives you've considered**
|
||||
A clear and concise description of any alternative solutions or features you've considered.
|
||||
|
||||
**Additional context**
|
||||
Add any other context or screenshots about the feature request here.
|
||||
@@ -1,55 +0,0 @@
|
||||
---
|
||||
# reference: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests
|
||||
name: "Feature request"
|
||||
description: "Suggest an idea for this project."
|
||||
labels: [
|
||||
"enhancement"
|
||||
]
|
||||
body:
|
||||
- type: markdown
|
||||
attributes:
|
||||
value: |
|
||||
Requesting a new feature or enhancement is following some simple rules:
|
||||
|
||||
- **Check**, if the feature is already requested
|
||||
- **Describe** what your feature will bring to the community
|
||||
- **Explain** the criteria to fulfill the request
|
||||
- **Add** more details like mock ups, attachments, lists, screenshots
|
||||
- **Follow Up** in the discussion to the feature
|
||||
|
||||
- type: textarea
|
||||
id: description
|
||||
attributes:
|
||||
label: "Description"
|
||||
description: Is your feature request related to a problem? Please describe.
|
||||
placeholder: A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: textarea
|
||||
id: solution
|
||||
attributes:
|
||||
label: "Solution"
|
||||
description: Describe the solution you'd like
|
||||
placeholder: A clear and concise description of what you want to happen.
|
||||
validations:
|
||||
required: false
|
||||
|
||||
- type: textarea
|
||||
id: alternatives
|
||||
attributes:
|
||||
label: "Alternatives"
|
||||
description: Describe alternatives you've considered
|
||||
placeholder: A clear and concise description of any alternative solutions or features you've considered.
|
||||
validations:
|
||||
required: false
|
||||
|
||||
- type: textarea
|
||||
id: additional
|
||||
attributes:
|
||||
label: "Additional information"
|
||||
description: Add any other context or screenshots about the feature request here.
|
||||
value: |
|
||||
...
|
||||
validations:
|
||||
required: false
|
||||
@@ -0,0 +1,12 @@
|
||||
---
|
||||
# To get started with Dependabot version updates, you'll need to specify which
|
||||
# package ecosystems to update and where the package manifests are located.
|
||||
# Please see the documentation for all configuration options:
|
||||
# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
|
||||
|
||||
version: 2
|
||||
updates:
|
||||
- package-ecosystem: "pip" # See documentation for possible values
|
||||
directory: "/" # Location of package manifests
|
||||
schedule:
|
||||
interval: "daily"
|
||||
+14
-22
@@ -1,30 +1,22 @@
|
||||
---
|
||||
mysql_hardening:
|
||||
- changed-files:
|
||||
- any-glob-to-any-file:
|
||||
- roles/mysql_hardening/**
|
||||
- molecule/mysql_hardening/**
|
||||
- .github/workflows/mysql_hardening.yml
|
||||
- 'roles/mysql_hardening/**'
|
||||
- 'molecule/mysql_hardening/**'
|
||||
- '.github/workflows/mysql_hardening.yml'
|
||||
|
||||
os_hardening:
|
||||
- changed-files:
|
||||
- any-glob-to-any-file:
|
||||
- roles/os_hardening/**
|
||||
- molecule/os_hardening/**
|
||||
- .github/workflows/os_hardening.yml
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening/**'
|
||||
- '.github/workflows/os_hardening.yml'
|
||||
|
||||
ssh_hardening:
|
||||
- changed-files:
|
||||
- any-glob-to-any-file:
|
||||
- roles/ssh_hardening/**
|
||||
- molecule/ssh_hardening/**
|
||||
- molecule/ssh_hardening_custom_tests/**
|
||||
- .github/workflows/ssh_hardening.yml
|
||||
- .github/workflows/ssh_hardening_custom_tests.yml
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_custom_tests/**'
|
||||
- '.github/workflows/ssh_hardening.yml'
|
||||
- '.github/workflows/ssh_hardening_custom_tests.yml'
|
||||
|
||||
nginx_hardening:
|
||||
- changed-files:
|
||||
- any-glob-to-any-file:
|
||||
- roles/nginx_hardening/**
|
||||
- molecule/nginx_hardening/**
|
||||
- .github/workflows/nginx_hardening.yml
|
||||
- 'roles/nginx_hardening/**'
|
||||
- 'molecule/nginx_hardening/**'
|
||||
- '.github/workflows/nginx_hardening.yml'
|
||||
@@ -1,3 +0,0 @@
|
||||
major-labels: ['major']
|
||||
minor-labels: ['minor', 'enhancement']
|
||||
patch-labels: ['patch', 'bug']
|
||||
@@ -5,28 +5,20 @@ on: # yamllint disable-line rule:truthy
|
||||
# Run CI against all pushes (direct commits, also merged PRs), Pull Requests
|
||||
push:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/**'
|
||||
- 'molecule/**'
|
||||
- 'requirements.txt'
|
||||
- '.github/workflows/ansible-lint.yml'
|
||||
- '.config/ansible-lint.yml'
|
||||
pull_request:
|
||||
# The branches below must be a subset of the branches above
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/**'
|
||||
- 'molecule/**'
|
||||
- 'requirements.txt'
|
||||
- '.github/workflows/ansible-lint.yml'
|
||||
- '.config/ansible-lint.yml'
|
||||
|
||||
jobs:
|
||||
ansible-lint:
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
# Important: This sets up your GITHUB_WORKSPACE environment variable
|
||||
- uses: actions/checkout@v3
|
||||
|
||||
- name: Lint Ansible Playbook
|
||||
uses: ansible/ansible-lint@5fac056c45595896c973fbde871f01f6cb14d74c # v26
|
||||
# replace "master" with any valid ref
|
||||
uses: ansible/ansible-lint-action@main
|
||||
with:
|
||||
path: "roles/"
|
||||
@@ -1,14 +0,0 @@
|
||||
---
|
||||
name: Codespell - Spellcheck
|
||||
|
||||
on: # yamllint disable-line rule:truthy
|
||||
push:
|
||||
branches: [master]
|
||||
pull_request:
|
||||
branches: [master]
|
||||
|
||||
jobs:
|
||||
codespell:
|
||||
uses: "dev-sec/.github/.github/workflows/codespell.yml@2cd00282cfdb322243d879a96d9494ce64e76119" # main
|
||||
with:
|
||||
ignore_words_list: "chage,BOOTUP"
|
||||
@@ -4,16 +4,11 @@ name: "Enforce PR labels"
|
||||
on: # yamllint disable-line rule:truthy
|
||||
pull_request_target:
|
||||
types: [labeled, unlabeled, opened, edited, synchronize]
|
||||
|
||||
permissions:
|
||||
contents: read # to read configuration file
|
||||
pull-requests: write # to label PRs
|
||||
|
||||
jobs:
|
||||
enforce-label:
|
||||
if: github.repository == 'dev-sec/ansible-collection-hardening'
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
|
||||
- uses: actions/labeler@main
|
||||
with:
|
||||
repo-token: "${{ secrets.GITHUB_TOKEN }}"
|
||||
@@ -4,37 +4,37 @@ name: Publish collection to Ansible Galaxy
|
||||
on: # yamllint disable-line rule:truthy
|
||||
release:
|
||||
types:
|
||||
- released
|
||||
- published
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
if: github.repository == 'dev-sec/ansible-collection-hardening'
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
- uses: actions/checkout@v3
|
||||
|
||||
# deploy the collection first, because if it fails, we don't want
|
||||
# to update the galaxy.yml
|
||||
- name: Deploy the collection
|
||||
uses: artis3n/ansible_galaxy_collection@ffbca2460a5a1c600b941bbf1536bd61de1c2227 # v3
|
||||
uses: artis3n/ansible_galaxy_collection@v2
|
||||
with:
|
||||
api_key: ${{ secrets.GALAXY_API_KEY }}
|
||||
galaxy_version: ${{ github.event.release.tag_name }}
|
||||
|
||||
# checkout master instead of the release-tag so we can push the galaxy.yml
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
- uses: actions/checkout@v3
|
||||
with:
|
||||
ref: master
|
||||
|
||||
- name: update galaxy.yml with new version
|
||||
uses: microsoft/variable-substitution@6287962da9e5b6e68778dc51e840caa03ca84495 # v1
|
||||
uses: microsoft/variable-substitution@v1
|
||||
with:
|
||||
files: 'galaxy.yml'
|
||||
env:
|
||||
version: "${{ github.event.release.tag_name }}"
|
||||
|
||||
- name: push galaxy.yml
|
||||
uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
|
||||
uses: github-actions-x/[email protected]
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
push-branch: 'master'
|
||||
@@ -9,27 +9,15 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/mysql_hardening/**'
|
||||
- 'molecule/mysql_hardening/**'
|
||||
- '.github/workflows/mysql_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/mysql_hardening/**'
|
||||
- 'molecule/mysql_hardening/**'
|
||||
- '.github/workflows/mysql_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 0'
|
||||
|
||||
concurrency:
|
||||
group: >-
|
||||
${{ github.workflow }}-${{
|
||||
github.event.pull_request.number || github.sha
|
||||
}}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-18.04
|
||||
env:
|
||||
PY_COLORS: 1
|
||||
ANSIBLE_FORCE_COLOR: 1
|
||||
@@ -37,47 +25,43 @@ jobs:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- almalinux8
|
||||
- almalinux9
|
||||
# - almalinux10 # problem with baseline
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
# - rocky10 # problem with baseline
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
# - ubuntu2604 # problem with test setup
|
||||
- debian10
|
||||
- debian11
|
||||
- debian12
|
||||
- debian13
|
||||
# - amazon # geerlingguy.mysql does not support fedora
|
||||
# - arch # geerlingguy.mysql does not support arch
|
||||
- opensuse_tumbleweed
|
||||
# - arch # needs to be fixed
|
||||
# - opensuse_tumbleweed # needs to be fixed
|
||||
# - fedora # geerlingguy.mysql does not support fedora
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
|
||||
- name: Set up Python 3.7
|
||||
uses: actions/setup-python@v1
|
||||
with:
|
||||
python-version: 3.13
|
||||
cache: 'pip'
|
||||
python-version: 3.7
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
run: |
|
||||
sudo apt install git
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Downgrade Ansible for Rocky 8 tests
|
||||
- name: Create default collection path symlink
|
||||
run: |
|
||||
pip install "ansible-core<2.17"
|
||||
ansible-galaxy collection install 'community.crypto:<3.0.0'
|
||||
ansible-galaxy collection install 'community.general:<12.0.0'
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
|
||||
mkdir -p /home/runner/.ansible
|
||||
ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
|
||||
|
||||
# that was a hard one to fix. robert did it thankfully
|
||||
# https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212
|
||||
@@ -89,19 +73,10 @@ jobs:
|
||||
sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld
|
||||
if: ${{ startsWith(matrix.molecule_distro, 'Debian') }}
|
||||
|
||||
# Molecule has problems detecting the proper location for installing roles
|
||||
# https://github.com/ansible/molecule/issues/3806
|
||||
# we do not set a custom role path, but the automatically determined install path used is not compatible with the location molecule expects the role
|
||||
# see CI logs of this action "INFO Set ANSIBLE_ROLES_PATH" should not be present, since we do not set a custom path
|
||||
# we have to find a proper way to configure this
|
||||
- name: Temporary fix for roles
|
||||
run: |
|
||||
mkdir -p /home/runner/.ansible
|
||||
ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles \
|
||||
/home/runner/.ansible/roles
|
||||
|
||||
- name: Test with molecule
|
||||
run: molecule test -s mysql_hardening
|
||||
run: |
|
||||
molecule --version
|
||||
molecule test -s mysql_hardening
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
@@ -8,27 +8,15 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/nginx_hardening/**'
|
||||
- 'molecule/nginx_hardening/**'
|
||||
- '.github/workflows/nginx_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/nginx_hardening/**'
|
||||
- 'molecule/nginx_hardening/**'
|
||||
- '.github/workflows/nginx_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 1'
|
||||
|
||||
concurrency:
|
||||
group: >-
|
||||
${{ github.workflow }}-${{
|
||||
github.event.pull_request.number || github.sha
|
||||
}}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-18.04
|
||||
env:
|
||||
PY_COLORS: 1
|
||||
ANSIBLE_FORCE_COLOR: 1
|
||||
@@ -36,61 +24,48 @@ jobs:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- almalinux8
|
||||
- almalinux9
|
||||
- almalinux10
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- rocky10
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
- ubuntu2604
|
||||
- debian10
|
||||
- debian11
|
||||
- debian12
|
||||
- debian13
|
||||
- amazon2023
|
||||
- amazon
|
||||
# - arch # needs to be fixed
|
||||
# - opensuse_tumbleweed # needs to be fixed
|
||||
# - fedora # no support from geerlingguy role
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
|
||||
- name: Set up Python 3.7
|
||||
uses: actions/setup-python@v1
|
||||
with:
|
||||
python-version: 3.13
|
||||
cache: 'pip'
|
||||
python-version: 3.7
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Downgrade Ansible for Rocky 8 tests
|
||||
run: |
|
||||
pip install "ansible-core<2.17"
|
||||
ansible-galaxy collection install 'community.crypto:<3.0.0'
|
||||
ansible-galaxy collection install 'community.general:<12.0.0'
|
||||
sudo apt install git
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
|
||||
|
||||
# Molecule has problems detecting the proper location for installing roles
|
||||
# https://github.com/ansible/molecule/issues/3806
|
||||
# we do not set a custom role path, but the automatically determined install path used is not compatible with the location molecule expects the role
|
||||
# see CI logs of this action "INFO Set ANSIBLE_ROLES_PATH" should not be present, since we do not set a custom path
|
||||
# we have to find a proper way to configure this
|
||||
- name: Temporary fix for roles
|
||||
- name: Create default collection path symlink
|
||||
run: |
|
||||
mkdir -p /home/runner/.ansible
|
||||
ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles \
|
||||
/home/runner/.ansible/roles
|
||||
ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
|
||||
|
||||
- name: Test with molecule
|
||||
run: molecule test -s nginx_hardening
|
||||
run: |
|
||||
molecule --version
|
||||
molecule test -s nginx_hardening
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
@@ -8,85 +8,66 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening/**'
|
||||
- '.github/workflows/os_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening/**'
|
||||
- '.github/workflows/os_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 3'
|
||||
|
||||
concurrency:
|
||||
group: >-
|
||||
${{ github.workflow }}-${{
|
||||
github.event.pull_request.number || github.sha
|
||||
}}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-18.04
|
||||
env:
|
||||
PY_COLORS: 1
|
||||
ANSIBLE_FORCE_COLOR: 1
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- molecule_distro: opensuse_tumbleweed
|
||||
molecule_docker_command: "/usr/lib/systemd/systemd"
|
||||
molecule_distro:
|
||||
- almalinux8
|
||||
- almalinux9
|
||||
- almalinux10
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- rocky10
|
||||
- fedora42
|
||||
- fedora43
|
||||
- fedora44
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
- ubuntu2604
|
||||
- debian10
|
||||
- debian11
|
||||
- debian12
|
||||
- debian13
|
||||
- amazon2023
|
||||
- arch
|
||||
molecule_docker_command:
|
||||
- "/lib/systemd/systemd"
|
||||
- amazon
|
||||
- opensuse_tumbleweed
|
||||
# - arch # needs to be fixed
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
|
||||
- name: Set up Python 3.7
|
||||
uses: actions/setup-python@v1
|
||||
with:
|
||||
python-version: 3.13
|
||||
cache: 'pip'
|
||||
python-version: 3.7
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
run: |
|
||||
sudo apt install git
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Downgrade Ansible for Rocky 8 tests
|
||||
- name: Create default collection path symlink
|
||||
run: |
|
||||
pip install "ansible-core<2.17"
|
||||
ansible-galaxy collection install 'community.crypto:<3.0.0'
|
||||
ansible-galaxy collection install 'community.general:<12.0.0'
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
|
||||
mkdir -p /home/runner/.ansible
|
||||
ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
|
||||
|
||||
- name: Test with molecule
|
||||
run: molecule test -s os_hardening
|
||||
run: |
|
||||
if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
|
||||
export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
|
||||
fi
|
||||
molecule --version
|
||||
molecule test -s os_hardening
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
@@ -8,26 +8,12 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening_vm/**'
|
||||
- '.github/workflows/os_hardening_vm.yml'
|
||||
- 'requirements.txt'
|
||||
- 'requirements-vm.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening_vm/**'
|
||||
- '.github/workflows/os_hardening_vm.yml'
|
||||
- 'requirements.txt'
|
||||
- 'requirements-vm.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 2'
|
||||
|
||||
concurrency:
|
||||
group: >-
|
||||
${{ github.workflow }}-${{
|
||||
github.event.pull_request.number || github.sha
|
||||
}}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: self-hosted
|
||||
@@ -38,58 +24,33 @@ jobs:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- almalinux/8
|
||||
- almalinux/9
|
||||
# - almalinux/10 # boot loop
|
||||
- generic/centos9s
|
||||
- generic/rocky8
|
||||
- generic/rocky9
|
||||
- alvistack/fedora-42
|
||||
# - alvistack/fedora-43 # no compatible test image
|
||||
- generic/ubuntu2204
|
||||
- alvistack/ubuntu-24.04
|
||||
# - alvistack/ubuntu-26.04 # no compatible test image
|
||||
- generic/debian11
|
||||
- generic/debian12
|
||||
- cloud-image/debian-13
|
||||
- generic/opensuse15
|
||||
- generic/arch
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- debian10
|
||||
- debian11
|
||||
# - opensuse42 # opensuse currently cannot get an ip address
|
||||
# - arch - arch is currently not supported by cinc-auditor
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Install dependencies
|
||||
- name: Create default collection path symlink
|
||||
run: |
|
||||
source ~/.venv/ansible-collection-hardening/bin/activate
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
pip install -r requirements-vm.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Downgrade Ansible for Rocky 8 tests
|
||||
run: |
|
||||
source ~/.venv/ansible-collection-hardening/bin/activate
|
||||
pip install "ansible-core<2.17"
|
||||
ansible-galaxy collection install 'community.crypto:<3.0.0'
|
||||
ansible-galaxy collection install 'community.general:<12.0.0'
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
if: >
|
||||
matrix.molecule_distro == 'generic/rocky8' ||
|
||||
matrix.molecule_distro == 'almalinux/8' ||
|
||||
matrix.molecule_distro == 'generic/opensuse15'
|
||||
|
||||
- name: Update Vagrant Box
|
||||
run: |
|
||||
vagrant box update --box ${{ matrix.molecule_distro }} || true
|
||||
mkdir -p /home/runner/.ansible
|
||||
ln -fs /opt/actions-runner/_work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections /home/runner/.ansible/collections
|
||||
|
||||
- name: Test with molecule
|
||||
run: |
|
||||
source ~/.venv/ansible-collection-hardening/bin/activate
|
||||
# Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
|
||||
export MOLECULE_VAGRANT_PLUGIN_DIR=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')/molecule_plugins/vagrant
|
||||
molecule --version
|
||||
molecule test -s os_hardening_vm
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
|
||||
@@ -11,16 +11,16 @@ on: # yamllint disable-line rule:truthy
|
||||
jobs:
|
||||
prettier-md:
|
||||
if: github.repository == 'dev-sec/ansible-collection-hardening'
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 1
|
||||
|
||||
steps:
|
||||
- name: Git checkout
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
ref: ${{ github.head_ref }}
|
||||
|
||||
- name: Prettify code
|
||||
uses: creyD/prettier_action@8c18391fdc98ed0d884c6345f03975edac71b8f0 # v4.6
|
||||
uses: creyD/prettier_action@v3.1
|
||||
with:
|
||||
prettier_options: --write {**/*,*}.md
|
||||
@@ -11,38 +11,38 @@ jobs:
|
||||
generate_changelog:
|
||||
name: create release draft
|
||||
if: github.repository == 'dev-sec/ansible-collection-hardening'
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
- uses: actions/checkout@v3
|
||||
with:
|
||||
fetch-depth: 0
|
||||
ref: master
|
||||
|
||||
- name: 'Get Previous tag'
|
||||
id: previoustag
|
||||
uses: "WyriHaximus/github-action-get-previous-tag@61819f33034117e6c686e6a31dba995a85afc9de" # master
|
||||
uses: "WyriHaximus/github-action-get-previous-tag@master"
|
||||
env:
|
||||
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
|
||||
|
||||
- name: calculate next version
|
||||
id: version
|
||||
uses: patrickjahns/version-drafter-action@2076fa43abb28f31d0e8b0890253fbd1d1a966fc # v1
|
||||
uses: patrickjahns/version-drafter-action@v1
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Generate changelog
|
||||
uses: charmixer/auto-changelog-action@b25e89c9410e03189f0d48b02b3a8caad6e78015 # v1
|
||||
uses: charmixer/auto-changelog-action@v1
|
||||
with:
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
future_release: ${{ steps.version.outputs.next-version }}
|
||||
# this excludes all versions prior to the collection-release
|
||||
# since they break the changelog generation with the error:
|
||||
# "No common ancestor between ... and $version"
|
||||
exclude_tags_regex: '^[0-6]\.\d\.\d'
|
||||
exclude_tags_regex: '[0-6]\.\d\.\d'
|
||||
issue_line_labels: mysql_hardening,os_hardening,ssh_hardening,nginx_hardening
|
||||
|
||||
- name: push changelog
|
||||
uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
|
||||
uses: github-actions-x/[email protected]
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
push-branch: 'master'
|
||||
@@ -58,18 +58,18 @@ jobs:
|
||||
|
||||
- name: Read CHANGELOG.md
|
||||
id: package
|
||||
uses: juliangruber/read-file-action@271ff311a4947af354c6abcd696a306553b9ec18 # v1
|
||||
uses: juliangruber/read-file-action@v1
|
||||
with:
|
||||
path: ./CHANGELOGRELEASE.md
|
||||
|
||||
- name: Delete old drafts
|
||||
uses: hugo19941994/delete-draft-releases@3f19a25abf2ce87850c2268938f98f14e4d3d1f1 # v3.0.0
|
||||
uses: hugo19941994/delete-draft-releases@v1.0.0
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Create Release draft
|
||||
id: create_release
|
||||
uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1
|
||||
uses: actions/create-release@v1
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
|
||||
with:
|
||||
|
||||
@@ -1,56 +0,0 @@
|
||||
---
|
||||
name: create roles readme
|
||||
|
||||
on: # yamllint disable-line rule:truthy
|
||||
push:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/**/meta/argument_specs.yml'
|
||||
- 'roles/**/meta/main.yml'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/**/meta/argument_specs.yml'
|
||||
- 'roles/**/meta/main.yml'
|
||||
- 'requirements.txt'
|
||||
|
||||
jobs:
|
||||
readme:
|
||||
name: create roles readme
|
||||
runs-on: ubuntu-22.04
|
||||
strategy:
|
||||
matrix:
|
||||
roles:
|
||||
- mysql_hardening
|
||||
- nginx_hardening
|
||||
- os_hardening
|
||||
- ssh_hardening
|
||||
steps:
|
||||
- name: Check out code
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
|
||||
with:
|
||||
python-version: 3.13
|
||||
cache: 'pip'
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
|
||||
- name: Run aar-doc
|
||||
run: aar-doc roles/${{ matrix.roles }} markdown
|
||||
|
||||
- name: Output diff
|
||||
run: git diff roles/${{ matrix.roles }}/README.md
|
||||
|
||||
- name: Push README
|
||||
if: github.event_name != 'pull_request'
|
||||
uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
commit-message: 'update ${{ matrix.roles }} readme'
|
||||
files: roles/${{ matrix.roles }}/README.md
|
||||
rebase: true
|
||||
name: dev-sec CI
|
||||
email: [email protected]
|
||||
@@ -8,88 +8,67 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening/**'
|
||||
- '.github/workflows/ssh_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening/**'
|
||||
- '.github/workflows/ssh_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 5'
|
||||
|
||||
concurrency:
|
||||
group: >-
|
||||
${{ github.workflow }}-${{
|
||||
github.event.pull_request.number || github.sha
|
||||
}}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-18.04
|
||||
env:
|
||||
PY_COLORS: 1
|
||||
ANSIBLE_FORCE_COLOR: 1
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
# needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
|
||||
# - molecule_distro: opensuse_tumbleweed
|
||||
# molecule_docker_command: "/usr/lib/systemd/systemd"
|
||||
- molecule_distro: alpine
|
||||
molecule_docker_command: "/sbin/init"
|
||||
molecule_distro:
|
||||
- almalinux8
|
||||
- almalinux9
|
||||
- almalinux10
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- rocky10
|
||||
- fedora42
|
||||
- fedora43
|
||||
- fedora44
|
||||
- fedora
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
- ubuntu2604
|
||||
- debian10
|
||||
- debian11
|
||||
- debian12
|
||||
- debian13
|
||||
- amazon2023
|
||||
- arch
|
||||
molecule_docker_command:
|
||||
- "/lib/systemd/systemd"
|
||||
- amazon
|
||||
# - arch # needs to be fixed
|
||||
# - opensuse_tumbleweed # baseline is not compatible with suse
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
|
||||
- name: Set up Python 3.7
|
||||
uses: actions/setup-python@v1
|
||||
with:
|
||||
python-version: 3.13
|
||||
cache: 'pip'
|
||||
python-version: 3.7
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
run: |
|
||||
sudo apt install git
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Downgrade Ansible for Rocky 8 tests
|
||||
- name: Create default collection path symlink
|
||||
run: |
|
||||
pip install "ansible-core<2.17"
|
||||
ansible-galaxy collection install 'community.crypto:<3.0.0'
|
||||
ansible-galaxy collection install 'community.general:<12.0.0'
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
|
||||
mkdir -p /home/runner/.ansible
|
||||
ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
|
||||
|
||||
- name: Test with molecule
|
||||
run: molecule test -s ssh_hardening
|
||||
run: |
|
||||
if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
|
||||
export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
|
||||
fi
|
||||
molecule --version
|
||||
molecule test -s ssh_hardening
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
@@ -8,88 +8,67 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_custom_tests/**'
|
||||
- '.github/workflows/ssh_hardening_custom_tests.yml'
|
||||
- 'requirements.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_custom_tests/**'
|
||||
- '.github/workflows/ssh_hardening_custom_tests.yml'
|
||||
- 'requirements.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 4'
|
||||
|
||||
concurrency:
|
||||
group: >-
|
||||
${{ github.workflow }}-${{
|
||||
github.event.pull_request.number || github.sha
|
||||
}}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-18.04
|
||||
env:
|
||||
PY_COLORS: 1
|
||||
ANSIBLE_FORCE_COLOR: 1
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
# needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
|
||||
# - molecule_distro: opensuse_tumbleweed
|
||||
# molecule_docker_command: "/usr/lib/systemd/systemd"
|
||||
- molecule_distro: alpine
|
||||
molecule_docker_command: "/sbin/init"
|
||||
molecule_distro:
|
||||
- almalinux8
|
||||
- almalinux9
|
||||
- almalinux10
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- rocky10
|
||||
- fedora42
|
||||
- fedora43
|
||||
- fedora44
|
||||
- fedora
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
- ubuntu2604
|
||||
- debian10
|
||||
- debian11
|
||||
- debian12
|
||||
- debian13
|
||||
- amazon2023
|
||||
- arch
|
||||
molecule_docker_command:
|
||||
- "/lib/systemd/systemd"
|
||||
- amazon
|
||||
# - arch # needs to be fixed
|
||||
# - opensuse_tumbleweed # baseline is not compatible with suse
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
|
||||
- name: Set up Python 3.7
|
||||
uses: actions/setup-python@v1
|
||||
with:
|
||||
python-version: 3.13
|
||||
cache: 'pip'
|
||||
python-version: 3.7
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
run: |
|
||||
sudo apt install git
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Downgrade Ansible for Rocky 8 tests
|
||||
- name: Create default collection path symlink
|
||||
run: |
|
||||
pip install "ansible-core<2.17"
|
||||
ansible-galaxy collection install 'community.crypto:<3.0.0'
|
||||
ansible-galaxy collection install 'community.general:<12.0.0'
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
|
||||
mkdir -p /home/runner/.ansible
|
||||
ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
|
||||
|
||||
- name: Test with molecule
|
||||
run: molecule test -s ssh_hardening_custom_tests
|
||||
run: |
|
||||
if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
|
||||
export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
|
||||
fi
|
||||
molecule --version
|
||||
molecule converge -s ssh_hardening_custom_tests
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
@@ -1,73 +0,0 @@
|
||||
---
|
||||
name: "devsec.ssh_hardening VM"
|
||||
on: # yamllint disable-line rule:truthy
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_vm/**'
|
||||
- '.github/workflows/ssh_hardening_vm.yml'
|
||||
- 'requirements.txt'
|
||||
- 'requirements-vm.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_vm/**'
|
||||
- '.github/workflows/ssh_hardening_vm.yml'
|
||||
- 'requirements.txt'
|
||||
- 'requirements-vm.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 5'
|
||||
|
||||
concurrency:
|
||||
group: >-
|
||||
${{ github.workflow }}-${{
|
||||
github.event.pull_request.number || github.sha
|
||||
}}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: self-hosted
|
||||
env:
|
||||
PY_COLORS: 1
|
||||
ANSIBLE_FORCE_COLOR: 1
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- generic/openbsd7
|
||||
- generic/freebsd14
|
||||
- cloud-image/debian-13
|
||||
- cloud-image/ubuntu-24.04
|
||||
- cloud-image/ubuntu-26.04
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
source ~/.venv/ansible-collection-hardening/bin/activate
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
pip install -r requirements-vm.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Update Vagrant Box
|
||||
run: |
|
||||
vagrant box update --box ${{ matrix.molecule_distro }} || true
|
||||
|
||||
- name: Test with molecule
|
||||
run: |
|
||||
source ~/.venv/ansible-collection-hardening/bin/activate
|
||||
# Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
|
||||
export MOLECULE_VAGRANT_PLUGIN_DIR=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')/molecule_plugins/vagrant
|
||||
molecule test -s ssh_hardening_vm
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
@@ -0,0 +1,26 @@
|
||||
---
|
||||
# Based on ansible-lint config
|
||||
extends: default
|
||||
|
||||
rules:
|
||||
braces:
|
||||
max-spaces-inside: 1
|
||||
level: error
|
||||
brackets:
|
||||
max-spaces-inside: 1
|
||||
level: error
|
||||
colons:
|
||||
max-spaces-after: -1
|
||||
level: error
|
||||
commas:
|
||||
max-spaces-after: -1
|
||||
level: error
|
||||
empty-lines:
|
||||
max: 3
|
||||
level: error
|
||||
hyphens:
|
||||
level: error
|
||||
key-duplicates: enable
|
||||
line-length: disable
|
||||
new-lines:
|
||||
type: unix
|
||||
+13
-530
@@ -1,528 +1,11 @@
|
||||
# Changelog
|
||||
|
||||
## [10.6.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.6.0) (2026-05-13)
|
||||
## [8.2.1](https://github.com/dev-sec/ansible-collection-hardening/tree/8.2.1) (2022-10-20)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.2...10.6.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Update APT package cache before installing any package in case freshly installed system. [\#945](https://github.com/dev-sec/ansible-collection-hardening/issues/945)
|
||||
- Update supported OS versions to current Fedora \(42/43/44\) and Ubuntu \(22.04/24.04/26.04\) [\#946](https://github.com/dev-sec/ansible-collection-hardening/pull/946) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Update actions/labeler action to v6.1.0 [\#947](https://github.com/dev-sec/ansible-collection-hardening/pull/947) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update dev-sec/.github digest to 2cd0028 [\#943](https://github.com/dev-sec/ansible-collection-hardening/pull/943) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update ansible/ansible-lint digest to 5fac056 [\#942](https://github.com/dev-sec/ansible-collection-hardening/pull/942) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update dependency molecule to v26 [\#935](https://github.com/dev-sec/ansible-collection-hardening/pull/935) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update dependency ansible-core to v2.20.5 [\#910](https://github.com/dev-sec/ansible-collection-hardening/pull/910) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.5.2](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.2) (2026-03-28)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.1...10.5.2)
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.2.0...8.2.1)
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- do not update apt cache when installing libpam-passwdqc [\#939](https://github.com/dev-sec/ansible-collection-hardening/pull/939) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([eikesauer](https://github.com/eikesauer))
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- chore\(deps\): update hugo19941994/delete-draft-releases action to v3 [\#940](https://github.com/dev-sec/ansible-collection-hardening/pull/940) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): pin dependencies [\#938](https://github.com/dev-sec/ansible-collection-hardening/pull/938) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/checkout digest to de0fac2 [\#932](https://github.com/dev-sec/ansible-collection-hardening/pull/932) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.5.1](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.1) (2026-03-20)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.0...10.5.1)
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- fix flaky failures on Ubuntu 24.04 and newer by disabling sshd socket activation first [\#931](https://github.com/dev-sec/ansible-collection-hardening/pull/931) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([kuglimon](https://github.com/kuglimon))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- SSH issue after running devsec.hardening.ssh\_hardening role [\#854](https://github.com/dev-sec/ansible-collection-hardening/issues/854)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- chore\(deps\): update juliangruber/read-file-action digest to 271ff31 [\#937](https://github.com/dev-sec/ansible-collection-hardening/pull/937) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 8ba9595 [\#934](https://github.com/dev-sec/ansible-collection-hardening/pull/934) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update artis3n/ansible\_galaxy\_collection action to v3 [\#933](https://github.com/dev-sec/ansible-collection-hardening/pull/933) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Improve VM based testing of SSH hardening [\#878](https://github.com/dev-sec/ansible-collection-hardening/pull/878) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
|
||||
## [10.5.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.0) (2026-01-22)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.4.0...10.5.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- fix: replace deprecated community.general.yaml callback plugin [\#918](https://github.com/dev-sec/ansible-collection-hardening/pull/918) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([Normo](https://github.com/Normo))
|
||||
- Consistently access facts via the ansible\_facts.\* namespace [\#917](https://github.com/dev-sec/ansible-collection-hardening/pull/917) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([Normo](https://github.com/Normo))
|
||||
- disable systemd audit logging [\#902](https://github.com/dev-sec/ansible-collection-hardening/pull/902) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([z-bsod](https://github.com/z-bsod))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- /etc/sysctl.conf is no longer honored in Debian 13 [\#905](https://github.com/dev-sec/ansible-collection-hardening/issues/905)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- chore\(deps\): update dependency jmespath to v1.1.0 [\#930](https://github.com/dev-sec/ansible-collection-hardening/pull/930) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/setup-python digest to a309ff8 [\#929](https://github.com/dev-sec/ansible-collection-hardening/pull/929) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint action to v26 [\#928](https://github.com/dev-sec/ansible-collection-hardening/pull/928) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update artis3n/ansible\_galaxy\_collection digest to 415a92b - autoclosed [\#927](https://github.com/dev-sec/ansible-collection-hardening/pull/927) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to a2bc8b8 [\#924](https://github.com/dev-sec/ansible-collection-hardening/pull/924) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/setup-python digest to 83679a8 [\#920](https://github.com/dev-sec/ansible-collection-hardening/pull/920) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/checkout action to v6 [\#919](https://github.com/dev-sec/ansible-collection-hardening/pull/919) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency molecule to v25.12.0 [\#914](https://github.com/dev-sec/ansible-collection-hardening/pull/914) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 40f24c2 [\#913](https://github.com/dev-sec/ansible-collection-hardening/pull/913) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update test environments to current Ansible version [\#909](https://github.com/dev-sec/ansible-collection-hardening/pull/909) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to d7cd7cf [\#903](https://github.com/dev-sec/ansible-collection-hardening/pull/903) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.4.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.4.0) (2025-10-22)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.3.1...10.4.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Support Debian 13 [\#891](https://github.com/dev-sec/ansible-collection-hardening/issues/891)
|
||||
- Support EL10 [\#870](https://github.com/dev-sec/ansible-collection-hardening/issues/870)
|
||||
- Add support for current versions of Debian and EL [\#893](https://github.com/dev-sec/ansible-collection-hardening/pull/893) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Add SSH config for EL/AlmaLinux 10 [\#888](https://github.com/dev-sec/ansible-collection-hardening/pull/888) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([jonathanspw](https://github.com/jonathanspw))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- Write sysctl config to separate file [\#907](https://github.com/dev-sec/ansible-collection-hardening/pull/907) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- sysctl-34 - fs.protected\_regular not set [\#536](https://github.com/dev-sec/ansible-collection-hardening/issues/536)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Update ArchLinux test environment before testing [\#908](https://github.com/dev-sec/ansible-collection-hardening/pull/908) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): update actions/setup-python action to v6 [\#901](https://github.com/dev-sec/ansible-collection-hardening/pull/901) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/labeler action to v6 [\#900](https://github.com/dev-sec/ansible-collection-hardening/pull/900) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 8861a73 [\#899](https://github.com/dev-sec/ansible-collection-hardening/pull/899) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/checkout action to v5 [\#895](https://github.com/dev-sec/ansible-collection-hardening/pull/895) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency python to 3.13 [\#892](https://github.com/dev-sec/ansible-collection-hardening/pull/892) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency aar-doc to v2.3.0 [\#890](https://github.com/dev-sec/ansible-collection-hardening/pull/890) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 9765b87 [\#889](https://github.com/dev-sec/ansible-collection-hardening/pull/889) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Improve OS support accuracy [\#887](https://github.com/dev-sec/ansible-collection-hardening/pull/887) ([jonathanspw](https://github.com/jonathanspw))
|
||||
- chore\(deps\): update hugo19941994/delete-draft-releases action to v2 [\#885](https://github.com/dev-sec/ansible-collection-hardening/pull/885) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.3.1](https://github.com/dev-sec/ansible-collection-hardening/tree/10.3.1) (2025-07-24)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.3.0...10.3.1)
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- Readme states Ansible \>= 2.9.10, but it uses password\_expire\_warn from 2.16 [\#871](https://github.com/dev-sec/ansible-collection-hardening/issues/871)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Use fixed test env for BSD VMs [\#884](https://github.com/dev-sec/ansible-collection-hardening/pull/884) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Downgrade community.crypto for rocky8 [\#882](https://github.com/dev-sec/ansible-collection-hardening/pull/882) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): update dependency aar-doc to v2.2.0 [\#877](https://github.com/dev-sec/ansible-collection-hardening/pull/877) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update creyd/prettier\_action action to v4.6 [\#876](https://github.com/dev-sec/ansible-collection-hardening/pull/876) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 06f616d [\#873](https://github.com/dev-sec/ansible-collection-hardening/pull/873) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.18.6 [\#872](https://github.com/dev-sec/ansible-collection-hardening/pull/872) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update creyd/prettier\_action action to v4.5 [\#869](https://github.com/dev-sec/ansible-collection-hardening/pull/869) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(ssh\_hardening\): ansible 2.19 compatibility [\#868](https://github.com/dev-sec/ansible-collection-hardening/pull/868) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to e98f9b3 [\#867](https://github.com/dev-sec/ansible-collection-hardening/pull/867) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/setup-python digest to a26af69 [\#866](https://github.com/dev-sec/ansible-collection-hardening/pull/866) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.18.5 [\#865](https://github.com/dev-sec/ansible-collection-hardening/pull/865) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to c16f018 [\#863](https://github.com/dev-sec/ansible-collection-hardening/pull/863) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 6a4fcdb [\#862](https://github.com/dev-sec/ansible-collection-hardening/pull/862) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency aar-doc to v2.1.0 [\#861](https://github.com/dev-sec/ansible-collection-hardening/pull/861) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.18.4 [\#860](https://github.com/dev-sec/ansible-collection-hardening/pull/860) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/setup-python digest to 8d9ed9a [\#859](https://github.com/dev-sec/ansible-collection-hardening/pull/859) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Fix: ForwardAgent j2 template space [\#856](https://github.com/dev-sec/ansible-collection-hardening/pull/856) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([cod3mas0n](https://github.com/cod3mas0n))
|
||||
- chore\(deps\): update artis3n/ansible\_galaxy\_collection digest to f6110ae [\#853](https://github.com/dev-sec/ansible-collection-hardening/pull/853) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.3.0) (2025-02-25)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.2.0...10.3.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Password expiry for users without password should not block SSH key based login [\#681](https://github.com/dev-sec/ansible-collection-hardening/issues/681)
|
||||
- Set number of warning days before password expires for existing users [\#839](https://github.com/dev-sec/ansible-collection-hardening/pull/839) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Normo](https://github.com/Normo))
|
||||
- Allow to override settings for sftponly users [\#794](https://github.com/dev-sec/ansible-collection-hardening/pull/794) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([mib1185](https://github.com/mib1185))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- os\_hardening & sysctl\_overwrite with host\_vars [\#837](https://github.com/dev-sec/ansible-collection-hardening/issues/837)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- chore\(deps\): update dependency ansible-core to v2.18.3 [\#852](https://github.com/dev-sec/ansible-collection-hardening/pull/852) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 49ded6a [\#851](https://github.com/dev-sec/ansible-collection-hardening/pull/851) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Pin runner image to specific version to decouple from GitHub updates [\#847](https://github.com/dev-sec/ansible-collection-hardening/pull/847) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Refactor: combine multiple set\_fact into single jinja filter [\#846](https://github.com/dev-sec/ansible-collection-hardening/pull/846) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Tinyblargon](https://github.com/Tinyblargon))
|
||||
- chore\(deps\): update actions/setup-python digest to 4237552 [\#844](https://github.com/dev-sec/ansible-collection-hardening/pull/844) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.18.2 [\#843](https://github.com/dev-sec/ansible-collection-hardening/pull/843) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency molecule to v25 [\#841](https://github.com/dev-sec/ansible-collection-hardening/pull/841) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint action to v25 [\#840](https://github.com/dev-sec/ansible-collection-hardening/pull/840) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.2.0) (2024-12-23)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.1.0...10.2.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Re-enable OpenBSD tests [\#826](https://github.com/dev-sec/ansible-collection-hardening/issues/826) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
|
||||
- Allow configuring the name\_format variable in auditd config [\#796](https://github.com/dev-sec/ansible-collection-hardening/issues/796) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
|
||||
- Modify PAM to allow SSH key based logins with locked passwords [\#835](https://github.com/dev-sec/ansible-collection-hardening/pull/835) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- adding switch for ForwardAgent in ssh\_config [\#818](https://github.com/dev-sec/ansible-collection-hardening/pull/818) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Shizzlebix](https://github.com/Shizzlebix))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- File system loop detected; ‘/bin/X11’ is part of the same file system loop as ‘/bin’." [\#815](https://github.com/dev-sec/ansible-collection-hardening/issues/815) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
|
||||
- Not working ssh\_hardening on Centos 7 [\#813](https://github.com/dev-sec/ansible-collection-hardening/issues/813) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- chore\(deps\): update dependency molecule-plugins to v23.6.0 [\#834](https://github.com/dev-sec/ansible-collection-hardening/pull/834) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 4ce8e49 [\#832](https://github.com/dev-sec/ansible-collection-hardening/pull/832) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency molecule to v24.12.0 [\#831](https://github.com/dev-sec/ansible-collection-hardening/pull/831) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.18.1 [\#829](https://github.com/dev-sec/ansible-collection-hardening/pull/829) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Change installation source for OpenBSD tests [\#828](https://github.com/dev-sec/ansible-collection-hardening/pull/828) ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 44be233 [\#825](https://github.com/dev-sec/ansible-collection-hardening/pull/825) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Bump ansible-core from 2.17.5 to 2.17.6 [\#820](https://github.com/dev-sec/ansible-collection-hardening/pull/820) ([dependabot[bot]](https://github.com/apps/dependabot))
|
||||
- chore\(deps\): update dependency ansible-core to v2.18.0 [\#819](https://github.com/dev-sec/ansible-collection-hardening/pull/819) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency aar-doc to v2.0.1 [\#817](https://github.com/dev-sec/ansible-collection-hardening/pull/817) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update actions/setup-python digest to 0b93645 [\#814](https://github.com/dev-sec/ansible-collection-hardening/pull/814) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/checkout digest to 11bd719 [\#812](https://github.com/dev-sec/ansible-collection-hardening/pull/812) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.1.0) (2024-10-22)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.0.0...10.1.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Ubuntu 24.04 support [\#764](https://github.com/dev-sec/ansible-collection-hardening/issues/764)
|
||||
- Add variable to set name\_format for auditd [\#810](https://github.com/dev-sec/ansible-collection-hardening/pull/810) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- feat\(ssh\): add alpine support [\#809](https://github.com/dev-sec/ansible-collection-hardening/pull/809) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Provide granular noop for ssh configuration [\#789](https://github.com/dev-sec/ansible-collection-hardening/pull/789) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([seven-beep](https://github.com/seven-beep))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- molecule scenario ssh\_hardening if failing due to missing docker image [\#790](https://github.com/dev-sec/ansible-collection-hardening/issues/790)
|
||||
- getent\_shadow empty [\#787](https://github.com/dev-sec/ansible-collection-hardening/issues/787)
|
||||
- Error: Missing privilege separation directory: /run/sshd [\#752](https://github.com/dev-sec/ansible-collection-hardening/issues/752)
|
||||
- fix\(ssh\_hardening\): test setting kex to false, remove wrong default [\#808](https://github.com/dev-sec/ansible-collection-hardening/pull/808) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Pin python dependencies and optimize GitHub Actions [\#811](https://github.com/dev-sec/ansible-collection-hardening/pull/811) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- fix\(cicd\): test idempotence on ssh custom tests [\#807](https://github.com/dev-sec/ansible-collection-hardening/pull/807) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Document correct quotes for ssh\_permit\_tunnel parameter [\#806](https://github.com/dev-sec/ansible-collection-hardening/pull/806) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([vmpr](https://github.com/vmpr))
|
||||
- fix\(docs\): add 'become: true' to example playbooks. fix \#787 [\#804](https://github.com/dev-sec/ansible-collection-hardening/pull/804) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- chore\(deps\): update dependency ansible-core to v2.17.5 [\#802](https://github.com/dev-sec/ansible-collection-hardening/pull/802) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Don't run tests if the environment is not correct [\#801](https://github.com/dev-sec/ansible-collection-hardening/pull/801) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): update actions/checkout digest to eef6144 [\#800](https://github.com/dev-sec/ansible-collection-hardening/pull/800) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- feat: Corrected package name [\#799](https://github.com/dev-sec/ansible-collection-hardening/pull/799) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([PapaPeskwo](https://github.com/PapaPeskwo))
|
||||
- Use Python venv for VM tests [\#798](https://github.com/dev-sec/ansible-collection-hardening/pull/798) ([schurzi](https://github.com/schurzi))
|
||||
- Remove unused files and variables [\#797](https://github.com/dev-sec/ansible-collection-hardening/pull/797) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 3b5bee1 [\#795](https://github.com/dev-sec/ansible-collection-hardening/pull/795) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 25f783c [\#792](https://github.com/dev-sec/ansible-collection-hardening/pull/792) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.17.4 [\#791](https://github.com/dev-sec/ansible-collection-hardening/pull/791) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/setup-python digest to f677139 [\#788](https://github.com/dev-sec/ansible-collection-hardening/pull/788) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.17.3 [\#786](https://github.com/dev-sec/ansible-collection-hardening/pull/786) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.17.2 [\#756](https://github.com/dev-sec/ansible-collection-hardening/pull/756) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.0.0) (2024-08-06)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/9.0.1...10.0.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- option to disable regeneration of ssh private key [\#772](https://github.com/dev-sec/ansible-collection-hardening/issues/772)
|
||||
- Support systemd socket activation for sshd [\#763](https://github.com/dev-sec/ansible-collection-hardening/issues/763) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
|
||||
- Release 9.0.2 [\#758](https://github.com/dev-sec/ansible-collection-hardening/issues/758)
|
||||
- Make Publickey authentication configurable [\#750](https://github.com/dev-sec/ansible-collection-hardening/issues/750)
|
||||
- Ansible Linting [\#747](https://github.com/dev-sec/ansible-collection-hardening/issues/747)
|
||||
- Make value of kernel.unprivileged\_userns\_clone depending on kernel version [\#727](https://github.com/dev-sec/ansible-collection-hardening/issues/727)
|
||||
- Ensure that ssh is installed \(cf \#771\) [\#774](https://github.com/dev-sec/ansible-collection-hardening/pull/774) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Byh0ki](https://github.com/Byh0ki))
|
||||
- ssh: explicitly enable or disable the service at boot [\#771](https://github.com/dev-sec/ansible-collection-hardening/pull/771) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Byh0ki](https://github.com/Byh0ki))
|
||||
- disable systemd socket activation [\#769](https://github.com/dev-sec/ansible-collection-hardening/pull/769) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Add ssh\_pubkey\_authentication variable to ssh hardening [\#749](https://github.com/dev-sec/ansible-collection-hardening/pull/749) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([debbabi](https://github.com/debbabi))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- ssh hardening role fails when `ssh_permit_root_login` var is set on ubuntu 24.04 [\#768](https://github.com/dev-sec/ansible-collection-hardening/issues/768)
|
||||
- os\_hardening fails when setting vm.mmap\_rnd\_bits [\#757](https://github.com/dev-sec/ansible-collection-hardening/issues/757)
|
||||
- `ssh_gateway_ports` is documented to accept 'clientspecified' string, but only accepts bools [\#755](https://github.com/dev-sec/ansible-collection-hardening/issues/755)
|
||||
- harden permissions for directory mount /var/log fails for minimized Ubuntu 22.04 [\#741](https://github.com/dev-sec/ansible-collection-hardening/issues/741)
|
||||
- Update Debian compatibility [\#784](https://github.com/dev-sec/ansible-collection-hardening/pull/784) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- do not force type of ssh\_gateway\_ports [\#765](https://github.com/dev-sec/ansible-collection-hardening/pull/765) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Update to current Fedora releases [\#783](https://github.com/dev-sec/ansible-collection-hardening/pull/783) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Remove deprecated rebuild of initrd [\#782](https://github.com/dev-sec/ansible-collection-hardening/pull/782) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): update patrickjahns/version-drafter-action digest to 2076fa4 [\#781](https://github.com/dev-sec/ansible-collection-hardening/pull/781) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 95382d3 [\#779](https://github.com/dev-sec/ansible-collection-hardening/pull/779) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/setup-python digest to 39cd149 [\#778](https://github.com/dev-sec/ansible-collection-hardening/pull/778) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- remove tests for FreeBSD12 since it's out of support [\#777](https://github.com/dev-sec/ansible-collection-hardening/pull/777) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): pin dependencies [\#776](https://github.com/dev-sec/ansible-collection-hardening/pull/776) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Use best-practice preset for renovate [\#775](https://github.com/dev-sec/ansible-collection-hardening/pull/775) ([schurzi](https://github.com/schurzi))
|
||||
- Deprecate Centos Stream 8 [\#770](https://github.com/dev-sec/ansible-collection-hardening/pull/770) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- centos7 is eol, remove it [\#767](https://github.com/dev-sec/ansible-collection-hardening/pull/767) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- fix spelling [\#766](https://github.com/dev-sec/ansible-collection-hardening/pull/766) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- ci: define permissions for enforce-labels workflow [\#760](https://github.com/dev-sec/ansible-collection-hardening/pull/760) ([fgreinacher](https://github.com/fgreinacher))
|
||||
- Update dependency ansible-core to v2.16.5 [\#754](https://github.com/dev-sec/ansible-collection-hardening/pull/754) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update dependency ansible-core to v2.16.4 [\#751](https://github.com/dev-sec/ansible-collection-hardening/pull/751) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update ansible/ansible-lint action to v24 [\#745](https://github.com/dev-sec/ansible-collection-hardening/pull/745) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Always update Vagrant Boxes before using [\#744](https://github.com/dev-sec/ansible-collection-hardening/pull/744) ([schurzi](https://github.com/schurzi))
|
||||
- Remove Docker containers on self-hosted runner after tests [\#743](https://github.com/dev-sec/ansible-collection-hardening/pull/743) ([schurzi](https://github.com/schurzi))
|
||||
- Update dependency ansible-core to v2.16.3 [\#742](https://github.com/dev-sec/ansible-collection-hardening/pull/742) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [9.0.1](https://github.com/dev-sec/ansible-collection-hardening/tree/9.0.1) (2024-01-15)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/9.0.0...9.0.1)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Extend ansible-lint testing to cover our test cases [\#731](https://github.com/dev-sec/ansible-collection-hardening/issues/731)
|
||||
- Complete tests for OS hardening [\#660](https://github.com/dev-sec/ansible-collection-hardening/issues/660)
|
||||
- support restarts of audit service on Arch linux [\#722](https://github.com/dev-sec/ansible-collection-hardening/pull/722) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- Fails to install [\#735](https://github.com/dev-sec/ansible-collection-hardening/issues/735)
|
||||
- Amazon Linux gpg check fails [\#734](https://github.com/dev-sec/ansible-collection-hardening/issues/734)
|
||||
- ssh\_hardening ipv6 [\#719](https://github.com/dev-sec/ansible-collection-hardening/issues/719)
|
||||
- boolean variable inconsistency? [\#330](https://github.com/dev-sec/ansible-collection-hardening/issues/330)
|
||||
- Restore idempotency for disabling unused filesystems with Ansible 2.16.0 [\#718](https://github.com/dev-sec/ansible-collection-hardening/pull/718) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([akikanellis](https://github.com/akikanellis))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- 9.0.0 version number in galaxy.yml file is wrong [\#740](https://github.com/dev-sec/ansible-collection-hardening/issues/740)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- restructure readme to move known limitations up top [\#739](https://github.com/dev-sec/ansible-collection-hardening/pull/739) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- release only on releases, not pre-releases [\#738](https://github.com/dev-sec/ansible-collection-hardening/pull/738) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Update dependency ansible-core to v2.16.2 [\#737](https://github.com/dev-sec/ansible-collection-hardening/pull/737) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- fix linting for github config [\#736](https://github.com/dev-sec/ansible-collection-hardening/pull/736) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Update actions/setup-python action to v5 [\#733](https://github.com/dev-sec/ansible-collection-hardening/pull/733) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update ansible-lint action and revise configuration to scan all Ansible code [\#732](https://github.com/dev-sec/ansible-collection-hardening/pull/732) ([schurzi](https://github.com/schurzi))
|
||||
- update labeler to new config format [\#730](https://github.com/dev-sec/ansible-collection-hardening/pull/730) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Update dependency ansible-core to v2.16.1 [\#728](https://github.com/dev-sec/ansible-collection-hardening/pull/728) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- pin Ansible to always let Renovate update to the most current version in our tests [\#721](https://github.com/dev-sec/ansible-collection-hardening/pull/721) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
|
||||
## [9.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/9.0.0) (2023-11-16)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.8.0...9.0.0)
|
||||
|
||||
**Breaking changes:**
|
||||
|
||||
- make it possible to configure more then yes and no for PermitTunnel [\#715](https://github.com/dev-sec/ansible-collection-hardening/pull/715) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- add role argument spec for os, ssh, mysql [\#687](https://github.com/dev-sec/ansible-collection-hardening/pull/687) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Create role documentation with Automated-Ansible-Role-Documentation [\#694](https://github.com/dev-sec/ansible-collection-hardening/issues/694)
|
||||
- Minimize access user paths should be fully configurable [\#689](https://github.com/dev-sec/ansible-collection-hardening/issues/689)
|
||||
- Add support for Debian 12 [\#672](https://github.com/dev-sec/ansible-collection-hardening/issues/672)
|
||||
- add testing and support for current versions of Fedora and FreeBSD [\#709](https://github.com/dev-sec/ansible-collection-hardening/pull/709) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- feat: workflow for roles readme [\#705](https://github.com/dev-sec/ansible-collection-hardening/pull/705) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
|
||||
- do not try to drop roles in mysql hardening [\#649](https://github.com/dev-sec/ansible-collection-hardening/pull/649) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- nginx conf.d directory is missing on Rocky Linux 8 [\#707](https://github.com/dev-sec/ansible-collection-hardening/issues/707)
|
||||
- Default value of `ssh_client_alive_interval` is inconsistent with what documentation says [\#701](https://github.com/dev-sec/ansible-collection-hardening/issues/701)
|
||||
- \[devsec.hardening.os\_hardening : restart-auditd\] fails [\#698](https://github.com/dev-sec/ansible-collection-hardening/issues/698)
|
||||
- sshd\_hardening role cannot be used to build system images [\#697](https://github.com/dev-sec/ansible-collection-hardening/issues/697)
|
||||
- Error: No file was found when using first\_found on Ubuntu 20.04 [\#676](https://github.com/dev-sec/ansible-collection-hardening/issues/676)
|
||||
- PUBLIC-role breaks mysql-hardening [\#648](https://github.com/dev-sec/ansible-collection-hardening/issues/648)
|
||||
- Error deploying the playbook [\#630](https://github.com/dev-sec/ansible-collection-hardening/issues/630)
|
||||
- Gather facts when os\_hardening role is executed with tags [\#708](https://github.com/dev-sec/ansible-collection-hardening/pull/708) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- Add send-to-mailinglist to github release action [\#434](https://github.com/dev-sec/ansible-collection-hardening/issues/434)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- update status badges in README [\#714](https://github.com/dev-sec/ansible-collection-hardening/pull/714) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- fix CI test for os\_hardening [\#711](https://github.com/dev-sec/ansible-collection-hardening/pull/711) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- fix nginx CI tests [\#710](https://github.com/dev-sec/ansible-collection-hardening/pull/710) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- fix: roles-readme action default value [\#706](https://github.com/dev-sec/ansible-collection-hardening/pull/706) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
|
||||
- fix some wrong defaults and types in the readmes [\#703](https://github.com/dev-sec/ansible-collection-hardening/pull/703) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- update links to new Ansible Galaxy [\#702](https://github.com/dev-sec/ansible-collection-hardening/pull/702) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Fix typo in login.defs.j2 [\#700](https://github.com/dev-sec/ansible-collection-hardening/pull/700) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))
|
||||
- chore\(deps\): update actions/checkout action to v4 [\#696](https://github.com/dev-sec/ansible-collection-hardening/pull/696) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- test debian12 on VM [\#695](https://github.com/dev-sec/ansible-collection-hardening/pull/695) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- fix descriptions in readme [\#693](https://github.com/dev-sec/ansible-collection-hardening/pull/693) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- feat: customize user paths default [\#692](https://github.com/dev-sec/ansible-collection-hardening/pull/692) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([S0obi](https://github.com/S0obi))
|
||||
- disable PAM tests [\#691](https://github.com/dev-sec/ansible-collection-hardening/pull/691) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [8.8.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.8.0) (2023-08-04)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.7.0...8.8.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Add support for Fedora 38 [\#671](https://github.com/dev-sec/ansible-collection-hardening/issues/671)
|
||||
- auditd: add possibility to override config template [\#685](https://github.com/dev-sec/ansible-collection-hardening/pull/685) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Meecr0b](https://github.com/Meecr0b))
|
||||
- add debian 12 support [\#684](https://github.com/dev-sec/ansible-collection-hardening/pull/684) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- feat: explicitly support Fedora 37 and 38 [\#682](https://github.com/dev-sec/ansible-collection-hardening/pull/682) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([nejch](https://github.com/nejch))
|
||||
- Replace ssh\_keys group with root, where applicable and use less permissive file mode [\#677](https://github.com/dev-sec/ansible-collection-hardening/pull/677) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Add oddjob mkhomedir option rhel pam [\#675](https://github.com/dev-sec/ansible-collection-hardening/pull/675) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([imp1sh](https://github.com/imp1sh))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- How does one set `sshd_authenticationmethods` to include password authentication? [\#686](https://github.com/dev-sec/ansible-collection-hardening/issues/686)
|
||||
- FreeIPA environment mkhomedir fails [\#664](https://github.com/dev-sec/ansible-collection-hardening/issues/664)
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- What is the uscase of sysctl\_overwrite over ansible.posix.sysctl? [\#683](https://github.com/dev-sec/ansible-collection-hardening/issues/683)
|
||||
- `Ensure permissions on mysql-logfile are correct` chokes when `log_error` is set to `stderr` [\#673](https://github.com/dev-sec/ansible-collection-hardening/issues/673)
|
||||
- TASK TASK FAILED: \[devsec.hardening.os\_hardening : Set password ageing for existing regular \(non-system, non-root\) accounts\] [\#670](https://github.com/dev-sec/ansible-collection-hardening/issues/670)
|
||||
- After os\_hardening ssh not working [\#663](https://github.com/dev-sec/ansible-collection-hardening/issues/663)
|
||||
- Unsupported parameters for \(ansible.builtin.user\) module [\#650](https://github.com/dev-sec/ansible-collection-hardening/issues/650)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- setting gets ignored [\#680](https://github.com/dev-sec/ansible-collection-hardening/pull/680) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- add var-naming\[no-role-prefix\] to skip-list [\#679](https://github.com/dev-sec/ansible-collection-hardening/pull/679) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- expand on check conditions for non-file locations of logs [\#674](https://github.com/dev-sec/ansible-collection-hardening/pull/674) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([whysthatso](https://github.com/whysthatso))
|
||||
- use new molecule-plugins [\#667](https://github.com/dev-sec/ansible-collection-hardening/pull/667) ([schurzi](https://github.com/schurzi))
|
||||
- add spellchecking with codespell [\#662](https://github.com/dev-sec/ansible-collection-hardening/pull/662) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
|
||||
## [8.7.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.7.0) (2023-04-12)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.6.0...8.7.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Support BSD and other operating systems CI with VM based tests [\#599](https://github.com/dev-sec/ansible-collection-hardening/issues/599)
|
||||
- add check mode to molecule tests [\#644](https://github.com/dev-sec/ansible-collection-hardening/pull/644) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- add testing for OpenBSD and FreeBSD [\#642](https://github.com/dev-sec/ansible-collection-hardening/pull/642) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Only skip audit restart handler in docker [\#637](https://github.com/dev-sec/ansible-collection-hardening/pull/637) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))
|
||||
- Make action\_mail\_acct configurable in auditd [\#631](https://github.com/dev-sec/ansible-collection-hardening/pull/631) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- getent task is skipped if user previously ran it with a key parameter [\#646](https://github.com/dev-sec/ansible-collection-hardening/issues/646)
|
||||
- Error running devsec.hardening.os\_hardening role [\#645](https://github.com/dev-sec/ansible-collection-hardening/issues/645)
|
||||
- devsec.hardening.mysql\_hardening - Get all users that have no authentication\_string - Hello world [\#640](https://github.com/dev-sec/ansible-collection-hardening/issues/640)
|
||||
- fixes \#646 - add another condition to getent task [\#647](https://github.com/dev-sec/ansible-collection-hardening/pull/647) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([gbolo](https://github.com/gbolo))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- Invalid login.defs for RHEL6 [\#651](https://github.com/dev-sec/ansible-collection-hardening/issues/651)
|
||||
- Deprecation warnings for os\_hardening [\#638](https://github.com/dev-sec/ansible-collection-hardening/issues/638)
|
||||
- Write tests for MySQL user-deletion [\#445](https://github.com/dev-sec/ansible-collection-hardening/issues/445)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Update minimum required Ansible version for os\_hardening [\#657](https://github.com/dev-sec/ansible-collection-hardening/pull/657) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Update test environment [\#656](https://github.com/dev-sec/ansible-collection-hardening/pull/656) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Update dependency geerlingguy.git to v3.0.1 [\#654](https://github.com/dev-sec/ansible-collection-hardening/pull/654) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Configure Renovate [\#653](https://github.com/dev-sec/ansible-collection-hardening/pull/653) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- simplify MySQL queries for user deletion [\#641](https://github.com/dev-sec/ansible-collection-hardening/pull/641) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Bump creyD/prettier\_action from 4.2 to 4.3 [\#639](https://github.com/dev-sec/ansible-collection-hardening/pull/639) ([dependabot[bot]](https://github.com/apps/dependabot))
|
||||
- Fix molecule tests for EL7 [\#636](https://github.com/dev-sec/ansible-collection-hardening/pull/636) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- run our CI tests periodically [\#634](https://github.com/dev-sec/ansible-collection-hardening/pull/634) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- try to fix molecule local tests [\#632](https://github.com/dev-sec/ansible-collection-hardening/pull/632) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- remove unnecessary tasks for VM based test [\#629](https://github.com/dev-sec/ansible-collection-hardening/pull/629) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
|
||||
## [8.6.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.6.0) (2023-02-04)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.5.0...8.6.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- make number of warning days before user password expires configurable [\#628](https://github.com/dev-sec/ansible-collection-hardening/pull/628) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Normo](https://github.com/Normo))
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Bump hugo19941994/delete-draft-releases from 1.0.0 to 1.0.1 [\#627](https://github.com/dev-sec/ansible-collection-hardening/pull/627) ([dependabot[bot]](https://github.com/apps/dependabot))
|
||||
|
||||
## [8.5.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.5.0) (2023-01-30)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.4.0...8.5.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Add support for /etc/auditd.conf num\_logs to go with max\_log\_file\_action [\#616](https://github.com/dev-sec/ansible-collection-hardening/issues/616)
|
||||
- password ageing not enforced [\#570](https://github.com/dev-sec/ansible-collection-hardening/issues/570)
|
||||
- Rewrite system account detection and hardening and create tests [\#621](https://github.com/dev-sec/ansible-collection-hardening/pull/621) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Add support for /etc/auditd.conf num\_logs to go with max\_log\_file\_action [\#617](https://github.com/dev-sec/ansible-collection-hardening/pull/617) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([richardlock](https://github.com/richardlock))
|
||||
- Preserve default ownership and dir mode for /var/log on Ubuntu [\#615](https://github.com/dev-sec/ansible-collection-hardening/pull/615) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([stdtom](https://github.com/stdtom))
|
||||
- rewrite user home dir hardening [\#584](https://github.com/dev-sec/ansible-collection-hardening/pull/584) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
|
||||
- apply password age settings to existing regular users [\#582](https://github.com/dev-sec/ansible-collection-hardening/pull/582) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
|
||||
- Parametrize more auditd.conf options [\#535](https://github.com/dev-sec/ansible-collection-hardening/pull/535) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([kravietz](https://github.com/kravietz))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- os\_hardening is setting wrong ownership for /var/log on Ubuntu [\#614](https://github.com/dev-sec/ansible-collection-hardening/issues/614)
|
||||
- \[os\_hardening\] Task for setting `initramfs` modules does not match its condition [\#590](https://github.com/dev-sec/ansible-collection-hardening/issues/590) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
|
||||
- Support for Amazon Linux 2 [\#624](https://github.com/dev-sec/ansible-collection-hardening/pull/624) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([mmitnyan](https://github.com/mmitnyan))
|
||||
|
||||
**Deprecated:**
|
||||
|
||||
- deprecate rebuilding of initramfs [\#618](https://github.com/dev-sec/ansible-collection-hardening/pull/618) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- Ubuntu 22.04 vars file missing? [\#619](https://github.com/dev-sec/ansible-collection-hardening/issues/619)
|
||||
- SSH KexAlgorithms causes SSH daemon to fail [\#500](https://github.com/dev-sec/ansible-collection-hardening/issues/500)
|
||||
- Playbook won't run for hardening [\#462](https://github.com/dev-sec/ansible-collection-hardening/issues/462)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- do not let dependabot label our prs [\#626](https://github.com/dev-sec/ansible-collection-hardening/pull/626) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- run linting only when files inside roles change [\#625](https://github.com/dev-sec/ansible-collection-hardening/pull/625) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- cancel running tests if new commit to branch is made [\#622](https://github.com/dev-sec/ansible-collection-hardening/pull/622) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Fixed problems with running molecule locally with cgroup v2 [\#620](https://github.com/dev-sec/ansible-collection-hardening/pull/620) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Bump actions/setup-python from 1 to 4 [\#611](https://github.com/dev-sec/ansible-collection-hardening/pull/611) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([dependabot[bot]](https://github.com/apps/dependabot))
|
||||
- Bump creyD/prettier\_action from 3.1 to 4.2 [\#610](https://github.com/dev-sec/ansible-collection-hardening/pull/610) ([dependabot[bot]](https://github.com/apps/dependabot))
|
||||
- linting [\#603](https://github.com/dev-sec/ansible-collection-hardening/pull/603) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [8.4.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.4.0) (2022-12-17)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.3.0...8.4.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Implement Test for MySQL systemd service [\#606](https://github.com/dev-sec/ansible-collection-hardening/issues/606)
|
||||
- Extended net hardening [\#607](https://github.com/dev-sec/ansible-collection-hardening/pull/607) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
|
||||
- Add OpenSUSE support [\#605](https://github.com/dev-sec/ansible-collection-hardening/pull/605) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Allow ssh\_allow\_tcp\_forwarding to be a boolean [\#600](https://github.com/dev-sec/ansible-collection-hardening/pull/600) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([crisbal](https://github.com/crisbal))
|
||||
- OpenBSD does not support GSSAPI Authentication [\#598](https://github.com/dev-sec/ansible-collection-hardening/pull/598) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([dennisse](https://github.com/dennisse))
|
||||
- add Ansible specific templates for issues [\#596](https://github.com/dev-sec/ansible-collection-hardening/pull/596) ([schurzi](https://github.com/schurzi))
|
||||
- use github templates for new issues [\#595](https://github.com/dev-sec/ansible-collection-hardening/pull/595) ([schurzi](https://github.com/schurzi))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- os\_auth\_retries variable causes a comparison type error on pam tasks [\#593](https://github.com/dev-sec/ansible-collection-hardening/issues/593)
|
||||
- ssh\_hardening: Install selinux dependencies fails on Oracle Linux \(RHEL\) 9 [\#585](https://github.com/dev-sec/ansible-collection-hardening/issues/585)
|
||||
- OpenBSD does not set distributiuon\_major\_version [\#597](https://github.com/dev-sec/ansible-collection-hardening/pull/597) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([dennisse](https://github.com/dennisse))
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Check for github action updates daily [\#609](https://github.com/dev-sec/ansible-collection-hardening/pull/609) ([jlosito](https://github.com/jlosito))
|
||||
- add verify-task to check if mysql is running and enabled [\#608](https://github.com/dev-sec/ansible-collection-hardening/pull/608) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Updates handlers for new ansible syntax and deprecated options for legacy commands [\#602](https://github.com/dev-sec/ansible-collection-hardening/pull/602) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([jsievertde](https://github.com/jsievertde))
|
||||
- add notice to sign-off work to contributor guideline [\#601](https://github.com/dev-sec/ansible-collection-hardening/pull/601) ([schurzi](https://github.com/schurzi))
|
||||
|
||||
## [8.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.3.0) (2022-10-27)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.2.0...8.3.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- add hardening of root user account\(s\) [\#579](https://github.com/dev-sec/ansible-collection-hardening/pull/579) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- cast expected int types in pam tasks [\#594](https://github.com/dev-sec/ansible-collection-hardening/pull/594) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([dlouzan](https://github.com/dlouzan))
|
||||
- do not manage trusted user ca keys if none exist [\#580](https://github.com/dev-sec/ansible-collection-hardening/pull/580) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([hollow](https://github.com/hollow))
|
||||
|
||||
**Closed issues:**
|
||||
@@ -533,8 +16,6 @@
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- adopt all current suggestions from ansible-lint [\#592](https://github.com/dev-sec/ansible-collection-hardening/pull/592) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Support more os [\#588](https://github.com/dev-sec/ansible-collection-hardening/pull/588) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- run tests only on pushes to master or to PRs [\#581](https://github.com/dev-sec/ansible-collection-hardening/pull/581) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [8.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.2.0) (2022-09-08)
|
||||
@@ -562,7 +43,7 @@
|
||||
**Merged pull requests:**
|
||||
|
||||
- update supported OS in meta and fix linting [\#572](https://github.com/dev-sec/ansible-collection-hardening/pull/572) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- fix misleading comment [\#571](https://github.com/dev-sec/ansible-collection-hardening/pull/571) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
|
||||
- fix misleading comment [\#571](https://github.com/dev-sec/ansible-collection-hardening/pull/571) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([donestefan](https://github.com/donestefan))
|
||||
- only run release actions on upstream-repo [\#568](https://github.com/dev-sec/ansible-collection-hardening/pull/568) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [8.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.0.0) (2022-08-22)
|
||||
@@ -591,7 +72,7 @@
|
||||
**Implemented enhancements:**
|
||||
|
||||
- revert debian 9 change, only one tls variable now [\#562](https://github.com/dev-sec/ansible-collection-hardening/pull/562) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- add possibility to run ssh\_hardening as unprivileged user [\#561](https://github.com/dev-sec/ansible-collection-hardening/pull/561) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- add posibility to run ssh\_hardening as unprivileged user [\#561](https://github.com/dev-sec/ansible-collection-hardening/pull/561) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- add basic support for ubuntu22.04 [\#554](https://github.com/dev-sec/ansible-collection-hardening/pull/554) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Add full support for Debian 11 [\#538](https://github.com/dev-sec/ansible-collection-hardening/pull/538) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([addianto](https://github.com/addianto))
|
||||
|
||||
@@ -662,7 +143,7 @@
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- No such file directory error triggered by the kernel.unprivileged\_userns\_clone configuration. [\#514](https://github.com/dev-sec/ansible-collection-hardening/issues/514)
|
||||
- No such file directory error triggered by the kernel.unpriviliged\_userns\_clone configuration. [\#514](https://github.com/dev-sec/ansible-collection-hardening/issues/514)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
@@ -1101,8 +582,9 @@
|
||||
- Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-collection-hardening/pull/259) ([jaredledvina](https://github.com/jaredledvina))
|
||||
- Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-collection-hardening/pull/254) ([kravietz](https://github.com/kravietz))
|
||||
- Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-collection-hardening/pull/251) ([dustinmiller](https://github.com/dustinmiller))
|
||||
- Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
|
||||
- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
|
||||
- Make max\_log\_file\_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-collection-hardening/pull/246) ([jandd](https://github.com/jandd))
|
||||
- Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-collection-hardening/pull/240) ([ghost](https://github.com/ghost))
|
||||
- Fedora - Use new auto ansible\_python\_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-collection-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
|
||||
- add test support for CentOS8 [\#237](https://github.com/dev-sec/ansible-collection-hardening/pull/237) ([yeoldegrove](https://github.com/yeoldegrove))
|
||||
- Support configuring SELinux and default to enforcing [\#236](https://github.com/dev-sec/ansible-collection-hardening/pull/236) ([jaredledvina](https://github.com/jaredledvina))
|
||||
@@ -1143,7 +625,7 @@
|
||||
- remove prelink package, control package-09 [\#135](https://github.com/dev-sec/ansible-collection-hardening/pull/135) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- style update [\#134](https://github.com/dev-sec/ansible-collection-hardening/pull/134) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Remove deprecated include for static tasks and use instead import\_tasks fix \#131 [\#132](https://github.com/dev-sec/ansible-collection-hardening/pull/132) ([HelioCampos](https://github.com/HelioCampos))
|
||||
- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-collection-hardening/pull/130) ([FazleArefin](https://github.com/FazleArefin))
|
||||
- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-collection-hardening/pull/130) ([fazlearefin](https://github.com/fazlearefin))
|
||||
- install initramfs-tools [\#114](https://github.com/dev-sec/ansible-collection-hardening/pull/114) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- omit empty variables [\#106](https://github.com/dev-sec/ansible-collection-hardening/pull/106) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Supports --check mode [\#93](https://github.com/dev-sec/ansible-collection-hardening/pull/93) ([conorsch](https://github.com/conorsch))
|
||||
@@ -1151,7 +633,7 @@
|
||||
- Docker [\#90](https://github.com/dev-sec/ansible-collection-hardening/pull/90) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- debian 8 support [\#88](https://github.com/dev-sec/ansible-collection-hardening/pull/88) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-collection-hardening/pull/85) ([fitz123](https://github.com/fitz123))
|
||||
- replace ignore\_errors to failed\_when to suppress ugly error warnings [\#81](https://github.com/dev-sec/ansible-collection-hardening/pull/81) ([fitz123](https://github.com/fitz123))
|
||||
- replace ignore\_errors to failed\_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-collection-hardening/pull/81) ([fitz123](https://github.com/fitz123))
|
||||
- fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-collection-hardening/pull/79) ([fitz123](https://github.com/fitz123))
|
||||
- update platforms in meta-file [\#69](https://github.com/dev-sec/ansible-collection-hardening/pull/69) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- add webhook for ansible galaxy [\#68](https://github.com/dev-sec/ansible-collection-hardening/pull/68) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
@@ -1177,7 +659,7 @@
|
||||
- \[lots of\] deprecation warnings in Ansible 2.8 [\#221](https://github.com/dev-sec/ansible-collection-hardening/issues/221)
|
||||
- `squash_actions` deprecation warning [\#218](https://github.com/dev-sec/ansible-collection-hardening/issues/218)
|
||||
- login.defs.j2 template: ENV\_PATH is missing ':' before variable substitution [\#202](https://github.com/dev-sec/ansible-collection-hardening/issues/202)
|
||||
- auditd causing v5.0 to fail on unprivileged LXC's [\#191](https://github.com/dev-sec/ansible-collection-hardening/issues/191)
|
||||
- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-collection-hardening/issues/191)
|
||||
- Setting os\_security\_users\_allow has no effect [\#175](https://github.com/dev-sec/ansible-collection-hardening/issues/175)
|
||||
- minimize\_access: maximum recursion depth exceeded on Ansible 2.5 [\#171](https://github.com/dev-sec/ansible-collection-hardening/issues/171)
|
||||
- wrong permissions passwdqc [\#170](https://github.com/dev-sec/ansible-collection-hardening/issues/170)
|
||||
@@ -1210,6 +692,7 @@
|
||||
- replace module parameter fixed [\#297](https://github.com/dev-sec/ansible-collection-hardening/pull/297) ([danielkubat](https://github.com/danielkubat))
|
||||
- Addressing issue \#255 [\#258](https://github.com/dev-sec/ansible-collection-hardening/pull/258) ([ljkimmel](https://github.com/ljkimmel))
|
||||
- Fix \#247, cleanup conditions [\#248](https://github.com/dev-sec/ansible-collection-hardening/pull/248) ([fernandezcuesta](https://github.com/fernandezcuesta))
|
||||
- Fix error on applying the sysctl vars on containers [\#243](https://github.com/dev-sec/ansible-collection-hardening/pull/243) ([ghost](https://github.com/ghost))
|
||||
- Update location of NSA RHEL 5 Guide [\#235](https://github.com/dev-sec/ansible-collection-hardening/pull/235) ([jaredledvina](https://github.com/jaredledvina))
|
||||
- Fix typo [\#212](https://github.com/dev-sec/ansible-collection-hardening/pull/212) ([ruslo](https://github.com/ruslo))
|
||||
- Update modprobe to 0644 [\#211](https://github.com/dev-sec/ansible-collection-hardening/pull/211) ([joshuatalb](https://github.com/joshuatalb))
|
||||
@@ -1264,7 +747,7 @@
|
||||
- adjust permissions on shadow file on suse [\#311](https://github.com/dev-sec/ansible-collection-hardening/pull/311) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- fix fedora build [\#296](https://github.com/dev-sec/ansible-collection-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-collection-hardening/pull/289) ([schurzi](https://github.com/schurzi))
|
||||
- move hidepid vars into defaults so they're overwritable [\#285](https://github.com/dev-sec/ansible-collection-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-collection-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- install procps in debian so sysctl.conf exists [\#282](https://github.com/dev-sec/ansible-collection-hardening/pull/282) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- move defaults to os-specific vars [\#157](https://github.com/dev-sec/ansible-collection-hardening/pull/157) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Converts set to JSON-serializable list [\#126](https://github.com/dev-sec/ansible-collection-hardening/pull/126) ([pestaa](https://github.com/pestaa))
|
||||
@@ -1316,7 +799,7 @@
|
||||
- Repair debian install script [\#8](https://github.com/dev-sec/ansible-collection-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-collection-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-collection-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Change playbook-path to accommodate test-repo [\#4](https://github.com/dev-sec/ansible-collection-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-collection-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-collection-hardening/pull/3) ([arlimus](https://github.com/arlimus))
|
||||
- Add Securetty-support [\#2](https://github.com/dev-sec/ansible-collection-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-collection-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
+1
-34
@@ -15,7 +15,7 @@ In order to contribute code please:
|
||||
1. Fork the project on GitHub
|
||||
2. Clone the project
|
||||
3. Add changes (and tests)
|
||||
4. Commit, sign off and push your changes
|
||||
4. Commit and push
|
||||
5. Create a merge-request
|
||||
|
||||
To have your code merged, see the expectations listed below.
|
||||
@@ -28,24 +28,6 @@ Some great guidelines can be found [here](https://wiki.openstack.org/wiki/GitCom
|
||||
|
||||
## Expectations
|
||||
|
||||
## Sign off Your Work
|
||||
|
||||
The Developer Certificate of Origin (DCO) is a lightweight way for contributors to certify that they wrote or otherwise have the right to submit the code they are contributing to the project.
|
||||
[Here is the full text of the DCO](http://developercertificate.org/).
|
||||
Contributors must sign-off that they adhere to these requirements by adding a `Signed-off-by` line to commit messages.
|
||||
|
||||
```text
|
||||
This is my commit message
|
||||
|
||||
Signed-off-by: Random J Developer <random@developer.example.org>
|
||||
```
|
||||
|
||||
Git even has a -s command line option to append this automatically to your commit message:
|
||||
|
||||
```text
|
||||
git commit -s -m 'This is my commit message'
|
||||
```
|
||||
|
||||
### Don't reinvent the wheel
|
||||
|
||||
This hardening project doesn't intend to reinvent the configuration stack for services. Aim to use official configuration projects first and provide hardening as a layer on top. The goal is remove the need for a user to configure all aspects of services and maintain security configuration. This way, the user can still configure a service using the interface provided by the official project.
|
||||
@@ -93,21 +75,6 @@ We generally include test for coding guidelines:
|
||||
|
||||
Remember: Code is generally read much more often than written.
|
||||
|
||||
### Local testing of roles in this collection
|
||||
|
||||
We are using Molecule to test our roles.
|
||||
If you want to execute the tests on your machine you need Docker and Molecule.
|
||||
You will also need to set the `MOLECULE_DISTRO` environment variable to execute the tests.
|
||||
To find valid values for the variable you can take a look at our GitHub Action workflows in `.github/workflows/`.
|
||||
|
||||
Example for executing tests locally:
|
||||
|
||||
```bash
|
||||
pip install -r requirements.txt
|
||||
export MOLECULE_DISTRO="debian12"
|
||||
molecule test -s os_hardening
|
||||
```
|
||||
|
||||
### Use Markdown
|
||||
|
||||
Wherever possible, please refrain from any other formats and stick to simple markdown.
|
||||
@@ -26,7 +26,7 @@
|
||||
|
||||
- fix fedora build [\#296](https://github.com/dev-sec/ansible-os-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-os-hardening/pull/289) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([schurzi](https://github.com/schurzi))
|
||||
- move hidepid vars into defaults so they're overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [6.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/6.1.0) (2020-07-21)
|
||||
|
||||
@@ -90,7 +90,7 @@
|
||||
- Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-os-hardening/pull/259) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jaredledvina](https://github.com/jaredledvina))
|
||||
- Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-os-hardening/pull/254) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([kravietz](https://github.com/kravietz))
|
||||
- Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-os-hardening/pull/251) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
|
||||
- Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
|
||||
- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
|
||||
- Make max_log_file_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-os-hardening/pull/246) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jandd](https://github.com/jandd))
|
||||
- Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-os-hardening/pull/240) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([ghost](https://github.com/ghost))
|
||||
- Fedora - Use new auto ansible_python_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-os-hardening/pull/239) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jaredledvina](https://github.com/jaredledvina))
|
||||
@@ -165,7 +165,7 @@
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- auditd causing v5.0 to fail on unprivileged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
|
||||
- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
|
||||
- Setting os_security_users_allow has no effect [\#175](https://github.com/dev-sec/ansible-os-hardening/issues/175) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
|
||||
- add /usr/bin/su to suid_guid whitelist [\#199](https://github.com/dev-sec/ansible-os-hardening/pull/199) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([ccolic](https://github.com/ccolic))
|
||||
- ensure that permissions to su-binary are not restricted to root user and group only, if os_security_users_allow contains the value change_user [\#197](https://github.com/dev-sec/ansible-os-hardening/pull/197) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([szEvEz](https://github.com/szEvEz))
|
||||
@@ -346,7 +346,7 @@
|
||||
- Docker [\#90](https://github.com/dev-sec/ansible-os-hardening/pull/90) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- debian 8 support [\#88](https://github.com/dev-sec/ansible-os-hardening/pull/88) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-os-hardening/pull/85) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
|
||||
- replace ignore_errors to failed_when to suppress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
|
||||
- replace ignore_errors to failed_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
|
||||
- fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-os-hardening/pull/79) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
|
||||
|
||||
**Fixed bugs:**
|
||||
@@ -459,7 +459,7 @@
|
||||
- Repair debian install script [\#8](https://github.com/dev-sec/ansible-os-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-os-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-os-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Change playbook-path to accommodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-os-hardening/pull/3) ([arlimus](https://github.com/arlimus))
|
||||
- Add Securetty-support [\#2](https://github.com/dev-sec/ansible-os-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-os-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
@@ -1,26 +1,23 @@
|
||||
# Ansible Collection - devsec.hardening
|
||||
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Description
|
||||
|
||||
This collection provides battle tested hardening for:
|
||||
|
||||
- Linux operating systems:
|
||||
- CentOS Stream 9
|
||||
- AlmaLinux 8/9/10
|
||||
- Rocky Linux 8/9/10
|
||||
- Debian 11/12/13
|
||||
- Ubuntu 22.04/24.04/26.04
|
||||
- CentOS 7
|
||||
- Rocky Linux 8
|
||||
- Debian 10/11
|
||||
- Ubuntu 18.04/20.04/22.04
|
||||
- Amazon Linux (some roles supported)
|
||||
- Arch Linux (some roles supported)
|
||||
- Fedora 42/43/44 (some roles supported)
|
||||
- Fedora (some roles supported)
|
||||
- Suse Tumbleweed (some roles supported)
|
||||
- MySQL
|
||||
- MariaDB >= 5.5.65, >= 10.1.45, >= 10.3.17
|
||||
@@ -51,7 +48,7 @@ The other roles are in separate archives repositories:
|
||||
|
||||
## Minimum required Ansible-version
|
||||
|
||||
- Ansible >= 2.16
|
||||
- Ansible >= 2.9.10
|
||||
|
||||
## Included content
|
||||
|
||||
|
||||
+1
-5
@@ -1,6 +1,6 @@
|
||||
namespace: devsec
|
||||
name: hardening
|
||||
version: 10.5.2
|
||||
version: 8.2.0
|
||||
readme: README.md
|
||||
authors:
|
||||
- dev-sec <[email protected]>
|
||||
@@ -22,9 +22,6 @@ tags:
|
||||
- nginx_hardening
|
||||
- os_hardening
|
||||
- ssh_hardening
|
||||
- database
|
||||
- linux
|
||||
- security
|
||||
dependencies:
|
||||
ansible.posix: '>=1.0.0'
|
||||
community.crypto: '>=1.0.0'
|
||||
@@ -45,4 +42,3 @@ build_ignore:
|
||||
- .tox
|
||||
- tox.ini
|
||||
- .yamllint
|
||||
- renovate.json
|
||||
+1
-1
@@ -1,2 +1,2 @@
|
||||
---
|
||||
requires_ansible: ">=2.9.10"
|
||||
requires_ansible: '>=2.9.10'
|
||||
@@ -1,29 +1,31 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-mysql-hardening"
|
||||
- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
|
||||
hosts: all
|
||||
become: true
|
||||
collections:
|
||||
- devsec.hardening
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
|
||||
ansible.builtin.set_fact:
|
||||
mysql_python_package_debian: python3-pymysql
|
||||
set_fact:
|
||||
mysql_python_package_debian: "python3-pymysql"
|
||||
when:
|
||||
- mysql_python_package_debian is not defined
|
||||
- ansible_facts.distribution == "Ubuntu"
|
||||
- ansible_facts.distribution_major_version|int > 19
|
||||
- ansible_distribution == "Ubuntu"
|
||||
- ansible_distribution_major_version|int > 19
|
||||
|
||||
- name: Use Python 3 on Suse
|
||||
ansible.builtin.set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
- name: Determine required MySQL Python libraries.
|
||||
set_fact:
|
||||
mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
|
||||
when:
|
||||
- ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Include mysql_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.mysql_hardening
|
||||
- mysql_python_package_debian is not defined
|
||||
- ansible_distribution != "Ubuntu"
|
||||
- ansible_distribution_major_version|int < 20
|
||||
- include_role:
|
||||
name: mysql_hardening
|
||||
vars:
|
||||
overwrite_global_mycnf: false
|
||||
mysql_root_password: iloverandompasswordsbutthiswilldo
|
||||
|
||||
@@ -8,23 +8,27 @@ driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: instance
|
||||
image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
|
||||
image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
privileged: true
|
||||
cgroupns_mode: host
|
||||
pre_build_image: true
|
||||
environment:
|
||||
container: docker
|
||||
security_opts:
|
||||
- apparmor=unconfined
|
||||
env:
|
||||
http_proxy: "${http_proxy}"
|
||||
https_proxy: "${https_proxy}"
|
||||
no_proxy: "${no_proxy}"
|
||||
container: docker
|
||||
provisioner:
|
||||
name: ansible
|
||||
options:
|
||||
diff: true
|
||||
config_options:
|
||||
defaults:
|
||||
interpreter_python: auto_silent
|
||||
callbacks_enabled: profile_tasks, timer
|
||||
# Currently not supported by dev-sec.mysql role
|
||||
# inject_facts_as_vars: false
|
||||
callback_whitelist: profile_tasks, timer, yaml
|
||||
verifier:
|
||||
name: ansible
|
||||
|
||||
@@ -35,7 +39,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -51,13 +54,11 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
- prepare
|
||||
- check
|
||||
- converge
|
||||
- idempotence
|
||||
# - idempotence # not idempotent
|
||||
- verify
|
||||
- destroy
|
||||
@@ -1,66 +1,73 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-mysql-hardening"
|
||||
|
||||
- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Use Python 3 on Debian 11
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when:
|
||||
- ansible_distribution == 'Debian'
|
||||
- ansible_distribution_major_version|int >= 11
|
||||
|
||||
- name: Use Python 2 on Debian 10
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python
|
||||
when:
|
||||
- ansible_distribution == 'Debian'
|
||||
- ansible_distribution_major_version|int == 10
|
||||
|
||||
- name: Run the equivalent of "apt-get update && apt-get upgrade"
|
||||
apt:
|
||||
name: "*"
|
||||
state: latest
|
||||
update_cache: true
|
||||
when: ansible_os_family == 'Debian'
|
||||
|
||||
- name: install required tools on SuSE
|
||||
community.general.zypper:
|
||||
name: "python-xml"
|
||||
state: present
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: create missing directory
|
||||
file:
|
||||
path: "/etc/mysql/conf.d"
|
||||
state: directory
|
||||
|
||||
- name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
|
||||
set_fact:
|
||||
mysql_python_package_debian: "python3-pymysql"
|
||||
when:
|
||||
- mysql_python_package_debian is not defined
|
||||
- ansible_distribution == "Ubuntu"
|
||||
- ansible_distribution_major_version|int > 19
|
||||
|
||||
- name: Determine required MySQL Python libraries.
|
||||
set_fact:
|
||||
mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
|
||||
when:
|
||||
- mysql_python_package_debian is not defined
|
||||
- ansible_distribution != "Ubuntu"
|
||||
- ansible_distribution_major_version|int < 20
|
||||
|
||||
|
||||
- include_role:
|
||||
name: dev-sec.mysql
|
||||
|
||||
- name: create a user with an empty password
|
||||
community.mysql.mysql_query:
|
||||
query:
|
||||
- "CREATE USER foo@bar;"
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
vars:
|
||||
overwrite_global_mycnf: false
|
||||
mysql_root_password: iloverandompasswordsbutthiswilldo
|
||||
mysql_user_password: iloverandompasswordsbutthiswilldo
|
||||
mysql_config_file: /etc/mysql/mariadb.cnf
|
||||
mysql_root_password_update: true
|
||||
tasks:
|
||||
- name: Use Python 3 on Debian 11
|
||||
ansible.builtin.set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when:
|
||||
- ansible_facts.distribution == 'Debian'
|
||||
- ansible_facts.distribution_major_version|int >= 11
|
||||
|
||||
- name: Use Python 3 on Suse
|
||||
ansible.builtin.set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when:
|
||||
- ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Run the equivalent of "apt-get update && apt-get upgrade"
|
||||
ansible.builtin.apt:
|
||||
upgrade: safe
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
|
||||
- name: Install required python packages on Suse
|
||||
ansible.builtin.command: zypper -n install python311-rpm python311-PyMySQL
|
||||
changed_when: false
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Create missing directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/mysql
|
||||
state: directory
|
||||
mode: "0755"
|
||||
|
||||
- name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
|
||||
ansible.builtin.set_fact:
|
||||
mysql_python_package_debian: python3-pymysql
|
||||
when:
|
||||
- mysql_python_package_debian is not defined
|
||||
- ansible_facts.distribution == "Ubuntu"
|
||||
- ansible_facts.distribution_major_version|int > 19
|
||||
|
||||
- name: Install required MySQL Python libraries on RHEL
|
||||
ansible.builtin.dnf:
|
||||
name: "{% if 'python3' in ansible_python_interpreter | default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
|
||||
when:
|
||||
- ansible_facts.os_family == "RedHat"
|
||||
- ansible_facts.distribution_major_version == "7"
|
||||
|
||||
- name: Install mysql with a generic Ansible role
|
||||
ansible.builtin.include_role:
|
||||
name: dev-sec.mysql
|
||||
|
||||
- name: Include MySQL user prepare tasks
|
||||
ansible.builtin.include_tasks: prepare_tasks/mysql_users.yml
|
||||
@@ -1,32 +0,0 @@
|
||||
---
|
||||
- name: Create users for test
|
||||
ansible.mysql.mysql_query:
|
||||
query:
|
||||
- CREATE USER 'user'@'delete';
|
||||
- CREATE USER 'user'@'127.0.0.1';
|
||||
- CREATE USER 'user'@'::1';
|
||||
- CREATE USER 'user'@'%';
|
||||
- CREATE USER 'user'@'192.168.0.%';
|
||||
- CREATE USER 'user'@'192.168.0.1';
|
||||
- CREATE USER '%'@'192.168.0.1';
|
||||
- CREATE USER 'user'@'192.168.0.2' IDENTIFIED BY 'keep';
|
||||
- CREATE USER 'user'@'keep' IDENTIFIED BY 'keep';
|
||||
- CREATE USER 'user'@'192.168.%' IDENTIFIED BY 'keep';
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
|
||||
- name: Detect role support on MySQL
|
||||
ansible.mysql.mysql_query:
|
||||
query: >
|
||||
SELECT 1 FROM information_schema.COLUMNS
|
||||
WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
|
||||
AND COLUMN_NAME = 'is_role';
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_role_support
|
||||
|
||||
- name: Create roles for test
|
||||
ansible.mysql.mysql_query:
|
||||
query:
|
||||
- CREATE ROLE 'role_keep';
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
when:
|
||||
- mysql_role_support.rowcount[0] > 0
|
||||
@@ -1,4 +1,11 @@
|
||||
---
|
||||
roles:
|
||||
- name: geerlingguy.git
|
||||
version: 3.0.0
|
||||
- name: dev-sec.mysql
|
||||
version: master
|
||||
|
||||
collections:
|
||||
- name: https://github.com/ansible-collections/community.mysql.git
|
||||
type: git
|
||||
version: main
|
||||
@@ -6,50 +6,54 @@
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
roles:
|
||||
- geerlingguy.git
|
||||
tasks:
|
||||
- name: Use Python 3 on Suse
|
||||
ansible.builtin.set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when:
|
||||
- ansible_facts.os_family == 'Suse'
|
||||
- name: install fake SuSE-release for cinc compatibility
|
||||
copy:
|
||||
content: |
|
||||
openSUSE Faked Enterprise 2020 (x86_64)
|
||||
VERSION = 2020
|
||||
CODENAME = Faked Feature
|
||||
dest: /etc/SuSE-release
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0444'
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Install procps for debian systems
|
||||
ansible.builtin.apt:
|
||||
- name: install git for SuSE since geerlinguy.git does not support it
|
||||
zypper:
|
||||
name: git
|
||||
state: present
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: install procps for debian systems
|
||||
apt:
|
||||
name: procps
|
||||
state: present
|
||||
update_cache: true
|
||||
when: ansible_facts.distribution == 'Debian'
|
||||
when: ansible_distribution == 'Debian'
|
||||
|
||||
- name: Include tests for the service
|
||||
ansible.builtin.include_tasks: verify_tasks/service.yml
|
||||
- name: download cinc-auditor
|
||||
get_url:
|
||||
url: https://omnitruck.cinc.sh/install.sh
|
||||
dest: /tmp/install.sh
|
||||
mode: '0775'
|
||||
|
||||
- name: Include tests for MySQL user
|
||||
ansible.builtin.include_tasks: verify_tasks/mysql_users.yml
|
||||
- name: install cinc-auditor
|
||||
shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
|
||||
|
||||
- name: Verify
|
||||
hosts: localhost
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Execute cinc-auditor tests
|
||||
ansible.builtin.command: >
|
||||
docker run
|
||||
--volume /run/docker.sock:/run/docker.sock
|
||||
docker.io/cincproject/auditor exec
|
||||
-t docker://instance
|
||||
--no-show-progress --no-color
|
||||
--no-distinct-exit https://github.com/dev-sec/mysql-baseline/archive/refs/heads/master.zip
|
||||
command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/mysql-baseline/archive/refs/heads/master.zip"
|
||||
register: test_results
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display details about the cinc-auditor results
|
||||
ansible.builtin.debug:
|
||||
debug:
|
||||
msg: "{{ test_results.stdout_lines }}"
|
||||
|
||||
- name: Fail when tests fail
|
||||
ansible.builtin.fail:
|
||||
msg: Inspec failed to validate
|
||||
fail:
|
||||
msg: "Inspec failed to validate"
|
||||
when: test_results.rc != 0
|
||||
@@ -1,41 +0,0 @@
|
||||
---
|
||||
- name: Get all users from MySQL server
|
||||
ansible.mysql.mysql_query:
|
||||
query: >
|
||||
SELECT CONCAT(USER, '@', HOST) AS users FROM mysql.user;
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_users
|
||||
|
||||
- name: Create list of users from mysql query
|
||||
ansible.builtin.set_fact:
|
||||
mysql_users_list: "{{ mysql_users.query_result.0 | json_query('[*].users') | list }}"
|
||||
|
||||
- name: Assert that only accounts with password remain
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- '"user@delete" not in mysql_users_list'
|
||||
- '"[email protected]" not in mysql_users_list'
|
||||
- '"user@::1" not in mysql_users_list'
|
||||
- '"user@%" not in mysql_users_list'
|
||||
- '"[email protected].%" not in mysql_users_list'
|
||||
- '"[email protected]" not in mysql_users_list'
|
||||
- '"%@192.168.0.1" not in mysql_users_list'
|
||||
- '"[email protected]" in mysql_users_list'
|
||||
- '"user@keep" in mysql_users_list'
|
||||
- '"[email protected].%" in mysql_users_list'
|
||||
|
||||
- name: Detect role support on MySQL
|
||||
ansible.mysql.mysql_query:
|
||||
query: >
|
||||
SELECT 1 FROM information_schema.COLUMNS
|
||||
WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
|
||||
AND COLUMN_NAME = 'is_role';
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_role_support
|
||||
|
||||
- name: Assert that roles remain
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- '"role_keep@" in mysql_users_list'
|
||||
when:
|
||||
- mysql_role_support.rowcount[0] > 0
|
||||
@@ -1,16 +0,0 @@
|
||||
---
|
||||
- name: Load variables from role to use the "mysql_daemon" variable
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.mysql_hardening
|
||||
apply:
|
||||
tags:
|
||||
- never
|
||||
|
||||
- name: Populate service facts
|
||||
ansible.builtin.service_facts:
|
||||
|
||||
- name: Check if MySQL is running and enabled
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- ansible_facts.services[mysql_daemon + '.service'].state == 'running'
|
||||
- ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
become: true
|
||||
hosts: all
|
||||
environment:
|
||||
@@ -7,9 +7,8 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
vars:
|
||||
nginx_ppa_use: true
|
||||
nginx_ppa_version: stable
|
||||
- nginx_ppa_use: true
|
||||
- nginx_ppa_version: stable
|
||||
tasks:
|
||||
- name: Include nginx_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.nginx_hardening
|
||||
- include_role:
|
||||
name: nginx_hardening
|
||||
@@ -7,23 +7,28 @@ driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: instance
|
||||
image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
|
||||
image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
privileged: true
|
||||
cgroupns_mode: host
|
||||
pre_build_image: true
|
||||
tmpfs:
|
||||
- /tmp
|
||||
- /run
|
||||
capabilities:
|
||||
- SYS_ADMIN
|
||||
tty: true
|
||||
env:
|
||||
http_proxy: "${http_proxy}"
|
||||
https_proxy: "${https_proxy}"
|
||||
no_proxy: "${no_proxy}"
|
||||
container: docker
|
||||
provisioner:
|
||||
name: ansible
|
||||
options:
|
||||
diff: true
|
||||
config_options:
|
||||
defaults:
|
||||
interpreter_python: auto_silent
|
||||
callbacks_enabled: profile_tasks, timer
|
||||
# Currently not supported by geerlingguy.nginx role
|
||||
# inject_facts_as_vars: false
|
||||
callback_whitelist: profile_tasks, timer, yaml
|
||||
verifier:
|
||||
name: ansible
|
||||
|
||||
@@ -34,7 +39,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -50,12 +54,10 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
- prepare
|
||||
- check
|
||||
- converge
|
||||
- idempotence
|
||||
- verify
|
||||
|
||||
@@ -1,24 +1,24 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
hosts: localhost
|
||||
vars:
|
||||
nginx_main_template_enable: true
|
||||
nginx_main_template:
|
||||
template_file: nginx.conf.j2
|
||||
conf_file_name: nginx.conf
|
||||
conf_file_location: /etc/nginx/
|
||||
user: www-data
|
||||
worker_processes: auto
|
||||
error_level: warn
|
||||
worker_connections: 1024
|
||||
http_enable: true
|
||||
http_settings:
|
||||
keepalive_timeout: 65
|
||||
cache: false
|
||||
rate_limit: false
|
||||
keyval: false
|
||||
stream_enable: false
|
||||
http_global_autoindex: false
|
||||
- nginx_main_template_enable: true
|
||||
- nginx_main_template:
|
||||
template_file: nginx.conf.j2
|
||||
conf_file_name: nginx.conf
|
||||
conf_file_location: /etc/nginx/
|
||||
user: www-data
|
||||
worker_processes: auto
|
||||
error_level: warn
|
||||
worker_connections: 1024
|
||||
http_enable: true
|
||||
http_settings:
|
||||
keepalive_timeout: 65
|
||||
cache: false
|
||||
rate_limit: false
|
||||
keyval: false
|
||||
stream_enable: false
|
||||
http_global_autoindex: false
|
||||
roles:
|
||||
- nginxinc.nginx
|
||||
- nginx_hardening
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
hosts: localhost
|
||||
roles:
|
||||
- nginxinc.nginx
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
- name: prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
become: true
|
||||
hosts: all
|
||||
environment:
|
||||
@@ -7,17 +7,22 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Install required packages
|
||||
ansible.builtin.package:
|
||||
name: python3-apt
|
||||
- name: install required tools on SuSE
|
||||
community.general.zypper:
|
||||
name: "python-xml"
|
||||
state: present
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: install required packages
|
||||
package:
|
||||
name: "python3-apt"
|
||||
update_cache: true
|
||||
ignore_errors: true # noqa ignore-errors
|
||||
ignore_errors: true # noqa ignore-errors
|
||||
|
||||
- name: Set correct distribution Version for Amazon Linux
|
||||
ansible.builtin.set_fact:
|
||||
set_fact:
|
||||
ansible_distribution_major_version: 7
|
||||
when: ansible_facts.distribution == 'Amazon'
|
||||
when: ansible_distribution == 'Amazon'
|
||||
|
||||
- name: Install nginx with a generic Ansible role
|
||||
ansible.builtin.include_role:
|
||||
- include_role:
|
||||
name: geerlingguy.nginx
|
||||
@@ -1,3 +1,4 @@
|
||||
---
|
||||
roles:
|
||||
- name: geerlingguy.nginx
|
||||
- geerlingguy.git
|
||||
- geerlingguy.nginx
|
||||
@@ -6,38 +6,57 @@
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
roles:
|
||||
- geerlingguy.git
|
||||
tasks:
|
||||
- name: Install procps for debian systems
|
||||
ansible.builtin.apt:
|
||||
name: procps
|
||||
- name: install fake SuSE-release for cinc compatibility
|
||||
copy:
|
||||
content: |
|
||||
openSUSE Faked Enterprise 2020 (x86_64)
|
||||
VERSION = 2020
|
||||
CODENAME = Faked Feature
|
||||
dest: /etc/SuSE-release
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0444'
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: install git for SuSE since geerlinguy.git does not support it
|
||||
zypper:
|
||||
name: git
|
||||
state: present
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Run the equivalent of "apt-get update" as a separate step
|
||||
apt:
|
||||
update_cache: true
|
||||
when: ansible_facts.distribution == 'Debian'
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
|
||||
- name: install required tools on debian
|
||||
apt:
|
||||
name: procps
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
|
||||
- name: download cinc-auditor
|
||||
get_url:
|
||||
url: https://omnitruck.cinc.sh/install.sh
|
||||
dest: /tmp/install.sh
|
||||
mode: '0775'
|
||||
|
||||
- name: install cinc-auditor
|
||||
shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
|
||||
|
||||
- name: Verify
|
||||
hosts: localhost
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Execute cinc-auditor tests
|
||||
ansible.builtin.command: >
|
||||
docker run
|
||||
--volume /run/docker.sock:/run/docker.sock
|
||||
docker.io/cincproject/auditor exec
|
||||
-t docker://instance
|
||||
--no-show-progress --no-color
|
||||
--no-distinct-exit https://github.com/dev-sec/nginx-baseline/archive/refs/heads/master.zip
|
||||
command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/nginx-baseline/archive/refs/heads/master.zip"
|
||||
register: test_results
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display details about the cinc-auditor results
|
||||
ansible.builtin.debug:
|
||||
debug:
|
||||
msg: "{{ test_results.stdout_lines }}"
|
||||
|
||||
- name: Fail when tests fail
|
||||
ansible.builtin.fail:
|
||||
msg: Inspec failed to validate
|
||||
fail:
|
||||
msg: "Inspec failed to validate"
|
||||
when: test_results.rc != 0
|
||||
@@ -1,36 +1,33 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
collections:
|
||||
- devsec.hardening
|
||||
tasks:
|
||||
- name: Workaround for https://github.com/ansible/ansible/issues/66304
|
||||
ansible.builtin.set_fact:
|
||||
ansible_virtualization_type: docker
|
||||
- name: Include os_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.os_hardening
|
||||
- name: workaround for https://github.com/ansible/ansible/issues/66304
|
||||
set_fact:
|
||||
ansible_virtualization_type: "docker"
|
||||
- include_role:
|
||||
name: os_hardening
|
||||
vars:
|
||||
os_security_users_allow: change_user
|
||||
os_security_kernel_enable_core_dump: false
|
||||
os_auditd_enabled: false
|
||||
os_security_suid_sgid_remove_from_unknown: true
|
||||
os_auth_pam_passwdqc_enable: false
|
||||
os_auth_lockout_time: 15
|
||||
os_env_extra_user_paths: [/home]
|
||||
os_desktop_enable: true
|
||||
os_env_extra_user_paths: ['/home']
|
||||
os_auth_allow_homeless: true
|
||||
os_security_suid_sgid_blacklist: [/bin/umount]
|
||||
os_security_suid_sgid_whitelist: [/usr/bin/rlogin]
|
||||
os_security_suid_sgid_blacklist: ['/bin/umount']
|
||||
os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
|
||||
os_filesystem_whitelist: []
|
||||
os_yum_repo_file_whitelist: [foo.repo]
|
||||
os_users_without_password_ageing: [pw_no_ageing]
|
||||
os_auth_pw_warn_age: 7
|
||||
os_yum_repo_file_whitelist: ['foo.repo']
|
||||
os_netrc_enabled: false
|
||||
os_ignore_users: [shell_sys_acc]
|
||||
os_ignore_home_folder_users: [user_with_777_home]
|
||||
sysctl_config:
|
||||
net.ipv4.ip_forward: 0
|
||||
net.ipv6.conf.all.forwarding: 0
|
||||
@@ -71,6 +68,8 @@
|
||||
# - name: wrapper playbook for kitchen testing "ansible-os-hardening"
|
||||
# hosts: all
|
||||
# become: true
|
||||
# collections:
|
||||
# - devsec.hardening
|
||||
# vars:
|
||||
# os_auditd_enabled: false
|
||||
# tasks:
|
||||
@@ -80,9 +79,9 @@
|
||||
# when: ansible_facts.distribution == 'Fedora'
|
||||
#
|
||||
# - name: Run the equivalent of "apt-get update" as a separate step
|
||||
# ansible.builtin.apt:
|
||||
# apt:
|
||||
# update_cache: yes
|
||||
# when: ansible_facts.os_family == 'Debian'
|
||||
#
|
||||
# - include_role:
|
||||
# name: devsec.hardening.os_hardening
|
||||
# name: os_hardening
|
||||
@@ -1,24 +1,34 @@
|
||||
---
|
||||
dependency:
|
||||
name: galaxy
|
||||
options:
|
||||
role-file: molecule/os_hardening/requirements.yml
|
||||
driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: instance
|
||||
image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
|
||||
image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
privileged: true
|
||||
cgroupns_mode: host
|
||||
pre_build_image: true
|
||||
tmpfs:
|
||||
- /tmp
|
||||
- /run
|
||||
capabilities:
|
||||
- SYS_ADMIN
|
||||
tty: true
|
||||
env:
|
||||
http_proxy: "${http_proxy}"
|
||||
https_proxy: "${https_proxy}"
|
||||
no_proxy: "${no_proxy}"
|
||||
container: docker
|
||||
provisioner:
|
||||
name: ansible
|
||||
options:
|
||||
diff: true
|
||||
config_options:
|
||||
defaults:
|
||||
interpreter_python: auto_silent
|
||||
callbacks_enabled: profile_tasks, timer
|
||||
inject_facts_as_vars: false
|
||||
callback_whitelist: profile_tasks, timer, yaml
|
||||
verifier:
|
||||
name: ansible
|
||||
|
||||
@@ -29,7 +39,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -45,12 +54,10 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
- prepare
|
||||
- check
|
||||
- converge
|
||||
- idempotence
|
||||
- verify
|
||||
|
||||
@@ -1,38 +1,40 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
hosts: all
|
||||
become: true
|
||||
collections:
|
||||
- devsec.hardening
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Set ansible_python_interpreter to "/usr/bin/python3" on fedora
|
||||
ansible.builtin.set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
- name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
|
||||
set_fact:
|
||||
ansible_python_interpreter: "/usr/bin/python3"
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Run the equivalent of "apt-get update && apt-get upgrade"
|
||||
ansible.builtin.apt:
|
||||
upgrade: safe
|
||||
apt:
|
||||
name: "*"
|
||||
state: latest
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
when: ansible_os_family == 'Debian'
|
||||
|
||||
- name: Install required tools on SuSE
|
||||
- name: install required tools on SuSE
|
||||
# cannot use zypper module, since it depends on python-xml
|
||||
ansible.builtin.command: zypper -n install awk
|
||||
changed_when: false
|
||||
shell: "zypper -n install python-xml"
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Install required tools on fedora
|
||||
ansible.builtin.dnf:
|
||||
- name: install required tools on fedora
|
||||
dnf:
|
||||
name:
|
||||
- python
|
||||
- findutils
|
||||
- procps-ng
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Install required tools on Arch
|
||||
- name: install required tools on Arch
|
||||
community.general.pacman:
|
||||
name:
|
||||
- awk
|
||||
@@ -40,8 +42,8 @@
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Archlinux'
|
||||
|
||||
- name: Install required tools on RHEL # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
- name: install required tools on RHEL # noqa ignore-errors
|
||||
yum:
|
||||
name:
|
||||
- openssh-clients
|
||||
- openssh
|
||||
@@ -49,19 +51,14 @@
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Create recursing symlink to test minimize access
|
||||
ansible.builtin.shell: rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz
|
||||
- name: create recursing symlink to test minimize access
|
||||
shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
|
||||
changed_when: false
|
||||
|
||||
- name: Include YUM prepare tasks
|
||||
ansible.builtin.include_tasks: prepare_tasks/yum.yml
|
||||
- name: include YUM prepare tasks
|
||||
include_tasks: prepare_tasks/yum.yml
|
||||
when: ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Include preparation tasks
|
||||
ansible.builtin.include_tasks:
|
||||
file: "{{ item }}"
|
||||
loop:
|
||||
- prepare_tasks/netrc.yml
|
||||
- prepare_tasks/pw_ageing.yml
|
||||
- prepare_tasks/sys_account_shell.yml
|
||||
- prepare_tasks/ignore_home_folders.yml
|
||||
- name: include YUM prepare tasks
|
||||
include_tasks: prepare_tasks/netrc.yml
|
||||
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
- name: Create user whose home-folder should not be touched
|
||||
ansible.builtin.user:
|
||||
name: user_with_777_home
|
||||
|
||||
- name: Change mode of home-folder for user to 777
|
||||
ansible.builtin.file:
|
||||
path: /home/user_with_777_home
|
||||
mode: "0777"
|
||||
@@ -1,8 +1,8 @@
|
||||
---
|
||||
- name: create '.netrc' in /root
|
||||
ansible.builtin.copy:
|
||||
dest: /root/.netrc
|
||||
mode: "0600"
|
||||
dest: '/root/.netrc'
|
||||
mode: '0600'
|
||||
content: |
|
||||
machine localhost
|
||||
login root
|
||||
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
- name: Create user those password ageing should not be changed
|
||||
user:
|
||||
name: pw_no_ageing
|
||||
password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
|
||||
password_expire_max: "-1"
|
||||
|
||||
- name: Create user those password ageing should be changed
|
||||
user:
|
||||
name: pw_ageing
|
||||
password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
|
||||
password_expire_max: "-1"
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
- name: Create system user with shell that should keep it
|
||||
user:
|
||||
name: shell_sys_acc
|
||||
shell: /bin/bash
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Create 'foo' repository
|
||||
- name: create 'foo' repository
|
||||
ansible.builtin.yum_repository:
|
||||
name: foo
|
||||
description: mandatory description
|
||||
@@ -7,7 +7,7 @@
|
||||
enabled: false
|
||||
gpgcheck: false
|
||||
|
||||
- name: Create 'bar' repository
|
||||
- name: create 'bar' repository
|
||||
ansible.builtin.yum_repository:
|
||||
name: bar
|
||||
description: mandatory description
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
---
|
||||
roles:
|
||||
- geerlingguy.git
|
||||
@@ -6,82 +6,82 @@
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
roles:
|
||||
- geerlingguy.git
|
||||
tasks:
|
||||
- name: Set ansible_python_interpreter to "/usr/bin/python3"
|
||||
ansible.builtin.set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
- name: install fake SuSE-release for cinc compatibility
|
||||
copy:
|
||||
content: |
|
||||
openSUSE Faked Enterprise 2020 (x86_64)
|
||||
VERSION = 2020
|
||||
CODENAME = Faked Feature
|
||||
dest: /etc/SuSE-release
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0444'
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Include verification tasks
|
||||
ansible.builtin.include_tasks:
|
||||
file: "{{ item }}"
|
||||
loop:
|
||||
- verify_tasks/sys_account_shell.yml
|
||||
- verify_tasks/pw_ageing.yml
|
||||
- verify_tasks/netrc.yml
|
||||
- verify_tasks/ignore_home_folders.yml
|
||||
- verify_tasks/ssh_auth_locked.yml
|
||||
- name: install git for SuSE since geerlinguy.git does not support it
|
||||
zypper:
|
||||
name: git
|
||||
state: present
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
# temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
|
||||
# - name: Include PAM tests
|
||||
# ansible.builtin.include_tasks: verify_tasks/pam.yml
|
||||
# when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
|
||||
- name: Run the equivalent of "apt-get update" as a separate step
|
||||
apt:
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
|
||||
- name: Include YUM tests
|
||||
ansible.builtin.include_tasks: verify_tasks/yum.yml
|
||||
- name: install required tools on debian
|
||||
apt:
|
||||
name: procps
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
|
||||
- name: include netrc tests
|
||||
include_tasks: verify_tasks/netrc.yml
|
||||
|
||||
- name: include PAM tests
|
||||
include_tasks: verify_tasks/pam.yml
|
||||
when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: include YUM tests
|
||||
include_tasks: verify_tasks/yum.yml
|
||||
when: ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Verify
|
||||
hosts: localhost
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Execute cinc-auditor tests
|
||||
ansible.builtin.command: >
|
||||
docker run
|
||||
--volume /run/docker.sock:/run/docker.sock
|
||||
--volume {{ playbook_dir }}/waivers.yaml:/waivers.yaml
|
||||
docker.io/cincproject/auditor exec
|
||||
-t docker://instance
|
||||
--no-show-progress --no-color
|
||||
--waiver-file /waivers.yaml
|
||||
--no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip
|
||||
- name: download cinc-auditor
|
||||
get_url:
|
||||
url: https://omnitruck.cinc.sh/install.sh
|
||||
dest: /tmp/install.sh
|
||||
mode: '0775'
|
||||
|
||||
- name: install cinc-auditor
|
||||
shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
|
||||
|
||||
- name: Execute cinc-auditor tests # noqa ignore-errors
|
||||
command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
|
||||
register: test_results
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display details about the cinc-auditor results
|
||||
ansible.builtin.debug:
|
||||
debug:
|
||||
msg: "{{ test_results.stdout_lines }}"
|
||||
|
||||
- name: Fail when tests fail
|
||||
ansible.builtin.fail:
|
||||
msg: Inspec failed to validate
|
||||
fail:
|
||||
msg: "Inspec failed to validate"
|
||||
when: test_results.rc != 0
|
||||
|
||||
- name: Verify
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
vars:
|
||||
os_auditd_enabled: false
|
||||
os_env_umask: "027 #override"
|
||||
tasks:
|
||||
# test if variable can be overridden
|
||||
- name: Workaround for https://github.com/ansible/ansible/issues/66304
|
||||
ansible.builtin.set_fact:
|
||||
ansible_virtualization_type: docker
|
||||
- name: workaround for https://github.com/ansible/ansible/issues/66304
|
||||
set_fact:
|
||||
ansible_virtualization_type: "docker"
|
||||
os_env_umask: "027 #override"
|
||||
|
||||
- name: Include os_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.os_hardening
|
||||
- include_role:
|
||||
name: os_hardening
|
||||
|
||||
- name: Verify os_env_umask
|
||||
ansible.builtin.command:
|
||||
- name: verify os_env_umask
|
||||
shell:
|
||||
cmd: "grep '027 #override' /etc/login.defs"
|
||||
changed_when: false
|
||||
@@ -1,10 +0,0 @@
|
||||
---
|
||||
- name: Get properties of user user_with_777_home's home-folder
|
||||
ansible.builtin.stat:
|
||||
path: /home/user_with_777_home
|
||||
register: stats
|
||||
|
||||
- name: Check that the home-folder has mode 777
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- stats.stat.mode == "0777"
|
||||
@@ -1,19 +1,19 @@
|
||||
---
|
||||
- name: Test that .netrc in root homedir exists
|
||||
- name: test that .netrc in root homedir exists
|
||||
ansible.builtin.file:
|
||||
path: /root/.netrc
|
||||
path: '/root/.netrc'
|
||||
state: file
|
||||
register: result_test_netrc
|
||||
|
||||
- name: Output result if .netrc for user root exists
|
||||
- name: output result if .netrc for user root exists
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- result_test_netrc.state == 'file'
|
||||
fail_msg: .netrc in /root/ not present
|
||||
success_msg: .netrc exists in /root/
|
||||
- "result_test_netrc.state == 'file'"
|
||||
fail_msg: ".netrc in /root/ not present"
|
||||
success_msg: ".netrc exists in /root/"
|
||||
|
||||
- name: Delete '.netrc' in /root
|
||||
- name: delete '.netrc' in /root
|
||||
ansible.builtin.file:
|
||||
path: /root/.netrc
|
||||
path: '/root/.netrc'
|
||||
state: absent
|
||||
when: result_test_netrc.state == 'file'
|
||||
@@ -1,24 +1,17 @@
|
||||
---
|
||||
- name: install pip
|
||||
package:
|
||||
name:
|
||||
- python3-pip
|
||||
- python3-setuptools
|
||||
state: present
|
||||
|
||||
- name: install pam-tester
|
||||
ansible.builtin.pip:
|
||||
name: pam-tester
|
||||
state: present
|
||||
executable: /usr/bin/pip3
|
||||
- name: download pam-tester
|
||||
get_url:
|
||||
url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
|
||||
dest: /bin/pam-tester
|
||||
mode: 0555
|
||||
|
||||
- name: set password for test
|
||||
ansible.builtin.set_fact:
|
||||
test_pw: myTest!pw
|
||||
set_fact:
|
||||
test_pw: "myTest!pw"
|
||||
|
||||
- name: set locale for test
|
||||
ansible.builtin.set_fact:
|
||||
locale: en_US.UTF-8
|
||||
set_fact:
|
||||
locale: "en_US.UTF-8"
|
||||
when:
|
||||
- ansible_facts.os_family == 'RedHat'
|
||||
- ansible_facts.distribution_major_version < '8'
|
||||
@@ -28,26 +21,26 @@
|
||||
name: testuser
|
||||
password: "{{ test_pw | password_hash('sha512') }}"
|
||||
|
||||
- name: check successful login with correct password
|
||||
ansible.builtin.shell:
|
||||
cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
|
||||
- name: check successfull login with correct password
|
||||
shell:
|
||||
cmd: "pam-tester --user testuser --password {{ test_pw }}"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
LANG: "{{ locale | default('C.UTF-8') }}"
|
||||
|
||||
- name: check unsuccessful login with incorrect password
|
||||
ansible.builtin.shell:
|
||||
cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail
|
||||
- name: check unsuccessfull login with incorrect password
|
||||
shell:
|
||||
cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
LANG: "{{ locale | default('C.UTF-8') }}"
|
||||
with_sequence: count=6
|
||||
|
||||
- name: check unsuccessful login, with correct password (lockout)
|
||||
ansible.builtin.shell:
|
||||
cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail
|
||||
- name: check unsuccessfull login, with correct password (lockout)
|
||||
shell:
|
||||
cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
@@ -57,9 +50,9 @@
|
||||
pause:
|
||||
seconds: 20
|
||||
|
||||
- name: check successful login
|
||||
ansible.builtin.shell:
|
||||
cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
|
||||
- name: check successfull login
|
||||
shell:
|
||||
cmd: "pam-tester --user testuser --password {{ test_pw }}"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
|
||||
@@ -1,32 +0,0 @@
|
||||
---
|
||||
- name: Get Password Expiry date for use pw_no_ageing
|
||||
ansible.builtin.shell: chage -l pw_no_ageing | grep "Password expires" | cut -d ":" -f 2
|
||||
changed_when: false
|
||||
register: expiry_date
|
||||
|
||||
- name: Check that the expiry date of pw_no_ageing is "never"
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- expiry_date.stdout | trim == 'never'
|
||||
|
||||
- name: Get Password Expiry date for pw_ageing
|
||||
ansible.builtin.shell: chage -l pw_ageing | grep "Password expires" | cut -d ":" -f 2
|
||||
changed_when: false
|
||||
register: expiry_date
|
||||
|
||||
- name: Check that the expiry date of pw_ageing is 60 days
|
||||
ansible.builtin.assert:
|
||||
# this uses the date from the expire_date variable and subtracts the current date.
|
||||
# it should be bigger that the password_expire_min of the user "pw_no_ageing"
|
||||
that:
|
||||
- ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_facts.date_time.date | to_datetime('%Y-%m-%d')).days == 60
|
||||
|
||||
- name: Get Password Expiry warning days for pw_ageing
|
||||
ansible.builtin.shell: chage -l pw_ageing | grep "warning before password expires" | cut -d ":" -f 2
|
||||
changed_when: false
|
||||
register: expiry_warndays
|
||||
|
||||
- name: Check that number of days of warning before password expires is 7 days
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- expiry_warndays.stdout | trim == '7'
|
||||
@@ -1,90 +0,0 @@
|
||||
---
|
||||
- name: Install tools
|
||||
package:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
ignore_errors: true
|
||||
loop:
|
||||
- sshpass
|
||||
- openssh
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
|
||||
- name: Allow password Login for sshd
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
search_string: PasswordAuthentication no
|
||||
line: PasswordAuthentication yes
|
||||
when:
|
||||
- ansible_facts.distribution == "Amazon"
|
||||
|
||||
- name: Start sshd service
|
||||
ansible.builtin.service:
|
||||
name: "{{ item }}"
|
||||
state: started
|
||||
ignore_errors: true
|
||||
loop:
|
||||
- sshd
|
||||
- ssh
|
||||
|
||||
- name: Set password for test
|
||||
ansible.builtin.set_fact:
|
||||
test_pw: myTest!pw
|
||||
|
||||
- name: Create locked_user
|
||||
user:
|
||||
name: locked_user
|
||||
password: "{{ test_pw | password_hash('sha512') }}"
|
||||
|
||||
- name: Create ssh-client-keypair
|
||||
community.crypto.openssh_keypair:
|
||||
path: /root/locked_user_id
|
||||
type: ed25519
|
||||
state: present
|
||||
register: generated_key
|
||||
|
||||
- name: Add ssh-public-key to locked_user
|
||||
ansible.posix.authorized_key:
|
||||
user: locked_user
|
||||
key: "{{ generated_key.public_key }}"
|
||||
state: present
|
||||
|
||||
- name: Check successful login with password
|
||||
ansible.builtin.shell:
|
||||
cmd: sshpass -p {{ test_pw }} ssh -o StrictHostKeyChecking=no locked_user@localhost echo "success"
|
||||
|
||||
- name: Check successful login with ssh key
|
||||
ansible.builtin.shell:
|
||||
cmd: ssh -i /root/locked_user_id -o StrictHostKeyChecking=no locked_user@localhost echo "success"
|
||||
|
||||
- name: Set password change date for locked_user
|
||||
ansible.builtin.shell:
|
||||
cmd: chage -d 2020-01-01 locked_user
|
||||
|
||||
- name: Check unsuccessful login with password
|
||||
ansible.builtin.shell:
|
||||
cmd: sshpass -p {{ test_pw }} ssh -o StrictHostKeyChecking=no locked_user@localhost echo "success"
|
||||
register: output
|
||||
ignore_errors: true
|
||||
|
||||
- name: Assert check unsuccessful login
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- output.rc | int == 1
|
||||
- "'WARNING: Your password has expired.' in output.stderr"
|
||||
- "'success' not in output.stdout"
|
||||
when:
|
||||
- ansible_facts.os_family != "Suse"
|
||||
|
||||
- name: Assert check unsuccessful login
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- output.rc | int == 5
|
||||
- "'(password expired)' in output.stderr"
|
||||
- output.stdout | length == 0
|
||||
when:
|
||||
- ansible_facts.os_family == "Suse"
|
||||
|
||||
- name: Check successful login with ssh key
|
||||
ansible.builtin.shell:
|
||||
cmd: ssh -i /root/locked_user_id -o StrictHostKeyChecking=no locked_user@localhost echo "success"
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
- name: Read local linux user database
|
||||
getent:
|
||||
database: passwd
|
||||
|
||||
- name: Check that shell_sys_acc's shell is still bash
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- ansible_facts.getent_passwd['shell_sys_acc'][5] == "/bin/bash"
|
||||
@@ -1,8 +1,8 @@
|
||||
---
|
||||
- name: Verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
|
||||
ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
|
||||
- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
|
||||
command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
|
||||
changed_when: false
|
||||
|
||||
- name: Verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
|
||||
ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
|
||||
- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
|
||||
command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
|
||||
changed_when: false
|
||||
@@ -1,9 +0,0 @@
|
||||
os-14:
|
||||
run: false
|
||||
justification: "ansible does not gather all fact-mounts (e.g. mounts with tmpfs) so we cannot change these. see https://github.com/ansible/ansible/pull/79787"
|
||||
os-15:
|
||||
run: false
|
||||
justification: "ansible does not gather all fact-mounts (e.g. mounts with tmpfs) so we cannot change these. see https://github.com/ansible/ansible/pull/79787"
|
||||
os-16:
|
||||
run: false
|
||||
justification: "ansible does not gather all fact-mounts (e.g. mounts with tmpfs) so we cannot change these. see https://github.com/ansible/ansible/pull/79787"
|
||||
@@ -1,53 +1,23 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
collections:
|
||||
- devsec.hardening
|
||||
tasks:
|
||||
- name: Override for arch
|
||||
ansible.builtin.set_fact:
|
||||
- name: override for arch
|
||||
set_fact:
|
||||
os_mnt_boot_enabled: false
|
||||
os_mnt_tmp_enabled: true
|
||||
os_mnt_tmp_src: tmpfs
|
||||
os_mnt_tmp_filesystem: tmpfs
|
||||
when: ansible_facts.os_family == 'Archlinux'
|
||||
|
||||
- name: Overrides for Fedora image
|
||||
ansible.builtin.set_fact:
|
||||
os_mnt_tmp_enabled: true
|
||||
os_mnt_tmp_src: tmpfs
|
||||
os_mnt_tmp_filesystem: tmpfs
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Overrides for Fedora 40 image
|
||||
ansible.builtin.set_fact:
|
||||
os_mnt_var_enabled: true
|
||||
os_mnt_var_src: UUID=282c6d73-afc2-4113-9856-c7679ad51920
|
||||
os_mnt_var_filesystem: btrfs
|
||||
os_mnt_var_options: rw,nosuid,nodev,compress=zstd:1,subvol=var
|
||||
when:
|
||||
- ansible_facts.distribution == 'Fedora'
|
||||
- ansible_facts.distribution_major_version|int == 40
|
||||
|
||||
- name: Overrides for Debian 13 image
|
||||
ansible.builtin.set_fact:
|
||||
os_mnt_tmp_enabled: true
|
||||
os_mnt_tmp_src: tmpfs
|
||||
os_mnt_tmp_filesystem: tmpfs
|
||||
when:
|
||||
- ansible_facts.distribution == 'Debian'
|
||||
- ansible_facts.distribution_major_version|int == 13
|
||||
|
||||
- name: Include os_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.os_hardening
|
||||
- include_role:
|
||||
name: os_hardening
|
||||
vars:
|
||||
os_auth_pam_passwdqc_enable: false
|
||||
os_auth_lockout_time: 15
|
||||
os_yum_repo_file_whitelist: [foo.repo]
|
||||
os_yum_repo_file_whitelist: ['foo.repo']
|
||||
os_mnt_boot_enabled: true
|
||||
os_mnt_home_enabled: true
|
||||
os_mnt_boot_src: /dev/vda1
|
||||
os_mnt_boot_src: "/dev/vda1"
|
||||
@@ -2,32 +2,24 @@
|
||||
dependency:
|
||||
name: galaxy
|
||||
options:
|
||||
role-file: molecule/os_hardening_vm/requirements.yml
|
||||
role-file: molecule/os_hardening/requirements.yml
|
||||
driver:
|
||||
name: vagrant
|
||||
provider:
|
||||
name: libvirt
|
||||
platforms:
|
||||
# we need to name every instance differently to start multiple VMs on the same host (parallelization)
|
||||
# since we also need to use different OS users to run the tests because of how molecule operates,
|
||||
# the VM names must be predictable by OS user (to clean up canceled runs)
|
||||
- name: ${USER}
|
||||
box: ${MOLECULE_DISTRO}
|
||||
- name: instance
|
||||
box: "generic/${MOLECULE_DISTRO}"
|
||||
memory: 1024
|
||||
cpus: 2
|
||||
provisioner:
|
||||
name: ansible
|
||||
options:
|
||||
diff: true
|
||||
env:
|
||||
ANSIBLE_PIPELINING: "True"
|
||||
config_options:
|
||||
defaults:
|
||||
interpreter_python: auto_silent
|
||||
callbacks_enabled: profile_tasks, timer
|
||||
# Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
|
||||
library: "${MOLECULE_PROJECT_DIRECTORY}/plugins/modules:/usr/share/ansible:${MOLECULE_VAGRANT_PLUGIN_DIR}"
|
||||
inject_facts_as_vars: false
|
||||
callback_whitelist: profile_tasks, timer, yaml
|
||||
verifier:
|
||||
name: ansible
|
||||
env:
|
||||
@@ -40,7 +32,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -56,12 +47,10 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
- prepare
|
||||
- check
|
||||
- converge
|
||||
- idempotence
|
||||
- verify
|
||||
|
||||
@@ -1,97 +1,49 @@
|
||||
---
|
||||
- name: Prepare Archliux host
|
||||
hosts: all
|
||||
become: true
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Update keyring
|
||||
ansible.builtin.raw: pacman --noconfirm -Sy archlinux-keyring
|
||||
changed_when: false
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
|
||||
|
||||
- name: Update OS
|
||||
ansible.builtin.raw: pacman --noconfirm -Suy
|
||||
changed_when: false
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
|
||||
|
||||
- name: Install python, since it's not installed by default
|
||||
ansible.builtin.raw: pacman --noconfirm -Sy python
|
||||
changed_when: false
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
|
||||
|
||||
- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
hosts: all
|
||||
become: true
|
||||
collections:
|
||||
- devsec.hardening
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Set ansible_python_interpreter to "/usr/bin/python3" on fedora
|
||||
ansible.builtin.set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
- name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
|
||||
set_fact:
|
||||
ansible_python_interpreter: "/usr/bin/python3"
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Block update of Grub, because of error
|
||||
ansible.builtin.dpkg_selections:
|
||||
name: grub-pc
|
||||
selection: hold
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
|
||||
# we need to free up space, since the /boot partition in some Vagrant images is
|
||||
# pretty small and system updates might fail
|
||||
- name: Find all initrd.img to delete them
|
||||
ansible.builtin.find:
|
||||
paths: /boot
|
||||
patterns: "initrd.img*"
|
||||
register: find_results
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
|
||||
- name: Delete all initrd.img to free space on /boot
|
||||
ansible.builtin.file:
|
||||
path: "{{ item['path'] }}"
|
||||
state: absent
|
||||
with_items: "{{ find_results['files'] }}"
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
|
||||
- name: Run the equivalent of "apt-get update && apt-get upgrade"
|
||||
ansible.builtin.apt:
|
||||
upgrade: safe
|
||||
apt:
|
||||
name: "*"
|
||||
state: latest
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
when: ansible_os_family == 'Debian'
|
||||
|
||||
- name: Install required tools on fedora
|
||||
ansible.builtin.dnf:
|
||||
- name: install required tools on SuSE
|
||||
# cannot use zypper module, since it depends on python-xml
|
||||
shell: "zypper -n install python-xml"
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: install required tools on fedora
|
||||
dnf:
|
||||
name:
|
||||
- python
|
||||
- findutils
|
||||
- procps-ng
|
||||
- python3-libselinux
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Install required tools on AlmaLinux
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- initscripts
|
||||
when: ansible_facts.distribution == 'AlmaLinux'
|
||||
|
||||
- name: Install required tools on Arch
|
||||
- name: install required tools on Arch
|
||||
community.general.pacman:
|
||||
name:
|
||||
- awk
|
||||
- archlinux-keyring
|
||||
state: latest
|
||||
state: present
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Archlinux'
|
||||
|
||||
- name: Run the equivalent of "pacman -Syu"
|
||||
community.general.pacman:
|
||||
update_cache: true
|
||||
upgrade: true
|
||||
when: ansible_facts.os_family == 'Archlinux'
|
||||
|
||||
- name: Install required tools on RHEL # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
- name: install required tools on RHEL # noqa ignore-errors
|
||||
yum:
|
||||
name:
|
||||
- openssh-clients
|
||||
- openssh
|
||||
@@ -99,15 +51,10 @@
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Create recursing symlink to test minimize access
|
||||
ansible.builtin.shell: rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz
|
||||
- name: create recursing symlink to test minimize access
|
||||
shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
|
||||
changed_when: false
|
||||
|
||||
- name: Unmount EFI partition to get rid of vfat filesystem (qemu has no firmware image that inspec can detect)
|
||||
ansible.posix.mount:
|
||||
path: /boot/efi
|
||||
state: unmounted
|
||||
|
||||
- name: Include YUM prepare tasks
|
||||
ansible.builtin.include_tasks: prepare_tasks/yum.yml
|
||||
- name: include YUM prepare tasks
|
||||
include_tasks: prepare_tasks/yum.yml
|
||||
when: ansible_facts.os_family == 'RedHat'
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Create 'foo' repository
|
||||
- name: create 'foo' repository
|
||||
ansible.builtin.yum_repository:
|
||||
name: foo
|
||||
description: mandatory description
|
||||
@@ -7,7 +7,7 @@
|
||||
enabled: false
|
||||
gpgcheck: false
|
||||
|
||||
- name: Create 'bar' repository
|
||||
- name: create 'bar' repository
|
||||
ansible.builtin.yum_repository:
|
||||
name: bar
|
||||
description: mandatory description
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
---
|
||||
roles:
|
||||
- name: geerlingguy.git
|
||||
- geerlingguy.git
|
||||
@@ -6,55 +6,65 @@
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
roles:
|
||||
- geerlingguy.git
|
||||
tasks:
|
||||
# temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
|
||||
# - name: Include PAM tests
|
||||
# ansible.builtin.include_tasks: verify_tasks/pam.yml
|
||||
# when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
|
||||
- name: install fake SuSE-release for cinc compatibility
|
||||
copy:
|
||||
content: |
|
||||
openSUSE Faked Enterprise 2020 (x86_64)
|
||||
VERSION = 2020
|
||||
CODENAME = Faked Feature
|
||||
dest: /etc/SuSE-release
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0444'
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Include YUM tests
|
||||
ansible.builtin.include_tasks: verify_tasks/yum.yml
|
||||
- name: install git for SuSE since geerlinguy.git does not support it
|
||||
zypper:
|
||||
name: git
|
||||
state: present
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Run the equivalent of "apt-get update" as a separate step
|
||||
apt:
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
|
||||
- name: install required tools on debian
|
||||
apt:
|
||||
name: procps
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
|
||||
- name: include PAM tests
|
||||
include_tasks: verify_tasks/pam.yml
|
||||
when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: include YUM tests
|
||||
include_tasks: verify_tasks/yum.yml
|
||||
when: ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Verify
|
||||
hosts: localhost
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Get ssh-config
|
||||
ansible.builtin.command:
|
||||
cmd: vagrant ssh-config
|
||||
chdir: "{{ molecule_ephemeral_directory }}"
|
||||
register: ssh_config
|
||||
changed_when: false
|
||||
- name: download cinc-auditor
|
||||
get_url:
|
||||
url: https://omnitruck.cinc.sh/install.sh
|
||||
dest: /tmp/install.sh
|
||||
mode: '0775'
|
||||
|
||||
- name: Create ssh-config file
|
||||
ansible.builtin.copy:
|
||||
content: "{{ ssh_config.stdout_lines | join ('\n') }}"
|
||||
dest: "{{ molecule_ephemeral_directory }}/ssh-config"
|
||||
mode: "0400"
|
||||
changed_when: false
|
||||
- name: install cinc-auditor
|
||||
shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
|
||||
|
||||
- name: Execute cinc-auditor tests
|
||||
ansible.builtin.command: >
|
||||
docker run --rm
|
||||
--volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
|
||||
docker.io/cincproject/auditor exec
|
||||
--ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
|
||||
-t ssh://{{ lookup('env', 'USER') }}
|
||||
--sudo --no-show-progress --no-color
|
||||
--no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip
|
||||
- name: Execute cinc-auditor tests # noqa ignore-errors
|
||||
command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
|
||||
register: test_results
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display details about the cinc-auditor results
|
||||
ansible.builtin.debug:
|
||||
debug:
|
||||
msg: "{{ test_results.stdout_lines }}"
|
||||
|
||||
- name: Fail when tests fail
|
||||
ansible.builtin.fail:
|
||||
msg: Inspec failed to validate
|
||||
fail:
|
||||
msg: "Inspec failed to validate"
|
||||
when: test_results.rc != 0
|
||||
@@ -1,23 +1,17 @@
|
||||
---
|
||||
- name: install pip
|
||||
package:
|
||||
name:
|
||||
- python3-pip
|
||||
- python3-setuptools
|
||||
state: present
|
||||
|
||||
- name: install pam-tester
|
||||
ansible.builtin.pip:
|
||||
name: pam-tester
|
||||
state: present
|
||||
- name: download pam-tester
|
||||
get_url:
|
||||
url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
|
||||
dest: /bin/pam-tester
|
||||
mode: 0555
|
||||
|
||||
- name: set password for test
|
||||
ansible.builtin.set_fact:
|
||||
test_pw: myTest!pw
|
||||
set_fact:
|
||||
test_pw: "myTest!pw"
|
||||
|
||||
- name: set locale for test
|
||||
ansible.builtin.set_fact:
|
||||
locale: en_US.UTF-8
|
||||
set_fact:
|
||||
locale: "en_US.UTF-8"
|
||||
when:
|
||||
- ansible_facts.os_family == 'RedHat'
|
||||
- ansible_facts.distribution_major_version < '8'
|
||||
@@ -27,26 +21,26 @@
|
||||
name: testuser
|
||||
password: "{{ test_pw | password_hash('sha512') }}"
|
||||
|
||||
- name: check successful login with correct password
|
||||
ansible.builtin.shell:
|
||||
cmd: pam-tester --user testuser --password {{ test_pw }}
|
||||
- name: check successfull login with correct password
|
||||
shell:
|
||||
cmd: "pam-tester --user testuser --password {{ test_pw }}"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
LANG: "{{ locale | default('C.UTF-8') }}"
|
||||
|
||||
- name: check unsuccessful login with incorrect password
|
||||
ansible.builtin.shell:
|
||||
cmd: pam-tester --user testuser --password {{ test_pw }}fail --expectfail
|
||||
- name: check unsuccessfull login with incorrect password
|
||||
shell:
|
||||
cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
LANG: "{{ locale | default('C.UTF-8') }}"
|
||||
with_sequence: count=6
|
||||
|
||||
- name: check unsuccessful login, with correct password (lockout)
|
||||
ansible.builtin.shell:
|
||||
cmd: pam-tester --user testuser --password {{ test_pw }} --expectfail
|
||||
- name: check unsuccessfull login, with correct password (lockout)
|
||||
shell:
|
||||
cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
@@ -56,9 +50,9 @@
|
||||
pause:
|
||||
seconds: 20
|
||||
|
||||
- name: check successful login
|
||||
ansible.builtin.shell:
|
||||
cmd: pam-tester --user testuser --password {{ test_pw }}
|
||||
- name: check successfull login
|
||||
shell:
|
||||
cmd: "pam-tester --user testuser --password {{ test_pw }}"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
---
|
||||
- name: Verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
|
||||
ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
|
||||
- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
|
||||
command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
|
||||
changed_when: false
|
||||
|
||||
- name: Verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
|
||||
ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
|
||||
- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
|
||||
command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
|
||||
changed_when: false
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
- name: Verify prerequisites
|
||||
hosts: localhost
|
||||
tasks:
|
||||
- name: Make sure environment variable for MOLECULE_DISTRO is set
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- "lookup('env','MOLECULE_DISTRO') | length > 0"
|
||||
fail_msg: "You need to set MOLECULE_DISTRO to a supported image name. See CONTRIBUTING.md"
|
||||
@@ -1,13 +1,14 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: all
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
collections:
|
||||
- devsec.hardening
|
||||
tasks:
|
||||
- name: Include ssh_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.ssh_hardening
|
||||
- include_role:
|
||||
name: ssh_hardening
|
||||
vars:
|
||||
sftp_enabled: false
|
||||
@@ -1,24 +1,34 @@
|
||||
---
|
||||
dependency:
|
||||
name: galaxy
|
||||
options:
|
||||
role-file: molecule/ssh_hardening/requirements.yml
|
||||
driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: instance
|
||||
image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
|
||||
image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
privileged: true
|
||||
cgroupns_mode: host
|
||||
pre_build_image: true
|
||||
tmpfs:
|
||||
- /tmp
|
||||
- /run
|
||||
capabilities:
|
||||
- SYS_ADMIN
|
||||
tty: true
|
||||
env:
|
||||
http_proxy: "${http_proxy}"
|
||||
https_proxy: "${https_proxy}"
|
||||
no_proxy: "${no_proxy}"
|
||||
container: docker
|
||||
provisioner:
|
||||
name: ansible
|
||||
options:
|
||||
diff: true
|
||||
config_options:
|
||||
defaults:
|
||||
interpreter_python: auto_silent
|
||||
callbacks_enabled: profile_tasks, timer
|
||||
inject_facts_as_vars: false
|
||||
callback_whitelist: profile_tasks, timer, yaml
|
||||
inventory:
|
||||
host_vars:
|
||||
# https://molecule.readthedocs.io/en/latest/examples.html#docker-with-non-privileged-user
|
||||
@@ -35,7 +45,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -51,12 +60,10 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
- prepare
|
||||
- check
|
||||
- converge
|
||||
- idempotence
|
||||
- verify
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Prepare the molecule container for the role
|
||||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
@@ -7,38 +7,33 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Use python3
|
||||
ansible.builtin.set_fact:
|
||||
- name: use python3
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Install dnf packages # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
- name: install packages # noqa ignore-errors
|
||||
yum:
|
||||
name:
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
state: present
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install libselinux-python # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- libselinux-python
|
||||
state: present
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install procps-ng # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
- name: install packages # noqa ignore-errors
|
||||
dnf:
|
||||
name:
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
- procps-ng
|
||||
state: present
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install apt packages # noqa ignore-errors
|
||||
ansible.builtin.apt:
|
||||
- name: install packages # noqa ignore-errors
|
||||
apt:
|
||||
name:
|
||||
- openssh-client
|
||||
- openssh-server
|
||||
@@ -46,28 +41,19 @@
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install required tools on SuSE
|
||||
- name: install required tools on SuSE
|
||||
# cannot use zypper module, since it depends on python-xml
|
||||
ansible.builtin.command: zypper -n install python-xml
|
||||
changed_when: false
|
||||
shell: "zypper -n install python-xml"
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Install packages on SuSE
|
||||
community.general.zypper:
|
||||
- name: install packages
|
||||
zypper:
|
||||
name:
|
||||
- openssh
|
||||
- "openssh"
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Install required tools on Alpine
|
||||
community.general.apk:
|
||||
name:
|
||||
- openssh
|
||||
state: present
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Alpine'
|
||||
|
||||
- name: Install required tools on Arch
|
||||
community.general.pacman:
|
||||
- name: install required tools on Arch
|
||||
pacman:
|
||||
name:
|
||||
- openssh
|
||||
- awk
|
||||
@@ -75,6 +61,16 @@
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Archlinux'
|
||||
|
||||
- name: Create ssh host keys # noqa ignore-errors no-changed-when
|
||||
ansible.builtin.command: ssh-keygen -A
|
||||
- name: created needed directory
|
||||
file:
|
||||
path: "/var/run/sshd"
|
||||
state: directory
|
||||
|
||||
- name: create ssh host keys # noqa ignore-errors
|
||||
command: "ssh-keygen -A"
|
||||
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
|
||||
ansible_facts.distribution == "Fedora" or
|
||||
ansible_facts.distribution == "Amazon" or
|
||||
ansible_facts.os_family == "Suse"
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
@@ -0,0 +1,3 @@
|
||||
---
|
||||
roles:
|
||||
- geerlingguy.git
|
||||
@@ -1,28 +1,57 @@
|
||||
---
|
||||
- name: Verify
|
||||
hosts: localhost
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
roles:
|
||||
- geerlingguy.git
|
||||
tasks:
|
||||
- name: install fake SuSE-release for cinc compatibility
|
||||
copy:
|
||||
content: |
|
||||
openSUSE Faked Enterprise 2020 (x86_64)
|
||||
VERSION = 2020
|
||||
CODENAME = Faked Feature
|
||||
dest: /etc/SuSE-release
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0444'
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: install git for SuSE since geerlinguy.git does not support it
|
||||
zypper:
|
||||
name: git
|
||||
state: present
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: install crypto compat modules on fedora
|
||||
dnf:
|
||||
name: libxcrypt-compat
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: download cinc-auditor
|
||||
get_url:
|
||||
url: https://omnitruck.cinc.sh/install.sh
|
||||
dest: /tmp/install.sh
|
||||
mode: '0775'
|
||||
|
||||
- name: install cinc-auditor
|
||||
shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
|
||||
|
||||
- name: Execute cinc-auditor tests
|
||||
ansible.builtin.command: >
|
||||
docker run
|
||||
--volume /run/docker.sock:/run/docker.sock
|
||||
docker.io/cincproject/auditor exec
|
||||
-t docker://instance
|
||||
--no-show-progress --no-color
|
||||
--no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip
|
||||
command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/simplify_crypto.zip"
|
||||
register: test_results
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display details about the cinc-auditor results
|
||||
ansible.builtin.debug:
|
||||
debug:
|
||||
msg: "{{ test_results.stdout_lines }}"
|
||||
|
||||
- name: Fail when tests fail
|
||||
ansible.builtin.fail:
|
||||
msg: Inspec failed to validate
|
||||
fail:
|
||||
msg: "Inspec failed to validate"
|
||||
when: test_results.rc != 0
|
||||
@@ -1,43 +1,49 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
collections:
|
||||
- devsec.hardening
|
||||
tasks:
|
||||
- name: Include ssh_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.ssh_hardening
|
||||
- include_role:
|
||||
name: ssh_hardening
|
||||
vars:
|
||||
ssh_trusted_user_ca_keys_file: /etc/ssh/ca.pub
|
||||
ssh_trusted_user_ca_keys_file: '/etc/ssh/ca.pub'
|
||||
ssh_trusted_user_ca_keys:
|
||||
- "# ssh-rsa ..."
|
||||
ssh_authorized_principals_file: /etc/ssh/auth_principals/%u
|
||||
- '# ssh-rsa ...'
|
||||
ssh_authorized_principals_file: '/etc/ssh/auth_principals/%u'
|
||||
ssh_authorized_principals:
|
||||
- path: /etc/ssh/auth_principals/root
|
||||
- path: "/etc/ssh/auth_principals/root"
|
||||
principals:
|
||||
- root
|
||||
- "root"
|
||||
owner: "{{ ssh_owner }}"
|
||||
group: "{{ ssh_group }}"
|
||||
directoryowner: "{{ ssh_owner }}"
|
||||
directorygroup: "{{ ssh_group }}"
|
||||
directorymode: "0700"
|
||||
network_ipv6_enable: true
|
||||
ssh_allow_tcp_forwarding: "yes"
|
||||
ssh_gateway_ports: "clientspecified"
|
||||
ssh_allow_tcp_forwarding: 'yes'
|
||||
ssh_gateway_ports: true
|
||||
ssh_allow_agent_forwarding: true
|
||||
ssh_server_permit_environment_vars: "yes"
|
||||
ssh_server_accept_env_vars: PWD HTTP_PROXY
|
||||
ssh_server_permit_environment_vars: 'yes'
|
||||
ssh_server_accept_env_vars: 'PWD HTTP_PROXY'
|
||||
ssh_client_alive_interval: 100
|
||||
ssh_client_alive_count: 10
|
||||
ssh_client_password_login: true
|
||||
ssh_challengeresponseauthentication: true
|
||||
ssh_compression: true
|
||||
ssh_allow_users: root kitchen vagrant
|
||||
ssh_allow_groups: root kitchen vagrant
|
||||
ssh_deny_users: foo bar
|
||||
ssh_deny_groups: foo bar
|
||||
ssh_authorized_keys_file: /etc/ssh/authorized_keys/%u
|
||||
ssh_allow_users: 'root kitchen vagrant'
|
||||
ssh_allow_groups: 'root kitchen vagrant'
|
||||
ssh_deny_users: 'foo bar'
|
||||
ssh_deny_groups: 'foo bar'
|
||||
ssh_authorized_keys_file: '/etc/ssh/authorized_keys/%u'
|
||||
ssh_max_auth_retries: 10
|
||||
ssh_permit_root_login: without-password
|
||||
ssh_permit_tunnel: "yes"
|
||||
ssh_permit_root_login: "without-password"
|
||||
ssh_permit_tunnel: true
|
||||
ssh_print_motd: true
|
||||
ssh_print_last_log: true
|
||||
ssh_banner: true
|
||||
@@ -48,33 +54,33 @@
|
||||
- 22
|
||||
- 222
|
||||
ssh_server_match_address:
|
||||
- address: 192.168.1.0/24
|
||||
- address: '192.168.1.0/24'
|
||||
rules:
|
||||
- AllowTcpForwarding yes
|
||||
- AllowAgentForwarding no
|
||||
- 'AllowTcpForwarding yes'
|
||||
- 'AllowAgentForwarding no'
|
||||
ssh_server_match_group:
|
||||
- group: root
|
||||
- group: 'root'
|
||||
rules:
|
||||
- AllowTcpForwarding yes
|
||||
- AllowAgentForwarding no
|
||||
- 'AllowTcpForwarding yes'
|
||||
- 'AllowAgentForwarding no'
|
||||
ssh_server_match_user:
|
||||
- user: root
|
||||
- user: 'root'
|
||||
rules:
|
||||
- AllowTcpForwarding yes
|
||||
- AllowAgentForwarding no
|
||||
- 'AllowTcpForwarding yes'
|
||||
- 'AllowAgentForwarding no'
|
||||
ssh_server_match_local_port:
|
||||
- port: 222
|
||||
rules:
|
||||
- AllowTcpForwarding yes
|
||||
- AllowAgentForwarding no
|
||||
- 'AllowTcpForwarding yes'
|
||||
- 'AllowAgentForwarding no'
|
||||
ssh_remote_hosts:
|
||||
- names: [example.com, example2.com]
|
||||
options: [Port 2222, ForwardAgent yes]
|
||||
- names: [example3.com]
|
||||
options: [StrictHostKeyChecking no]
|
||||
- names: ['example.com', 'example2.com']
|
||||
options: ['Port 2222', 'ForwardAgent yes']
|
||||
- names: ['example3.com']
|
||||
options: ['StrictHostKeyChecking no']
|
||||
ssh_use_dns: true
|
||||
ssh_use_pam: true
|
||||
ssh_max_startups: 10:30:60
|
||||
ssh_max_startups: '10:30:60'
|
||||
ssh_host_key_algorithms:
|
||||
- ssh-ed25519
|
||||
- rsa-sha2-512
|
||||
@@ -88,9 +94,10 @@
|
||||
- aes192-ctr
|
||||
- aes128-ctr
|
||||
- aes256-cbc
|
||||
# these should not be set in the final sshd_config
|
||||
ssh_kex: false
|
||||
ssh_kex:
|
||||
- diffie-hellman-group-exchange-sha256
|
||||
- diffie-hellman-group-exchange-sha1
|
||||
ssh_custom_options:
|
||||
- Include /etc/ssh/ssh_config.d/*
|
||||
- "Include /etc/ssh/ssh_config.d/*"
|
||||
sshd_custom_options:
|
||||
- AcceptEnv LANG
|
||||
- "AcceptEnv LANG"
|
||||
@@ -1,24 +1,34 @@
|
||||
---
|
||||
dependency:
|
||||
name: galaxy
|
||||
options:
|
||||
role-file: molecule/ssh_hardening/requirements.yml
|
||||
driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: instance
|
||||
image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
|
||||
image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
privileged: true
|
||||
cgroupns_mode: host
|
||||
pre_build_image: true
|
||||
tmpfs:
|
||||
- /tmp
|
||||
- /run
|
||||
capabilities:
|
||||
- SYS_ADMIN
|
||||
tty: true
|
||||
env:
|
||||
http_proxy: "${http_proxy}"
|
||||
https_proxy: "${https_proxy}"
|
||||
no_proxy: "${no_proxy}"
|
||||
container: docker
|
||||
provisioner:
|
||||
name: ansible
|
||||
options:
|
||||
diff: true
|
||||
config_options:
|
||||
defaults:
|
||||
interpreter_python: auto_silent
|
||||
callbacks_enabled: profile_tasks, timer
|
||||
inject_facts_as_vars: false
|
||||
callback_whitelist: profile_tasks, timer, yaml
|
||||
verifier:
|
||||
name: ansible
|
||||
|
||||
@@ -29,7 +39,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -45,12 +54,11 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
- prepare
|
||||
- check
|
||||
- converge
|
||||
- idempotence
|
||||
- verify
|
||||
- destroy
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
@@ -7,38 +7,33 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Use python3
|
||||
ansible.builtin.set_fact:
|
||||
- name: use python3
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Install dnf packages # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
- name: install packages # noqa ignore-errors
|
||||
yum:
|
||||
name:
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
state: present
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install libselinux-python # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- libselinux-python
|
||||
state: present
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install procps-ng # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
- name: install packages # noqa ignore-errors
|
||||
dnf:
|
||||
name:
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
- procps-ng
|
||||
state: present
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install apt packages # noqa ignore-errors
|
||||
ansible.builtin.apt:
|
||||
- name: install packages # noqa ignore-errors
|
||||
apt:
|
||||
name:
|
||||
- openssh-client
|
||||
- openssh-server
|
||||
@@ -46,20 +41,19 @@
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install required tools on SuSE
|
||||
- name: install required tools on SuSE
|
||||
# cannot use zypper module, since it depends on python-xml
|
||||
ansible.builtin.command: zypper -n install python-xml
|
||||
changed_when: false
|
||||
shell: "zypper -n install python-xml"
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Install packages on SuSE
|
||||
community.general.zypper:
|
||||
- name: install packages
|
||||
zypper:
|
||||
name:
|
||||
- openssh
|
||||
- "openssh"
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Install required tools on Arch
|
||||
community.general.pacman:
|
||||
- name: install required tools on Arch
|
||||
pacman:
|
||||
name:
|
||||
- openssh
|
||||
- awk
|
||||
@@ -67,14 +61,16 @@
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Archlinux'
|
||||
|
||||
- name: Install required tools on Alpine
|
||||
community.general.apk:
|
||||
name:
|
||||
- openssh
|
||||
state: present
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Alpine'
|
||||
- name: created needed directory
|
||||
file:
|
||||
path: "/var/run/sshd"
|
||||
state: directory
|
||||
|
||||
- name: Create ssh host keys # noqa ignore-errors no-changed-when
|
||||
ansible.builtin.command: ssh-keygen -A
|
||||
- name: create ssh host keys # noqa ignore-errors
|
||||
command: "ssh-keygen -A"
|
||||
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
|
||||
ansible_facts.distribution == "Fedora" or
|
||||
ansible_facts.distribution == "Amazon" or
|
||||
ansible_facts.os_family == "Suse"
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
@@ -0,0 +1,3 @@
|
||||
---
|
||||
roles:
|
||||
- geerlingguy.git
|
||||
@@ -1,22 +0,0 @@
|
||||
*******
|
||||
Docker driver installation guide
|
||||
*******
|
||||
|
||||
Requirements
|
||||
============
|
||||
|
||||
* Docker Engine
|
||||
|
||||
Install
|
||||
=======
|
||||
|
||||
Please refer to the `Virtual environment`_ documentation for installation best
|
||||
practices. If not using a virtual environment, please consider passing the
|
||||
widely recommended `'--user' flag`_ when invoking ``pip``.
|
||||
|
||||
.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
|
||||
.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
|
||||
|
||||
.. code-block:: bash
|
||||
|
||||
$ python3 -m pip install 'molecule[docker]'
|
||||
@@ -1,13 +0,0 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: all
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Include ssh_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.ssh_hardening
|
||||
vars:
|
||||
sftp_enabled: false
|
||||
@@ -1,63 +0,0 @@
|
||||
---
|
||||
driver:
|
||||
name: vagrant
|
||||
provider:
|
||||
name: libvirt
|
||||
platforms:
|
||||
# we need to name every instance differently to start multiple VMs on the same host (parallelization)
|
||||
# since we also need to use different OS users to run the tests because of how molecule operates,
|
||||
# the VM names must be predictable by OS user (to clean up canceled runs)
|
||||
- name: ${USER}
|
||||
box: ${MOLECULE_DISTRO}
|
||||
memory: 1024
|
||||
cpus: 2
|
||||
provisioner:
|
||||
name: ansible
|
||||
options:
|
||||
diff: true
|
||||
env:
|
||||
ANSIBLE_PIPELINING: "True"
|
||||
config_options:
|
||||
defaults:
|
||||
interpreter_python: auto_silent
|
||||
callbacks_enabled: profile_tasks, timer
|
||||
# Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
|
||||
library: "${MOLECULE_PROJECT_DIRECTORY}/plugins/modules:/usr/share/ansible:${MOLECULE_VAGRANT_PLUGIN_DIR}"
|
||||
inject_facts_as_vars: false
|
||||
verifier:
|
||||
name: ansible
|
||||
env:
|
||||
ANSIBLE_PIPELINING: "True"
|
||||
|
||||
scenario:
|
||||
create_sequence:
|
||||
- dependency
|
||||
- create
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
- converge
|
||||
- check
|
||||
- destroy
|
||||
converge_sequence:
|
||||
- dependency
|
||||
- create
|
||||
- prepare
|
||||
- converge
|
||||
destroy_sequence:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
- prepare
|
||||
- converge
|
||||
- idempotence
|
||||
- verify
|
||||
- destroy
|
||||
@@ -1,34 +0,0 @@
|
||||
---
|
||||
- name: Prepare OpenBSD host
|
||||
hosts: all
|
||||
become: true
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Change installation source
|
||||
# temporary fix for https://github.com/lavabit/robox/issues/305
|
||||
ansible.builtin.raw: echo "https://ftp.eu.openbsd.org/pub/OpenBSD" > /etc/installurl
|
||||
changed_when: false
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
|
||||
|
||||
- name: Install python
|
||||
# BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
|
||||
ansible.builtin.raw: pkg_add -I python%3.11
|
||||
changed_when: false
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
|
||||
|
||||
- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Create ssh host keys # noqa ignore-errors
|
||||
ansible.builtin.command: ssh-keygen -A
|
||||
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
|
||||
or ansible_facts.distribution == "Fedora"
|
||||
or ansible_facts.distribution == "Amazon"
|
||||
or ansible_facts.os_family == "Suse"
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
@@ -1,57 +0,0 @@
|
||||
---
|
||||
- name: OpenBSD workaround - inspec detects OpenSBD as unix and not linux compatible
|
||||
hosts: all
|
||||
become: true
|
||||
tasks:
|
||||
- name: Use the type command instead of which to detect existing commands
|
||||
ansible.builtin.file:
|
||||
src: /usr/bin/which
|
||||
dest: /usr/bin/type
|
||||
state: hard
|
||||
mode: "0770"
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
|
||||
|
||||
- name: Verify
|
||||
hosts: localhost
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Get ssh-config
|
||||
ansible.builtin.command:
|
||||
cmd: vagrant ssh-config
|
||||
chdir: "{{ molecule_ephemeral_directory }}"
|
||||
register: ssh_config
|
||||
changed_when: false
|
||||
|
||||
- name: Create ssh-config file
|
||||
ansible.builtin.copy:
|
||||
content: "{{ ssh_config.stdout_lines | join ('\n') }}"
|
||||
dest: "{{ molecule_ephemeral_directory }}/ssh-config"
|
||||
mode: "0400"
|
||||
changed_when: false
|
||||
|
||||
- name: Execute cinc-auditor tests
|
||||
ansible.builtin.command: >
|
||||
docker run --rm
|
||||
--volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
|
||||
--volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') | regex_replace('^.*/', '') }}.yaml:/waivers.yaml
|
||||
docker.io/cincproject/auditor exec
|
||||
--ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
|
||||
-t ssh://{{ lookup('env', 'USER') }}
|
||||
--sudo --no-show-progress --no-color
|
||||
--waiver-file /waivers.yaml
|
||||
--no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip
|
||||
register: test_results
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display details about the cinc-auditor results
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ test_results.stdout_lines }}"
|
||||
|
||||
- name: Fail when tests fail
|
||||
ansible.builtin.fail:
|
||||
msg: Inspec failed to validate
|
||||
when: test_results.rc != 0
|
||||
@@ -1,3 +0,0 @@
|
||||
unrelated:
|
||||
run: false
|
||||
justification: "cinc-auditor needs at least one waived control"
|
||||
@@ -1,3 +0,0 @@
|
||||
unrelated:
|
||||
run: false
|
||||
justification: "cinc-auditor needs at least one waived control"
|
||||
@@ -1,3 +0,0 @@
|
||||
sshd-45:
|
||||
run: false
|
||||
justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"
|
||||
@@ -1,21 +0,0 @@
|
||||
ssh-17:
|
||||
run: false
|
||||
justification: "GSSAPIAuthentication is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
|
||||
ssh-18:
|
||||
run: false
|
||||
justification: "GSSAPIDelegateCredentials is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
|
||||
sshd-30:
|
||||
run: false
|
||||
justification: "KerberosAuthentication is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
|
||||
sshd-31:
|
||||
run: false
|
||||
justification: "KerberosOrLocalPasswd is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
|
||||
sshd-32:
|
||||
run: false
|
||||
justification: "KerberosTicketCleanup is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
|
||||
sshd-33:
|
||||
run: false
|
||||
justification: "GSSAPIAuthentication is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
|
||||
sshd-34:
|
||||
run: false
|
||||
justification: "GSSAPICleanupCredentials is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
|
||||
@@ -1,3 +0,0 @@
|
||||
unrelated:
|
||||
run: false
|
||||
justification: "cinc-auditor needs at least one waived control"
|
||||
@@ -1,3 +0,0 @@
|
||||
unrelated:
|
||||
run: false
|
||||
justification: "cinc-auditor needs at least one waived control"
|
||||
@@ -1,15 +0,0 @@
|
||||
{
|
||||
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
||||
"extends": [
|
||||
"config:best-practices",
|
||||
":gitSignOff"
|
||||
],
|
||||
"dependencyDashboard": true,
|
||||
"dependencyDashboardAutoclose": true,
|
||||
"packageRules": [
|
||||
{
|
||||
"matchUpdateTypes": ["patch", "minor"],
|
||||
"automerge": true
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
molecule-plugins[vagrant]==25.8.12
|
||||
+7
-7
@@ -1,7 +1,7 @@
|
||||
molecule==26.4.0
|
||||
molecule-plugins[docker]==25.8.12
|
||||
ansible-core==2.20.5
|
||||
docker==7.1.0
|
||||
jmespath==1.1.0
|
||||
aar-doc==2.3.0
|
||||
passlib==1.7.4
|
||||
molecule[docker]
|
||||
yamllint
|
||||
ansible
|
||||
ansible-lint
|
||||
docker
|
||||
flake8
|
||||
jmespath
|
||||
@@ -91,7 +91,7 @@
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- add follow=yes to my.cnf protect task, in case its a symlink. fixes \#20 [\#21](https://github.com/dev-sec/ansible-mysql-hardening/pull/21) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- add follow=yes to my.cnf protect task, incase its a symlink. fixes \#20 [\#21](https://github.com/dev-sec/ansible-mysql-hardening/pull/21) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- add changelog generator [\#7](https://github.com/dev-sec/ansible-mysql-hardening/pull/7) ([chris-rock](https://github.com/chris-rock))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
+49
-107
@@ -1,6 +1,6 @@
|
||||
# devsec.mysql_hardening
|
||||
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
|
||||
|
||||
|
||||
## Description
|
||||
|
||||
@@ -12,131 +12,73 @@ It configures:
|
||||
- Removes anonymous users, users without a password or authentication_string and test databases
|
||||
- various hardening options inside MySQL
|
||||
|
||||
Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.
|
||||
|
||||
Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
|
||||
|
||||
## Requirements
|
||||
|
||||
- An existing installation of MySQL or MariaDB.
|
||||
- python-jmespath on the ansible host
|
||||
- Ansible 2.9.0
|
||||
- An existing MySQL installation
|
||||
|
||||
<!-- BEGIN_ANSIBLE_DOCS -->
|
||||
### Example playbook
|
||||
|
||||
## Supported Operating Systems
|
||||
- EL
|
||||
- 8, 9, 10
|
||||
- Ubuntu
|
||||
- jammy, noble
|
||||
- Debian
|
||||
- trixie, bookworm, bullseye
|
||||
- Amazon
|
||||
- opensuse
|
||||
```yml
|
||||
- hosts: localhost
|
||||
collections:
|
||||
- devsec.hardening
|
||||
roles:
|
||||
- mysql_hardening
|
||||
```
|
||||
|
||||
This role expects an existing installation of MySQL or MariaDB. Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.
|
||||
Please ensure that the following variables are set accordingly:
|
||||
|
||||
- `mysql_hardening_enabled: yes` role is enabled by default and can be disabled without removing it from a playbook. You can use conditional variable, for example: `mysql_hardening_enabled: "{{ true if mysql_enabled else false }}"`
|
||||
- `mysql_hardening_user: 'mysql'` The user that mysql runs as.
|
||||
- `mysql_hardening_mysql_hardening_conf_file: '/etc/mysql/conf.d/hardening.cnf'` The path to the configuration file where the hardening will be performed
|
||||
- _deprecated: `mysql_datadir: '/var/lib/mysql'` The MySQL data directory_
|
||||
- `mysql_datadir` is no longer necessary, as MySQL data directory is automatically taken from `mysql_info`. But it can still be defined and will also be checked for correct permissions.
|
||||
|
||||
## Role Variables
|
||||
|
||||
- `mysql_daemon_enabled`
|
||||
- Default: `True`
|
||||
- Description: Whether to enable the MySQL-service so it starts on boot
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `mysql_hardening_chroot`
|
||||
- Default: ``
|
||||
- Default: ""
|
||||
- Description: [chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `mysql_hardening_chroot.automatic-sp-privileges`
|
||||
- Default: `0`
|
||||
- Description: [automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `mysql_hardening_enabled`
|
||||
- Default: `True`
|
||||
- Description: Whether to run the hardening
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `mysql_hardening_options.allow-suspicious-udfs`
|
||||
- Default: `0`
|
||||
- Description: [allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `mysql_hardening_options.local-infile`
|
||||
- Default: `0`
|
||||
- Description: [local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `mysql_hardening_options.safe-user-create`
|
||||
- Default: `1`
|
||||
- Default: 1
|
||||
- Description: [safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `mysql_hardening_options.secure-auth`
|
||||
- Default: `1`
|
||||
- Default: 1
|
||||
- Description: [secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `mysql_hardening_options.secure-file-priv`
|
||||
- Default: `/tmp`
|
||||
- Description: [secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `mysql_hardening_options.skip-symbolic-links`
|
||||
- Default: `1`
|
||||
- Default: 1
|
||||
- Description: [skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `mysql_hardening_restart_mysql`
|
||||
- Default: `True`
|
||||
- Description: Restart mysql after running this role
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `mysql_hardening_skip_grant_tables:`
|
||||
- Default: `False`
|
||||
- Default: false
|
||||
- Description: [skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `mysql_hardening_skip_show_database`
|
||||
- Default: `1`
|
||||
- Default: 1
|
||||
- Description: [skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `mysql_hardening_options.local-infile`
|
||||
- Default: 0
|
||||
- Description: [local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)
|
||||
- `mysql_hardening_options.allow-suspicious-udfs`
|
||||
- Default: 0
|
||||
- Description: [allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)
|
||||
- `mysql_hardening_chroot.automatic-sp-privileges`
|
||||
- Default: 0
|
||||
- Description: [automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)
|
||||
- `mysql_hardening_options.secure-file-priv`
|
||||
- Default: /tmp
|
||||
- Description: [secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)
|
||||
- `mysql_allow_remote_root`
|
||||
- Default: false
|
||||
- Description: delete remote root users
|
||||
- `mysql_remove_anonymous_users`
|
||||
- Default: `True`
|
||||
- Description: Set to `false` to keep users without authentication
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `mysql_remove_remote_root`
|
||||
- Default: `True`
|
||||
- Description: If `true`, root can only connect from localhost. Set to `false` to not remove remote root users.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- Default: true
|
||||
- Description: remove users without authentication
|
||||
- `mysql_remove_test_database`
|
||||
- Default: `True`
|
||||
- Description: Set to `false` to keep the test database
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `mysql_root_password`
|
||||
- Default: `-----====>SetR00tPa$$wordH3r3!!!<====-----`
|
||||
- Description: The default password. Please change or overwrite it
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `mysql_user_home`
|
||||
- Default: `{{ ansible_env.HOME }}`
|
||||
- Description: The path where the `.my.cnf` will be stored
|
||||
- Type: str
|
||||
- Required: no
|
||||
- Default: true
|
||||
- Description: remove test database
|
||||
- `mysql_hardening_restart_mysql`
|
||||
- Default: true
|
||||
- Description: Restart mysql after running this role
|
||||
|
||||
## Dependencies
|
||||
|
||||
None.
|
||||
|
||||
## Example Playbook
|
||||
|
||||
```
|
||||
- hosts: all
|
||||
become: true
|
||||
roles:
|
||||
- name: devsec.hardening.mysql_hardening
|
||||
```
|
||||
|
||||
<!-- END_ANSIBLE_DOCS -->
|
||||
Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
|
||||
@@ -6,8 +6,10 @@ mysql_daemon_enabled: true
|
||||
|
||||
mysql_hardening_restart_mysql: true
|
||||
|
||||
# general configuration
|
||||
mysql_hardening_mysql_hardening_conf_file: '{{ mysql_hardening_mysql_confd_dir }}/hardening.cnf'
|
||||
# You have to change this to your own strong enough mysql root password
|
||||
mysql_root_password: "-----====>SetR00tPa$$wordH3r3!!!<====-----"
|
||||
mysql_root_password: '-----====>SetR00tPa$$wordH3r3!!!<====-----'
|
||||
# There .my.cnf with mysql root credentials will be installed
|
||||
mysql_user_home: "{{ ansible_env.HOME }}"
|
||||
|
||||
@@ -46,6 +48,6 @@ mysql_hardening_options:
|
||||
automatic-sp-privileges: 0
|
||||
|
||||
# @see https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option-mysqld-secure-file-priv
|
||||
secure-file-priv: /tmp
|
||||
secure-file-priv: '/tmp'
|
||||
# @see https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_user
|
||||
user: "{{ mysql_hardening_user }}"
|
||||
user: '{{ mysql_hardening_user }}'
|
||||
@@ -1,6 +1,7 @@
|
||||
---
|
||||
|
||||
- name: Restart mysql
|
||||
ansible.builtin.service:
|
||||
name: "{{ mysql_daemon }}"
|
||||
service:
|
||||
name: '{{ mysql_daemon }}'
|
||||
state: restarted
|
||||
when: mysql_hardening_restart_mysql | bool
|
||||
@@ -1,79 +0,0 @@
|
||||
---
|
||||
argument_specs:
|
||||
main:
|
||||
short_description: The main entry point for the mysql hardening role.
|
||||
version_added: 8.8.0
|
||||
options:
|
||||
mysql_hardening_chroot:
|
||||
default: ''
|
||||
type: str
|
||||
description: '[chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)'
|
||||
mysql_hardening_options.safe-user-create:
|
||||
default: 1
|
||||
type: int
|
||||
description: '[safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)'
|
||||
mysql_hardening_options.secure-auth:
|
||||
default: 1
|
||||
type: int
|
||||
description: '[secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)'
|
||||
mysql_hardening_options.skip-symbolic-links:
|
||||
default: 1
|
||||
type: int
|
||||
description: '[skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)'
|
||||
'mysql_hardening_skip_grant_tables:':
|
||||
default: false
|
||||
type: bool
|
||||
description: '[skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)'
|
||||
mysql_hardening_skip_show_database:
|
||||
default: 1
|
||||
type: int
|
||||
description: '[skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)'
|
||||
mysql_hardening_options.local-infile:
|
||||
default: 0
|
||||
type: int
|
||||
description: '[local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)'
|
||||
mysql_hardening_options.allow-suspicious-udfs:
|
||||
default: 0
|
||||
type: int
|
||||
description: '[allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)'
|
||||
mysql_hardening_chroot.automatic-sp-privileges:
|
||||
default: 0
|
||||
type: int
|
||||
description: '[automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)'
|
||||
mysql_hardening_options.secure-file-priv:
|
||||
default: /tmp
|
||||
type: str
|
||||
description: '[secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)'
|
||||
mysql_remove_anonymous_users:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to `false` to keep users without authentication
|
||||
mysql_remove_test_database:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to `false` to keep the test database
|
||||
mysql_hardening_restart_mysql:
|
||||
default: true
|
||||
type: bool
|
||||
description: Restart mysql after running this role
|
||||
mysql_hardening_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Whether to run the hardening
|
||||
mysql_daemon_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Whether to enable the MySQL-service so it starts on boot
|
||||
mysql_root_password:
|
||||
default: '-----====>SetR00tPa$$wordH3r3!!!<====-----'
|
||||
type: str
|
||||
description: The default password. Please change or overwrite it
|
||||
mysql_user_home:
|
||||
default: '{{ ansible_env.HOME }}'
|
||||
type: str
|
||||
description: The path where the `.my.cnf` will be stored
|
||||
mysql_remove_remote_root:
|
||||
default: true
|
||||
type: bool
|
||||
description: If `true`, root can only connect from localhost. Set to `false`
|
||||
to not remove remote root users.
|
||||
Loaded 100 of 194 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user