Compare commits
5
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Sebastian Gumprich
|
cbab91c423 | ||
|
Sebastian Gumprich
|
5e6164abb1 | ||
|
Sebastian Gumprich
|
f1ec9f2c78 | ||
|
Sebastian Gumprich
|
8220ae9da0 | ||
|
Sebastian Gumprich
|
a9f19a0bdf |
No files matched your search
@@ -1,51 +0,0 @@
|
||||
output_template: |
|
||||
<!-- BEGIN_ANSIBLE_DOCS -->
|
||||
|
||||
## Supported Operating Systems
|
||||
|
||||
{%- for platform in metadata.galaxy_info.platforms %}
|
||||
- {{ platform.name }}
|
||||
{%- if "versions" in platform %}
|
||||
- {{ platform.versions | default([]) | join(', ') }}
|
||||
{%- endif %}
|
||||
{%- endfor %}
|
||||
|
||||
## Role Variables
|
||||
{% for entrypoint in argument_specs.keys() %}
|
||||
{%- set path, options=entrypoint_options[entrypoint][0] -%}
|
||||
{%- for name, details in options.items() |sort() %}
|
||||
- `{{ name }}`
|
||||
- Default: `{{ details.display_default }}`
|
||||
- Description: {{ details.display_description }}
|
||||
- Type: {{ details.display_type }}
|
||||
- Required: {{ details.display_required }}
|
||||
{%- if details.choices %}
|
||||
- Choices:
|
||||
{%- for choice in details.choices %}
|
||||
- {{ choice }}
|
||||
{%- endfor %}
|
||||
{%- endif %}
|
||||
{%- endfor %}
|
||||
{%- endfor %}
|
||||
|
||||
## Dependencies
|
||||
|
||||
{%- if ("dependencies" in metadata) and (metadata.dependencies | length > 0) %}
|
||||
{%- for dependency in metadata.dependencies %}
|
||||
- {{ dependency }}
|
||||
{%- endfor %}
|
||||
{%- else %}
|
||||
|
||||
None.
|
||||
{%- endif %}
|
||||
|
||||
## Example Playbook
|
||||
|
||||
```
|
||||
- hosts: all
|
||||
become: true
|
||||
roles:
|
||||
- name: {{ role }}
|
||||
```
|
||||
|
||||
<!-- END_ANSIBLE_DOCS -->
|
||||
@@ -5,10 +5,9 @@
|
||||
# option will be parsed relative to the CWD of execution.
|
||||
exclude_paths:
|
||||
- .cache/ # implicit unless exclude_paths is defined in config
|
||||
- .ansible/ # somehow someone decided that the cache directory should be renamed
|
||||
# add all waivers individually, since exclude_files does not support globs
|
||||
- molecule/os_hardening/waivers.yaml
|
||||
- molecule/ssh_hardening_vm/waivers_*.yaml
|
||||
- .yamllint
|
||||
- ../molecule/
|
||||
- ../.github/
|
||||
|
||||
mock_roles:
|
||||
- geerlingguy.git
|
||||
@@ -16,4 +15,3 @@ mock_roles:
|
||||
|
||||
skip_list:
|
||||
- var-naming[no-role-prefix]
|
||||
- meta-runtime[unsupported-version]
|
||||
@@ -31,7 +31,7 @@ body:
|
||||
attributes:
|
||||
label: "Reproduction steps"
|
||||
render: Shell
|
||||
description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, no need for backticks.
|
||||
description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, so no need for backticks.
|
||||
value: |
|
||||
...
|
||||
validations:
|
||||
|
||||
+14
-22
@@ -1,30 +1,22 @@
|
||||
---
|
||||
mysql_hardening:
|
||||
- changed-files:
|
||||
- any-glob-to-any-file:
|
||||
- roles/mysql_hardening/**
|
||||
- molecule/mysql_hardening/**
|
||||
- .github/workflows/mysql_hardening.yml
|
||||
- 'roles/mysql_hardening/**'
|
||||
- 'molecule/mysql_hardening/**'
|
||||
- '.github/workflows/mysql_hardening.yml'
|
||||
|
||||
os_hardening:
|
||||
- changed-files:
|
||||
- any-glob-to-any-file:
|
||||
- roles/os_hardening/**
|
||||
- molecule/os_hardening/**
|
||||
- .github/workflows/os_hardening.yml
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening/**'
|
||||
- '.github/workflows/os_hardening.yml'
|
||||
|
||||
ssh_hardening:
|
||||
- changed-files:
|
||||
- any-glob-to-any-file:
|
||||
- roles/ssh_hardening/**
|
||||
- molecule/ssh_hardening/**
|
||||
- molecule/ssh_hardening_custom_tests/**
|
||||
- .github/workflows/ssh_hardening.yml
|
||||
- .github/workflows/ssh_hardening_custom_tests.yml
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_custom_tests/**'
|
||||
- '.github/workflows/ssh_hardening.yml'
|
||||
- '.github/workflows/ssh_hardening_custom_tests.yml'
|
||||
|
||||
nginx_hardening:
|
||||
- changed-files:
|
||||
- any-glob-to-any-file:
|
||||
- roles/nginx_hardening/**
|
||||
- molecule/nginx_hardening/**
|
||||
- .github/workflows/nginx_hardening.yml
|
||||
- 'roles/nginx_hardening/**'
|
||||
- 'molecule/nginx_hardening/**'
|
||||
- '.github/workflows/nginx_hardening.yml'
|
||||
@@ -1,3 +0,0 @@
|
||||
major-labels: ['major']
|
||||
minor-labels: ['minor', 'enhancement']
|
||||
patch-labels: ['patch', 'bug']
|
||||
@@ -7,26 +7,22 @@ on: # yamllint disable-line rule:truthy
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/**'
|
||||
- 'molecule/**'
|
||||
- 'requirements.txt'
|
||||
- '.github/workflows/ansible-lint.yml'
|
||||
- '.config/ansible-lint.yml'
|
||||
pull_request:
|
||||
# The branches below must be a subset of the branches above
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/**'
|
||||
- 'molecule/**'
|
||||
- 'requirements.txt'
|
||||
- '.github/workflows/ansible-lint.yml'
|
||||
- '.config/ansible-lint.yml'
|
||||
|
||||
jobs:
|
||||
ansible-lint:
|
||||
runs-on: ubuntu-24.04
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
# Important: This sets up your GITHUB_WORKSPACE environment variable
|
||||
- uses: actions/checkout@v3
|
||||
|
||||
- name: Lint Ansible Playbook
|
||||
uses: ansible/ansible-lint@5fac056c45595896c973fbde871f01f6cb14d74c # v26
|
||||
# replace "master" with any valid ref
|
||||
uses: ansible/ansible-lint-action@main
|
||||
with:
|
||||
path: "roles/"
|
||||
@@ -9,6 +9,6 @@ on: # yamllint disable-line rule:truthy
|
||||
|
||||
jobs:
|
||||
codespell:
|
||||
uses: "dev-sec/.github/.github/workflows/codespell.yml@2cd00282cfdb322243d879a96d9494ce64e76119" # main
|
||||
uses: "dev-sec/.github/.github/workflows/codespell.yml@main"
|
||||
with:
|
||||
ignore_words_list: "chage,BOOTUP"
|
||||
ignore_words_list: "chage"
|
||||
@@ -4,16 +4,11 @@ name: "Enforce PR labels"
|
||||
on: # yamllint disable-line rule:truthy
|
||||
pull_request_target:
|
||||
types: [labeled, unlabeled, opened, edited, synchronize]
|
||||
|
||||
permissions:
|
||||
contents: read # to read configuration file
|
||||
pull-requests: write # to label PRs
|
||||
|
||||
jobs:
|
||||
enforce-label:
|
||||
if: github.repository == 'dev-sec/ansible-collection-hardening'
|
||||
runs-on: ubuntu-24.04
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
|
||||
- uses: actions/labeler@main
|
||||
with:
|
||||
repo-token: "${{ secrets.GITHUB_TOKEN }}"
|
||||
@@ -4,37 +4,37 @@ name: Publish collection to Ansible Galaxy
|
||||
on: # yamllint disable-line rule:truthy
|
||||
release:
|
||||
types:
|
||||
- released
|
||||
- published
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
if: github.repository == 'dev-sec/ansible-collection-hardening'
|
||||
runs-on: ubuntu-24.04
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
- uses: actions/checkout@v3
|
||||
|
||||
# deploy the collection first, because if it fails, we don't want
|
||||
# to update the galaxy.yml
|
||||
- name: Deploy the collection
|
||||
uses: artis3n/ansible_galaxy_collection@ffbca2460a5a1c600b941bbf1536bd61de1c2227 # v3
|
||||
uses: artis3n/ansible_galaxy_collection@v2
|
||||
with:
|
||||
api_key: ${{ secrets.GALAXY_API_KEY }}
|
||||
galaxy_version: ${{ github.event.release.tag_name }}
|
||||
|
||||
# checkout master instead of the release-tag so we can push the galaxy.yml
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
- uses: actions/checkout@v3
|
||||
with:
|
||||
ref: master
|
||||
|
||||
- name: update galaxy.yml with new version
|
||||
uses: microsoft/variable-substitution@6287962da9e5b6e68778dc51e840caa03ca84495 # v1
|
||||
uses: microsoft/variable-substitution@v1
|
||||
with:
|
||||
files: 'galaxy.yml'
|
||||
env:
|
||||
version: "${{ github.event.release.tag_name }}"
|
||||
|
||||
- name: push galaxy.yml
|
||||
uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
|
||||
uses: github-actions-x/[email protected]
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
push-branch: 'master'
|
||||
@@ -9,14 +9,12 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/mysql_hardening/**'
|
||||
- 'molecule/mysql_hardening/**'
|
||||
- '.github/workflows/mysql_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/mysql_hardening/**'
|
||||
- 'molecule/mysql_hardening/**'
|
||||
- '.github/workflows/mysql_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 0'
|
||||
|
||||
@@ -29,7 +27,7 @@ concurrency:
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-24.04
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
PY_COLORS: 1
|
||||
ANSIBLE_FORCE_COLOR: 1
|
||||
@@ -37,47 +35,39 @@ jobs:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- almalinux8
|
||||
- almalinux9
|
||||
# - almalinux10 # problem with baseline
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
# - rocky10 # problem with baseline
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
# - ubuntu2604 # problem with test setup
|
||||
- debian10
|
||||
- debian11
|
||||
- debian12
|
||||
- debian13
|
||||
# - amazon # geerlingguy.mysql does not support fedora
|
||||
# - arch # geerlingguy.mysql does not support arch
|
||||
- opensuse_tumbleweed
|
||||
# - fedora # geerlingguy.mysql does not support fedora
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
|
||||
- name: Set up Python 3.11
|
||||
uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: 3.13
|
||||
cache: 'pip'
|
||||
python-version: 3.11
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Downgrade Ansible for Rocky 8 tests
|
||||
run: |
|
||||
pip install "ansible-core<2.17"
|
||||
ansible-galaxy collection install 'community.crypto:<3.0.0'
|
||||
ansible-galaxy collection install 'community.general:<12.0.0'
|
||||
sudo apt install git
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
|
||||
|
||||
# that was a hard one to fix. robert did it thankfully
|
||||
# https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212
|
||||
@@ -89,19 +79,10 @@ jobs:
|
||||
sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld
|
||||
if: ${{ startsWith(matrix.molecule_distro, 'Debian') }}
|
||||
|
||||
# Molecule has problems detecting the proper location for installing roles
|
||||
# https://github.com/ansible/molecule/issues/3806
|
||||
# we do not set a custom role path, but the automatically determined install path used is not compatible with the location molecule expects the role
|
||||
# see CI logs of this action "INFO Set ANSIBLE_ROLES_PATH" should not be present, since we do not set a custom path
|
||||
# we have to find a proper way to configure this
|
||||
- name: Temporary fix for roles
|
||||
run: |
|
||||
mkdir -p /home/runner/.ansible
|
||||
ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles \
|
||||
/home/runner/.ansible/roles
|
||||
|
||||
- name: Test with molecule
|
||||
run: molecule test -s mysql_hardening
|
||||
run: |
|
||||
molecule --version
|
||||
molecule test -s mysql_hardening
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
@@ -8,14 +8,12 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/nginx_hardening/**'
|
||||
- 'molecule/nginx_hardening/**'
|
||||
- '.github/workflows/nginx_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/nginx_hardening/**'
|
||||
- 'molecule/nginx_hardening/**'
|
||||
- '.github/workflows/nginx_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 1'
|
||||
|
||||
@@ -28,7 +26,7 @@ concurrency:
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-24.04
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
PY_COLORS: 1
|
||||
ANSIBLE_FORCE_COLOR: 1
|
||||
@@ -36,61 +34,44 @@ jobs:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- almalinux8
|
||||
- almalinux9
|
||||
- almalinux10
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- rocky10
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
- ubuntu2604
|
||||
- debian10
|
||||
- debian11
|
||||
- debian12
|
||||
- debian13
|
||||
- amazon2023
|
||||
# - arch # needs to be fixed
|
||||
# - opensuse_tumbleweed # needs to be fixed
|
||||
# - fedora # no support from geerlingguy role
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
|
||||
- name: Set up Python 3.11
|
||||
uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: 3.13
|
||||
cache: 'pip'
|
||||
python-version: 3.11
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Downgrade Ansible for Rocky 8 tests
|
||||
run: |
|
||||
pip install "ansible-core<2.17"
|
||||
ansible-galaxy collection install 'community.crypto:<3.0.0'
|
||||
ansible-galaxy collection install 'community.general:<12.0.0'
|
||||
sudo apt install git
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
|
||||
|
||||
# Molecule has problems detecting the proper location for installing roles
|
||||
# https://github.com/ansible/molecule/issues/3806
|
||||
# we do not set a custom role path, but the automatically determined install path used is not compatible with the location molecule expects the role
|
||||
# see CI logs of this action "INFO Set ANSIBLE_ROLES_PATH" should not be present, since we do not set a custom path
|
||||
# we have to find a proper way to configure this
|
||||
- name: Temporary fix for roles
|
||||
run: |
|
||||
mkdir -p /home/runner/.ansible
|
||||
ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles \
|
||||
/home/runner/.ansible/roles
|
||||
|
||||
- name: Test with molecule
|
||||
run: molecule test -s nginx_hardening
|
||||
run: |
|
||||
molecule --version
|
||||
molecule test -s nginx_hardening
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
@@ -8,14 +8,12 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening/**'
|
||||
- '.github/workflows/os_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening/**'
|
||||
- '.github/workflows/os_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 3'
|
||||
|
||||
@@ -28,65 +26,56 @@ concurrency:
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-24.04
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
PY_COLORS: 1
|
||||
ANSIBLE_FORCE_COLOR: 1
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- molecule_distro: opensuse_tumbleweed
|
||||
molecule_docker_command: "/usr/lib/systemd/systemd"
|
||||
molecule_distro:
|
||||
- almalinux8
|
||||
- almalinux9
|
||||
- almalinux10
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- rocky10
|
||||
- fedora42
|
||||
- fedora43
|
||||
- fedora44
|
||||
- fedora37
|
||||
- fedora38
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
- ubuntu2604
|
||||
- debian10
|
||||
- debian11
|
||||
- debian12
|
||||
- debian13
|
||||
- amazon2023
|
||||
- opensuse_tumbleweed
|
||||
- arch
|
||||
molecule_docker_command:
|
||||
- "/lib/systemd/systemd"
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
|
||||
- name: Set up Python 3.11
|
||||
uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: 3.13
|
||||
cache: 'pip'
|
||||
python-version: 3.11
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Downgrade Ansible for Rocky 8 tests
|
||||
run: |
|
||||
pip install "ansible-core<2.17"
|
||||
ansible-galaxy collection install 'community.crypto:<3.0.0'
|
||||
ansible-galaxy collection install 'community.general:<12.0.0'
|
||||
sudo apt install git
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
|
||||
|
||||
- name: Test with molecule
|
||||
run: molecule test -s os_hardening
|
||||
run: |
|
||||
if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
|
||||
export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
|
||||
fi
|
||||
molecule --version
|
||||
molecule test -s os_hardening
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
@@ -8,16 +8,12 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening_vm/**'
|
||||
- '.github/workflows/os_hardening_vm.yml'
|
||||
- 'requirements.txt'
|
||||
- 'requirements-vm.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening_vm/**'
|
||||
- '.github/workflows/os_hardening_vm.yml'
|
||||
- 'requirements.txt'
|
||||
- 'requirements-vm.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 2'
|
||||
|
||||
@@ -38,58 +34,31 @@ jobs:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- almalinux/8
|
||||
- almalinux/9
|
||||
# - almalinux/10 # boot loop
|
||||
- generic/centos9s
|
||||
- generic/rocky8
|
||||
- generic/rocky9
|
||||
- alvistack/fedora-42
|
||||
# - alvistack/fedora-43 # no compatible test image
|
||||
- generic/ubuntu2204
|
||||
- alvistack/ubuntu-24.04
|
||||
# - alvistack/ubuntu-26.04 # no compatible test image
|
||||
- generic/debian11
|
||||
- generic/debian12
|
||||
- cloud-image/debian-13
|
||||
- generic/opensuse15
|
||||
- generic/arch
|
||||
- centos7
|
||||
- centos8s
|
||||
- centos9s
|
||||
- rocky8
|
||||
- rocky9
|
||||
- fedora37
|
||||
- fedora38
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- debian10
|
||||
- debian11
|
||||
# - debian12 # waiting for https://github.com/lavabit/robox/pull/274
|
||||
- opensuse15
|
||||
# - arch # needs fix for audit
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
source ~/.venv/ansible-collection-hardening/bin/activate
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
pip install -r requirements-vm.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Downgrade Ansible for Rocky 8 tests
|
||||
run: |
|
||||
source ~/.venv/ansible-collection-hardening/bin/activate
|
||||
pip install "ansible-core<2.17"
|
||||
ansible-galaxy collection install 'community.crypto:<3.0.0'
|
||||
ansible-galaxy collection install 'community.general:<12.0.0'
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
if: >
|
||||
matrix.molecule_distro == 'generic/rocky8' ||
|
||||
matrix.molecule_distro == 'almalinux/8' ||
|
||||
matrix.molecule_distro == 'generic/opensuse15'
|
||||
|
||||
- name: Update Vagrant Box
|
||||
run: |
|
||||
vagrant box update --box ${{ matrix.molecule_distro }} || true
|
||||
|
||||
- name: Test with molecule
|
||||
run: |
|
||||
source ~/.venv/ansible-collection-hardening/bin/activate
|
||||
# Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
|
||||
export MOLECULE_VAGRANT_PLUGIN_DIR=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')/molecule_plugins/vagrant
|
||||
molecule --version
|
||||
molecule test -s os_hardening_vm
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
|
||||
@@ -11,16 +11,16 @@ on: # yamllint disable-line rule:truthy
|
||||
jobs:
|
||||
prettier-md:
|
||||
if: github.repository == 'dev-sec/ansible-collection-hardening'
|
||||
runs-on: ubuntu-24.04
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 1
|
||||
|
||||
steps:
|
||||
- name: Git checkout
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
ref: ${{ github.head_ref }}
|
||||
|
||||
- name: Prettify code
|
||||
uses: creyD/prettier_action@8c18391fdc98ed0d884c6345f03975edac71b8f0 # v4.6
|
||||
uses: creyD/prettier_action@v4.3
|
||||
with:
|
||||
prettier_options: --write {**/*,*}.md
|
||||
@@ -11,38 +11,38 @@ jobs:
|
||||
generate_changelog:
|
||||
name: create release draft
|
||||
if: github.repository == 'dev-sec/ansible-collection-hardening'
|
||||
runs-on: ubuntu-24.04
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
- uses: actions/checkout@v3
|
||||
with:
|
||||
fetch-depth: 0
|
||||
ref: master
|
||||
|
||||
- name: 'Get Previous tag'
|
||||
id: previoustag
|
||||
uses: "WyriHaximus/github-action-get-previous-tag@61819f33034117e6c686e6a31dba995a85afc9de" # master
|
||||
uses: "WyriHaximus/github-action-get-previous-tag@master"
|
||||
env:
|
||||
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
|
||||
|
||||
- name: calculate next version
|
||||
id: version
|
||||
uses: patrickjahns/version-drafter-action@2076fa43abb28f31d0e8b0890253fbd1d1a966fc # v1
|
||||
uses: patrickjahns/version-drafter-action@v1
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Generate changelog
|
||||
uses: charmixer/auto-changelog-action@b25e89c9410e03189f0d48b02b3a8caad6e78015 # v1
|
||||
uses: charmixer/auto-changelog-action@v1
|
||||
with:
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
future_release: ${{ steps.version.outputs.next-version }}
|
||||
# this excludes all versions prior to the collection-release
|
||||
# since they break the changelog generation with the error:
|
||||
# "No common ancestor between ... and $version"
|
||||
exclude_tags_regex: '^[0-6]\.\d\.\d'
|
||||
exclude_tags_regex: '[0-6]\.\d\.\d'
|
||||
issue_line_labels: mysql_hardening,os_hardening,ssh_hardening,nginx_hardening
|
||||
|
||||
- name: push changelog
|
||||
uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
|
||||
uses: github-actions-x/[email protected]
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
push-branch: 'master'
|
||||
@@ -58,18 +58,18 @@ jobs:
|
||||
|
||||
- name: Read CHANGELOG.md
|
||||
id: package
|
||||
uses: juliangruber/read-file-action@271ff311a4947af354c6abcd696a306553b9ec18 # v1
|
||||
uses: juliangruber/read-file-action@v1
|
||||
with:
|
||||
path: ./CHANGELOGRELEASE.md
|
||||
|
||||
- name: Delete old drafts
|
||||
uses: hugo19941994/delete-draft-releases@3f19a25abf2ce87850c2268938f98f14e4d3d1f1 # v3.0.0
|
||||
uses: hugo19941994/delete-draft-releases@v1.0.1
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Create Release draft
|
||||
id: create_release
|
||||
uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1
|
||||
uses: actions/create-release@v1
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
|
||||
with:
|
||||
|
||||
@@ -1,56 +0,0 @@
|
||||
---
|
||||
name: create roles readme
|
||||
|
||||
on: # yamllint disable-line rule:truthy
|
||||
push:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/**/meta/argument_specs.yml'
|
||||
- 'roles/**/meta/main.yml'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/**/meta/argument_specs.yml'
|
||||
- 'roles/**/meta/main.yml'
|
||||
- 'requirements.txt'
|
||||
|
||||
jobs:
|
||||
readme:
|
||||
name: create roles readme
|
||||
runs-on: ubuntu-24.04
|
||||
strategy:
|
||||
matrix:
|
||||
roles:
|
||||
- mysql_hardening
|
||||
- nginx_hardening
|
||||
- os_hardening
|
||||
- ssh_hardening
|
||||
steps:
|
||||
- name: Check out code
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
|
||||
with:
|
||||
python-version: 3.13
|
||||
cache: 'pip'
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
|
||||
- name: Run aar-doc
|
||||
run: aar-doc roles/${{ matrix.roles }} markdown
|
||||
|
||||
- name: Output diff
|
||||
run: git diff roles/${{ matrix.roles }}/README.md
|
||||
|
||||
- name: Push README
|
||||
if: github.event_name != 'pull_request'
|
||||
uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
commit-message: 'update ${{ matrix.roles }} readme'
|
||||
files: roles/${{ matrix.roles }}/README.md
|
||||
rebase: true
|
||||
name: dev-sec CI
|
||||
email: [email protected]
|
||||
@@ -8,14 +8,12 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening/**'
|
||||
- '.github/workflows/ssh_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening/**'
|
||||
- '.github/workflows/ssh_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 5'
|
||||
|
||||
@@ -28,68 +26,56 @@ concurrency:
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-24.04
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
PY_COLORS: 1
|
||||
ANSIBLE_FORCE_COLOR: 1
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
# needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
|
||||
# - molecule_distro: opensuse_tumbleweed
|
||||
# molecule_docker_command: "/usr/lib/systemd/systemd"
|
||||
- molecule_distro: alpine
|
||||
molecule_docker_command: "/sbin/init"
|
||||
molecule_distro:
|
||||
- almalinux8
|
||||
- almalinux9
|
||||
- almalinux10
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- rocky10
|
||||
- fedora42
|
||||
- fedora43
|
||||
- fedora44
|
||||
- fedora37
|
||||
- fedora38
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
- ubuntu2604
|
||||
- debian10
|
||||
- debian11
|
||||
- debian12
|
||||
- debian13
|
||||
- amazon2023
|
||||
- arch
|
||||
molecule_docker_command:
|
||||
- "/lib/systemd/systemd"
|
||||
# - opensuse_tumbleweed # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
|
||||
- name: Set up Python 3.11
|
||||
uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: 3.13
|
||||
cache: 'pip'
|
||||
python-version: 3.11
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Downgrade Ansible for Rocky 8 tests
|
||||
run: |
|
||||
pip install "ansible-core<2.17"
|
||||
ansible-galaxy collection install 'community.crypto:<3.0.0'
|
||||
ansible-galaxy collection install 'community.general:<12.0.0'
|
||||
sudo apt install git
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
|
||||
|
||||
- name: Test with molecule
|
||||
run: molecule test -s ssh_hardening
|
||||
run: |
|
||||
if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
|
||||
export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
|
||||
fi
|
||||
molecule --version
|
||||
molecule test -s ssh_hardening
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
@@ -0,0 +1,52 @@
|
||||
---
|
||||
name: "devsec.ssh_hardening BSD"
|
||||
on: # yamllint disable-line rule:truthy
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_bsd/**'
|
||||
- '.github/workflows/ssh_hardening_bsd.yml'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_bsd/**'
|
||||
- '.github/workflows/ssh_hardening_bsd.yml'
|
||||
schedule:
|
||||
- cron: '0 6 * * 5'
|
||||
|
||||
concurrency:
|
||||
group: >-
|
||||
${{ github.workflow }}-${{
|
||||
github.event.pull_request.number || github.sha
|
||||
}}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: self-hosted
|
||||
env:
|
||||
PY_COLORS: 1
|
||||
ANSIBLE_FORCE_COLOR: 1
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- openbsd7
|
||||
- freebsd12
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Test with molecule
|
||||
run: |
|
||||
molecule --version
|
||||
molecule test -s ssh_hardening_bsd
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
@@ -8,14 +8,12 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_custom_tests/**'
|
||||
- '.github/workflows/ssh_hardening_custom_tests.yml'
|
||||
- 'requirements.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_custom_tests/**'
|
||||
- '.github/workflows/ssh_hardening_custom_tests.yml'
|
||||
- 'requirements.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 4'
|
||||
|
||||
@@ -28,68 +26,56 @@ concurrency:
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-24.04
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
PY_COLORS: 1
|
||||
ANSIBLE_FORCE_COLOR: 1
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
# needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
|
||||
# - molecule_distro: opensuse_tumbleweed
|
||||
# molecule_docker_command: "/usr/lib/systemd/systemd"
|
||||
- molecule_distro: alpine
|
||||
molecule_docker_command: "/sbin/init"
|
||||
molecule_distro:
|
||||
- almalinux8
|
||||
- almalinux9
|
||||
- almalinux10
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- rocky10
|
||||
- fedora42
|
||||
- fedora43
|
||||
- fedora44
|
||||
- fedora37
|
||||
- fedora38
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
- ubuntu2604
|
||||
- debian10
|
||||
- debian11
|
||||
- debian12
|
||||
- debian13
|
||||
- amazon2023
|
||||
- arch
|
||||
molecule_docker_command:
|
||||
- "/lib/systemd/systemd"
|
||||
# - opensuse_tumbleweed # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
|
||||
- name: Set up Python 3.11
|
||||
uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: 3.13
|
||||
cache: 'pip'
|
||||
python-version: 3.11
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Downgrade Ansible for Rocky 8 tests
|
||||
run: |
|
||||
pip install "ansible-core<2.17"
|
||||
ansible-galaxy collection install 'community.crypto:<3.0.0'
|
||||
ansible-galaxy collection install 'community.general:<12.0.0'
|
||||
sudo apt install git
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
|
||||
|
||||
- name: Test with molecule
|
||||
run: molecule test -s ssh_hardening_custom_tests
|
||||
run: |
|
||||
if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
|
||||
export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
|
||||
fi
|
||||
molecule --version
|
||||
molecule converge -s ssh_hardening_custom_tests
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
@@ -1,73 +0,0 @@
|
||||
---
|
||||
name: "devsec.ssh_hardening VM"
|
||||
on: # yamllint disable-line rule:truthy
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_vm/**'
|
||||
- '.github/workflows/ssh_hardening_vm.yml'
|
||||
- 'requirements.txt'
|
||||
- 'requirements-vm.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_vm/**'
|
||||
- '.github/workflows/ssh_hardening_vm.yml'
|
||||
- 'requirements.txt'
|
||||
- 'requirements-vm.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 5'
|
||||
|
||||
concurrency:
|
||||
group: >-
|
||||
${{ github.workflow }}-${{
|
||||
github.event.pull_request.number || github.sha
|
||||
}}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: self-hosted
|
||||
env:
|
||||
PY_COLORS: 1
|
||||
ANSIBLE_FORCE_COLOR: 1
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- generic/openbsd7
|
||||
- generic/freebsd14
|
||||
- cloud-image/debian-13
|
||||
- cloud-image/ubuntu-24.04
|
||||
- cloud-image/ubuntu-26.04
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
source ~/.venv/ansible-collection-hardening/bin/activate
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
pip install -r requirements-vm.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Update Vagrant Box
|
||||
run: |
|
||||
vagrant box update --box ${{ matrix.molecule_distro }} || true
|
||||
|
||||
- name: Test with molecule
|
||||
run: |
|
||||
source ~/.venv/ansible-collection-hardening/bin/activate
|
||||
# Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
|
||||
export MOLECULE_VAGRANT_PLUGIN_DIR=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')/molecule_plugins/vagrant
|
||||
molecule test -s ssh_hardening_vm
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
+7
-355
@@ -1,365 +1,13 @@
|
||||
# Changelog
|
||||
|
||||
## [10.6.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.6.0) (2026-05-13)
|
||||
## [8.9.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.9.0) (2023-08-07)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.2...10.6.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Update APT package cache before installing any package in case freshly installed system. [\#945](https://github.com/dev-sec/ansible-collection-hardening/issues/945)
|
||||
- Update supported OS versions to current Fedora \(42/43/44\) and Ubuntu \(22.04/24.04/26.04\) [\#946](https://github.com/dev-sec/ansible-collection-hardening/pull/946) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Update actions/labeler action to v6.1.0 [\#947](https://github.com/dev-sec/ansible-collection-hardening/pull/947) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update dev-sec/.github digest to 2cd0028 [\#943](https://github.com/dev-sec/ansible-collection-hardening/pull/943) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update ansible/ansible-lint digest to 5fac056 [\#942](https://github.com/dev-sec/ansible-collection-hardening/pull/942) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update dependency molecule to v26 [\#935](https://github.com/dev-sec/ansible-collection-hardening/pull/935) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update dependency ansible-core to v2.20.5 [\#910](https://github.com/dev-sec/ansible-collection-hardening/pull/910) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.5.2](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.2) (2026-03-28)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.1...10.5.2)
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- do not update apt cache when installing libpam-passwdqc [\#939](https://github.com/dev-sec/ansible-collection-hardening/pull/939) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([eikesauer](https://github.com/eikesauer))
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- chore\(deps\): update hugo19941994/delete-draft-releases action to v3 [\#940](https://github.com/dev-sec/ansible-collection-hardening/pull/940) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): pin dependencies [\#938](https://github.com/dev-sec/ansible-collection-hardening/pull/938) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/checkout digest to de0fac2 [\#932](https://github.com/dev-sec/ansible-collection-hardening/pull/932) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.5.1](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.1) (2026-03-20)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.0...10.5.1)
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- fix flaky failures on Ubuntu 24.04 and newer by disabling sshd socket activation first [\#931](https://github.com/dev-sec/ansible-collection-hardening/pull/931) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([kuglimon](https://github.com/kuglimon))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- SSH issue after running devsec.hardening.ssh\_hardening role [\#854](https://github.com/dev-sec/ansible-collection-hardening/issues/854)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- chore\(deps\): update juliangruber/read-file-action digest to 271ff31 [\#937](https://github.com/dev-sec/ansible-collection-hardening/pull/937) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 8ba9595 [\#934](https://github.com/dev-sec/ansible-collection-hardening/pull/934) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update artis3n/ansible\_galaxy\_collection action to v3 [\#933](https://github.com/dev-sec/ansible-collection-hardening/pull/933) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Improve VM based testing of SSH hardening [\#878](https://github.com/dev-sec/ansible-collection-hardening/pull/878) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
|
||||
## [10.5.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.0) (2026-01-22)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.4.0...10.5.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- fix: replace deprecated community.general.yaml callback plugin [\#918](https://github.com/dev-sec/ansible-collection-hardening/pull/918) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([Normo](https://github.com/Normo))
|
||||
- Consistently access facts via the ansible\_facts.\* namespace [\#917](https://github.com/dev-sec/ansible-collection-hardening/pull/917) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([Normo](https://github.com/Normo))
|
||||
- disable systemd audit logging [\#902](https://github.com/dev-sec/ansible-collection-hardening/pull/902) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([z-bsod](https://github.com/z-bsod))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- /etc/sysctl.conf is no longer honored in Debian 13 [\#905](https://github.com/dev-sec/ansible-collection-hardening/issues/905)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- chore\(deps\): update dependency jmespath to v1.1.0 [\#930](https://github.com/dev-sec/ansible-collection-hardening/pull/930) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/setup-python digest to a309ff8 [\#929](https://github.com/dev-sec/ansible-collection-hardening/pull/929) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint action to v26 [\#928](https://github.com/dev-sec/ansible-collection-hardening/pull/928) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update artis3n/ansible\_galaxy\_collection digest to 415a92b - autoclosed [\#927](https://github.com/dev-sec/ansible-collection-hardening/pull/927) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to a2bc8b8 [\#924](https://github.com/dev-sec/ansible-collection-hardening/pull/924) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/setup-python digest to 83679a8 [\#920](https://github.com/dev-sec/ansible-collection-hardening/pull/920) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/checkout action to v6 [\#919](https://github.com/dev-sec/ansible-collection-hardening/pull/919) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency molecule to v25.12.0 [\#914](https://github.com/dev-sec/ansible-collection-hardening/pull/914) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 40f24c2 [\#913](https://github.com/dev-sec/ansible-collection-hardening/pull/913) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update test environments to current Ansible version [\#909](https://github.com/dev-sec/ansible-collection-hardening/pull/909) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to d7cd7cf [\#903](https://github.com/dev-sec/ansible-collection-hardening/pull/903) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.4.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.4.0) (2025-10-22)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.3.1...10.4.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Support Debian 13 [\#891](https://github.com/dev-sec/ansible-collection-hardening/issues/891)
|
||||
- Support EL10 [\#870](https://github.com/dev-sec/ansible-collection-hardening/issues/870)
|
||||
- Add support for current versions of Debian and EL [\#893](https://github.com/dev-sec/ansible-collection-hardening/pull/893) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Add SSH config for EL/AlmaLinux 10 [\#888](https://github.com/dev-sec/ansible-collection-hardening/pull/888) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([jonathanspw](https://github.com/jonathanspw))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- Write sysctl config to separate file [\#907](https://github.com/dev-sec/ansible-collection-hardening/pull/907) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- sysctl-34 - fs.protected\_regular not set [\#536](https://github.com/dev-sec/ansible-collection-hardening/issues/536)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Update ArchLinux test environment before testing [\#908](https://github.com/dev-sec/ansible-collection-hardening/pull/908) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): update actions/setup-python action to v6 [\#901](https://github.com/dev-sec/ansible-collection-hardening/pull/901) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/labeler action to v6 [\#900](https://github.com/dev-sec/ansible-collection-hardening/pull/900) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 8861a73 [\#899](https://github.com/dev-sec/ansible-collection-hardening/pull/899) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/checkout action to v5 [\#895](https://github.com/dev-sec/ansible-collection-hardening/pull/895) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency python to 3.13 [\#892](https://github.com/dev-sec/ansible-collection-hardening/pull/892) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency aar-doc to v2.3.0 [\#890](https://github.com/dev-sec/ansible-collection-hardening/pull/890) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 9765b87 [\#889](https://github.com/dev-sec/ansible-collection-hardening/pull/889) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Improve OS support accuracy [\#887](https://github.com/dev-sec/ansible-collection-hardening/pull/887) ([jonathanspw](https://github.com/jonathanspw))
|
||||
- chore\(deps\): update hugo19941994/delete-draft-releases action to v2 [\#885](https://github.com/dev-sec/ansible-collection-hardening/pull/885) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.3.1](https://github.com/dev-sec/ansible-collection-hardening/tree/10.3.1) (2025-07-24)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.3.0...10.3.1)
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- Readme states Ansible \>= 2.9.10, but it uses password\_expire\_warn from 2.16 [\#871](https://github.com/dev-sec/ansible-collection-hardening/issues/871)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Use fixed test env for BSD VMs [\#884](https://github.com/dev-sec/ansible-collection-hardening/pull/884) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Downgrade community.crypto for rocky8 [\#882](https://github.com/dev-sec/ansible-collection-hardening/pull/882) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): update dependency aar-doc to v2.2.0 [\#877](https://github.com/dev-sec/ansible-collection-hardening/pull/877) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update creyd/prettier\_action action to v4.6 [\#876](https://github.com/dev-sec/ansible-collection-hardening/pull/876) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 06f616d [\#873](https://github.com/dev-sec/ansible-collection-hardening/pull/873) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.18.6 [\#872](https://github.com/dev-sec/ansible-collection-hardening/pull/872) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update creyd/prettier\_action action to v4.5 [\#869](https://github.com/dev-sec/ansible-collection-hardening/pull/869) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(ssh\_hardening\): ansible 2.19 compatibility [\#868](https://github.com/dev-sec/ansible-collection-hardening/pull/868) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to e98f9b3 [\#867](https://github.com/dev-sec/ansible-collection-hardening/pull/867) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/setup-python digest to a26af69 [\#866](https://github.com/dev-sec/ansible-collection-hardening/pull/866) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.18.5 [\#865](https://github.com/dev-sec/ansible-collection-hardening/pull/865) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to c16f018 [\#863](https://github.com/dev-sec/ansible-collection-hardening/pull/863) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 6a4fcdb [\#862](https://github.com/dev-sec/ansible-collection-hardening/pull/862) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency aar-doc to v2.1.0 [\#861](https://github.com/dev-sec/ansible-collection-hardening/pull/861) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.18.4 [\#860](https://github.com/dev-sec/ansible-collection-hardening/pull/860) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/setup-python digest to 8d9ed9a [\#859](https://github.com/dev-sec/ansible-collection-hardening/pull/859) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Fix: ForwardAgent j2 template space [\#856](https://github.com/dev-sec/ansible-collection-hardening/pull/856) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([cod3mas0n](https://github.com/cod3mas0n))
|
||||
- chore\(deps\): update artis3n/ansible\_galaxy\_collection digest to f6110ae [\#853](https://github.com/dev-sec/ansible-collection-hardening/pull/853) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.3.0) (2025-02-25)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.2.0...10.3.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Password expiry for users without password should not block SSH key based login [\#681](https://github.com/dev-sec/ansible-collection-hardening/issues/681)
|
||||
- Set number of warning days before password expires for existing users [\#839](https://github.com/dev-sec/ansible-collection-hardening/pull/839) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Normo](https://github.com/Normo))
|
||||
- Allow to override settings for sftponly users [\#794](https://github.com/dev-sec/ansible-collection-hardening/pull/794) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([mib1185](https://github.com/mib1185))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- os\_hardening & sysctl\_overwrite with host\_vars [\#837](https://github.com/dev-sec/ansible-collection-hardening/issues/837)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- chore\(deps\): update dependency ansible-core to v2.18.3 [\#852](https://github.com/dev-sec/ansible-collection-hardening/pull/852) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 49ded6a [\#851](https://github.com/dev-sec/ansible-collection-hardening/pull/851) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Pin runner image to specific version to decouple from GitHub updates [\#847](https://github.com/dev-sec/ansible-collection-hardening/pull/847) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Refactor: combine multiple set\_fact into single jinja filter [\#846](https://github.com/dev-sec/ansible-collection-hardening/pull/846) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Tinyblargon](https://github.com/Tinyblargon))
|
||||
- chore\(deps\): update actions/setup-python digest to 4237552 [\#844](https://github.com/dev-sec/ansible-collection-hardening/pull/844) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.18.2 [\#843](https://github.com/dev-sec/ansible-collection-hardening/pull/843) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency molecule to v25 [\#841](https://github.com/dev-sec/ansible-collection-hardening/pull/841) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint action to v25 [\#840](https://github.com/dev-sec/ansible-collection-hardening/pull/840) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.2.0) (2024-12-23)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.1.0...10.2.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Re-enable OpenBSD tests [\#826](https://github.com/dev-sec/ansible-collection-hardening/issues/826) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
|
||||
- Allow configuring the name\_format variable in auditd config [\#796](https://github.com/dev-sec/ansible-collection-hardening/issues/796) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
|
||||
- Modify PAM to allow SSH key based logins with locked passwords [\#835](https://github.com/dev-sec/ansible-collection-hardening/pull/835) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- adding switch for ForwardAgent in ssh\_config [\#818](https://github.com/dev-sec/ansible-collection-hardening/pull/818) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Shizzlebix](https://github.com/Shizzlebix))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- File system loop detected; ‘/bin/X11’ is part of the same file system loop as ‘/bin’." [\#815](https://github.com/dev-sec/ansible-collection-hardening/issues/815) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
|
||||
- Not working ssh\_hardening on Centos 7 [\#813](https://github.com/dev-sec/ansible-collection-hardening/issues/813) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- chore\(deps\): update dependency molecule-plugins to v23.6.0 [\#834](https://github.com/dev-sec/ansible-collection-hardening/pull/834) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 4ce8e49 [\#832](https://github.com/dev-sec/ansible-collection-hardening/pull/832) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency molecule to v24.12.0 [\#831](https://github.com/dev-sec/ansible-collection-hardening/pull/831) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.18.1 [\#829](https://github.com/dev-sec/ansible-collection-hardening/pull/829) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Change installation source for OpenBSD tests [\#828](https://github.com/dev-sec/ansible-collection-hardening/pull/828) ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 44be233 [\#825](https://github.com/dev-sec/ansible-collection-hardening/pull/825) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Bump ansible-core from 2.17.5 to 2.17.6 [\#820](https://github.com/dev-sec/ansible-collection-hardening/pull/820) ([dependabot[bot]](https://github.com/apps/dependabot))
|
||||
- chore\(deps\): update dependency ansible-core to v2.18.0 [\#819](https://github.com/dev-sec/ansible-collection-hardening/pull/819) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency aar-doc to v2.0.1 [\#817](https://github.com/dev-sec/ansible-collection-hardening/pull/817) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update actions/setup-python digest to 0b93645 [\#814](https://github.com/dev-sec/ansible-collection-hardening/pull/814) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/checkout digest to 11bd719 [\#812](https://github.com/dev-sec/ansible-collection-hardening/pull/812) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.1.0) (2024-10-22)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.0.0...10.1.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Ubuntu 24.04 support [\#764](https://github.com/dev-sec/ansible-collection-hardening/issues/764)
|
||||
- Add variable to set name\_format for auditd [\#810](https://github.com/dev-sec/ansible-collection-hardening/pull/810) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- feat\(ssh\): add alpine support [\#809](https://github.com/dev-sec/ansible-collection-hardening/pull/809) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Provide granular noop for ssh configuration [\#789](https://github.com/dev-sec/ansible-collection-hardening/pull/789) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([seven-beep](https://github.com/seven-beep))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- molecule scenario ssh\_hardening if failing due to missing docker image [\#790](https://github.com/dev-sec/ansible-collection-hardening/issues/790)
|
||||
- getent\_shadow empty [\#787](https://github.com/dev-sec/ansible-collection-hardening/issues/787)
|
||||
- Error: Missing privilege separation directory: /run/sshd [\#752](https://github.com/dev-sec/ansible-collection-hardening/issues/752)
|
||||
- fix\(ssh\_hardening\): test setting kex to false, remove wrong default [\#808](https://github.com/dev-sec/ansible-collection-hardening/pull/808) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Pin python dependencies and optimize GitHub Actions [\#811](https://github.com/dev-sec/ansible-collection-hardening/pull/811) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- fix\(cicd\): test idempotence on ssh custom tests [\#807](https://github.com/dev-sec/ansible-collection-hardening/pull/807) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Document correct quotes for ssh\_permit\_tunnel parameter [\#806](https://github.com/dev-sec/ansible-collection-hardening/pull/806) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([vmpr](https://github.com/vmpr))
|
||||
- fix\(docs\): add 'become: true' to example playbooks. fix \#787 [\#804](https://github.com/dev-sec/ansible-collection-hardening/pull/804) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- chore\(deps\): update dependency ansible-core to v2.17.5 [\#802](https://github.com/dev-sec/ansible-collection-hardening/pull/802) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Don't run tests if the environment is not correct [\#801](https://github.com/dev-sec/ansible-collection-hardening/pull/801) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): update actions/checkout digest to eef6144 [\#800](https://github.com/dev-sec/ansible-collection-hardening/pull/800) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- feat: Corrected package name [\#799](https://github.com/dev-sec/ansible-collection-hardening/pull/799) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([PapaPeskwo](https://github.com/PapaPeskwo))
|
||||
- Use Python venv for VM tests [\#798](https://github.com/dev-sec/ansible-collection-hardening/pull/798) ([schurzi](https://github.com/schurzi))
|
||||
- Remove unused files and variables [\#797](https://github.com/dev-sec/ansible-collection-hardening/pull/797) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 3b5bee1 [\#795](https://github.com/dev-sec/ansible-collection-hardening/pull/795) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 25f783c [\#792](https://github.com/dev-sec/ansible-collection-hardening/pull/792) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.17.4 [\#791](https://github.com/dev-sec/ansible-collection-hardening/pull/791) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/setup-python digest to f677139 [\#788](https://github.com/dev-sec/ansible-collection-hardening/pull/788) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.17.3 [\#786](https://github.com/dev-sec/ansible-collection-hardening/pull/786) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.17.2 [\#756](https://github.com/dev-sec/ansible-collection-hardening/pull/756) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.0.0) (2024-08-06)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/9.0.1...10.0.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- option to disable regeneration of ssh private key [\#772](https://github.com/dev-sec/ansible-collection-hardening/issues/772)
|
||||
- Support systemd socket activation for sshd [\#763](https://github.com/dev-sec/ansible-collection-hardening/issues/763) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
|
||||
- Release 9.0.2 [\#758](https://github.com/dev-sec/ansible-collection-hardening/issues/758)
|
||||
- Make Publickey authentication configurable [\#750](https://github.com/dev-sec/ansible-collection-hardening/issues/750)
|
||||
- Ansible Linting [\#747](https://github.com/dev-sec/ansible-collection-hardening/issues/747)
|
||||
- Make value of kernel.unprivileged\_userns\_clone depending on kernel version [\#727](https://github.com/dev-sec/ansible-collection-hardening/issues/727)
|
||||
- Ensure that ssh is installed \(cf \#771\) [\#774](https://github.com/dev-sec/ansible-collection-hardening/pull/774) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Byh0ki](https://github.com/Byh0ki))
|
||||
- ssh: explicitly enable or disable the service at boot [\#771](https://github.com/dev-sec/ansible-collection-hardening/pull/771) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Byh0ki](https://github.com/Byh0ki))
|
||||
- disable systemd socket activation [\#769](https://github.com/dev-sec/ansible-collection-hardening/pull/769) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Add ssh\_pubkey\_authentication variable to ssh hardening [\#749](https://github.com/dev-sec/ansible-collection-hardening/pull/749) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([debbabi](https://github.com/debbabi))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- ssh hardening role fails when `ssh_permit_root_login` var is set on ubuntu 24.04 [\#768](https://github.com/dev-sec/ansible-collection-hardening/issues/768)
|
||||
- os\_hardening fails when setting vm.mmap\_rnd\_bits [\#757](https://github.com/dev-sec/ansible-collection-hardening/issues/757)
|
||||
- `ssh_gateway_ports` is documented to accept 'clientspecified' string, but only accepts bools [\#755](https://github.com/dev-sec/ansible-collection-hardening/issues/755)
|
||||
- harden permissions for directory mount /var/log fails for minimized Ubuntu 22.04 [\#741](https://github.com/dev-sec/ansible-collection-hardening/issues/741)
|
||||
- Update Debian compatibility [\#784](https://github.com/dev-sec/ansible-collection-hardening/pull/784) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- do not force type of ssh\_gateway\_ports [\#765](https://github.com/dev-sec/ansible-collection-hardening/pull/765) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Update to current Fedora releases [\#783](https://github.com/dev-sec/ansible-collection-hardening/pull/783) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Remove deprecated rebuild of initrd [\#782](https://github.com/dev-sec/ansible-collection-hardening/pull/782) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): update patrickjahns/version-drafter-action digest to 2076fa4 [\#781](https://github.com/dev-sec/ansible-collection-hardening/pull/781) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 95382d3 [\#779](https://github.com/dev-sec/ansible-collection-hardening/pull/779) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/setup-python digest to 39cd149 [\#778](https://github.com/dev-sec/ansible-collection-hardening/pull/778) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- remove tests for FreeBSD12 since it's out of support [\#777](https://github.com/dev-sec/ansible-collection-hardening/pull/777) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): pin dependencies [\#776](https://github.com/dev-sec/ansible-collection-hardening/pull/776) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Use best-practice preset for renovate [\#775](https://github.com/dev-sec/ansible-collection-hardening/pull/775) ([schurzi](https://github.com/schurzi))
|
||||
- Deprecate Centos Stream 8 [\#770](https://github.com/dev-sec/ansible-collection-hardening/pull/770) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- centos7 is eol, remove it [\#767](https://github.com/dev-sec/ansible-collection-hardening/pull/767) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- fix spelling [\#766](https://github.com/dev-sec/ansible-collection-hardening/pull/766) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- ci: define permissions for enforce-labels workflow [\#760](https://github.com/dev-sec/ansible-collection-hardening/pull/760) ([fgreinacher](https://github.com/fgreinacher))
|
||||
- Update dependency ansible-core to v2.16.5 [\#754](https://github.com/dev-sec/ansible-collection-hardening/pull/754) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update dependency ansible-core to v2.16.4 [\#751](https://github.com/dev-sec/ansible-collection-hardening/pull/751) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update ansible/ansible-lint action to v24 [\#745](https://github.com/dev-sec/ansible-collection-hardening/pull/745) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Always update Vagrant Boxes before using [\#744](https://github.com/dev-sec/ansible-collection-hardening/pull/744) ([schurzi](https://github.com/schurzi))
|
||||
- Remove Docker containers on self-hosted runner after tests [\#743](https://github.com/dev-sec/ansible-collection-hardening/pull/743) ([schurzi](https://github.com/schurzi))
|
||||
- Update dependency ansible-core to v2.16.3 [\#742](https://github.com/dev-sec/ansible-collection-hardening/pull/742) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [9.0.1](https://github.com/dev-sec/ansible-collection-hardening/tree/9.0.1) (2024-01-15)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/9.0.0...9.0.1)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Extend ansible-lint testing to cover our test cases [\#731](https://github.com/dev-sec/ansible-collection-hardening/issues/731)
|
||||
- Complete tests for OS hardening [\#660](https://github.com/dev-sec/ansible-collection-hardening/issues/660)
|
||||
- support restarts of audit service on Arch linux [\#722](https://github.com/dev-sec/ansible-collection-hardening/pull/722) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- Fails to install [\#735](https://github.com/dev-sec/ansible-collection-hardening/issues/735)
|
||||
- Amazon Linux gpg check fails [\#734](https://github.com/dev-sec/ansible-collection-hardening/issues/734)
|
||||
- ssh\_hardening ipv6 [\#719](https://github.com/dev-sec/ansible-collection-hardening/issues/719)
|
||||
- boolean variable inconsistency? [\#330](https://github.com/dev-sec/ansible-collection-hardening/issues/330)
|
||||
- Restore idempotency for disabling unused filesystems with Ansible 2.16.0 [\#718](https://github.com/dev-sec/ansible-collection-hardening/pull/718) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([akikanellis](https://github.com/akikanellis))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- 9.0.0 version number in galaxy.yml file is wrong [\#740](https://github.com/dev-sec/ansible-collection-hardening/issues/740)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- restructure readme to move known limitations up top [\#739](https://github.com/dev-sec/ansible-collection-hardening/pull/739) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- release only on releases, not pre-releases [\#738](https://github.com/dev-sec/ansible-collection-hardening/pull/738) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Update dependency ansible-core to v2.16.2 [\#737](https://github.com/dev-sec/ansible-collection-hardening/pull/737) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- fix linting for github config [\#736](https://github.com/dev-sec/ansible-collection-hardening/pull/736) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Update actions/setup-python action to v5 [\#733](https://github.com/dev-sec/ansible-collection-hardening/pull/733) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update ansible-lint action and revise configuration to scan all Ansible code [\#732](https://github.com/dev-sec/ansible-collection-hardening/pull/732) ([schurzi](https://github.com/schurzi))
|
||||
- update labeler to new config format [\#730](https://github.com/dev-sec/ansible-collection-hardening/pull/730) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Update dependency ansible-core to v2.16.1 [\#728](https://github.com/dev-sec/ansible-collection-hardening/pull/728) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- pin Ansible to always let Renovate update to the most current version in our tests [\#721](https://github.com/dev-sec/ansible-collection-hardening/pull/721) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
|
||||
## [9.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/9.0.0) (2023-11-16)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.8.0...9.0.0)
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.8.0...8.9.0)
|
||||
|
||||
**Breaking changes:**
|
||||
|
||||
- make it possible to configure more then yes and no for PermitTunnel [\#715](https://github.com/dev-sec/ansible-collection-hardening/pull/715) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- add role argument spec for os, ssh, mysql [\#687](https://github.com/dev-sec/ansible-collection-hardening/pull/687) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Create role documentation with Automated-Ansible-Role-Documentation [\#694](https://github.com/dev-sec/ansible-collection-hardening/issues/694)
|
||||
- Minimize access user paths should be fully configurable [\#689](https://github.com/dev-sec/ansible-collection-hardening/issues/689)
|
||||
- Add support for Debian 12 [\#672](https://github.com/dev-sec/ansible-collection-hardening/issues/672)
|
||||
- add testing and support for current versions of Fedora and FreeBSD [\#709](https://github.com/dev-sec/ansible-collection-hardening/pull/709) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- feat: workflow for roles readme [\#705](https://github.com/dev-sec/ansible-collection-hardening/pull/705) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
|
||||
- do not try to drop roles in mysql hardening [\#649](https://github.com/dev-sec/ansible-collection-hardening/pull/649) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- nginx conf.d directory is missing on Rocky Linux 8 [\#707](https://github.com/dev-sec/ansible-collection-hardening/issues/707)
|
||||
- Default value of `ssh_client_alive_interval` is inconsistent with what documentation says [\#701](https://github.com/dev-sec/ansible-collection-hardening/issues/701)
|
||||
- \[devsec.hardening.os\_hardening : restart-auditd\] fails [\#698](https://github.com/dev-sec/ansible-collection-hardening/issues/698)
|
||||
- sshd\_hardening role cannot be used to build system images [\#697](https://github.com/dev-sec/ansible-collection-hardening/issues/697)
|
||||
- Error: No file was found when using first\_found on Ubuntu 20.04 [\#676](https://github.com/dev-sec/ansible-collection-hardening/issues/676)
|
||||
- PUBLIC-role breaks mysql-hardening [\#648](https://github.com/dev-sec/ansible-collection-hardening/issues/648)
|
||||
- Error deploying the playbook [\#630](https://github.com/dev-sec/ansible-collection-hardening/issues/630)
|
||||
- Gather facts when os\_hardening role is executed with tags [\#708](https://github.com/dev-sec/ansible-collection-hardening/pull/708) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- Add send-to-mailinglist to github release action [\#434](https://github.com/dev-sec/ansible-collection-hardening/issues/434)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- update status badges in README [\#714](https://github.com/dev-sec/ansible-collection-hardening/pull/714) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- fix CI test for os\_hardening [\#711](https://github.com/dev-sec/ansible-collection-hardening/pull/711) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- fix nginx CI tests [\#710](https://github.com/dev-sec/ansible-collection-hardening/pull/710) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- fix: roles-readme action default value [\#706](https://github.com/dev-sec/ansible-collection-hardening/pull/706) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
|
||||
- fix some wrong defaults and types in the readmes [\#703](https://github.com/dev-sec/ansible-collection-hardening/pull/703) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- update links to new Ansible Galaxy [\#702](https://github.com/dev-sec/ansible-collection-hardening/pull/702) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Fix typo in login.defs.j2 [\#700](https://github.com/dev-sec/ansible-collection-hardening/pull/700) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))
|
||||
- chore\(deps\): update actions/checkout action to v4 [\#696](https://github.com/dev-sec/ansible-collection-hardening/pull/696) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- test debian12 on VM [\#695](https://github.com/dev-sec/ansible-collection-hardening/pull/695) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- fix descriptions in readme [\#693](https://github.com/dev-sec/ansible-collection-hardening/pull/693) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- feat: customize user paths default [\#692](https://github.com/dev-sec/ansible-collection-hardening/pull/692) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([S0obi](https://github.com/S0obi))
|
||||
- disable PAM tests [\#691](https://github.com/dev-sec/ansible-collection-hardening/pull/691) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [8.8.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.8.0) (2023-08-04)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.7.0...8.8.0)
|
||||
@@ -376,6 +24,7 @@
|
||||
**Fixed bugs:**
|
||||
|
||||
- How does one set `sshd_authenticationmethods` to include password authentication? [\#686](https://github.com/dev-sec/ansible-collection-hardening/issues/686)
|
||||
- Error: No file was found when using first\_found on Ubuntu 20.04 [\#676](https://github.com/dev-sec/ansible-collection-hardening/issues/676)
|
||||
- FreeIPA environment mkhomedir fails [\#664](https://github.com/dev-sec/ansible-collection-hardening/issues/664)
|
||||
|
||||
**Closed issues:**
|
||||
@@ -415,6 +64,7 @@
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- Dependency Dashboard [\#655](https://github.com/dev-sec/ansible-collection-hardening/issues/655)
|
||||
- Invalid login.defs for RHEL6 [\#651](https://github.com/dev-sec/ansible-collection-hardening/issues/651)
|
||||
- Deprecation warnings for os\_hardening [\#638](https://github.com/dev-sec/ansible-collection-hardening/issues/638)
|
||||
- Write tests for MySQL user-deletion [\#445](https://github.com/dev-sec/ansible-collection-hardening/issues/445)
|
||||
@@ -1103,6 +753,7 @@
|
||||
- Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-collection-hardening/pull/251) ([dustinmiller](https://github.com/dustinmiller))
|
||||
- Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
|
||||
- Make max\_log\_file\_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-collection-hardening/pull/246) ([jandd](https://github.com/jandd))
|
||||
- Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-collection-hardening/pull/240) ([ghost](https://github.com/ghost))
|
||||
- Fedora - Use new auto ansible\_python\_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-collection-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
|
||||
- add test support for CentOS8 [\#237](https://github.com/dev-sec/ansible-collection-hardening/pull/237) ([yeoldegrove](https://github.com/yeoldegrove))
|
||||
- Support configuring SELinux and default to enforcing [\#236](https://github.com/dev-sec/ansible-collection-hardening/pull/236) ([jaredledvina](https://github.com/jaredledvina))
|
||||
@@ -1143,7 +794,7 @@
|
||||
- remove prelink package, control package-09 [\#135](https://github.com/dev-sec/ansible-collection-hardening/pull/135) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- style update [\#134](https://github.com/dev-sec/ansible-collection-hardening/pull/134) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Remove deprecated include for static tasks and use instead import\_tasks fix \#131 [\#132](https://github.com/dev-sec/ansible-collection-hardening/pull/132) ([HelioCampos](https://github.com/HelioCampos))
|
||||
- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-collection-hardening/pull/130) ([FazleArefin](https://github.com/FazleArefin))
|
||||
- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-collection-hardening/pull/130) ([fazlearefin](https://github.com/fazlearefin))
|
||||
- install initramfs-tools [\#114](https://github.com/dev-sec/ansible-collection-hardening/pull/114) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- omit empty variables [\#106](https://github.com/dev-sec/ansible-collection-hardening/pull/106) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Supports --check mode [\#93](https://github.com/dev-sec/ansible-collection-hardening/pull/93) ([conorsch](https://github.com/conorsch))
|
||||
@@ -1210,6 +861,7 @@
|
||||
- replace module parameter fixed [\#297](https://github.com/dev-sec/ansible-collection-hardening/pull/297) ([danielkubat](https://github.com/danielkubat))
|
||||
- Addressing issue \#255 [\#258](https://github.com/dev-sec/ansible-collection-hardening/pull/258) ([ljkimmel](https://github.com/ljkimmel))
|
||||
- Fix \#247, cleanup conditions [\#248](https://github.com/dev-sec/ansible-collection-hardening/pull/248) ([fernandezcuesta](https://github.com/fernandezcuesta))
|
||||
- Fix error on applying the sysctl vars on containers [\#243](https://github.com/dev-sec/ansible-collection-hardening/pull/243) ([ghost](https://github.com/ghost))
|
||||
- Update location of NSA RHEL 5 Guide [\#235](https://github.com/dev-sec/ansible-collection-hardening/pull/235) ([jaredledvina](https://github.com/jaredledvina))
|
||||
- Fix typo [\#212](https://github.com/dev-sec/ansible-collection-hardening/pull/212) ([ruslo](https://github.com/ruslo))
|
||||
- Update modprobe to 0644 [\#211](https://github.com/dev-sec/ansible-collection-hardening/pull/211) ([joshuatalb](https://github.com/joshuatalb))
|
||||
|
||||
@@ -93,21 +93,6 @@ We generally include test for coding guidelines:
|
||||
|
||||
Remember: Code is generally read much more often than written.
|
||||
|
||||
### Local testing of roles in this collection
|
||||
|
||||
We are using Molecule to test our roles.
|
||||
If you want to execute the tests on your machine you need Docker and Molecule.
|
||||
You will also need to set the `MOLECULE_DISTRO` environment variable to execute the tests.
|
||||
To find valid values for the variable you can take a look at our GitHub Action workflows in `.github/workflows/`.
|
||||
|
||||
Example for executing tests locally:
|
||||
|
||||
```bash
|
||||
pip install -r requirements.txt
|
||||
export MOLECULE_DISTRO="debian12"
|
||||
molecule test -s os_hardening
|
||||
```
|
||||
|
||||
### Use Markdown
|
||||
|
||||
Wherever possible, please refrain from any other formats and stick to simple markdown.
|
||||
@@ -1,26 +1,23 @@
|
||||
# Ansible Collection - devsec.hardening
|
||||
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Description
|
||||
|
||||
This collection provides battle tested hardening for:
|
||||
|
||||
- Linux operating systems:
|
||||
- CentOS Stream 9
|
||||
- AlmaLinux 8/9/10
|
||||
- Rocky Linux 8/9/10
|
||||
- Debian 11/12/13
|
||||
- Ubuntu 22.04/24.04/26.04
|
||||
- CentOS 7/8/9
|
||||
- Rocky Linux 8/9
|
||||
- Debian 10/11/12
|
||||
- Ubuntu 18.04/20.04/22.04
|
||||
- Amazon Linux (some roles supported)
|
||||
- Arch Linux (some roles supported)
|
||||
- Fedora 42/43/44 (some roles supported)
|
||||
- Fedora 37/38 (some roles supported)
|
||||
- Suse Tumbleweed (some roles supported)
|
||||
- MySQL
|
||||
- MariaDB >= 5.5.65, >= 10.1.45, >= 10.3.17
|
||||
@@ -51,7 +48,7 @@ The other roles are in separate archives repositories:
|
||||
|
||||
## Minimum required Ansible-version
|
||||
|
||||
- Ansible >= 2.16
|
||||
- Ansible >= 2.9.10
|
||||
|
||||
## Included content
|
||||
|
||||
|
||||
+1
-4
@@ -1,6 +1,6 @@
|
||||
namespace: devsec
|
||||
name: hardening
|
||||
version: 10.5.2
|
||||
version: 8.8.0
|
||||
readme: README.md
|
||||
authors:
|
||||
- dev-sec <[email protected]>
|
||||
@@ -22,9 +22,6 @@ tags:
|
||||
- nginx_hardening
|
||||
- os_hardening
|
||||
- ssh_hardening
|
||||
- database
|
||||
- linux
|
||||
- security
|
||||
dependencies:
|
||||
ansible.posix: '>=1.0.0'
|
||||
community.crypto: '>=1.0.0'
|
||||
|
||||
@@ -1,29 +1,38 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-mysql-hardening"
|
||||
- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
|
||||
hosts: all
|
||||
become: true
|
||||
collections:
|
||||
- devsec.hardening
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
|
||||
ansible.builtin.set_fact:
|
||||
mysql_python_package_debian: python3-pymysql
|
||||
set_fact:
|
||||
mysql_python_package_debian: "python3-pymysql"
|
||||
when:
|
||||
- mysql_python_package_debian is not defined
|
||||
- ansible_facts.distribution == "Ubuntu"
|
||||
- ansible_facts.distribution_major_version|int > 19
|
||||
- ansible_distribution == "Ubuntu"
|
||||
- ansible_distribution_major_version|int > 19
|
||||
|
||||
- name: Determine required MySQL Python libraries.
|
||||
set_fact:
|
||||
mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
|
||||
when:
|
||||
- mysql_python_package_debian is not defined
|
||||
- ansible_distribution != "Ubuntu"
|
||||
- ansible_distribution_major_version|int < 20
|
||||
|
||||
- name: Use Python 3 on Suse
|
||||
ansible.builtin.set_fact:
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when:
|
||||
- ansible_facts.os_family == 'Suse'
|
||||
- ansible_os_family == 'Suse'
|
||||
|
||||
- name: Include mysql_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.mysql_hardening
|
||||
- include_role:
|
||||
name: mysql_hardening
|
||||
vars:
|
||||
overwrite_global_mycnf: false
|
||||
mysql_root_password: iloverandompasswordsbutthiswilldo
|
||||
|
||||
@@ -8,7 +8,7 @@ driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: instance
|
||||
image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
|
||||
image: "ghcr.io/dev-sec/docker-${MOLECULE_DISTRO}-ansible:latest"
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
||||
@@ -22,9 +22,7 @@ provisioner:
|
||||
config_options:
|
||||
defaults:
|
||||
interpreter_python: auto_silent
|
||||
callbacks_enabled: profile_tasks, timer
|
||||
# Currently not supported by dev-sec.mysql role
|
||||
# inject_facts_as_vars: false
|
||||
callbacks_enabled: profile_tasks, timer, yaml
|
||||
verifier:
|
||||
name: ansible
|
||||
|
||||
@@ -35,7 +33,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -51,7 +48,6 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
|
||||
@@ -1,66 +1,80 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-mysql-hardening"
|
||||
|
||||
- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Use Python 3 on Debian 11
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when:
|
||||
- ansible_distribution == 'Debian'
|
||||
- ansible_distribution_major_version|int >= 11
|
||||
|
||||
- name: Use Python 3 on Suse
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when:
|
||||
- ansible_os_family == 'Suse'
|
||||
|
||||
- name: Use Python 2 on Debian 10
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python
|
||||
when:
|
||||
- ansible_distribution == 'Debian'
|
||||
- ansible_distribution_major_version|int == 10
|
||||
|
||||
- name: Run the equivalent of "apt-get update && apt-get upgrade"
|
||||
apt:
|
||||
name: "*"
|
||||
state: latest
|
||||
update_cache: true
|
||||
when: ansible_os_family == 'Debian'
|
||||
|
||||
- name: Install required python packages on Suse
|
||||
ansible.builtin.shell: zypper -n install python-xml python3-rpm python3-PyMySQL
|
||||
when: ansible_os_family == 'Suse'
|
||||
|
||||
- name: create missing directory
|
||||
file:
|
||||
path: "/etc/mysql/conf.d"
|
||||
state: directory
|
||||
|
||||
- name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
|
||||
set_fact:
|
||||
mysql_python_package_debian: "python3-pymysql"
|
||||
when:
|
||||
- mysql_python_package_debian is not defined
|
||||
- ansible_distribution == "Ubuntu"
|
||||
- ansible_distribution_major_version|int > 19
|
||||
|
||||
- name: Determine required MySQL Python libraries.
|
||||
set_fact:
|
||||
mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
|
||||
when:
|
||||
- mysql_python_package_debian is not defined
|
||||
- ansible_distribution != "Ubuntu"
|
||||
- ansible_distribution_major_version|int < 20
|
||||
|
||||
- name: Install required MySQL Python libraries on RHEL
|
||||
yum:
|
||||
name: "{% if 'python3' in ansible_python_interpreter|default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
|
||||
when:
|
||||
- ansible_os_family == "RedHat"
|
||||
- ansible_distribution_major_version == "7"
|
||||
|
||||
- include_role:
|
||||
name: dev-sec.mysql
|
||||
|
||||
- name: include MySQL user prepare tasks
|
||||
include_tasks: prepare_tasks/mysql_users.yml
|
||||
vars:
|
||||
overwrite_global_mycnf: false
|
||||
mysql_root_password: iloverandompasswordsbutthiswilldo
|
||||
mysql_user_password: iloverandompasswordsbutthiswilldo
|
||||
mysql_config_file: /etc/mysql/mariadb.cnf
|
||||
mysql_root_password_update: true
|
||||
tasks:
|
||||
- name: Use Python 3 on Debian 11
|
||||
ansible.builtin.set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when:
|
||||
- ansible_facts.distribution == 'Debian'
|
||||
- ansible_facts.distribution_major_version|int >= 11
|
||||
|
||||
- name: Use Python 3 on Suse
|
||||
ansible.builtin.set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when:
|
||||
- ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Run the equivalent of "apt-get update && apt-get upgrade"
|
||||
ansible.builtin.apt:
|
||||
upgrade: safe
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
|
||||
- name: Install required python packages on Suse
|
||||
ansible.builtin.command: zypper -n install python311-rpm python311-PyMySQL
|
||||
changed_when: false
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Create missing directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/mysql
|
||||
state: directory
|
||||
mode: "0755"
|
||||
|
||||
- name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
|
||||
ansible.builtin.set_fact:
|
||||
mysql_python_package_debian: python3-pymysql
|
||||
when:
|
||||
- mysql_python_package_debian is not defined
|
||||
- ansible_facts.distribution == "Ubuntu"
|
||||
- ansible_facts.distribution_major_version|int > 19
|
||||
|
||||
- name: Install required MySQL Python libraries on RHEL
|
||||
ansible.builtin.dnf:
|
||||
name: "{% if 'python3' in ansible_python_interpreter | default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
|
||||
when:
|
||||
- ansible_facts.os_family == "RedHat"
|
||||
- ansible_facts.distribution_major_version == "7"
|
||||
|
||||
- name: Install mysql with a generic Ansible role
|
||||
ansible.builtin.include_role:
|
||||
name: dev-sec.mysql
|
||||
|
||||
- name: Include MySQL user prepare tasks
|
||||
ansible.builtin.include_tasks: prepare_tasks/mysql_users.yml
|
||||
@@ -1,32 +1,15 @@
|
||||
---
|
||||
- name: Create users for test
|
||||
ansible.mysql.mysql_query:
|
||||
- name: create users for test
|
||||
community.mysql.mysql_query:
|
||||
query:
|
||||
- CREATE USER 'user'@'delete';
|
||||
- CREATE USER 'user'@'127.0.0.1';
|
||||
- CREATE USER 'user'@'::1';
|
||||
- CREATE USER 'user'@'%';
|
||||
- CREATE USER 'user'@'192.168.0.%';
|
||||
- CREATE USER 'user'@'192.168.0.1';
|
||||
- CREATE USER '%'@'192.168.0.1';
|
||||
- CREATE USER 'user'@'192.168.0.2' IDENTIFIED BY 'keep';
|
||||
- CREATE USER 'user'@'keep' IDENTIFIED BY 'keep';
|
||||
- CREATE USER 'user'@'192.168.%' IDENTIFIED BY 'keep';
|
||||
- "CREATE USER 'user'@'delete';"
|
||||
- "CREATE USER 'user'@'127.0.0.1';"
|
||||
- "CREATE USER 'user'@'::1';"
|
||||
- "CREATE USER 'user'@'%';"
|
||||
- "CREATE USER 'user'@'192.168.0.%';"
|
||||
- "CREATE USER 'user'@'192.168.0.1';"
|
||||
- "CREATE USER '%'@'192.168.0.1';"
|
||||
- "CREATE USER 'user'@'192.168.0.2' IDENTIFIED BY 'keep';"
|
||||
- "CREATE USER 'user'@'keep' IDENTIFIED BY 'keep';"
|
||||
- "CREATE USER 'user'@'192.168.%' IDENTIFIED BY 'keep';"
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
|
||||
- name: Detect role support on MySQL
|
||||
ansible.mysql.mysql_query:
|
||||
query: >
|
||||
SELECT 1 FROM information_schema.COLUMNS
|
||||
WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
|
||||
AND COLUMN_NAME = 'is_role';
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_role_support
|
||||
|
||||
- name: Create roles for test
|
||||
ansible.mysql.mysql_query:
|
||||
query:
|
||||
- CREATE ROLE 'role_keep';
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
when:
|
||||
- mysql_role_support.rowcount[0] > 0
|
||||
@@ -2,3 +2,8 @@
|
||||
roles:
|
||||
- name: dev-sec.mysql
|
||||
version: master
|
||||
|
||||
collections:
|
||||
- name: https://github.com/ansible-collections/community.mysql.git
|
||||
type: git
|
||||
version: main
|
||||
@@ -8,23 +8,23 @@
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Use Python 3 on Suse
|
||||
ansible.builtin.set_fact:
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when:
|
||||
- ansible_facts.os_family == 'Suse'
|
||||
- ansible_os_family == 'Suse'
|
||||
|
||||
- name: Install procps for debian systems
|
||||
ansible.builtin.apt:
|
||||
- name: install procps for debian systems
|
||||
apt:
|
||||
name: procps
|
||||
state: present
|
||||
update_cache: true
|
||||
when: ansible_facts.distribution == 'Debian'
|
||||
when: ansible_distribution == 'Debian'
|
||||
|
||||
- name: Include tests for the service
|
||||
ansible.builtin.include_tasks: verify_tasks/service.yml
|
||||
- name: include tests for the service
|
||||
include_tasks: verify_tasks/service.yml
|
||||
|
||||
- name: Include tests for MySQL user
|
||||
ansible.builtin.include_tasks: verify_tasks/mysql_users.yml
|
||||
- name: include tests for MySQL user
|
||||
include_tasks: verify_tasks/mysql_users.yml
|
||||
|
||||
- name: Verify
|
||||
hosts: localhost
|
||||
@@ -34,7 +34,7 @@
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Execute cinc-auditor tests
|
||||
ansible.builtin.command: >
|
||||
command: >
|
||||
docker run
|
||||
--volume /run/docker.sock:/run/docker.sock
|
||||
docker.io/cincproject/auditor exec
|
||||
@@ -46,10 +46,10 @@
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display details about the cinc-auditor results
|
||||
ansible.builtin.debug:
|
||||
debug:
|
||||
msg: "{{ test_results.stdout_lines }}"
|
||||
|
||||
- name: Fail when tests fail
|
||||
ansible.builtin.fail:
|
||||
msg: Inspec failed to validate
|
||||
fail:
|
||||
msg: "Inspec failed to validate"
|
||||
when: test_results.rc != 0
|
||||
@@ -1,16 +1,16 @@
|
||||
---
|
||||
- name: Get all users from MySQL server
|
||||
ansible.mysql.mysql_query:
|
||||
community.mysql.mysql_query:
|
||||
query: >
|
||||
SELECT CONCAT(USER, '@', HOST) AS users FROM mysql.user;
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_users
|
||||
|
||||
- name: Create list of users from mysql query
|
||||
ansible.builtin.set_fact:
|
||||
- name: create list of users from mysql query
|
||||
set_fact:
|
||||
mysql_users_list: "{{ mysql_users.query_result.0 | json_query('[*].users') | list }}"
|
||||
|
||||
- name: Assert that only accounts with password remain
|
||||
- name: assert that only accounts with password remain
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- '"user@delete" not in mysql_users_list'
|
||||
@@ -23,19 +23,3 @@
|
||||
- '"[email protected]" in mysql_users_list'
|
||||
- '"user@keep" in mysql_users_list'
|
||||
- '"[email protected].%" in mysql_users_list'
|
||||
|
||||
- name: Detect role support on MySQL
|
||||
ansible.mysql.mysql_query:
|
||||
query: >
|
||||
SELECT 1 FROM information_schema.COLUMNS
|
||||
WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
|
||||
AND COLUMN_NAME = 'is_role';
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_role_support
|
||||
|
||||
- name: Assert that roles remain
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- '"role_keep@" in mysql_users_list'
|
||||
when:
|
||||
- mysql_role_support.rowcount[0] > 0
|
||||
@@ -10,7 +10,7 @@
|
||||
ansible.builtin.service_facts:
|
||||
|
||||
- name: Check if MySQL is running and enabled
|
||||
ansible.builtin.assert:
|
||||
assert:
|
||||
that:
|
||||
- ansible_facts.services[mysql_daemon + '.service'].state == 'running'
|
||||
- ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'
|
||||
- "ansible_facts.services[mysql_daemon + '.service'].state == 'running'"
|
||||
- "ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'"
|
||||
@@ -1,15 +1,16 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
become: true
|
||||
hosts: all
|
||||
collections:
|
||||
- devsec.hardening
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
vars:
|
||||
nginx_ppa_use: true
|
||||
nginx_ppa_version: stable
|
||||
- nginx_ppa_use: true
|
||||
- nginx_ppa_version: stable
|
||||
tasks:
|
||||
- name: Include nginx_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.nginx_hardening
|
||||
- include_role:
|
||||
name: nginx_hardening
|
||||
@@ -7,7 +7,7 @@ driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: instance
|
||||
image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
|
||||
image: "ghcr.io/dev-sec/docker-${MOLECULE_DISTRO}-ansible:latest"
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
||||
@@ -21,9 +21,7 @@ provisioner:
|
||||
config_options:
|
||||
defaults:
|
||||
interpreter_python: auto_silent
|
||||
callbacks_enabled: profile_tasks, timer
|
||||
# Currently not supported by geerlingguy.nginx role
|
||||
# inject_facts_as_vars: false
|
||||
callbacks_enabled: profile_tasks, timer, yaml
|
||||
verifier:
|
||||
name: ansible
|
||||
|
||||
@@ -34,7 +32,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -50,7 +47,6 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
|
||||
@@ -1,24 +1,24 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
hosts: localhost
|
||||
vars:
|
||||
nginx_main_template_enable: true
|
||||
nginx_main_template:
|
||||
template_file: nginx.conf.j2
|
||||
conf_file_name: nginx.conf
|
||||
conf_file_location: /etc/nginx/
|
||||
user: www-data
|
||||
worker_processes: auto
|
||||
error_level: warn
|
||||
worker_connections: 1024
|
||||
http_enable: true
|
||||
http_settings:
|
||||
keepalive_timeout: 65
|
||||
cache: false
|
||||
rate_limit: false
|
||||
keyval: false
|
||||
stream_enable: false
|
||||
http_global_autoindex: false
|
||||
- nginx_main_template_enable: true
|
||||
- nginx_main_template:
|
||||
template_file: nginx.conf.j2
|
||||
conf_file_name: nginx.conf
|
||||
conf_file_location: /etc/nginx/
|
||||
user: www-data
|
||||
worker_processes: auto
|
||||
error_level: warn
|
||||
worker_connections: 1024
|
||||
http_enable: true
|
||||
http_settings:
|
||||
keepalive_timeout: 65
|
||||
cache: false
|
||||
rate_limit: false
|
||||
keyval: false
|
||||
stream_enable: false
|
||||
http_global_autoindex: false
|
||||
roles:
|
||||
- nginxinc.nginx
|
||||
- nginx_hardening
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
hosts: localhost
|
||||
roles:
|
||||
- nginxinc.nginx
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
- name: prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
become: true
|
||||
hosts: all
|
||||
environment:
|
||||
@@ -7,17 +7,22 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Install required packages
|
||||
ansible.builtin.package:
|
||||
name: python3-apt
|
||||
- name: install required tools on SuSE
|
||||
community.general.zypper:
|
||||
name: "python-xml"
|
||||
state: present
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: install required packages
|
||||
package:
|
||||
name: "python3-apt"
|
||||
update_cache: true
|
||||
ignore_errors: true # noqa ignore-errors
|
||||
ignore_errors: true # noqa ignore-errors
|
||||
|
||||
- name: Set correct distribution Version for Amazon Linux
|
||||
ansible.builtin.set_fact:
|
||||
set_fact:
|
||||
ansible_distribution_major_version: 7
|
||||
when: ansible_facts.distribution == 'Amazon'
|
||||
when: ansible_distribution == 'Amazon'
|
||||
|
||||
- name: Install nginx with a generic Ansible role
|
||||
ansible.builtin.include_role:
|
||||
- include_role:
|
||||
name: geerlingguy.nginx
|
||||
@@ -1,3 +1,3 @@
|
||||
---
|
||||
roles:
|
||||
- name: geerlingguy.nginx
|
||||
- geerlingguy.nginx
|
||||
@@ -7,12 +7,12 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Install procps for debian systems
|
||||
ansible.builtin.apt:
|
||||
- name: install procps for debian systems
|
||||
apt:
|
||||
name: procps
|
||||
state: present
|
||||
update_cache: true
|
||||
when: ansible_facts.distribution == 'Debian'
|
||||
when: ansible_distribution == 'Debian'
|
||||
|
||||
- name: Verify
|
||||
hosts: localhost
|
||||
@@ -22,7 +22,7 @@
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Execute cinc-auditor tests
|
||||
ansible.builtin.command: >
|
||||
command: >
|
||||
docker run
|
||||
--volume /run/docker.sock:/run/docker.sock
|
||||
docker.io/cincproject/auditor exec
|
||||
@@ -34,10 +34,10 @@
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display details about the cinc-auditor results
|
||||
ansible.builtin.debug:
|
||||
debug:
|
||||
msg: "{{ test_results.stdout_lines }}"
|
||||
|
||||
- name: Fail when tests fail
|
||||
ansible.builtin.fail:
|
||||
msg: Inspec failed to validate
|
||||
fail:
|
||||
msg: "Inspec failed to validate"
|
||||
when: test_results.rc != 0
|
||||
@@ -1,36 +1,38 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
collections:
|
||||
- devsec.hardening
|
||||
tasks:
|
||||
- name: Workaround for https://github.com/ansible/ansible/issues/66304
|
||||
ansible.builtin.set_fact:
|
||||
ansible_virtualization_type: docker
|
||||
- name: Include os_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.os_hardening
|
||||
- name: workaround for https://github.com/ansible/ansible/issues/66304
|
||||
set_fact:
|
||||
ansible_virtualization_type: "docker"
|
||||
- include_role:
|
||||
name: os_hardening
|
||||
vars:
|
||||
os_security_users_allow: change_user
|
||||
os_security_kernel_enable_core_dump: false
|
||||
os_auditd_enabled: false
|
||||
os_auditd_num_logs: 10
|
||||
os_security_suid_sgid_remove_from_unknown: true
|
||||
os_auth_pam_passwdqc_enable: false
|
||||
os_auth_lockout_time: 15
|
||||
os_env_extra_user_paths: [/home]
|
||||
os_desktop_enable: true
|
||||
os_env_extra_user_paths: ['/home']
|
||||
os_auth_allow_homeless: true
|
||||
os_security_suid_sgid_blacklist: [/bin/umount]
|
||||
os_security_suid_sgid_whitelist: [/usr/bin/rlogin]
|
||||
os_security_suid_sgid_blacklist: ['/bin/umount']
|
||||
os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
|
||||
os_filesystem_whitelist: []
|
||||
os_yum_repo_file_whitelist: [foo.repo]
|
||||
os_users_without_password_ageing: [pw_no_ageing]
|
||||
os_yum_repo_file_whitelist: ['foo.repo']
|
||||
os_users_without_password_ageing: ['pw_no_ageing']
|
||||
os_auth_pw_warn_age: 7
|
||||
os_netrc_enabled: false
|
||||
os_ignore_users: [shell_sys_acc]
|
||||
os_ignore_home_folder_users: [user_with_777_home]
|
||||
os_ignore_users: ["shell_sys_acc"]
|
||||
os_ignore_home_folder_users: ["user_with_777_home"]
|
||||
sysctl_config:
|
||||
net.ipv4.ip_forward: 0
|
||||
net.ipv6.conf.all.forwarding: 0
|
||||
@@ -71,6 +73,8 @@
|
||||
# - name: wrapper playbook for kitchen testing "ansible-os-hardening"
|
||||
# hosts: all
|
||||
# become: true
|
||||
# collections:
|
||||
# - devsec.hardening
|
||||
# vars:
|
||||
# os_auditd_enabled: false
|
||||
# tasks:
|
||||
@@ -80,9 +84,9 @@
|
||||
# when: ansible_facts.distribution == 'Fedora'
|
||||
#
|
||||
# - name: Run the equivalent of "apt-get update" as a separate step
|
||||
# ansible.builtin.apt:
|
||||
# apt:
|
||||
# update_cache: yes
|
||||
# when: ansible_facts.os_family == 'Debian'
|
||||
#
|
||||
# - include_role:
|
||||
# name: devsec.hardening.os_hardening
|
||||
# name: os_hardening
|
||||
@@ -3,7 +3,7 @@ driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: instance
|
||||
image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
|
||||
image: "ghcr.io/dev-sec/docker-${MOLECULE_DISTRO}-ansible:latest"
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
||||
@@ -17,8 +17,7 @@ provisioner:
|
||||
config_options:
|
||||
defaults:
|
||||
interpreter_python: auto_silent
|
||||
callbacks_enabled: profile_tasks, timer
|
||||
inject_facts_as_vars: false
|
||||
callbacks_enabled: profile_tasks, timer, yaml
|
||||
verifier:
|
||||
name: ansible
|
||||
|
||||
@@ -29,7 +28,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -45,7 +43,6 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
|
||||
@@ -7,21 +7,20 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Set ansible_python_interpreter to "/usr/bin/python3" on fedora
|
||||
- name: Install Python3 on Debian 10
|
||||
ansible.builtin.apt:
|
||||
name: python3
|
||||
state: present
|
||||
update_cache: true
|
||||
when: ansible_os_family == 'Debian'
|
||||
|
||||
- name: Set ansible_python_interpreter to "/usr/bin/python3"
|
||||
ansible.builtin.set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Run the equivalent of "apt-get update && apt-get upgrade"
|
||||
ansible.builtin.apt:
|
||||
upgrade: safe
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
|
||||
- name: Install required tools on SuSE
|
||||
# cannot use zypper module, since it depends on python-xml
|
||||
ansible.builtin.command: zypper -n install awk
|
||||
changed_when: false
|
||||
ansible.builtin.shell: zypper -n install python-xml
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Install required tools on fedora
|
||||
@@ -41,7 +40,7 @@
|
||||
when: ansible_facts.os_family == 'Archlinux'
|
||||
|
||||
- name: Install required tools on RHEL # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
ansible.builtin.yum:
|
||||
name:
|
||||
- openssh-clients
|
||||
- openssh
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
- name: Create user whose home-folder should not be touched
|
||||
ansible.builtin.user:
|
||||
name: user_with_777_home
|
||||
name: "user_with_777_home"
|
||||
|
||||
- name: Change mode of home-folder for user to 777
|
||||
ansible.builtin.file:
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
---
|
||||
- name: create '.netrc' in /root
|
||||
ansible.builtin.copy:
|
||||
dest: /root/.netrc
|
||||
mode: "0600"
|
||||
dest: '/root/.netrc'
|
||||
mode: '0600'
|
||||
content: |
|
||||
machine localhost
|
||||
login root
|
||||
|
||||
@@ -1,12 +1,9 @@
|
||||
---
|
||||
- name: Create user those password ageing should not be changed
|
||||
user:
|
||||
name: pw_no_ageing
|
||||
password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
|
||||
password_expire_max: "-1"
|
||||
name: "pw_no_ageing"
|
||||
password: "$6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1"
|
||||
|
||||
- name: Create user those password ageing should be changed
|
||||
user:
|
||||
name: pw_ageing
|
||||
password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
|
||||
password_expire_max: "-1"
|
||||
name: "pw_ageing"
|
||||
password: "$6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1"
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Create system user with shell that should keep it
|
||||
user:
|
||||
name: shell_sys_acc
|
||||
shell: /bin/bash
|
||||
name: "shell_sys_acc"
|
||||
shell: "/bin/bash"
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Create 'foo' repository
|
||||
- name: create 'foo' repository
|
||||
ansible.builtin.yum_repository:
|
||||
name: foo
|
||||
description: mandatory description
|
||||
@@ -7,7 +7,7 @@
|
||||
enabled: false
|
||||
gpgcheck: false
|
||||
|
||||
- name: Create 'bar' repository
|
||||
- name: create 'bar' repository
|
||||
ansible.builtin.yum_repository:
|
||||
name: bar
|
||||
description: mandatory description
|
||||
|
||||
@@ -10,7 +10,6 @@
|
||||
- name: Set ansible_python_interpreter to "/usr/bin/python3"
|
||||
ansible.builtin.set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Include verification tasks
|
||||
ansible.builtin.include_tasks:
|
||||
@@ -20,17 +19,15 @@
|
||||
- verify_tasks/pw_ageing.yml
|
||||
- verify_tasks/netrc.yml
|
||||
- verify_tasks/ignore_home_folders.yml
|
||||
- verify_tasks/ssh_auth_locked.yml
|
||||
|
||||
# temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
|
||||
# - name: Include PAM tests
|
||||
# ansible.builtin.include_tasks: verify_tasks/pam.yml
|
||||
# when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Include YUM tests
|
||||
ansible.builtin.include_tasks: verify_tasks/yum.yml
|
||||
when: ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Include PAM tests
|
||||
ansible.builtin.include_tasks: verify_tasks/pam.yml
|
||||
when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Verify
|
||||
hosts: localhost
|
||||
environment:
|
||||
@@ -68,20 +65,19 @@
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
vars:
|
||||
os_auditd_enabled: false
|
||||
os_env_umask: "027 #override"
|
||||
collections:
|
||||
- devsec.hardening
|
||||
tasks:
|
||||
# test if variable can be overridden
|
||||
- name: Workaround for https://github.com/ansible/ansible/issues/66304
|
||||
ansible.builtin.set_fact:
|
||||
ansible_virtualization_type: docker
|
||||
os_env_umask: "027 #override"
|
||||
|
||||
- name: Include os_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.os_hardening
|
||||
- ansible.builtin.include_role:
|
||||
name: os_hardening
|
||||
|
||||
- name: Verify os_env_umask
|
||||
ansible.builtin.command:
|
||||
ansible.builtin.shell:
|
||||
cmd: "grep '027 #override' /etc/login.defs"
|
||||
changed_when: false
|
||||
@@ -1,18 +1,18 @@
|
||||
---
|
||||
- name: Test that .netrc in root homedir exists
|
||||
- name: test that .netrc in root homedir exists
|
||||
ansible.builtin.file:
|
||||
path: /root/.netrc
|
||||
state: file
|
||||
register: result_test_netrc
|
||||
|
||||
- name: Output result if .netrc for user root exists
|
||||
- name: output result if .netrc for user root exists
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- result_test_netrc.state == 'file'
|
||||
fail_msg: .netrc in /root/ not present
|
||||
success_msg: .netrc exists in /root/
|
||||
|
||||
- name: Delete '.netrc' in /root
|
||||
- name: delete '.netrc' in /root
|
||||
ansible.builtin.file:
|
||||
path: /root/.netrc
|
||||
state: absent
|
||||
|
||||
@@ -1,34 +1,34 @@
|
||||
---
|
||||
- name: install pip
|
||||
package:
|
||||
- name: Install pip
|
||||
ansible.builtin.package:
|
||||
name:
|
||||
- python3-pip
|
||||
- python3-setuptools
|
||||
state: present
|
||||
|
||||
- name: install pam-tester
|
||||
- name: Install pam-tester
|
||||
ansible.builtin.pip:
|
||||
name: pam-tester
|
||||
state: present
|
||||
executable: /usr/bin/pip3
|
||||
|
||||
- name: set password for test
|
||||
- name: Set password for test
|
||||
ansible.builtin.set_fact:
|
||||
test_pw: myTest!pw
|
||||
test_pw: myTestpwSage
|
||||
|
||||
- name: set locale for test
|
||||
- name: Set locale for test
|
||||
ansible.builtin.set_fact:
|
||||
locale: en_US.UTF-8
|
||||
when:
|
||||
- ansible_facts.os_family == 'RedHat'
|
||||
- ansible_facts.distribution_major_version < '8'
|
||||
|
||||
- name: create testuser
|
||||
user:
|
||||
- name: Create testuser
|
||||
ansible.builtin.user:
|
||||
name: testuser
|
||||
password: "{{ test_pw | password_hash('sha512') }}"
|
||||
|
||||
- name: check successful login with correct password
|
||||
- name: Check successful login with correct password
|
||||
ansible.builtin.shell:
|
||||
cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
|
||||
environment:
|
||||
@@ -36,7 +36,7 @@
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
LANG: "{{ locale | default('C.UTF-8') }}"
|
||||
|
||||
- name: check unsuccessful login with incorrect password
|
||||
- name: Check unsuccessful login with incorrect password
|
||||
ansible.builtin.shell:
|
||||
cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail
|
||||
environment:
|
||||
@@ -45,7 +45,7 @@
|
||||
LANG: "{{ locale | default('C.UTF-8') }}"
|
||||
with_sequence: count=6
|
||||
|
||||
- name: check unsuccessful login, with correct password (lockout)
|
||||
- name: Check unsuccessful login, with correct password (lockout)
|
||||
ansible.builtin.shell:
|
||||
cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail
|
||||
environment:
|
||||
@@ -53,11 +53,11 @@
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
LANG: "{{ locale | default('C.UTF-8') }}"
|
||||
|
||||
- name: wait for account to unlock
|
||||
pause:
|
||||
- name: Wait for account to unlock
|
||||
ansible.builtin.pause:
|
||||
seconds: 20
|
||||
|
||||
- name: check successful login
|
||||
- name: Check successful login
|
||||
ansible.builtin.shell:
|
||||
cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
|
||||
environment:
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
- name: Check that the expiry date of pw_no_ageing is "never"
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- expiry_date.stdout | trim == 'never'
|
||||
- "expiry_date.stdout | trim == 'never'"
|
||||
|
||||
- name: Get Password Expiry date for pw_ageing
|
||||
ansible.builtin.shell: chage -l pw_ageing | grep "Password expires" | cut -d ":" -f 2
|
||||
@@ -19,7 +19,7 @@
|
||||
# this uses the date from the expire_date variable and subtracts the current date.
|
||||
# it should be bigger that the password_expire_min of the user "pw_no_ageing"
|
||||
that:
|
||||
- ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_facts.date_time.date | to_datetime('%Y-%m-%d')).days == 60
|
||||
- "{{ ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_date_time.date | to_datetime('%Y-%m-%d')).days }} == 60"
|
||||
|
||||
- name: Get Password Expiry warning days for pw_ageing
|
||||
ansible.builtin.shell: chage -l pw_ageing | grep "warning before password expires" | cut -d ":" -f 2
|
||||
@@ -29,4 +29,4 @@
|
||||
- name: Check that number of days of warning before password expires is 7 days
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- expiry_warndays.stdout | trim == '7'
|
||||
- "expiry_warndays.stdout | trim == '7'"
|
||||
@@ -1,90 +0,0 @@
|
||||
---
|
||||
- name: Install tools
|
||||
package:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
ignore_errors: true
|
||||
loop:
|
||||
- sshpass
|
||||
- openssh
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
|
||||
- name: Allow password Login for sshd
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
search_string: PasswordAuthentication no
|
||||
line: PasswordAuthentication yes
|
||||
when:
|
||||
- ansible_facts.distribution == "Amazon"
|
||||
|
||||
- name: Start sshd service
|
||||
ansible.builtin.service:
|
||||
name: "{{ item }}"
|
||||
state: started
|
||||
ignore_errors: true
|
||||
loop:
|
||||
- sshd
|
||||
- ssh
|
||||
|
||||
- name: Set password for test
|
||||
ansible.builtin.set_fact:
|
||||
test_pw: myTest!pw
|
||||
|
||||
- name: Create locked_user
|
||||
user:
|
||||
name: locked_user
|
||||
password: "{{ test_pw | password_hash('sha512') }}"
|
||||
|
||||
- name: Create ssh-client-keypair
|
||||
community.crypto.openssh_keypair:
|
||||
path: /root/locked_user_id
|
||||
type: ed25519
|
||||
state: present
|
||||
register: generated_key
|
||||
|
||||
- name: Add ssh-public-key to locked_user
|
||||
ansible.posix.authorized_key:
|
||||
user: locked_user
|
||||
key: "{{ generated_key.public_key }}"
|
||||
state: present
|
||||
|
||||
- name: Check successful login with password
|
||||
ansible.builtin.shell:
|
||||
cmd: sshpass -p {{ test_pw }} ssh -o StrictHostKeyChecking=no locked_user@localhost echo "success"
|
||||
|
||||
- name: Check successful login with ssh key
|
||||
ansible.builtin.shell:
|
||||
cmd: ssh -i /root/locked_user_id -o StrictHostKeyChecking=no locked_user@localhost echo "success"
|
||||
|
||||
- name: Set password change date for locked_user
|
||||
ansible.builtin.shell:
|
||||
cmd: chage -d 2020-01-01 locked_user
|
||||
|
||||
- name: Check unsuccessful login with password
|
||||
ansible.builtin.shell:
|
||||
cmd: sshpass -p {{ test_pw }} ssh -o StrictHostKeyChecking=no locked_user@localhost echo "success"
|
||||
register: output
|
||||
ignore_errors: true
|
||||
|
||||
- name: Assert check unsuccessful login
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- output.rc | int == 1
|
||||
- "'WARNING: Your password has expired.' in output.stderr"
|
||||
- "'success' not in output.stdout"
|
||||
when:
|
||||
- ansible_facts.os_family != "Suse"
|
||||
|
||||
- name: Assert check unsuccessful login
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- output.rc | int == 5
|
||||
- "'(password expired)' in output.stderr"
|
||||
- output.stdout | length == 0
|
||||
when:
|
||||
- ansible_facts.os_family == "Suse"
|
||||
|
||||
- name: Check successful login with ssh key
|
||||
ansible.builtin.shell:
|
||||
cmd: ssh -i /root/locked_user_id -o StrictHostKeyChecking=no locked_user@localhost echo "success"
|
||||
@@ -1,9 +1,9 @@
|
||||
---
|
||||
- name: Read local linux user database
|
||||
getent:
|
||||
ansible.builtin.getent:
|
||||
database: passwd
|
||||
|
||||
- name: Check that shell_sys_acc's shell is still bash
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- ansible_facts.getent_passwd['shell_sys_acc'][5] == "/bin/bash"
|
||||
- getent_passwd['shell_sys_acc'][5] == "/bin/bash"
|
||||
@@ -1,8 +1,8 @@
|
||||
---
|
||||
- name: Verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
|
||||
- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
|
||||
ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
|
||||
changed_when: false
|
||||
|
||||
- name: Verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
|
||||
- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
|
||||
ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
|
||||
changed_when: false
|
||||
@@ -1,53 +1,23 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
collections:
|
||||
- devsec.hardening
|
||||
tasks:
|
||||
- name: Override for arch
|
||||
ansible.builtin.set_fact:
|
||||
- name: override for arch
|
||||
set_fact:
|
||||
os_mnt_boot_enabled: false
|
||||
os_mnt_tmp_enabled: true
|
||||
os_mnt_tmp_src: tmpfs
|
||||
os_mnt_tmp_filesystem: tmpfs
|
||||
when: ansible_facts.os_family == 'Archlinux'
|
||||
|
||||
- name: Overrides for Fedora image
|
||||
ansible.builtin.set_fact:
|
||||
os_mnt_tmp_enabled: true
|
||||
os_mnt_tmp_src: tmpfs
|
||||
os_mnt_tmp_filesystem: tmpfs
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Overrides for Fedora 40 image
|
||||
ansible.builtin.set_fact:
|
||||
os_mnt_var_enabled: true
|
||||
os_mnt_var_src: UUID=282c6d73-afc2-4113-9856-c7679ad51920
|
||||
os_mnt_var_filesystem: btrfs
|
||||
os_mnt_var_options: rw,nosuid,nodev,compress=zstd:1,subvol=var
|
||||
when:
|
||||
- ansible_facts.distribution == 'Fedora'
|
||||
- ansible_facts.distribution_major_version|int == 40
|
||||
|
||||
- name: Overrides for Debian 13 image
|
||||
ansible.builtin.set_fact:
|
||||
os_mnt_tmp_enabled: true
|
||||
os_mnt_tmp_src: tmpfs
|
||||
os_mnt_tmp_filesystem: tmpfs
|
||||
when:
|
||||
- ansible_facts.distribution == 'Debian'
|
||||
- ansible_facts.distribution_major_version|int == 13
|
||||
|
||||
- name: Include os_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.os_hardening
|
||||
- include_role:
|
||||
name: os_hardening
|
||||
vars:
|
||||
os_auth_pam_passwdqc_enable: false
|
||||
os_auth_lockout_time: 15
|
||||
os_yum_repo_file_whitelist: [foo.repo]
|
||||
os_yum_repo_file_whitelist: ['foo.repo']
|
||||
os_mnt_boot_enabled: true
|
||||
os_mnt_home_enabled: true
|
||||
os_mnt_boot_src: /dev/vda1
|
||||
os_mnt_boot_src: "/dev/vda1"
|
||||
@@ -2,7 +2,7 @@
|
||||
dependency:
|
||||
name: galaxy
|
||||
options:
|
||||
role-file: molecule/os_hardening_vm/requirements.yml
|
||||
role-file: molecule/os_hardening/requirements.yml
|
||||
driver:
|
||||
name: vagrant
|
||||
provider:
|
||||
@@ -11,8 +11,8 @@ platforms:
|
||||
# we need to name every instance differently to start multiple VMs on the same host (parallelization)
|
||||
# since we also need to use different OS users to run the tests because of how molecule operates,
|
||||
# the VM names must be predictable by OS user (to clean up canceled runs)
|
||||
- name: ${USER}
|
||||
box: ${MOLECULE_DISTRO}
|
||||
- name: "${USER}"
|
||||
box: "generic/${MOLECULE_DISTRO}"
|
||||
memory: 1024
|
||||
cpus: 2
|
||||
provisioner:
|
||||
@@ -24,10 +24,7 @@ provisioner:
|
||||
config_options:
|
||||
defaults:
|
||||
interpreter_python: auto_silent
|
||||
callbacks_enabled: profile_tasks, timer
|
||||
# Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
|
||||
library: "${MOLECULE_PROJECT_DIRECTORY}/plugins/modules:/usr/share/ansible:${MOLECULE_VAGRANT_PLUGIN_DIR}"
|
||||
inject_facts_as_vars: false
|
||||
callbacks_enabled: profile_tasks, timer, yaml
|
||||
verifier:
|
||||
name: ansible
|
||||
env:
|
||||
@@ -40,7 +37,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -56,7 +52,6 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
|
||||
@@ -1,25 +1,5 @@
|
||||
---
|
||||
- name: Prepare Archliux host
|
||||
hosts: all
|
||||
become: true
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Update keyring
|
||||
ansible.builtin.raw: pacman --noconfirm -Sy archlinux-keyring
|
||||
changed_when: false
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
|
||||
|
||||
- name: Update OS
|
||||
ansible.builtin.raw: pacman --noconfirm -Suy
|
||||
changed_when: false
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
|
||||
|
||||
- name: Install python, since it's not installed by default
|
||||
ansible.builtin.raw: pacman --noconfirm -Sy python
|
||||
changed_when: false
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
|
||||
|
||||
- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
@@ -27,71 +7,39 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Set ansible_python_interpreter to "/usr/bin/python3" on fedora
|
||||
ansible.builtin.set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
- name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
|
||||
set_fact:
|
||||
ansible_python_interpreter: "/usr/bin/python3"
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Block update of Grub, because of error
|
||||
ansible.builtin.dpkg_selections:
|
||||
name: grub-pc
|
||||
selection: hold
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
|
||||
# we need to free up space, since the /boot partition in some Vagrant images is
|
||||
# pretty small and system updates might fail
|
||||
- name: Find all initrd.img to delete them
|
||||
ansible.builtin.find:
|
||||
paths: /boot
|
||||
patterns: "initrd.img*"
|
||||
register: find_results
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
|
||||
- name: Delete all initrd.img to free space on /boot
|
||||
ansible.builtin.file:
|
||||
path: "{{ item['path'] }}"
|
||||
state: absent
|
||||
with_items: "{{ find_results['files'] }}"
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
|
||||
- name: Run the equivalent of "apt-get update && apt-get upgrade"
|
||||
ansible.builtin.apt:
|
||||
upgrade: safe
|
||||
apt:
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
when: ansible_os_family == 'Debian'
|
||||
|
||||
- name: Install required tools on fedora
|
||||
ansible.builtin.dnf:
|
||||
- name: install required tools on SuSE
|
||||
# cannot use zypper module, since it depends on python-xml
|
||||
shell: "zypper -n install python-xml"
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: install required tools on fedora
|
||||
dnf:
|
||||
name:
|
||||
- python
|
||||
- findutils
|
||||
- procps-ng
|
||||
- python3-libselinux
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Install required tools on AlmaLinux
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- initscripts
|
||||
when: ansible_facts.distribution == 'AlmaLinux'
|
||||
|
||||
- name: Install required tools on Arch
|
||||
- name: install required tools on Arch
|
||||
community.general.pacman:
|
||||
name:
|
||||
- awk
|
||||
- archlinux-keyring
|
||||
state: latest
|
||||
state: present
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Archlinux'
|
||||
|
||||
- name: Run the equivalent of "pacman -Syu"
|
||||
community.general.pacman:
|
||||
update_cache: true
|
||||
upgrade: true
|
||||
when: ansible_facts.os_family == 'Archlinux'
|
||||
|
||||
- name: Install required tools on RHEL # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
- name: install required tools on RHEL # noqa ignore-errors
|
||||
yum:
|
||||
name:
|
||||
- openssh-clients
|
||||
- openssh
|
||||
@@ -99,15 +47,10 @@
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Create recursing symlink to test minimize access
|
||||
ansible.builtin.shell: rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz
|
||||
- name: create recursing symlink to test minimize access
|
||||
shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
|
||||
changed_when: false
|
||||
|
||||
- name: Unmount EFI partition to get rid of vfat filesystem (qemu has no firmware image that inspec can detect)
|
||||
ansible.posix.mount:
|
||||
path: /boot/efi
|
||||
state: unmounted
|
||||
|
||||
- name: Include YUM prepare tasks
|
||||
ansible.builtin.include_tasks: prepare_tasks/yum.yml
|
||||
- name: include YUM prepare tasks
|
||||
include_tasks: prepare_tasks/yum.yml
|
||||
when: ansible_facts.os_family == 'RedHat'
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Create 'foo' repository
|
||||
- name: create 'foo' repository
|
||||
ansible.builtin.yum_repository:
|
||||
name: foo
|
||||
description: mandatory description
|
||||
@@ -7,7 +7,7 @@
|
||||
enabled: false
|
||||
gpgcheck: false
|
||||
|
||||
- name: Create 'bar' repository
|
||||
- name: create 'bar' repository
|
||||
ansible.builtin.yum_repository:
|
||||
name: bar
|
||||
description: mandatory description
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
---
|
||||
roles:
|
||||
- name: geerlingguy.git
|
||||
- geerlingguy.git
|
||||
@@ -7,13 +7,14 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
# temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
|
||||
# - name: Include PAM tests
|
||||
# ansible.builtin.include_tasks: verify_tasks/pam.yml
|
||||
# when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Include YUM tests
|
||||
ansible.builtin.include_tasks: verify_tasks/yum.yml
|
||||
# temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
|
||||
# - name: include PAM tests
|
||||
# include_tasks: verify_tasks/pam.yml
|
||||
# when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: include YUM tests
|
||||
include_tasks: verify_tasks/yum.yml
|
||||
when: ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Verify
|
||||
@@ -23,23 +24,22 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Get ssh-config
|
||||
ansible.builtin.command:
|
||||
cmd: vagrant ssh-config
|
||||
- name: get ssh-config
|
||||
command:
|
||||
cmd: "vagrant ssh-config"
|
||||
chdir: "{{ molecule_ephemeral_directory }}"
|
||||
register: ssh_config
|
||||
changed_when: false
|
||||
|
||||
- name: Create ssh-config file
|
||||
ansible.builtin.copy:
|
||||
- name: create ssh-config file
|
||||
copy:
|
||||
content: "{{ ssh_config.stdout_lines | join ('\n') }}"
|
||||
dest: "{{ molecule_ephemeral_directory }}/ssh-config"
|
||||
mode: "0400"
|
||||
changed_when: false
|
||||
|
||||
- name: Execute cinc-auditor tests
|
||||
ansible.builtin.command: >
|
||||
docker run --rm
|
||||
command: >
|
||||
docker run
|
||||
--volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
|
||||
docker.io/cincproject/auditor exec
|
||||
--ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
|
||||
@@ -51,10 +51,10 @@
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display details about the cinc-auditor results
|
||||
ansible.builtin.debug:
|
||||
debug:
|
||||
msg: "{{ test_results.stdout_lines }}"
|
||||
|
||||
- name: Fail when tests fail
|
||||
ansible.builtin.fail:
|
||||
msg: Inspec failed to validate
|
||||
fail:
|
||||
msg: "Inspec failed to validate"
|
||||
when: test_results.rc != 0
|
||||
@@ -1,4 +1,5 @@
|
||||
---
|
||||
|
||||
- name: install pip
|
||||
package:
|
||||
name:
|
||||
@@ -10,14 +11,15 @@
|
||||
ansible.builtin.pip:
|
||||
name: pam-tester
|
||||
state: present
|
||||
executable: /usr/bin/pip3
|
||||
|
||||
- name: set password for test
|
||||
ansible.builtin.set_fact:
|
||||
test_pw: myTest!pw
|
||||
set_fact:
|
||||
test_pw: "myTest!pw"
|
||||
|
||||
- name: set locale for test
|
||||
ansible.builtin.set_fact:
|
||||
locale: en_US.UTF-8
|
||||
set_fact:
|
||||
locale: "en_US.UTF-8"
|
||||
when:
|
||||
- ansible_facts.os_family == 'RedHat'
|
||||
- ansible_facts.distribution_major_version < '8'
|
||||
@@ -28,16 +30,16 @@
|
||||
password: "{{ test_pw | password_hash('sha512') }}"
|
||||
|
||||
- name: check successful login with correct password
|
||||
ansible.builtin.shell:
|
||||
cmd: pam-tester --user testuser --password {{ test_pw }}
|
||||
shell:
|
||||
cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
LANG: "{{ locale | default('C.UTF-8') }}"
|
||||
|
||||
- name: check unsuccessful login with incorrect password
|
||||
ansible.builtin.shell:
|
||||
cmd: pam-tester --user testuser --password {{ test_pw }}fail --expectfail
|
||||
shell:
|
||||
cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
@@ -45,8 +47,8 @@
|
||||
with_sequence: count=6
|
||||
|
||||
- name: check unsuccessful login, with correct password (lockout)
|
||||
ansible.builtin.shell:
|
||||
cmd: pam-tester --user testuser --password {{ test_pw }} --expectfail
|
||||
shell:
|
||||
cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
@@ -57,8 +59,8 @@
|
||||
seconds: 20
|
||||
|
||||
- name: check successful login
|
||||
ansible.builtin.shell:
|
||||
cmd: pam-tester --user testuser --password {{ test_pw }}
|
||||
shell:
|
||||
cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
---
|
||||
- name: Verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
|
||||
ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
|
||||
- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
|
||||
command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
|
||||
changed_when: false
|
||||
|
||||
- name: Verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
|
||||
ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
|
||||
- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
|
||||
command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
|
||||
changed_when: false
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
- name: Verify prerequisites
|
||||
hosts: localhost
|
||||
tasks:
|
||||
- name: Make sure environment variable for MOLECULE_DISTRO is set
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- "lookup('env','MOLECULE_DISTRO') | length > 0"
|
||||
fail_msg: "You need to set MOLECULE_DISTRO to a supported image name. See CONTRIBUTING.md"
|
||||
@@ -1,13 +1,14 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: all
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
collections:
|
||||
- devsec.hardening
|
||||
tasks:
|
||||
- name: Include ssh_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.ssh_hardening
|
||||
- include_role:
|
||||
name: ssh_hardening
|
||||
vars:
|
||||
sftp_enabled: false
|
||||
@@ -3,7 +3,7 @@ driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: instance
|
||||
image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
|
||||
image: "ghcr.io/dev-sec/docker-${MOLECULE_DISTRO}-ansible:latest"
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
||||
@@ -17,8 +17,7 @@ provisioner:
|
||||
config_options:
|
||||
defaults:
|
||||
interpreter_python: auto_silent
|
||||
callbacks_enabled: profile_tasks, timer
|
||||
inject_facts_as_vars: false
|
||||
callbacks_enabled: profile_tasks, timer, yaml
|
||||
inventory:
|
||||
host_vars:
|
||||
# https://molecule.readthedocs.io/en/latest/examples.html#docker-with-non-privileged-user
|
||||
@@ -35,7 +34,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -51,7 +49,6 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Prepare the molecule container for the role
|
||||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
@@ -7,38 +7,33 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Use python3
|
||||
ansible.builtin.set_fact:
|
||||
- name: use python3
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Install dnf packages # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
- name: install packages # noqa ignore-errors
|
||||
yum:
|
||||
name:
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
state: present
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install libselinux-python # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- libselinux-python
|
||||
state: present
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install procps-ng # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
- name: install packages # noqa ignore-errors
|
||||
dnf:
|
||||
name:
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
- procps-ng
|
||||
state: present
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install apt packages # noqa ignore-errors
|
||||
ansible.builtin.apt:
|
||||
- name: install packages # noqa ignore-errors
|
||||
apt:
|
||||
name:
|
||||
- openssh-client
|
||||
- openssh-server
|
||||
@@ -46,28 +41,19 @@
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install required tools on SuSE
|
||||
- name: install required tools on SuSE
|
||||
# cannot use zypper module, since it depends on python-xml
|
||||
ansible.builtin.command: zypper -n install python-xml
|
||||
changed_when: false
|
||||
shell: "zypper -n install python-xml"
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Install packages on SuSE
|
||||
community.general.zypper:
|
||||
- name: install packages
|
||||
zypper:
|
||||
name:
|
||||
- openssh
|
||||
- "openssh"
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Install required tools on Alpine
|
||||
community.general.apk:
|
||||
name:
|
||||
- openssh
|
||||
state: present
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Alpine'
|
||||
|
||||
- name: Install required tools on Arch
|
||||
community.general.pacman:
|
||||
- name: install required tools on Arch
|
||||
pacman:
|
||||
name:
|
||||
- openssh
|
||||
- awk
|
||||
@@ -75,6 +61,16 @@
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Archlinux'
|
||||
|
||||
- name: Create ssh host keys # noqa ignore-errors no-changed-when
|
||||
ansible.builtin.command: ssh-keygen -A
|
||||
- name: created needed directory
|
||||
file:
|
||||
path: "/var/run/sshd"
|
||||
state: directory
|
||||
|
||||
- name: create ssh host keys # noqa ignore-errors
|
||||
command: "ssh-keygen -A"
|
||||
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
|
||||
ansible_facts.distribution == "Fedora" or
|
||||
ansible_facts.distribution == "Amazon" or
|
||||
ansible_facts.os_family == "Suse"
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
@@ -7,7 +7,7 @@
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Execute cinc-auditor tests
|
||||
ansible.builtin.command: >
|
||||
command: >
|
||||
docker run
|
||||
--volume /run/docker.sock:/run/docker.sock
|
||||
docker.io/cincproject/auditor exec
|
||||
@@ -19,10 +19,10 @@
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display details about the cinc-auditor results
|
||||
ansible.builtin.debug:
|
||||
debug:
|
||||
msg: "{{ test_results.stdout_lines }}"
|
||||
|
||||
- name: Fail when tests fail
|
||||
ansible.builtin.fail:
|
||||
msg: Inspec failed to validate
|
||||
fail:
|
||||
msg: "Inspec failed to validate"
|
||||
when: test_results.rc != 0
|
||||
File renamed without changes.
@@ -1,13 +1,14 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: all
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
collections:
|
||||
- devsec.hardening
|
||||
tasks:
|
||||
- name: Include ssh_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.ssh_hardening
|
||||
- include_role:
|
||||
name: ssh_hardening
|
||||
vars:
|
||||
sftp_enabled: false
|
||||
@@ -7,8 +7,8 @@ platforms:
|
||||
# we need to name every instance differently to start multiple VMs on the same host (parallelization)
|
||||
# since we also need to use different OS users to run the tests because of how molecule operates,
|
||||
# the VM names must be predictable by OS user (to clean up canceled runs)
|
||||
- name: ${USER}
|
||||
box: ${MOLECULE_DISTRO}
|
||||
- name: "${USER}"
|
||||
box: "generic/${MOLECULE_DISTRO}"
|
||||
memory: 1024
|
||||
cpus: 2
|
||||
provisioner:
|
||||
@@ -20,10 +20,7 @@ provisioner:
|
||||
config_options:
|
||||
defaults:
|
||||
interpreter_python: auto_silent
|
||||
callbacks_enabled: profile_tasks, timer
|
||||
# Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
|
||||
library: "${MOLECULE_PROJECT_DIRECTORY}/plugins/modules:/usr/share/ansible:${MOLECULE_VAGRANT_PLUGIN_DIR}"
|
||||
inject_facts_as_vars: false
|
||||
callbacks_enabled: profile_tasks, timer, yaml
|
||||
verifier:
|
||||
name: ansible
|
||||
env:
|
||||
@@ -36,7 +33,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -52,7 +48,6 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
@@ -0,0 +1,32 @@
|
||||
---
|
||||
- name: prepare OpenBSD host
|
||||
hosts: all
|
||||
become: true
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: install python
|
||||
# BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
|
||||
raw: "pkg_add python%3.10"
|
||||
when: "lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'"
|
||||
|
||||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: created needed directory
|
||||
file:
|
||||
path: "/var/run/sshd"
|
||||
state: directory
|
||||
|
||||
- name: create ssh host keys # noqa ignore-errors
|
||||
command: "ssh-keygen -A"
|
||||
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
|
||||
ansible_facts.distribution == "Fedora" or
|
||||
ansible_facts.distribution == "Amazon" or
|
||||
ansible_facts.os_family == "Suse"
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
@@ -3,13 +3,12 @@
|
||||
hosts: all
|
||||
become: true
|
||||
tasks:
|
||||
- name: Use the type command instead of which to detect existing commands
|
||||
ansible.builtin.file:
|
||||
src: /usr/bin/which
|
||||
dest: /usr/bin/type
|
||||
- name: use the type command instead of which to detect existing commands
|
||||
file:
|
||||
src: "/usr/bin/which"
|
||||
dest: "/usr/bin/type"
|
||||
state: hard
|
||||
mode: "0770"
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
|
||||
when: "lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'"
|
||||
|
||||
- name: Verify
|
||||
hosts: localhost
|
||||
@@ -18,25 +17,24 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Get ssh-config
|
||||
ansible.builtin.command:
|
||||
cmd: vagrant ssh-config
|
||||
- name: get ssh-config
|
||||
command:
|
||||
cmd: "vagrant ssh-config"
|
||||
chdir: "{{ molecule_ephemeral_directory }}"
|
||||
register: ssh_config
|
||||
changed_when: false
|
||||
|
||||
- name: Create ssh-config file
|
||||
ansible.builtin.copy:
|
||||
- name: create ssh-config file
|
||||
copy:
|
||||
content: "{{ ssh_config.stdout_lines | join ('\n') }}"
|
||||
dest: "{{ molecule_ephemeral_directory }}/ssh-config"
|
||||
mode: "0400"
|
||||
changed_when: false
|
||||
|
||||
- name: Execute cinc-auditor tests
|
||||
ansible.builtin.command: >
|
||||
docker run --rm
|
||||
command: >
|
||||
docker run
|
||||
--volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
|
||||
--volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') | regex_replace('^.*/', '') }}.yaml:/waivers.yaml
|
||||
--volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') }}.yaml:/waivers.yaml
|
||||
docker.io/cincproject/auditor exec
|
||||
--ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
|
||||
-t ssh://{{ lookup('env', 'USER') }}
|
||||
@@ -48,10 +46,10 @@
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display details about the cinc-auditor results
|
||||
ansible.builtin.debug:
|
||||
debug:
|
||||
msg: "{{ test_results.stdout_lines }}"
|
||||
|
||||
- name: Fail when tests fail
|
||||
ansible.builtin.fail:
|
||||
msg: Inspec failed to validate
|
||||
fail:
|
||||
msg: "Inspec failed to validate"
|
||||
when: test_results.rc != 0
|
||||
File renamed without changes.
File renamed without changes.
@@ -1,43 +1,44 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
collections:
|
||||
- devsec.hardening
|
||||
tasks:
|
||||
- name: Include ssh_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.ssh_hardening
|
||||
- include_role:
|
||||
name: ssh_hardening
|
||||
vars:
|
||||
ssh_trusted_user_ca_keys_file: /etc/ssh/ca.pub
|
||||
ssh_trusted_user_ca_keys_file: '/etc/ssh/ca.pub'
|
||||
ssh_trusted_user_ca_keys:
|
||||
- "# ssh-rsa ..."
|
||||
ssh_authorized_principals_file: /etc/ssh/auth_principals/%u
|
||||
- '# ssh-rsa ...'
|
||||
ssh_authorized_principals_file: '/etc/ssh/auth_principals/%u'
|
||||
ssh_authorized_principals:
|
||||
- path: /etc/ssh/auth_principals/root
|
||||
- path: "/etc/ssh/auth_principals/root"
|
||||
principals:
|
||||
- root
|
||||
- "root"
|
||||
network_ipv6_enable: true
|
||||
ssh_allow_tcp_forwarding: "yes"
|
||||
ssh_gateway_ports: "clientspecified"
|
||||
ssh_allow_tcp_forwarding: 'yes'
|
||||
ssh_gateway_ports: true
|
||||
ssh_allow_agent_forwarding: true
|
||||
ssh_server_permit_environment_vars: "yes"
|
||||
ssh_server_accept_env_vars: PWD HTTP_PROXY
|
||||
ssh_server_permit_environment_vars: 'yes'
|
||||
ssh_server_accept_env_vars: 'PWD HTTP_PROXY'
|
||||
ssh_client_alive_interval: 100
|
||||
ssh_client_alive_count: 10
|
||||
ssh_client_password_login: true
|
||||
ssh_challengeresponseauthentication: true
|
||||
ssh_compression: true
|
||||
ssh_allow_users: root kitchen vagrant
|
||||
ssh_allow_groups: root kitchen vagrant
|
||||
ssh_deny_users: foo bar
|
||||
ssh_deny_groups: foo bar
|
||||
ssh_authorized_keys_file: /etc/ssh/authorized_keys/%u
|
||||
ssh_allow_users: 'root kitchen vagrant'
|
||||
ssh_allow_groups: 'root kitchen vagrant'
|
||||
ssh_deny_users: 'foo bar'
|
||||
ssh_deny_groups: 'foo bar'
|
||||
ssh_authorized_keys_file: '/etc/ssh/authorized_keys/%u'
|
||||
ssh_max_auth_retries: 10
|
||||
ssh_permit_root_login: without-password
|
||||
ssh_permit_tunnel: "yes"
|
||||
ssh_permit_root_login: "without-password"
|
||||
ssh_permit_tunnel: true
|
||||
ssh_print_motd: true
|
||||
ssh_print_last_log: true
|
||||
ssh_banner: true
|
||||
@@ -48,33 +49,33 @@
|
||||
- 22
|
||||
- 222
|
||||
ssh_server_match_address:
|
||||
- address: 192.168.1.0/24
|
||||
- address: '192.168.1.0/24'
|
||||
rules:
|
||||
- AllowTcpForwarding yes
|
||||
- AllowAgentForwarding no
|
||||
- 'AllowTcpForwarding yes'
|
||||
- 'AllowAgentForwarding no'
|
||||
ssh_server_match_group:
|
||||
- group: root
|
||||
- group: 'root'
|
||||
rules:
|
||||
- AllowTcpForwarding yes
|
||||
- AllowAgentForwarding no
|
||||
- 'AllowTcpForwarding yes'
|
||||
- 'AllowAgentForwarding no'
|
||||
ssh_server_match_user:
|
||||
- user: root
|
||||
- user: 'root'
|
||||
rules:
|
||||
- AllowTcpForwarding yes
|
||||
- AllowAgentForwarding no
|
||||
- 'AllowTcpForwarding yes'
|
||||
- 'AllowAgentForwarding no'
|
||||
ssh_server_match_local_port:
|
||||
- port: 222
|
||||
rules:
|
||||
- AllowTcpForwarding yes
|
||||
- AllowAgentForwarding no
|
||||
- 'AllowTcpForwarding yes'
|
||||
- 'AllowAgentForwarding no'
|
||||
ssh_remote_hosts:
|
||||
- names: [example.com, example2.com]
|
||||
options: [Port 2222, ForwardAgent yes]
|
||||
- names: [example3.com]
|
||||
options: [StrictHostKeyChecking no]
|
||||
- names: ['example.com', 'example2.com']
|
||||
options: ['Port 2222', 'ForwardAgent yes']
|
||||
- names: ['example3.com']
|
||||
options: ['StrictHostKeyChecking no']
|
||||
ssh_use_dns: true
|
||||
ssh_use_pam: true
|
||||
ssh_max_startups: 10:30:60
|
||||
ssh_max_startups: '10:30:60'
|
||||
ssh_host_key_algorithms:
|
||||
- ssh-ed25519
|
||||
- rsa-sha2-512
|
||||
@@ -88,9 +89,10 @@
|
||||
- aes192-ctr
|
||||
- aes128-ctr
|
||||
- aes256-cbc
|
||||
# these should not be set in the final sshd_config
|
||||
ssh_kex: false
|
||||
ssh_kex:
|
||||
- diffie-hellman-group-exchange-sha256
|
||||
- diffie-hellman-group-exchange-sha1
|
||||
ssh_custom_options:
|
||||
- Include /etc/ssh/ssh_config.d/*
|
||||
- "Include /etc/ssh/ssh_config.d/*"
|
||||
sshd_custom_options:
|
||||
- AcceptEnv LANG
|
||||
- "AcceptEnv LANG"
|
||||
@@ -3,7 +3,7 @@ driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: instance
|
||||
image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
|
||||
image: "ghcr.io/dev-sec/docker-${MOLECULE_DISTRO}-ansible:latest"
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
||||
@@ -17,8 +17,7 @@ provisioner:
|
||||
config_options:
|
||||
defaults:
|
||||
interpreter_python: auto_silent
|
||||
callbacks_enabled: profile_tasks, timer
|
||||
inject_facts_as_vars: false
|
||||
callbacks_enabled: profile_tasks, timer, yaml
|
||||
verifier:
|
||||
name: ansible
|
||||
|
||||
@@ -29,7 +28,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -45,7 +43,6 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
@@ -53,4 +50,5 @@ scenario:
|
||||
- check
|
||||
- converge
|
||||
- idempotence
|
||||
- verify
|
||||
- destroy
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
@@ -7,38 +7,33 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Use python3
|
||||
ansible.builtin.set_fact:
|
||||
- name: use python3
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Install dnf packages # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
- name: install packages # noqa ignore-errors
|
||||
yum:
|
||||
name:
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
state: present
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install libselinux-python # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- libselinux-python
|
||||
state: present
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install procps-ng # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
- name: install packages # noqa ignore-errors
|
||||
dnf:
|
||||
name:
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
- procps-ng
|
||||
state: present
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install apt packages # noqa ignore-errors
|
||||
ansible.builtin.apt:
|
||||
- name: install packages # noqa ignore-errors
|
||||
apt:
|
||||
name:
|
||||
- openssh-client
|
||||
- openssh-server
|
||||
@@ -46,20 +41,19 @@
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install required tools on SuSE
|
||||
- name: install required tools on SuSE
|
||||
# cannot use zypper module, since it depends on python-xml
|
||||
ansible.builtin.command: zypper -n install python-xml
|
||||
changed_when: false
|
||||
shell: "zypper -n install python-xml"
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Install packages on SuSE
|
||||
community.general.zypper:
|
||||
- name: install packages
|
||||
zypper:
|
||||
name:
|
||||
- openssh
|
||||
- "openssh"
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Install required tools on Arch
|
||||
community.general.pacman:
|
||||
- name: install required tools on Arch
|
||||
pacman:
|
||||
name:
|
||||
- openssh
|
||||
- awk
|
||||
@@ -67,14 +61,16 @@
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Archlinux'
|
||||
|
||||
- name: Install required tools on Alpine
|
||||
community.general.apk:
|
||||
name:
|
||||
- openssh
|
||||
state: present
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Alpine'
|
||||
- name: created needed directory
|
||||
file:
|
||||
path: "/var/run/sshd"
|
||||
state: directory
|
||||
|
||||
- name: Create ssh host keys # noqa ignore-errors no-changed-when
|
||||
ansible.builtin.command: ssh-keygen -A
|
||||
- name: create ssh host keys # noqa ignore-errors
|
||||
command: "ssh-keygen -A"
|
||||
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
|
||||
ansible_facts.distribution == "Fedora" or
|
||||
ansible_facts.distribution == "Amazon" or
|
||||
ansible_facts.os_family == "Suse"
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
@@ -1,34 +0,0 @@
|
||||
---
|
||||
- name: Prepare OpenBSD host
|
||||
hosts: all
|
||||
become: true
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Change installation source
|
||||
# temporary fix for https://github.com/lavabit/robox/issues/305
|
||||
ansible.builtin.raw: echo "https://ftp.eu.openbsd.org/pub/OpenBSD" > /etc/installurl
|
||||
changed_when: false
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
|
||||
|
||||
- name: Install python
|
||||
# BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
|
||||
ansible.builtin.raw: pkg_add -I python%3.11
|
||||
changed_when: false
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
|
||||
|
||||
- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Create ssh host keys # noqa ignore-errors
|
||||
ansible.builtin.command: ssh-keygen -A
|
||||
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
|
||||
or ansible_facts.distribution == "Fedora"
|
||||
or ansible_facts.distribution == "Amazon"
|
||||
or ansible_facts.os_family == "Suse"
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
@@ -1,3 +0,0 @@
|
||||
unrelated:
|
||||
run: false
|
||||
justification: "cinc-auditor needs at least one waived control"
|
||||
@@ -1,3 +0,0 @@
|
||||
unrelated:
|
||||
run: false
|
||||
justification: "cinc-auditor needs at least one waived control"
|
||||
@@ -1,3 +0,0 @@
|
||||
unrelated:
|
||||
run: false
|
||||
justification: "cinc-auditor needs at least one waived control"
|
||||
@@ -1,3 +0,0 @@
|
||||
unrelated:
|
||||
run: false
|
||||
justification: "cinc-auditor needs at least one waived control"
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
||||
"extends": [
|
||||
"config:best-practices",
|
||||
"config:base",
|
||||
":gitSignOff"
|
||||
],
|
||||
"dependencyDashboard": true,
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
molecule-plugins[vagrant]==25.8.12
|
||||
+8
-7
@@ -1,7 +1,8 @@
|
||||
molecule==26.4.0
|
||||
molecule-plugins[docker]==25.8.12
|
||||
ansible-core==2.20.5
|
||||
docker==7.1.0
|
||||
jmespath==1.1.0
|
||||
aar-doc==2.3.0
|
||||
passlib==1.7.4
|
||||
molecule
|
||||
molecule-plugins[docker]
|
||||
yamllint
|
||||
ansible
|
||||
ansible-lint
|
||||
docker
|
||||
flake8
|
||||
jmespath
|
||||
@@ -1,6 +1,6 @@
|
||||
# devsec.mysql_hardening
|
||||
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
|
||||
|
||||
|
||||
## Description
|
||||
|
||||
@@ -24,19 +24,19 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
|
||||
<!-- BEGIN_ANSIBLE_DOCS -->
|
||||
|
||||
## Supported Operating Systems
|
||||
- EL
|
||||
- 8, 9, 10
|
||||
- Ubuntu
|
||||
- jammy, noble
|
||||
- Debian
|
||||
- trixie, bookworm, bullseye
|
||||
- Amazon
|
||||
- opensuse
|
||||
|
||||
| Platform | Versions |
|
||||
| -------- | -------------------- |
|
||||
| EL | 7, 8, 9 |
|
||||
| Ubuntu | bionic, focal, jammy |
|
||||
| Debian | bullseye, buster |
|
||||
| Amazon | |
|
||||
| opensuse | |
|
||||
|
||||
## Role Variables
|
||||
|
||||
- `mysql_daemon_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Whether to enable the MySQL-service so it starts on boot
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -51,7 +51,7 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `mysql_hardening_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Whether to run the hardening
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -86,12 +86,12 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `mysql_hardening_restart_mysql`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Restart mysql after running this role
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `mysql_hardening_skip_grant_tables:`
|
||||
- Default: `False`
|
||||
- Default: `false`
|
||||
- Description: [skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -101,17 +101,17 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `mysql_remove_anonymous_users`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to `false` to keep users without authentication
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `mysql_remove_remote_root`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: If `true`, root can only connect from localhost. Set to `false` to not remove remote root users.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `mysql_remove_test_database`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to `false` to keep the test database
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -134,7 +134,6 @@ None.
|
||||
|
||||
```
|
||||
- hosts: all
|
||||
become: true
|
||||
roles:
|
||||
- name: devsec.hardening.mysql_hardening
|
||||
```
|
||||
|
||||
@@ -8,18 +8,18 @@ galaxy_info:
|
||||
platforms:
|
||||
- name: EL
|
||||
versions:
|
||||
- "7"
|
||||
- "8"
|
||||
- "9"
|
||||
- "10"
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- bionic
|
||||
- focal
|
||||
- jammy
|
||||
- noble
|
||||
- name: Debian
|
||||
versions:
|
||||
- trixie
|
||||
- bookworm
|
||||
- bullseye
|
||||
- buster
|
||||
- name: Amazon
|
||||
- name: opensuse
|
||||
galaxy_tags:
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
state: directory
|
||||
owner: "{{ mysql_hardening_user }}"
|
||||
group: "{{ mysql_hardening_user }}"
|
||||
mode: '{{ mysql_hardening_datadir_permissions | default("0750") }}'
|
||||
mode: "0750"
|
||||
when: item is defined and item != ""
|
||||
loop:
|
||||
- "{{ mysql_settings.settings.datadir }}"
|
||||
|
||||
@@ -39,13 +39,13 @@
|
||||
when: not mysql_distribution is defined
|
||||
|
||||
- name: Check which MySQL/MariaDB version is used
|
||||
ansible.mysql.mysql_info:
|
||||
community.mysql.mysql_info:
|
||||
filter: version
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_version
|
||||
|
||||
- name: Check MySQL/MariaDB settings
|
||||
ansible.mysql.mysql_info:
|
||||
community.mysql.mysql_info:
|
||||
filter: settings
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_settings
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'
|
||||
|
||||
- name: Ensure that the root password is present
|
||||
ansible.mysql.mysql_user:
|
||||
community.mysql.mysql_user:
|
||||
name: root
|
||||
host_all: true
|
||||
password: "{{ mysql_root_password | mandatory }}"
|
||||
@@ -20,14 +20,14 @@
|
||||
tags: my_cnf
|
||||
|
||||
- name: Ensure that the test database is absent
|
||||
ansible.mysql.mysql_db:
|
||||
community.mysql.mysql_db:
|
||||
name: test
|
||||
state: absent
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
when: mysql_remove_test_database
|
||||
|
||||
- name: Ensure that anonymous users are absent
|
||||
ansible.mysql.mysql_user:
|
||||
community.mysql.mysql_user:
|
||||
name: ""
|
||||
state: absent
|
||||
host_all: true
|
||||
@@ -35,7 +35,7 @@
|
||||
when: mysql_remove_anonymous_users
|
||||
|
||||
- name: Ensure that root can only login from localhost
|
||||
ansible.mysql.mysql_query:
|
||||
community.mysql.mysql_query:
|
||||
query: >
|
||||
DELETE
|
||||
FROM mysql.user
|
||||
@@ -46,18 +46,8 @@
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
when: mysql_remove_remote_root
|
||||
|
||||
- name: Detect role support on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
|
||||
ansible.mysql.mysql_query:
|
||||
query: >
|
||||
SELECT 1 FROM information_schema.COLUMNS
|
||||
WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
|
||||
AND COLUMN_NAME = 'is_role';
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_role_support
|
||||
check_mode: false
|
||||
|
||||
- name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
|
||||
ansible.mysql.mysql_query:
|
||||
community.mysql.mysql_query:
|
||||
query: >
|
||||
SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
|
||||
FROM mysql.user
|
||||
@@ -65,8 +55,7 @@
|
||||
OR authentication_string="")
|
||||
AND USER NOT IN ('mysql.sys',
|
||||
'mysqlxsys',
|
||||
'mariadb.sys')
|
||||
{{ 'AND CONVERT(is_role USING utf8) = "N"' if mysql_role_support.rowcount[0] > 0 }};
|
||||
'mariadb.sys');
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_users_wo_passwords_or_auth_string
|
||||
check_mode: false
|
||||
@@ -76,7 +65,7 @@
|
||||
is version('10.4.0', '>='))
|
||||
|
||||
- name: Get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
|
||||
ansible.mysql.mysql_query:
|
||||
community.mysql.mysql_query:
|
||||
query: >
|
||||
SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
|
||||
FROM mysql.user
|
||||
@@ -86,8 +75,7 @@
|
||||
OR authentication_string="")
|
||||
AND USER NOT IN ('mysql.sys',
|
||||
'mysqlxsys',
|
||||
'mariadb.sys')
|
||||
{{ 'AND is_role = "N"' if mysql_role_support.rowcount[0] > 0 }};
|
||||
'mariadb.sys');
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_users_wo_passwords
|
||||
check_mode: false
|
||||
@@ -97,7 +85,7 @@
|
||||
version('10.4.0', '<'))
|
||||
|
||||
- name: Ensure that there are no users without password or authentication_string
|
||||
ansible.mysql.mysql_query:
|
||||
community.mysql.mysql_query:
|
||||
query:
|
||||
- DROP USER {{ item.user }}
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
|
||||
@@ -6,7 +6,5 @@ mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
|
||||
mysql_cnf_owner: 'root' # owner of /etc/my.cnf.d/*.cnf files
|
||||
mysql_cnf_group: 'mysql' # owner of /etc/my.cnf.d/*.cnf files
|
||||
|
||||
mysql_hardening_datadir_permissions: "0700"
|
||||
|
||||
mysql_hardening_group: 'mysql'
|
||||
login_unix_socket: '/run/mysql/mysql.sock'
|
||||
@@ -1,6 +1,6 @@
|
||||
# devsec.nginx_hardening
|
||||
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml)
|
||||
|
||||
|
||||
## Description
|
||||
|
||||
@@ -8,29 +8,30 @@ This role provides secure nginx configuration. It is intended to be compliant wi
|
||||
|
||||
It works with the following nginx-roles, including, but not limited to:
|
||||
|
||||
- [nginxinc.nginx](https://galaxy.ansible.com/ui/standalone/roles/nginxinc/nginx/)
|
||||
- [geerlinggux.nginx](https://galaxy.ansible.com/ui/standalone/roles/geerlingguy/nginx/)
|
||||
- [jdauphant.nginx](https://galaxy.ansible.com/ui/standalone/roles/jdauphant/nginx/)
|
||||
- [geerlingguy.nginx](https://galaxy.ansible.com/geerlingguy/nginx/)
|
||||
- [nginxinc.nginx](https://galaxy.ansible.com/nginxinc/nginx)
|
||||
- [jdauphant.nginx](https://galaxy.ansible.com/jdauphant/nginx/)
|
||||
- [franklinkim.nginx](https://galaxy.ansible.com/franklinkim/nginx/)
|
||||
|
||||
**NOTE: This role does not work with nginx 1.0.15 or older! Please use the latest version from the official nginx repositories!**
|
||||
|
||||
<!-- BEGIN_ANSIBLE_DOCS -->
|
||||
|
||||
## Supported Operating Systems
|
||||
- EL
|
||||
- 8, 9, 10
|
||||
- Ubuntu
|
||||
- jammy, noble, resolute
|
||||
- Debian
|
||||
- trixie, bookworm, bullseye
|
||||
- Amazon
|
||||
|
||||
| Platform | Versions |
|
||||
| -------- | -------------------- |
|
||||
| EL | 7, 8, 9 |
|
||||
| Ubuntu | bionic, focal, jammy |
|
||||
| Debian | buster, bullseye |
|
||||
| Amazon | |
|
||||
|
||||
## Role Variables
|
||||
|
||||
- `nginx_add_header`
|
||||
- Default: `['X-Frame-Options SAMEORIGIN', 'X-Content-Type-Options nosniff', 'X-XSS-Protection "1; mode=block"', 'Content-Security-Policy \\"script-src \'self\'; object-src \'self\'\\"']`
|
||||
- Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See [nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
|
||||
- Type: list of ''
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `nginx_client_body_buffer_size`
|
||||
- Default: `1k`
|
||||
@@ -70,7 +71,7 @@ It works with the following nginx-roles, including, but not limited to:
|
||||
- `nginx_dh_size`
|
||||
- Default: `2048`
|
||||
- Description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam)
|
||||
- Type: int
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `nginx_keepalive_timeout`
|
||||
- Default: `5 5`
|
||||
@@ -103,7 +104,7 @@ It works with the following nginx-roles, including, but not limited to:
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `nginx_remove_default_site`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Disables the default site. Set to false to enable the default site in nginx.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -113,7 +114,7 @@ It works with the following nginx-roles, including, but not limited to:
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `nginx_server_tokens`
|
||||
- Default: `off`
|
||||
- Default: `False`
|
||||
- Description: Disables emitting nginx version in error messages and in the "Server" response header field. Set to on to enable the nginx version in error messages and "Server" response header. See [nginx_server_tokens](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens)
|
||||
- Type: str
|
||||
- Required: no
|
||||
@@ -141,7 +142,6 @@ None.
|
||||
|
||||
```
|
||||
- hosts: all
|
||||
become: true
|
||||
roles:
|
||||
- name: devsec.hardening.nginx_hardening
|
||||
```
|
||||
|
||||
@@ -30,7 +30,7 @@ argument_specs:
|
||||
keep-alive client connections. The optional second parameter sets a value
|
||||
in the "Keep-Alive timeout=time" response header field. See [nginx_keepalive_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout) # noqa yaml[line-length]
|
||||
nginx_server_tokens:
|
||||
default: 'off'
|
||||
default: false
|
||||
type: str
|
||||
description: Disables emitting nginx version in error messages and in the
|
||||
"Server" response header field. Set to on to enable the nginx version in
|
||||
@@ -72,7 +72,7 @@ argument_specs:
|
||||
default: [X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff, X-XSS-Protection
|
||||
"1; mode=block", Content-Security-Policy \"script-src 'self'; object-src
|
||||
'self'\"]
|
||||
type: list
|
||||
type: str
|
||||
description: Adds the specified field to a response header provided that the
|
||||
response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See
|
||||
[nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
|
||||
@@ -91,7 +91,7 @@ argument_specs:
|
||||
ciphers when using the TLS protocols. Set to false to disable it. See [nginx_ssl_prefer_server_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers) # noqa yaml[line-length]
|
||||
nginx_dh_size:
|
||||
default: 2048
|
||||
type: int
|
||||
type: str
|
||||
description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam) # noqa yaml[line-length]
|
||||
nginx_configuration_dir:
|
||||
default: /etc/nginx
|
||||
|
||||
@@ -8,18 +8,17 @@ galaxy_info:
|
||||
platforms:
|
||||
- name: EL
|
||||
versions:
|
||||
- "7"
|
||||
- "8"
|
||||
- "9"
|
||||
- "10"
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- bionic
|
||||
- focal
|
||||
- jammy
|
||||
- noble
|
||||
- resolute
|
||||
- name: Debian
|
||||
versions:
|
||||
- trixie
|
||||
- bookworm
|
||||
- buster
|
||||
- bullseye
|
||||
- name: Amazon
|
||||
galaxy_tags:
|
||||
|
||||
+187
-201
@@ -1,7 +1,7 @@
|
||||
# devsec.os_hardening
|
||||
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml)
|
||||
|
||||
|
||||
|
||||
## Description
|
||||
|
||||
@@ -53,126 +53,25 @@ We disable the following filesystems, because they're most likely not used:
|
||||
|
||||
To prevent some of the filesystems from being disabled, add them to the `os_filesystem_whitelist` variable.
|
||||
|
||||
## Known Limitations
|
||||
|
||||
### Docker support
|
||||
|
||||
If you're using Docker / Kubernetes+Docker you'll need to override the ipv4 ip forward sysctl setting.
|
||||
|
||||
```yaml
|
||||
- hosts: localhost
|
||||
roles:
|
||||
- devsec.hardening.os_hardening
|
||||
vars:
|
||||
sysctl_overwrite:
|
||||
# Enable IPv4 traffic forwarding.
|
||||
net.ipv4.ip_forward: 1
|
||||
```
|
||||
|
||||
### hidepid on RHEL/CentOS 7
|
||||
|
||||
When having `polkit-0.112-18.el7` (and later) installed and `/proc` mounted with `hidepid=2`, every time someone uses `systemctl` the following error is displayed, but systemctl runs successfully.
|
||||
|
||||
```
|
||||
Error registering authentication agent: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: Cannot determine user of subject (polkit-error-quark, 0)
|
||||
```
|
||||
|
||||
We decided to set `hidepid=0` to remove the error message, if you want to use the other proposed workaround, you have to setup the user yourself and set our option to `hidepid_option: 2` via Ansible vars.
|
||||
|
||||
For further details see [RedHat: "GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: Cannot determine user of subject" seen when executing systemctl command](https://access.redhat.com/solutions/5005111) or [#364: hidepid=2 gives error when running systemctl on EL7](https://github.com/dev-sec/ansible-collection-hardening/issues/364)
|
||||
|
||||
### sysctl - vm.mmap_rnd_bits
|
||||
|
||||
We are setting this sysctl to a default of `32`, some systems only support smaller values and this will generate an error. Unfortunately we cannot determine the correct applicable maximum. If you encounter this error you have to override this sysctl in your playbook.
|
||||
|
||||
```yaml
|
||||
- hosts: localhost
|
||||
roles:
|
||||
- devsec.hardening.os_hardening
|
||||
vars:
|
||||
sysctl_overwrite:
|
||||
vm.mmap_rnd_bits: 16
|
||||
```
|
||||
|
||||
### password expiry and SSH key based logins
|
||||
|
||||
With default PAM configuration setting a password expiry for users will also block SSH key logins after the password has expired.
|
||||
We have added a flag for PAM to ignore the expiry if SSH keys or other login mechanisms are used.
|
||||
If you choose to use your own PAM configuration please adjust it accordingly to contain `no_pass_expiry` in the `account` stage for the `pam_unix.so` module.
|
||||
|
||||
A valid example would look like this:
|
||||
|
||||
```text
|
||||
account required pam_unix.so no_pass_expiry
|
||||
```
|
||||
|
||||
## Testing with inspec
|
||||
|
||||
If you're using inspec to test your machines after applying this role, please make sure to add the connecting user to the `os_ignore_users`-variable.
|
||||
Otherwise inspec will fail. For more information, see [issue #124](https://github.com/dev-sec/ansible-os-hardening/issues/124).
|
||||
|
||||
We know that this is the case on Raspberry Pi.
|
||||
|
||||
## Changing sysctl variables
|
||||
|
||||
If you want to override sysctl-variables, you can use the `sysctl_overwrite` variable (in older versions you had to override the whole `sysctl_dict`).
|
||||
So for example if you want to change the IPv4 traffic forwarding variable to `1`, do it like this:
|
||||
|
||||
```yaml
|
||||
- hosts: localhost
|
||||
roles:
|
||||
- devsec.hardening.os_hardening
|
||||
vars:
|
||||
sysctl_overwrite:
|
||||
# Enable IPv4 traffic forwarding.
|
||||
net.ipv4.ip_forward: 1
|
||||
```
|
||||
|
||||
Alternatively you can change Ansible's [hash-behaviour](https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-hash-behaviour) to `merge`, then you only have to overwrite the single hash you need to. But please be aware that changing the hash-behaviour changes it for all your playbooks and is not recommended by Ansible.
|
||||
|
||||
## Improving Kernel Audit logging
|
||||
|
||||
By default, any process that starts before the `auditd` daemon will have an AUID of `4294967295`. To improve this and provide more accurate logging, it's recommended to add the kernel boot parameter `audit=1` to you configuration. Without doing this, you will find that your `auditd` logs fail to properly audit all processes.
|
||||
|
||||
For more information, please see this [upstream documentation](https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html) and your system's boot loader documentation for how to configure additional kernel parameters.
|
||||
|
||||
## PAM configuration
|
||||
|
||||
We use specific PAM configuration for every linux distribution. This is a very diverse area, since every vendor seems to push their own system for managing PAM. We used following guides and sources for our configuration.
|
||||
|
||||
- on Debian/Ubuntu we use [pam-config-framework](https://wiki.ubuntu.com/PAMConfigFrameworkSpec)
|
||||
- RHEL8 and compatible use information from [authselect](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_authentication_and_authorization_in_rhel/configuring-user-authentication-using-authselect_configuring-authentication-and-authorization-in-rhel), but our setup disables the configuration from authselect
|
||||
- RHEL 6/7 and compatible use [authconfig](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/authconfig-install), but our setup disables the configuration from authconfig
|
||||
- for RHEL 6/7 we also use information from [Desktop Security](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-hardening_your_system_with_tools_and_services#sec-Desktop_Security)
|
||||
|
||||
## Acknowledgements
|
||||
|
||||
This role is mostly based on guides by:
|
||||
|
||||
- [Arch Linux wiki, Sysctl hardening](https://wiki.archlinux.org/index.php/Sysctl)
|
||||
- [NSA: Guide to the Secure Configuration of Red Hat Enterprise Linux 5](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf)
|
||||
- [Ubuntu Security/Features](https://wiki.ubuntu.com/Security/Features)
|
||||
- [Deutsche Telekom, Group IT Security, Security Requirements (German)](https://www.telekom.com/psa)
|
||||
|
||||
<!-- BEGIN_ANSIBLE_DOCS -->
|
||||
|
||||
## Supported Operating Systems
|
||||
- EL
|
||||
- 8, 9, 10
|
||||
- Ubuntu
|
||||
- jammy, noble, resolute
|
||||
- Debian
|
||||
- trixie, bookworm, bullseye
|
||||
- Amazon
|
||||
- Fedora
|
||||
- ArchLinux
|
||||
- SmartOS
|
||||
- opensuse
|
||||
|
||||
| Platform | Versions |
|
||||
| --------- | -------------------- |
|
||||
| EL | 7, 8, 9 |
|
||||
| Ubuntu | bionic, focal, jammy |
|
||||
| Debian | buster, bullseye |
|
||||
| Amazon | |
|
||||
| Fedora | |
|
||||
| ArchLinux | |
|
||||
| SmartOS | |
|
||||
| opensuse | |
|
||||
|
||||
## Role Variables
|
||||
|
||||
- `os_apt_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to disable installing and configuring apt.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -202,7 +101,7 @@ This role is mostly based on guides by:
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `os_auditd_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to disable installing and configuring auditd.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -231,16 +130,6 @@ This role is mostly based on guides by:
|
||||
- Description: Defines the behaviour of auditd when its log file is filled up. Possible other values are described in the auditd.conf man page. The most common alternative to the default may be `rotate`.
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `os_auditd_name_format`
|
||||
- Default: `NONE`
|
||||
- Description: This keyword specifies how computer node names are inserted into the audit event stream.
|
||||
- Type: str
|
||||
- Required: no
|
||||
- Choices:
|
||||
- NONE
|
||||
- hostname
|
||||
- fqd
|
||||
- numeric
|
||||
- `os_auditd_num_logs`
|
||||
- Default: `5`
|
||||
- Description: This keyword specifies the number of log files to keep if `rotate` is given as the max_log_file_action. The value given must be numeric.
|
||||
@@ -257,7 +146,7 @@ This role is mostly based on guides by:
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `os_auth_allow_homeless`
|
||||
- Default: `False`
|
||||
- Default: `false`
|
||||
- Description: true if to allow users without home to login.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -277,12 +166,12 @@ This role is mostly based on guides by:
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `os_auth_pam_oddjob_mkhomedir`
|
||||
- Default: `False`
|
||||
- Default: `false`
|
||||
- Description: Enables automatic homedir e.g. in FreeIPA environments
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_auth_pam_passwdqc_enable`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: true if you want to use strong password checking in PAM using passwdqc.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -322,9 +211,9 @@ This role is mostly based on guides by:
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `os_auth_root_ttys`
|
||||
- Default: `['console', 'tty1', 'tty2', 'tty3', 'tty4', 'tty5', 'tty6']`
|
||||
- Default: `["console", "tty1", "tty2", "tty3", "tty4", "tty5", "tty6"]`
|
||||
- Description: A list of TTYs, from which root can log in, see `man securetty` for reference
|
||||
- Type: list of ''
|
||||
- Type: list
|
||||
- Required: no
|
||||
- `os_auth_sub_gid_count`
|
||||
- Default: `65536`
|
||||
@@ -377,67 +266,67 @@ This role is mostly based on guides by:
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `os_chmod_home_folders`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to `false` to disable "chmod 700" of home folders for regular users
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_chmod_rootuser_home_folder`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to `false` to disable "chmod 700" of root's home folder
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_cron_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to disable installing and configuring cron.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_ctrlaltdel_disabled`
|
||||
- Default: `False`
|
||||
- Default: `false`
|
||||
- Description: Set to true to disable ctrl-alt-delete key combination.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_env_extra_user_paths`
|
||||
- Default: `[]`
|
||||
- Description: Specify additional paths that should be checked for binaries where access will be minimized
|
||||
- Type: list of ''
|
||||
- `os_desktop_enable`
|
||||
- Default: `false`
|
||||
- Description: true if this is a desktop system, ie Xorg, KDE/GNOME/Unity/etc.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_env_user_paths`
|
||||
- Default: `['/usr/local/sbin', '/usr/local/bin', '/usr/sbin', '/usr/bin', '/sbin', '/bin']`
|
||||
- Description: Specify paths that should be checked for binaries where access will be minimized
|
||||
- Type: list of ''
|
||||
- `os_env_extra_user_paths`
|
||||
- Default: `"[]"`
|
||||
- Description: add additional paths to the user's `PATH` variable (default is empty).
|
||||
- Type: list
|
||||
- Required: no
|
||||
- `os_filesystem_whitelist`
|
||||
- Default: `[]`
|
||||
- Default: `"[]"`
|
||||
- Description: A list of filesystems that should not be disabled
|
||||
- Type: list of ''
|
||||
- Type: list
|
||||
- Required: no
|
||||
- `os_hardening_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Whether to run the hardening
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_ignore_home_folder_users`
|
||||
- Default: `[]`
|
||||
- Default: `"[]"`
|
||||
- Description: Specify user accounts, whose home folders shouldn't be chmodded to 700 when "os_chmod_home_folders" is enabled.
|
||||
- Type: list of ''
|
||||
- Type: list
|
||||
- Required: no
|
||||
- `os_ignore_users`
|
||||
- Default: `['vagrant', 'kitchen']`
|
||||
- Default: `["vagrant", "kitchen"]`
|
||||
- Description: Specify system accounts whose login should not be disabled and password not changed
|
||||
- Type: list of ''
|
||||
- Type: list
|
||||
- Required: no
|
||||
- `os_limits_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to disable installing and configuring limits.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_login_defs_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to disable installing and configuring login_defs for newly created users.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_minimize_access_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to disable installing and configuring minimize_access.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -452,7 +341,7 @@ This role is mostly based on guides by:
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `os_mnt_boot_enabled`
|
||||
- Default: `False`
|
||||
- Default: `false`
|
||||
- Description: Set to true to configure /boot mountpoint
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -487,7 +376,7 @@ This role is mostly based on guides by:
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `os_mnt_dev_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to ignore /dev mountpoint
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -517,7 +406,7 @@ This role is mostly based on guides by:
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `os_mnt_dev_shm_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to ignore /dev/shm mountpoint
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -557,7 +446,7 @@ This role is mostly based on guides by:
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `os_mnt_home_enabled`
|
||||
- Default: `False`
|
||||
- Default: `false`
|
||||
- Description: Set to true to configure /home mountpoint
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -592,7 +481,7 @@ This role is mostly based on guides by:
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `os_mnt_run_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to ignore /run mountpoint
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -627,7 +516,7 @@ This role is mostly based on guides by:
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `os_mnt_tmp_enabled`
|
||||
- Default: `False`
|
||||
- Default: `false`
|
||||
- Description: Set to true to configure /tmp mountpoint
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -662,7 +551,7 @@ This role is mostly based on guides by:
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `os_mnt_var_enabled`
|
||||
- Default: `False`
|
||||
- Default: `false`
|
||||
- Description: Set to true to configure /var mountpoint
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -682,7 +571,7 @@ This role is mostly based on guides by:
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `os_mnt_var_log_audit_enabled`
|
||||
- Default: `False`
|
||||
- Default: `false`
|
||||
- Description: Set to true to configure /var/log/audit mountpoint
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -717,7 +606,7 @@ This role is mostly based on guides by:
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `os_mnt_var_log_enabled`
|
||||
- Default: `False`
|
||||
- Default: `false`
|
||||
- Description: Set to true to configure /var/log mountpoint
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -767,7 +656,7 @@ This role is mostly based on guides by:
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `os_mnt_var_tmp_enabled`
|
||||
- Default: `False`
|
||||
- Default: `false`
|
||||
- Description: Set to true to configure /var/tmp mountpoint
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -792,47 +681,47 @@ This role is mostly based on guides by:
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `os_modprobe_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to disable installing and configuring modprobe.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_netrc_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Configure filesystem for existence of .netrc file in homedir
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_netrc_whitelist_user`
|
||||
- Default: `[]`
|
||||
- Default: `"[]"`
|
||||
- Description: Add list of user to allow creation of .netrc in users homedir
|
||||
- Type: list of ''
|
||||
- Type: list
|
||||
- Required: no
|
||||
- `os_pam_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to disable installing and configuring pam.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_profile_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to disable installing and configuring profile.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_remove_additional_root_users`
|
||||
- Default: `False`
|
||||
- Default: `false`
|
||||
- Description: When enabled and there are multiple users with UID=0, only "root" will be kept. Others will be deleted.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_rhosts_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to disable installing and configuring rhosts.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_rootuser_pw_ageing`
|
||||
- Default: `False`
|
||||
- Default: `false`
|
||||
- Description: Set to true to enforce password age settings for root user(s)
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_securetty_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to disable installing and configuring securetty.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -842,57 +731,62 @@ This role is mostly based on guides by:
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `os_security_init_prompt`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: The PROMPT option provides console users the ability to interactively boot the system and select which services to start on boot.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_security_init_single`
|
||||
- Default: `False`
|
||||
- Default: `false`
|
||||
- Description: Single-user mode is intended as a system recovery method, providing a single user root access to the system by providing a boot option at startup. By default, no authentication is performed if single-user mode is selected. To require entry of the root password even if the system is started in single-user mode, set this to false
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_security_kernel_enable_core_dump`
|
||||
- Default: `False`
|
||||
- Default: `false`
|
||||
- Description: kernel is crashing or otherwise misbehaving and a kernel core dump is created.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_security_kernel_enable_module_loading`
|
||||
- Default: `true`
|
||||
- Description: true if you want to allowed to change kernel modules once the system is running (eg `modprobe`, `rmmod`). WARNING - Rebuilding initramfs is deprecated and will be removed in the next major release. For more information take a look at this issue <https://github.com/dev-sec/ansible-collection-hardening/pull/591>
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_security_packages_clean`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: removes packages with known issues. See section packages.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_security_packages_list`
|
||||
- Default: `['xinetd', 'inetd', 'ypserv', 'telnet-server', 'rsh-server', 'prelink']`
|
||||
- Default: `["xinetd", "inetd", "ypserv", "telnet-server", "rsh-server", "prelink"]`
|
||||
- Description: List of deprecated or insecure packages to remove
|
||||
- Type: list of ''
|
||||
- Type: list
|
||||
- Required: no
|
||||
- `os_security_suid_sgid_blacklist`
|
||||
- Default: `[]`
|
||||
- Default: `"[]"`
|
||||
- Description: a list of paths which should have their SUID/SGID bits removed.
|
||||
- Type: list of ''
|
||||
- Type: list
|
||||
- Required: no
|
||||
- `os_security_suid_sgid_enforce`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: true if you want to reduce SUID/SGID bits. There is already a list of items which are searched for configured, but you can also add your own.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_security_suid_sgid_remove_from_unknown`
|
||||
- Default: `False`
|
||||
- Default: `false`
|
||||
- Description: true if you want to remove SUID/SGID bits from any file, that is not explicitly configured in a `blacklist`. This will make every Ansible-run search through the mounted filesystems looking for SUID/SGID bits that are not configured in the default and user blacklist. If it finds an SUID/SGID bit, it will be removed, unless this file is in your `whitelist`.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_security_suid_sgid_whitelist`
|
||||
- Default: `[]`
|
||||
- Default: `"[]"`
|
||||
- Description: a list of paths which should not have their SUID/SGID bits altered.
|
||||
- Type: list of ''
|
||||
- Type: list
|
||||
- Required: no
|
||||
- `os_security_users_allow`
|
||||
- Default: `[]`
|
||||
- Default: `"[]"`
|
||||
- Description: list of things, that a user is allowed to do. May contain `change_user`.
|
||||
- Type: list of ''
|
||||
- Type: list
|
||||
- Required: no
|
||||
- `os_selinux_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to disable installing and configuring selinux.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -917,39 +811,39 @@ This role is mostly based on guides by:
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `os_sysctl_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to disable installing and configuring sysctl.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_unused_filesystems`
|
||||
- Default: `['cramfs', 'freevxfs', 'jffs2', 'hfs', 'hfsplus', 'squashfs', 'udf', 'vfat', 'dccp', 'rds', 'sctp', 'tipc']`
|
||||
- Default: `["cramfs", "freevxfs", "jffs2", "hfs", "hfsplus", "squashfs", "udf", "vfat", "dccp", "rds", "sctp", "tipc"]`
|
||||
- Description: Disable this list of unused filesystems
|
||||
- Type: list of ''
|
||||
- Type: list
|
||||
- Required: no
|
||||
- `os_user_accounts_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to disable installing and configuring user_accounts.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_user_pw_ageing`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to disable password age enforcement on existing users
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_users_without_password_ageing`
|
||||
- Default: `[]`
|
||||
- Default: `"[]"`
|
||||
- Description: List of users, where password ageing should not be enforced even if "os_user_pw_ageing" is enabled
|
||||
- Type: list of ''
|
||||
- Type: list
|
||||
- Required: no
|
||||
- `os_yum_enabled`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to false to disable installing and configuring yum.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `os_yum_repo_file_whitelist`
|
||||
- Default: `[]`
|
||||
- Default: `"[]"`
|
||||
- Description: List of yum repository files under /etc/yum.repos.d/ which should not be altered.
|
||||
- Type: list of ''
|
||||
- Type: list
|
||||
- Required: no
|
||||
- `proc_mnt_options`
|
||||
- Default: `rw,nosuid,nodev,noexec,relatime`
|
||||
@@ -987,7 +881,7 @@ This role is mostly based on guides by:
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `ufw_enable_ipv6`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: Set to `true` to apply rules to support IPv6 (no means only IPv6 on loopback accepted).
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -1007,7 +901,7 @@ This role is mostly based on guides by:
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `ufw_manage_defaults`
|
||||
- Default: `True`
|
||||
- Default: `true`
|
||||
- Description: true means apply all settings with `ufw_` prefix.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
@@ -1020,9 +914,101 @@ None.
|
||||
|
||||
```
|
||||
- hosts: all
|
||||
become: true
|
||||
roles:
|
||||
- name: devsec.hardening.os_hardening
|
||||
```
|
||||
|
||||
<!-- END_ANSIBLE_DOCS -->
|
||||
|
||||
## Known Limitations
|
||||
|
||||
### Docker support
|
||||
|
||||
If you're using Docker / Kubernetes+Docker you'll need to override the ipv4 ip forward sysctl setting.
|
||||
|
||||
```yaml
|
||||
- hosts: localhost
|
||||
collections:
|
||||
- devsec.hardening
|
||||
roles:
|
||||
- devsec.hardening.os_hardening
|
||||
vars:
|
||||
sysctl_overwrite:
|
||||
# Enable IPv4 traffic forwarding.
|
||||
net.ipv4.ip_forward: 1
|
||||
```
|
||||
|
||||
### hidepid on RHEL/CentOS 7
|
||||
|
||||
When having `polkit-0.112-18.el7` (and later) installed and `/proc` mounted with `hidepid=2`, every time someone uses `systemctl` the following error is displayed, but systemctl runs successfully.
|
||||
|
||||
```
|
||||
Error registering authentication agent: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: Cannot determine user of subject (polkit-error-quark, 0)
|
||||
```
|
||||
|
||||
We decided to set `hidepid=0` to remove the error message, if you want to use the other proposed workaround, you have to setup the user yourself and set our option to `hidepid_option: 2` via Ansible vars.
|
||||
|
||||
For further details see [RedHat: "GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: Cannot determine user of subject" seen when executing systemctl command](https://access.redhat.com/solutions/5005111) or [#364: hidepid=2 gives error when running systemctl on EL7](https://github.com/dev-sec/ansible-collection-hardening/issues/364)
|
||||
|
||||
### sysctl - vm.mmap_rnd_bits
|
||||
|
||||
We are setting this sysctl to a default of `32`, some systems only support smaller values and this will generate an error. Unfortunately we cannot determine the correct applicable maximum. If you encounter this error you have to override this sysctl in your playbook.
|
||||
|
||||
```yaml
|
||||
- hosts: localhost
|
||||
collections:
|
||||
- devsec.hardening
|
||||
roles:
|
||||
- devsec.hardening.os_hardening
|
||||
vars:
|
||||
sysctl_overwrite:
|
||||
vm.mmap_rnd_bits: 16
|
||||
```
|
||||
|
||||
## Testing with inspec
|
||||
|
||||
If you're using inspec to test your machines after applying this role, please make sure to add the connecting user to the `os_ignore_users`-variable.
|
||||
Otherwise inspec will fail. For more information, see [issue #124](https://github.com/dev-sec/ansible-os-hardening/issues/124).
|
||||
|
||||
We know that this is the case on Raspberry Pi.
|
||||
|
||||
## Changing sysctl variables
|
||||
|
||||
If you want to override sysctl-variables, you can use the `sysctl_overwrite` variable (in older versions you had to override the whole `sysctl_dict`).
|
||||
So for example if you want to change the IPv4 traffic forwarding variable to `1`, do it like this:
|
||||
|
||||
```yaml
|
||||
- hosts: localhost
|
||||
collections:
|
||||
- devsec.hardening
|
||||
roles:
|
||||
- os_hardening
|
||||
vars:
|
||||
sysctl_overwrite:
|
||||
# Enable IPv4 traffic forwarding.
|
||||
net.ipv4.ip_forward: 1
|
||||
```
|
||||
|
||||
Alternatively you can change Ansible's [hash-behaviour](https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-hash-behaviour) to `merge`, then you only have to overwrite the single hash you need to. But please be aware that changing the hash-behaviour changes it for all your playbooks and is not recommended by Ansible.
|
||||
|
||||
## Improving Kernel Audit logging
|
||||
|
||||
By default, any process that starts before the `auditd` daemon will have an AUID of `4294967295`. To improve this and provide more accurate logging, it's recommended to add the kernel boot parameter `audit=1` to you configuration. Without doing this, you will find that your `auditd` logs fail to properly audit all processes.
|
||||
|
||||
For more information, please see this [upstream documentation](https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html) and your system's boot loader documentation for how to configure additional kernel parameters.
|
||||
|
||||
## More information
|
||||
|
||||
We use specific PAM configuration for every linux distribution. This is a very diverse area, since every vendor seems to push their own system for managing PAM. We used following guides and sources for our configuration.
|
||||
|
||||
- on Debian/Ubuntu we use [pam-config-framework](https://wiki.ubuntu.com/PAMConfigFrameworkSpec)
|
||||
- RHEL8 and compatible use information from [authselect](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_authentication_and_authorization_in_rhel/configuring-user-authentication-using-authselect_configuring-authentication-and-authorization-in-rhel), but our setup disables the configuration from authselect
|
||||
- RHEL 6/7 and compatible use [authconfig](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/authconfig-install), but our setup disables the configuration from authconfig
|
||||
- for RHEL 6/7 we also use information from [Desktop Security](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-hardening_your_system_with_tools_and_services#sec-Desktop_Security)
|
||||
|
||||
This role is mostly based on guides by:
|
||||
|
||||
- [Arch Linux wiki, Sysctl hardening](https://wiki.archlinux.org/index.php/Sysctl)
|
||||
- [NSA: Guide to the Secure Configuration of Red Hat Enterprise Linux 5](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf)
|
||||
- [Ubuntu Security/Features](https://wiki.ubuntu.com/Security/Features)
|
||||
- [Deutsche Telekom, Group IT Security, Security Requirements (German)](https://www.telekom.com/psa)
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
os_env_user_paths: [/usr/local/sbin, /usr/local/bin, /usr/sbin, /usr/bin, /sbin, /bin]
|
||||
os_desktop_enable: false
|
||||
os_env_extra_user_paths: []
|
||||
os_auth_pw_max_age: 60
|
||||
os_auth_pw_min_age: 7 # Discourage password cycling
|
||||
@@ -39,6 +39,7 @@ os_users_without_password_ageing: []
|
||||
|
||||
# Specify system accounts whose login should not be disabled and password not changed
|
||||
os_ignore_users: [vagrant, kitchen]
|
||||
os_security_kernel_enable_module_loading: true
|
||||
os_security_kernel_enable_core_dump: false
|
||||
os_security_suid_sgid_enforce: true
|
||||
# User-defined blacklist and whitelist
|
||||
@@ -146,7 +147,7 @@ sysctl_config:
|
||||
# The PTRACE system is used for debugging. With it, a single user process
|
||||
# can attach to any other dumpable process owned by the same user. In the
|
||||
# case of malicious software, it is possible to use PTRACE to access
|
||||
# credentials that exist in memory (reusing existing SSH connections,
|
||||
# credentials that exist in memory (re-using existing SSH connections,
|
||||
# extracting GPG agent information, etc).
|
||||
#
|
||||
# A PTRACE scope of "0" is the more permissive mode. A scope of "1" limits
|
||||
@@ -348,7 +349,6 @@ os_auditd_disk_error_action: SUSPEND
|
||||
os_auditd_action_mail_acct: root
|
||||
os_auditd_log_group: root
|
||||
os_auditd_num_logs: 5
|
||||
os_auditd_name_format: NONE
|
||||
|
||||
# Set the SELinux state, which can be either disabled, permissive, or enforcing.
|
||||
os_selinux_state: enforcing
|
||||
|
||||
@@ -2,33 +2,17 @@
|
||||
- name: Update-initramfs # noqa no-changed-when
|
||||
ansible.builtin.command: update-initramfs -u
|
||||
|
||||
- name: Restart auditd # noqa command-instead-of-module no-changed-when
|
||||
ansible.builtin.command:
|
||||
cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
|
||||
when: molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
|
||||
|
||||
- name: Reload systemd
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: true
|
||||
|
||||
- name: Restart auditd via systemd
|
||||
ansible.builtin.systemd:
|
||||
name: auditd.service
|
||||
state: restarted
|
||||
ignore_errors: "{{ ansible_check_mode }}"
|
||||
when:
|
||||
- molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
|
||||
- not ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Restart auditd via service # noqa command-instead-of-module no-changed-when
|
||||
ansible.builtin.command:
|
||||
cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
|
||||
when:
|
||||
- molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
|
||||
- ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Remount filesystems
|
||||
ansible.posix.mount:
|
||||
path: "{{ item }}"
|
||||
state: remounted
|
||||
loop: "{{ mountpoints_changed }}"
|
||||
|
||||
- name: Restart journald
|
||||
ansible.builtin.systemd:
|
||||
name: systemd-journald.service
|
||||
state: restarted
|
||||
@@ -4,14 +4,15 @@ argument_specs:
|
||||
short_description: The main entry point for the os hardening role.
|
||||
version_added: 8.8.0
|
||||
options:
|
||||
os_env_user_paths:
|
||||
default: [/usr/local/sbin, /usr/local/bin, /usr/sbin, /usr/bin, /sbin, /bin]
|
||||
type: list
|
||||
description: Specify paths that should be checked for binaries where access will be minimized
|
||||
os_desktop_enable:
|
||||
default: false
|
||||
type: bool
|
||||
description: true if this is a desktop system, ie Xorg, KDE/GNOME/Unity/etc.
|
||||
os_env_extra_user_paths:
|
||||
default: '[]'
|
||||
type: list
|
||||
description: Specify additional paths that should be checked for binaries where access will be minimized
|
||||
description: add additional paths to the user's `PATH` variable (default is
|
||||
empty).
|
||||
os_auth_pw_max_age:
|
||||
default: 60
|
||||
type: int
|
||||
@@ -69,6 +70,13 @@ argument_specs:
|
||||
default: '[]'
|
||||
type: list
|
||||
description: list of things, that a user is allowed to do. May contain `change_user`.
|
||||
os_security_kernel_enable_module_loading:
|
||||
default: true
|
||||
type: bool
|
||||
description: true if you want to allowed to change kernel modules once the
|
||||
system is running (eg `modprobe`, `rmmod`). WARNING - Rebuilding initramfs
|
||||
is deprecated and will be removed in the next major release. For more information
|
||||
take a look at this issue <https://github.com/dev-sec/ansible-collection-hardening/pull/591>
|
||||
os_security_kernel_enable_core_dump:
|
||||
default: false
|
||||
type: bool
|
||||
@@ -207,16 +215,6 @@ argument_specs:
|
||||
description: This keyword specifies the maximum file size in megabytes. When
|
||||
this limit is reached, it will trigger a configurable action. The value
|
||||
given must be numeric.
|
||||
os_auditd_name_format:
|
||||
default: NONE
|
||||
type: str
|
||||
description: This keyword specifies how computer node names are inserted
|
||||
into the audit event stream.
|
||||
choices:
|
||||
- NONE
|
||||
- hostname
|
||||
- fqd
|
||||
- numeric
|
||||
os_auditd_num_logs:
|
||||
default: 5
|
||||
type: int
|
||||
@@ -237,7 +235,7 @@ argument_specs:
|
||||
default: SUSPEND
|
||||
type: str
|
||||
description: This parameter tells the system what action to take when the
|
||||
system has detected that it is low on disk space. Valid values are ignore,
|
||||
system has detected that it is low on disk space. Valid values are ignore,
|
||||
syslog, rotate, email, exec, suspend, single, and halt.
|
||||
os_auditd_space_left:
|
||||
default: 75
|
||||
@@ -453,11 +451,11 @@ argument_specs:
|
||||
type: str
|
||||
description: Configure file system for fstab entry /dev
|
||||
os_mnt_dev_dump:
|
||||
default: '0'
|
||||
default: 0
|
||||
type: str
|
||||
description: Configure dump for fstab entry /var/tmp.
|
||||
os_mnt_dev_passno:
|
||||
default: '0'
|
||||
default: 0
|
||||
type: str
|
||||
description: Configure passno for fstab entry /var/tmp.
|
||||
os_mnt_dev_shm_dir_mode:
|
||||
@@ -481,11 +479,11 @@ argument_specs:
|
||||
type: str
|
||||
description: Configure file system for fstab entry /dev/shm
|
||||
os_mnt_dev_shm_dump:
|
||||
default: '0'
|
||||
default: 0
|
||||
type: str
|
||||
description: Configure dump for fstab entry /var/tmp.
|
||||
os_mnt_dev_shm_passno:
|
||||
default: '0'
|
||||
default: 0
|
||||
type: str
|
||||
description: Configure passno for fstab entry /var/tmp.
|
||||
os_mnt_home_dir_mode:
|
||||
@@ -541,11 +539,11 @@ argument_specs:
|
||||
type: str
|
||||
description: Configure file system for fstab entry /run
|
||||
os_mnt_run_dump:
|
||||
default: '0'
|
||||
default: 0
|
||||
type: str
|
||||
description: Configure dump for fstab entry /var/tmp.
|
||||
os_mnt_run_passno:
|
||||
default: '0'
|
||||
default: 0
|
||||
type: str
|
||||
description: Configure passno for fstab entry /var/tmp.
|
||||
os_mnt_tmp_dir_mode:
|
||||
|
||||
@@ -4,22 +4,21 @@ galaxy_info:
|
||||
description: This Ansible role provides numerous security-related ssh configurations, providing all-round base protection.
|
||||
company: Hardening Framework Team
|
||||
license: Apache License 2.0
|
||||
min_ansible_version: "2.16"
|
||||
min_ansible_version: "2.11"
|
||||
platforms:
|
||||
- name: EL
|
||||
versions:
|
||||
- "7"
|
||||
- "8"
|
||||
- "9"
|
||||
- "10"
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- bionic
|
||||
- focal
|
||||
- jammy
|
||||
- noble
|
||||
- resolute
|
||||
- name: Debian
|
||||
versions:
|
||||
- trixie
|
||||
- bookworm
|
||||
- buster
|
||||
- bullseye
|
||||
- name: Amazon
|
||||
- name: Fedora
|
||||
|
||||
@@ -12,19 +12,5 @@
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0640"
|
||||
notify:
|
||||
- Restart auditd via service
|
||||
- Restart auditd via systemd
|
||||
tags: auditd
|
||||
|
||||
- name: Disable systemd-journald.audit
|
||||
when:
|
||||
- ansible_facts.os_family != 'Suse' # socket doesn't seem to exist on suse
|
||||
ansible.builtin.systemd:
|
||||
name: systemd-journald-audit.socket
|
||||
state: stopped
|
||||
enabled: false
|
||||
masked: true
|
||||
notify:
|
||||
- Restart journald
|
||||
notify: Restart auditd
|
||||
tags: auditd
|
||||
Loaded 100 of 143 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user