Compare commits
16
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Sebastian Gumprich
|
8effc06c91 | ||
|
Sebastian Gumprich
|
a81b9bc0e6 | ||
|
Sebastian Gumprich
|
a1c44a1459 | ||
|
Sebastian Gumprich
|
00b6556e33 | ||
|
Sebastian Gumprich
|
c87fe430c7 | ||
|
Sebastian Gumprich
|
35d3e6aa9d | ||
|
Sebastian Gumprich
|
5fbed64dd4 | ||
|
Sebastian Gumprich
|
c678514bb6 | ||
|
Sebastian Gumprich
|
c9d6d981a3 | ||
|
Sebastian Gumprich
|
a2aae0f49b | ||
|
Sebastian Gumprich
|
6ca2f11433 | ||
|
Sebastian Gumprich
|
f901b684ba | ||
|
Sebastian Gumprich
|
186b36d954 | ||
|
Sebastian Gumprich
|
49e8d4fdda | ||
|
Sebastian Gumprich
|
7f8b34e0fb | ||
|
Sebastian Gumprich
|
6d8f4dfbfb |
No files matched your search
@@ -1,51 +0,0 @@
|
||||
output_template: |
|
||||
<!-- BEGIN_ANSIBLE_DOCS -->
|
||||
|
||||
## Supported Operating Systems
|
||||
|
||||
{%- for platform in metadata.galaxy_info.platforms %}
|
||||
- {{ platform.name }}
|
||||
{%- if "versions" in platform %}
|
||||
- {{ platform.versions | default([]) | join(', ') }}
|
||||
{%- endif %}
|
||||
{%- endfor %}
|
||||
|
||||
## Role Variables
|
||||
{% for entrypoint in argument_specs.keys() %}
|
||||
{%- set path, options=entrypoint_options[entrypoint][0] -%}
|
||||
{%- for name, details in options.items() |sort() %}
|
||||
- `{{ name }}`
|
||||
- Default: `{{ details.display_default }}`
|
||||
- Description: {{ details.display_description }}
|
||||
- Type: {{ details.display_type }}
|
||||
- Required: {{ details.display_required }}
|
||||
{%- if details.choices %}
|
||||
- Choices:
|
||||
{%- for choice in details.choices %}
|
||||
- {{ choice }}
|
||||
{%- endfor %}
|
||||
{%- endif %}
|
||||
{%- endfor %}
|
||||
{%- endfor %}
|
||||
|
||||
## Dependencies
|
||||
|
||||
{%- if ("dependencies" in metadata) and (metadata.dependencies | length > 0) %}
|
||||
{%- for dependency in metadata.dependencies %}
|
||||
- {{ dependency }}
|
||||
{%- endfor %}
|
||||
{%- else %}
|
||||
|
||||
None.
|
||||
{%- endif %}
|
||||
|
||||
## Example Playbook
|
||||
|
||||
```
|
||||
- hosts: all
|
||||
become: true
|
||||
roles:
|
||||
- name: {{ role }}
|
||||
```
|
||||
|
||||
<!-- END_ANSIBLE_DOCS -->
|
||||
@@ -5,12 +5,9 @@
|
||||
# option will be parsed relative to the CWD of execution.
|
||||
exclude_paths:
|
||||
- .cache/ # implicit unless exclude_paths is defined in config
|
||||
- .ansible/ # somehow someone decided that the cache directory should be renamed
|
||||
# add all waivers individually, since exclude_files does not support globs
|
||||
- molecule/os_hardening/waivers.yaml
|
||||
- molecule/ssh_hardening_bsd/waivers_freebsd13.yaml
|
||||
- molecule/ssh_hardening_bsd/waivers_freebsd14.yaml
|
||||
- molecule/ssh_hardening_bsd/waivers_openbsd7.yaml
|
||||
- .yamllint
|
||||
- ../molecule/
|
||||
- ../.github/
|
||||
|
||||
mock_roles:
|
||||
- geerlingguy.git
|
||||
@@ -18,4 +15,3 @@ mock_roles:
|
||||
|
||||
skip_list:
|
||||
- var-naming[no-role-prefix]
|
||||
- meta-runtime[unsupported-version]
|
||||
@@ -31,7 +31,7 @@ body:
|
||||
attributes:
|
||||
label: "Reproduction steps"
|
||||
render: Shell
|
||||
description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, no need for backticks.
|
||||
description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, so no need for backticks.
|
||||
value: |
|
||||
...
|
||||
validations:
|
||||
|
||||
+14
-22
@@ -1,30 +1,22 @@
|
||||
---
|
||||
mysql_hardening:
|
||||
- changed-files:
|
||||
- any-glob-to-any-file:
|
||||
- roles/mysql_hardening/**
|
||||
- molecule/mysql_hardening/**
|
||||
- .github/workflows/mysql_hardening.yml
|
||||
- 'roles/mysql_hardening/**'
|
||||
- 'molecule/mysql_hardening/**'
|
||||
- '.github/workflows/mysql_hardening.yml'
|
||||
|
||||
os_hardening:
|
||||
- changed-files:
|
||||
- any-glob-to-any-file:
|
||||
- roles/os_hardening/**
|
||||
- molecule/os_hardening/**
|
||||
- .github/workflows/os_hardening.yml
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening/**'
|
||||
- '.github/workflows/os_hardening.yml'
|
||||
|
||||
ssh_hardening:
|
||||
- changed-files:
|
||||
- any-glob-to-any-file:
|
||||
- roles/ssh_hardening/**
|
||||
- molecule/ssh_hardening/**
|
||||
- molecule/ssh_hardening_custom_tests/**
|
||||
- .github/workflows/ssh_hardening.yml
|
||||
- .github/workflows/ssh_hardening_custom_tests.yml
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_custom_tests/**'
|
||||
- '.github/workflows/ssh_hardening.yml'
|
||||
- '.github/workflows/ssh_hardening_custom_tests.yml'
|
||||
|
||||
nginx_hardening:
|
||||
- changed-files:
|
||||
- any-glob-to-any-file:
|
||||
- roles/nginx_hardening/**
|
||||
- molecule/nginx_hardening/**
|
||||
- .github/workflows/nginx_hardening.yml
|
||||
- 'roles/nginx_hardening/**'
|
||||
- 'molecule/nginx_hardening/**'
|
||||
- '.github/workflows/nginx_hardening.yml'
|
||||
@@ -1,3 +0,0 @@
|
||||
major-labels: ['major']
|
||||
minor-labels: ['minor', 'enhancement']
|
||||
patch-labels: ['patch', 'bug']
|
||||
@@ -7,26 +7,22 @@ on: # yamllint disable-line rule:truthy
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/**'
|
||||
- 'molecule/**'
|
||||
- 'requirements.txt'
|
||||
- '.github/workflows/ansible-lint.yml'
|
||||
- '.config/ansible-lint.yml'
|
||||
pull_request:
|
||||
# The branches below must be a subset of the branches above
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/**'
|
||||
- 'molecule/**'
|
||||
- 'requirements.txt'
|
||||
- '.github/workflows/ansible-lint.yml'
|
||||
- '.config/ansible-lint.yml'
|
||||
|
||||
jobs:
|
||||
ansible-lint:
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
|
||||
# Important: This sets up your GITHUB_WORKSPACE environment variable
|
||||
- uses: actions/checkout@v3
|
||||
|
||||
- name: Lint Ansible Playbook
|
||||
uses: ansible/ansible-lint@9cf49a01ac6b34f45aab16f0bbac1196fcd681e5 # v25
|
||||
# replace "master" with any valid ref
|
||||
uses: ansible/ansible-lint-action@main
|
||||
with:
|
||||
path: "roles/"
|
||||
@@ -11,4 +11,4 @@ jobs:
|
||||
codespell:
|
||||
uses: "dev-sec/.github/.github/workflows/codespell.yml@main"
|
||||
with:
|
||||
ignore_words_list: "chage,BOOTUP"
|
||||
ignore_words_list: "chage"
|
||||
@@ -4,16 +4,11 @@ name: "Enforce PR labels"
|
||||
on: # yamllint disable-line rule:truthy
|
||||
pull_request_target:
|
||||
types: [labeled, unlabeled, opened, edited, synchronize]
|
||||
|
||||
permissions:
|
||||
contents: read # to read configuration file
|
||||
pull-requests: write # to label PRs
|
||||
|
||||
jobs:
|
||||
enforce-label:
|
||||
if: github.repository == 'dev-sec/ansible-collection-hardening'
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
|
||||
- uses: actions/labeler@main
|
||||
with:
|
||||
repo-token: "${{ secrets.GITHUB_TOKEN }}"
|
||||
@@ -4,37 +4,37 @@ name: Publish collection to Ansible Galaxy
|
||||
on: # yamllint disable-line rule:truthy
|
||||
release:
|
||||
types:
|
||||
- released
|
||||
- published
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
if: github.repository == 'dev-sec/ansible-collection-hardening'
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
|
||||
- uses: actions/checkout@v3
|
||||
|
||||
# deploy the collection first, because if it fails, we don't want
|
||||
# to update the galaxy.yml
|
||||
- name: Deploy the collection
|
||||
uses: artis3n/ansible_galaxy_collection@3368f56529a2ef47ef0ac1ecfcda039f90d0174a # v2
|
||||
uses: artis3n/ansible_galaxy_collection@v2
|
||||
with:
|
||||
api_key: ${{ secrets.GALAXY_API_KEY }}
|
||||
galaxy_version: ${{ github.event.release.tag_name }}
|
||||
|
||||
# checkout master instead of the release-tag so we can push the galaxy.yml
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
|
||||
- uses: actions/checkout@v3
|
||||
with:
|
||||
ref: master
|
||||
|
||||
- name: update galaxy.yml with new version
|
||||
uses: microsoft/variable-substitution@6287962da9e5b6e68778dc51e840caa03ca84495 # v1
|
||||
uses: microsoft/variable-substitution@v1
|
||||
with:
|
||||
files: 'galaxy.yml'
|
||||
env:
|
||||
version: "${{ github.event.release.tag_name }}"
|
||||
|
||||
- name: push galaxy.yml
|
||||
uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
|
||||
uses: github-actions-x/[email protected]
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
push-branch: 'master'
|
||||
@@ -9,14 +9,12 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/mysql_hardening/**'
|
||||
- 'molecule/mysql_hardening/**'
|
||||
- '.github/workflows/mysql_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/mysql_hardening/**'
|
||||
- 'molecule/mysql_hardening/**'
|
||||
- '.github/workflows/mysql_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 0'
|
||||
|
||||
@@ -29,7 +27,7 @@ concurrency:
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
PY_COLORS: 1
|
||||
ANSIBLE_FORCE_COLOR: 1
|
||||
@@ -37,12 +35,15 @@ jobs:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
- debian10
|
||||
- debian11
|
||||
- debian12
|
||||
# - amazon # geerlingguy.mysql does not support fedora
|
||||
@@ -51,26 +52,23 @@ jobs:
|
||||
# - fedora # geerlingguy.mysql does not support fedora
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
|
||||
- name: Set up Python 3.11
|
||||
uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: 3.12
|
||||
cache: 'pip'
|
||||
python-version: 3.11
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
run: |
|
||||
sudo apt install git
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Downgrade Ansible for Rocky 8 tests
|
||||
run: pip install "ansible-core<2.17"
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
if: matrix.molecule_distro == 'rocky8'
|
||||
|
||||
# that was a hard one to fix. robert did it thankfully
|
||||
# https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212
|
||||
- name: disable apparmor on debian systems
|
||||
@@ -81,19 +79,10 @@ jobs:
|
||||
sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld
|
||||
if: ${{ startsWith(matrix.molecule_distro, 'Debian') }}
|
||||
|
||||
# Molecule has problems detecting the proper location for installing roles
|
||||
# https://github.com/ansible/molecule/issues/3806
|
||||
# we do not set a custom role path, but the automatically determined install path used is not compatible with the location molecule expects the role
|
||||
# see CI logs of this action "INFO Set ANSIBLE_ROLES_PATH" should not be present, since we do not set a custom path
|
||||
# we have to find a proper way to configure this
|
||||
- name: Temporary fix for roles
|
||||
run: |
|
||||
mkdir -p /home/runner/.ansible
|
||||
ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles \
|
||||
/home/runner/.ansible/roles
|
||||
|
||||
- name: Test with molecule
|
||||
run: molecule test -s mysql_hardening
|
||||
run: |
|
||||
molecule --version
|
||||
molecule test -s mysql_hardening
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
@@ -8,14 +8,12 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/nginx_hardening/**'
|
||||
- 'molecule/nginx_hardening/**'
|
||||
- '.github/workflows/nginx_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/nginx_hardening/**'
|
||||
- 'molecule/nginx_hardening/**'
|
||||
- '.github/workflows/nginx_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 1'
|
||||
|
||||
@@ -28,7 +26,7 @@ concurrency:
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
PY_COLORS: 1
|
||||
ANSIBLE_FORCE_COLOR: 1
|
||||
@@ -36,12 +34,15 @@ jobs:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
- debian10
|
||||
- debian11
|
||||
- debian12
|
||||
- amazon2023
|
||||
@@ -50,39 +51,27 @@ jobs:
|
||||
# - fedora # no support from geerlingguy role
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
|
||||
- name: Set up Python 3.11
|
||||
uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: 3.12
|
||||
cache: 'pip'
|
||||
python-version: 3.11
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Downgrade Ansible for Rocky 8 tests
|
||||
run: pip install "ansible-core<2.17"
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
if: matrix.molecule_distro == 'rocky8'
|
||||
|
||||
# Molecule has problems detecting the proper location for installing roles
|
||||
# https://github.com/ansible/molecule/issues/3806
|
||||
# we do not set a custom role path, but the automatically determined install path used is not compatible with the location molecule expects the role
|
||||
# see CI logs of this action "INFO Set ANSIBLE_ROLES_PATH" should not be present, since we do not set a custom path
|
||||
# we have to find a proper way to configure this
|
||||
- name: Temporary fix for roles
|
||||
run: |
|
||||
mkdir -p /home/runner/.ansible
|
||||
ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles \
|
||||
/home/runner/.ansible/roles
|
||||
sudo apt install git
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Test with molecule
|
||||
run: molecule test -s nginx_hardening
|
||||
run: |
|
||||
molecule --version
|
||||
molecule test -s nginx_hardening
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
@@ -8,14 +8,12 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening/**'
|
||||
- '.github/workflows/os_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening/**'
|
||||
- '.github/workflows/os_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 3'
|
||||
|
||||
@@ -28,56 +26,56 @@ concurrency:
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
PY_COLORS: 1
|
||||
ANSIBLE_FORCE_COLOR: 1
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- molecule_distro: opensuse_tumbleweed
|
||||
molecule_docker_command: "/usr/lib/systemd/systemd"
|
||||
molecule_distro:
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- fedora39
|
||||
- fedora40
|
||||
- fedora37
|
||||
- fedora38
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
- debian10
|
||||
- debian11
|
||||
- debian12
|
||||
- amazon2023
|
||||
- opensuse_tumbleweed
|
||||
- arch
|
||||
molecule_docker_command:
|
||||
- "/lib/systemd/systemd"
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
|
||||
- name: Set up Python 3.11
|
||||
uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: 3.12
|
||||
cache: 'pip'
|
||||
python-version: 3.11
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
run: |
|
||||
sudo apt install git
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Downgrade Ansible for Rocky 8 tests
|
||||
run: pip install "ansible-core<2.17"
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
if: matrix.molecule_distro == 'rocky8'
|
||||
|
||||
- name: Test with molecule
|
||||
run: molecule test -s os_hardening
|
||||
run: |
|
||||
if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
|
||||
export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
|
||||
fi
|
||||
molecule --version
|
||||
molecule test -s os_hardening
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
@@ -8,14 +8,12 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening_vm/**'
|
||||
- '.github/workflows/os_hardening_vm.yml'
|
||||
- 'requirements.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening_vm/**'
|
||||
- '.github/workflows/os_hardening_vm.yml'
|
||||
- 'requirements.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 2'
|
||||
|
||||
@@ -36,47 +34,31 @@ jobs:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- generic/centos9s
|
||||
- generic/rocky8
|
||||
- generic/rocky9
|
||||
- fedora/39-cloud-base
|
||||
- fedora/40-cloud-base
|
||||
- generic/ubuntu2004
|
||||
- generic/ubuntu2204
|
||||
- alvistack/ubuntu-24.04
|
||||
- generic/debian11
|
||||
- generic/debian12
|
||||
- generic/opensuse15
|
||||
- generic/arch
|
||||
- centos7
|
||||
- centos8s
|
||||
- centos9s
|
||||
- rocky8
|
||||
- rocky9
|
||||
- fedora37
|
||||
- fedora38
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- debian10
|
||||
- debian11
|
||||
- debian12
|
||||
- opensuse15
|
||||
# - arch # needs fix for audit
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
source ~/.venv/ansible-collection-hardening/bin/activate
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
pip install python-vagrant
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Downgrade Ansible for Rocky 8 tests
|
||||
run: |
|
||||
source ~/.venv/ansible-collection-hardening/bin/activate
|
||||
pip install "ansible-core<2.17"
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
if: matrix.molecule_distro == 'generic/rocky8' || matrix.molecule_distro == 'generic/opensuse15'
|
||||
|
||||
- name: Update Vagrant Box
|
||||
run: |
|
||||
vagrant box update --box ${{ matrix.molecule_distro }} || true
|
||||
|
||||
- name: Test with molecule
|
||||
run: |
|
||||
source ~/.venv/ansible-collection-hardening/bin/activate
|
||||
molecule --version
|
||||
molecule test -s os_hardening_vm
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
|
||||
@@ -11,16 +11,16 @@ on: # yamllint disable-line rule:truthy
|
||||
jobs:
|
||||
prettier-md:
|
||||
if: github.repository == 'dev-sec/ansible-collection-hardening'
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 1
|
||||
|
||||
steps:
|
||||
- name: Git checkout
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
ref: ${{ github.head_ref }}
|
||||
|
||||
- name: Prettify code
|
||||
uses: creyD/prettier_action@31355f8eef017f8aeba2e0bc09d8502b13dbbad1 # v4.3
|
||||
uses: creyD/[email protected]
|
||||
with:
|
||||
prettier_options: --write {**/*,*}.md
|
||||
@@ -11,9 +11,9 @@ jobs:
|
||||
generate_changelog:
|
||||
name: create release draft
|
||||
if: github.repository == 'dev-sec/ansible-collection-hardening'
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
|
||||
- uses: actions/checkout@v3
|
||||
with:
|
||||
fetch-depth: 0
|
||||
ref: master
|
||||
@@ -26,23 +26,23 @@ jobs:
|
||||
|
||||
- name: calculate next version
|
||||
id: version
|
||||
uses: patrickjahns/version-drafter-action@2076fa43abb28f31d0e8b0890253fbd1d1a966fc # v1
|
||||
uses: patrickjahns/version-drafter-action@v1
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Generate changelog
|
||||
uses: charmixer/auto-changelog-action@b25e89c9410e03189f0d48b02b3a8caad6e78015 # v1
|
||||
uses: charmixer/auto-changelog-action@v1
|
||||
with:
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
future_release: ${{ steps.version.outputs.next-version }}
|
||||
# this excludes all versions prior to the collection-release
|
||||
# since they break the changelog generation with the error:
|
||||
# "No common ancestor between ... and $version"
|
||||
exclude_tags_regex: '^[0-6]\.\d\.\d'
|
||||
exclude_tags_regex: '[0-6]\.\d\.\d'
|
||||
issue_line_labels: mysql_hardening,os_hardening,ssh_hardening,nginx_hardening
|
||||
|
||||
- name: push changelog
|
||||
uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
|
||||
uses: github-actions-x/[email protected]
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
push-branch: 'master'
|
||||
@@ -58,18 +58,18 @@ jobs:
|
||||
|
||||
- name: Read CHANGELOG.md
|
||||
id: package
|
||||
uses: juliangruber/read-file-action@b549046febe0fe86f8cb4f93c24e284433f9ab58 # v1
|
||||
uses: juliangruber/read-file-action@v1
|
||||
with:
|
||||
path: ./CHANGELOGRELEASE.md
|
||||
|
||||
- name: Delete old drafts
|
||||
uses: hugo19941994/delete-draft-releases@1bdca1ea7ffb25ae7f468a7bdb40056dae98175e # v1.0.1
|
||||
uses: hugo19941994/[email protected]
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Create Release draft
|
||||
id: create_release
|
||||
uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1
|
||||
uses: actions/create-release@v1
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
|
||||
with:
|
||||
|
||||
@@ -1,56 +0,0 @@
|
||||
---
|
||||
name: create roles readme
|
||||
|
||||
on: # yamllint disable-line rule:truthy
|
||||
push:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/**/meta/argument_specs.yml'
|
||||
- 'roles/**/meta/main.yml'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/**/meta/argument_specs.yml'
|
||||
- 'roles/**/meta/main.yml'
|
||||
- 'requirements.txt'
|
||||
|
||||
jobs:
|
||||
readme:
|
||||
name: create roles readme
|
||||
runs-on: ubuntu-22.04
|
||||
strategy:
|
||||
matrix:
|
||||
roles:
|
||||
- mysql_hardening
|
||||
- nginx_hardening
|
||||
- os_hardening
|
||||
- ssh_hardening
|
||||
steps:
|
||||
- name: Check out code
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
|
||||
with:
|
||||
python-version: 3.12
|
||||
cache: 'pip'
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
|
||||
- name: Run aar-doc
|
||||
run: aar-doc roles/${{ matrix.roles }} markdown
|
||||
|
||||
- name: Output diff
|
||||
run: git diff roles/${{ matrix.roles }}/README.md
|
||||
|
||||
- name: Push README
|
||||
if: github.event_name != 'pull_request'
|
||||
uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
commit-message: 'update ${{ matrix.roles }} readme'
|
||||
files: roles/${{ matrix.roles }}/README.md
|
||||
rebase: true
|
||||
name: dev-sec CI
|
||||
email: [email protected]
|
||||
@@ -8,14 +8,12 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening/**'
|
||||
- '.github/workflows/ssh_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening/**'
|
||||
- '.github/workflows/ssh_hardening.yml'
|
||||
- 'requirements.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 5'
|
||||
|
||||
@@ -28,59 +26,56 @@ concurrency:
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
PY_COLORS: 1
|
||||
ANSIBLE_FORCE_COLOR: 1
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
# needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
|
||||
# - molecule_distro: opensuse_tumbleweed
|
||||
# molecule_docker_command: "/usr/lib/systemd/systemd"
|
||||
- molecule_distro: alpine
|
||||
molecule_docker_command: "/sbin/init"
|
||||
molecule_distro:
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- fedora39
|
||||
- fedora40
|
||||
- fedora37
|
||||
- fedora38
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
- debian10
|
||||
- debian11
|
||||
- debian12
|
||||
- amazon2023
|
||||
- arch
|
||||
molecule_docker_command:
|
||||
- "/lib/systemd/systemd"
|
||||
# - opensuse_tumbleweed # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
|
||||
- name: Set up Python 3.11
|
||||
uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: 3.12
|
||||
cache: 'pip'
|
||||
python-version: 3.11
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
run: |
|
||||
sudo apt install git
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Downgrade Ansible for Rocky 8 tests
|
||||
run: pip install "ansible-core<2.17"
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
if: matrix.molecule_distro == 'rocky8'
|
||||
|
||||
- name: Test with molecule
|
||||
run: molecule test -s ssh_hardening
|
||||
run: |
|
||||
if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
|
||||
export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
|
||||
fi
|
||||
molecule --version
|
||||
molecule test -s ssh_hardening
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
@@ -8,14 +8,12 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_bsd/**'
|
||||
- '.github/workflows/ssh_hardening_bsd.yml'
|
||||
- 'requirements.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_bsd/**'
|
||||
- '.github/workflows/ssh_hardening_bsd.yml'
|
||||
- 'requirements.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 5'
|
||||
|
||||
@@ -37,20 +35,18 @@ jobs:
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- openbsd7
|
||||
- freebsd13
|
||||
- freebsd14
|
||||
- freebsd12
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Update Vagrant Box
|
||||
run: vagrant box update --box generic/${{ matrix.molecule_distro }} || true
|
||||
|
||||
- name: Test with molecule
|
||||
run: molecule test -s ssh_hardening_bsd
|
||||
run: |
|
||||
molecule --version
|
||||
molecule test -s ssh_hardening_bsd
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
@@ -8,14 +8,12 @@ on: # yamllint disable-line rule:truthy
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_custom_tests/**'
|
||||
- '.github/workflows/ssh_hardening_custom_tests.yml'
|
||||
- 'requirements.txt'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_custom_tests/**'
|
||||
- '.github/workflows/ssh_hardening_custom_tests.yml'
|
||||
- 'requirements.txt'
|
||||
schedule:
|
||||
- cron: '0 6 * * 4'
|
||||
|
||||
@@ -28,59 +26,56 @@ concurrency:
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
PY_COLORS: 1
|
||||
ANSIBLE_FORCE_COLOR: 1
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
# needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
|
||||
# - molecule_distro: opensuse_tumbleweed
|
||||
# molecule_docker_command: "/usr/lib/systemd/systemd"
|
||||
- molecule_distro: alpine
|
||||
molecule_docker_command: "/sbin/init"
|
||||
molecule_distro:
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- fedora39
|
||||
- fedora40
|
||||
- fedora37
|
||||
- fedora38
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- ubuntu2404
|
||||
- debian10
|
||||
- debian11
|
||||
- debian12
|
||||
- amazon2023
|
||||
- arch
|
||||
molecule_docker_command:
|
||||
- "/lib/systemd/systemd"
|
||||
# - opensuse_tumbleweed # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
path: ansible_collections/devsec/hardening
|
||||
submodules: true
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
|
||||
- name: Set up Python 3.11
|
||||
uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: 3.12
|
||||
cache: 'pip'
|
||||
python-version: 3.11
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
run: |
|
||||
sudo apt install git
|
||||
python -m pip install --no-cache-dir --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
|
||||
- name: Downgrade Ansible for Rocky 8 tests
|
||||
run: pip install "ansible-core<2.17"
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
if: matrix.molecule_distro == 'rocky8'
|
||||
|
||||
- name: Test with molecule
|
||||
run: molecule test -s ssh_hardening_custom_tests
|
||||
run: |
|
||||
if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
|
||||
export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
|
||||
fi
|
||||
molecule --version
|
||||
molecule converge -s ssh_hardening_custom_tests
|
||||
env:
|
||||
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
|
||||
MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
|
||||
working-directory: ansible_collections/devsec/hardening
|
||||
+3
-223
@@ -1,243 +1,22 @@
|
||||
# Changelog
|
||||
|
||||
## [10.2.1](https://github.com/dev-sec/ansible-collection-hardening/tree/10.2.1) (2025-02-08)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.2.0...10.2.1)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Password expiry for users without password should not block SSH key based login [\#681](https://github.com/dev-sec/ansible-collection-hardening/issues/681)
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- os\_hardening & sysctl\_overwrite with host\_vars [\#837](https://github.com/dev-sec/ansible-collection-hardening/issues/837)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Pin runner image to specific version to decouple from GitHub updates [\#847](https://github.com/dev-sec/ansible-collection-hardening/pull/847) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Refactor: combine multiple set\_fact into single jinja filter [\#846](https://github.com/dev-sec/ansible-collection-hardening/pull/846) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Tinyblargon](https://github.com/Tinyblargon))
|
||||
- chore\(deps\): update actions/setup-python digest to 4237552 [\#844](https://github.com/dev-sec/ansible-collection-hardening/pull/844) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.18.2 [\#843](https://github.com/dev-sec/ansible-collection-hardening/pull/843) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency molecule to v25 [\#841](https://github.com/dev-sec/ansible-collection-hardening/pull/841) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint action to v25 [\#840](https://github.com/dev-sec/ansible-collection-hardening/pull/840) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.2.0) (2024-12-23)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.1.0...10.2.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Re-enable OpenBSD tests [\#826](https://github.com/dev-sec/ansible-collection-hardening/issues/826) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
|
||||
- Allow configuring the name\_format variable in auditd config [\#796](https://github.com/dev-sec/ansible-collection-hardening/issues/796) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
|
||||
- Modify PAM to allow SSH key based logins with locked passwords [\#835](https://github.com/dev-sec/ansible-collection-hardening/pull/835) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- adding switch for ForwardAgent in ssh\_config [\#818](https://github.com/dev-sec/ansible-collection-hardening/pull/818) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Shizzlebix](https://github.com/Shizzlebix))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- File system loop detected; ‘/bin/X11’ is part of the same file system loop as ‘/bin’." [\#815](https://github.com/dev-sec/ansible-collection-hardening/issues/815) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
|
||||
- Not working ssh\_hardening on Centos 7 [\#813](https://github.com/dev-sec/ansible-collection-hardening/issues/813) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- chore\(deps\): update dependency molecule-plugins to v23.6.0 [\#834](https://github.com/dev-sec/ansible-collection-hardening/pull/834) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 4ce8e49 [\#832](https://github.com/dev-sec/ansible-collection-hardening/pull/832) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency molecule to v24.12.0 [\#831](https://github.com/dev-sec/ansible-collection-hardening/pull/831) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.18.1 [\#829](https://github.com/dev-sec/ansible-collection-hardening/pull/829) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Change installation source for OpenBSD tests [\#828](https://github.com/dev-sec/ansible-collection-hardening/pull/828) ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 44be233 [\#825](https://github.com/dev-sec/ansible-collection-hardening/pull/825) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Bump ansible-core from 2.17.5 to 2.17.6 [\#820](https://github.com/dev-sec/ansible-collection-hardening/pull/820) ([dependabot[bot]](https://github.com/apps/dependabot))
|
||||
- chore\(deps\): update dependency ansible-core to v2.18.0 [\#819](https://github.com/dev-sec/ansible-collection-hardening/pull/819) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency aar-doc to v2.0.1 [\#817](https://github.com/dev-sec/ansible-collection-hardening/pull/817) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update actions/setup-python digest to 0b93645 [\#814](https://github.com/dev-sec/ansible-collection-hardening/pull/814) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/checkout digest to 11bd719 [\#812](https://github.com/dev-sec/ansible-collection-hardening/pull/812) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.1.0) (2024-10-22)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.0.0...10.1.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Ubuntu 24.04 support [\#764](https://github.com/dev-sec/ansible-collection-hardening/issues/764)
|
||||
- Add variable to set name\_format for auditd [\#810](https://github.com/dev-sec/ansible-collection-hardening/pull/810) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- feat\(ssh\): add alpine support [\#809](https://github.com/dev-sec/ansible-collection-hardening/pull/809) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Provide granular noop for ssh configuration [\#789](https://github.com/dev-sec/ansible-collection-hardening/pull/789) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([seven-beep](https://github.com/seven-beep))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- molecule scenario ssh\_hardening if failing due to missing docker image [\#790](https://github.com/dev-sec/ansible-collection-hardening/issues/790)
|
||||
- getent\_shadow empty [\#787](https://github.com/dev-sec/ansible-collection-hardening/issues/787)
|
||||
- Error: Missing privilege separation directory: /run/sshd [\#752](https://github.com/dev-sec/ansible-collection-hardening/issues/752)
|
||||
- fix\(ssh\_hardening\): test setting kex to false, remove wrong default [\#808](https://github.com/dev-sec/ansible-collection-hardening/pull/808) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Pin python dependencies and optimize GitHub Actions [\#811](https://github.com/dev-sec/ansible-collection-hardening/pull/811) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- fix\(cicd\): test idempotence on ssh custom tests [\#807](https://github.com/dev-sec/ansible-collection-hardening/pull/807) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Document correct quotes for ssh\_permit\_tunnel parameter [\#806](https://github.com/dev-sec/ansible-collection-hardening/pull/806) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([vmpr](https://github.com/vmpr))
|
||||
- fix\(docs\): add 'become: true' to example playbooks. fix \#787 [\#804](https://github.com/dev-sec/ansible-collection-hardening/pull/804) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- chore\(deps\): update dependency ansible-core to v2.17.5 [\#802](https://github.com/dev-sec/ansible-collection-hardening/pull/802) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Don't run tests if the environment is not correct [\#801](https://github.com/dev-sec/ansible-collection-hardening/pull/801) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): update actions/checkout digest to eef6144 [\#800](https://github.com/dev-sec/ansible-collection-hardening/pull/800) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- feat: Corrected package name [\#799](https://github.com/dev-sec/ansible-collection-hardening/pull/799) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([PapaPeskwo](https://github.com/PapaPeskwo))
|
||||
- Use Python venv for VM tests [\#798](https://github.com/dev-sec/ansible-collection-hardening/pull/798) ([schurzi](https://github.com/schurzi))
|
||||
- Remove unused files and variables [\#797](https://github.com/dev-sec/ansible-collection-hardening/pull/797) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 3b5bee1 [\#795](https://github.com/dev-sec/ansible-collection-hardening/pull/795) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 25f783c [\#792](https://github.com/dev-sec/ansible-collection-hardening/pull/792) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.17.4 [\#791](https://github.com/dev-sec/ansible-collection-hardening/pull/791) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/setup-python digest to f677139 [\#788](https://github.com/dev-sec/ansible-collection-hardening/pull/788) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.17.3 [\#786](https://github.com/dev-sec/ansible-collection-hardening/pull/786) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update dependency ansible-core to v2.17.2 [\#756](https://github.com/dev-sec/ansible-collection-hardening/pull/756) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [10.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.0.0) (2024-08-06)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/9.0.1...10.0.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- option to disable regeneration of ssh private key [\#772](https://github.com/dev-sec/ansible-collection-hardening/issues/772)
|
||||
- Support systemd socket activation for sshd [\#763](https://github.com/dev-sec/ansible-collection-hardening/issues/763) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
|
||||
- Release 9.0.2 [\#758](https://github.com/dev-sec/ansible-collection-hardening/issues/758)
|
||||
- Make Publickey authentication configurable [\#750](https://github.com/dev-sec/ansible-collection-hardening/issues/750)
|
||||
- Ansible Linting [\#747](https://github.com/dev-sec/ansible-collection-hardening/issues/747)
|
||||
- Make value of kernel.unprivileged\_userns\_clone depending on kernel version [\#727](https://github.com/dev-sec/ansible-collection-hardening/issues/727)
|
||||
- Ensure that ssh is installed \(cf \#771\) [\#774](https://github.com/dev-sec/ansible-collection-hardening/pull/774) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Byh0ki](https://github.com/Byh0ki))
|
||||
- ssh: explicitly enable or disable the service at boot [\#771](https://github.com/dev-sec/ansible-collection-hardening/pull/771) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Byh0ki](https://github.com/Byh0ki))
|
||||
- disable systemd socket activation [\#769](https://github.com/dev-sec/ansible-collection-hardening/pull/769) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Add ssh\_pubkey\_authentication variable to ssh hardening [\#749](https://github.com/dev-sec/ansible-collection-hardening/pull/749) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([debbabi](https://github.com/debbabi))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- ssh hardening role fails when `ssh_permit_root_login` var is set on ubuntu 24.04 [\#768](https://github.com/dev-sec/ansible-collection-hardening/issues/768)
|
||||
- os\_hardening fails when setting vm.mmap\_rnd\_bits [\#757](https://github.com/dev-sec/ansible-collection-hardening/issues/757)
|
||||
- `ssh_gateway_ports` is documented to accept 'clientspecified' string, but only accepts bools [\#755](https://github.com/dev-sec/ansible-collection-hardening/issues/755)
|
||||
- harden permissions for directory mount /var/log fails for minimized Ubuntu 22.04 [\#741](https://github.com/dev-sec/ansible-collection-hardening/issues/741)
|
||||
- Update Debian compatibility [\#784](https://github.com/dev-sec/ansible-collection-hardening/pull/784) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- do not force type of ssh\_gateway\_ports [\#765](https://github.com/dev-sec/ansible-collection-hardening/pull/765) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Update to current Fedora releases [\#783](https://github.com/dev-sec/ansible-collection-hardening/pull/783) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Remove deprecated rebuild of initrd [\#782](https://github.com/dev-sec/ansible-collection-hardening/pull/782) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): update patrickjahns/version-drafter-action digest to 2076fa4 [\#781](https://github.com/dev-sec/ansible-collection-hardening/pull/781) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update ansible/ansible-lint digest to 95382d3 [\#779](https://github.com/dev-sec/ansible-collection-hardening/pull/779) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- chore\(deps\): update actions/setup-python digest to 39cd149 [\#778](https://github.com/dev-sec/ansible-collection-hardening/pull/778) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- remove tests for FreeBSD12 since it's out of support [\#777](https://github.com/dev-sec/ansible-collection-hardening/pull/777) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- chore\(deps\): pin dependencies [\#776](https://github.com/dev-sec/ansible-collection-hardening/pull/776) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Use best-practice preset for renovate [\#775](https://github.com/dev-sec/ansible-collection-hardening/pull/775) ([schurzi](https://github.com/schurzi))
|
||||
- Deprecate Centos Stream 8 [\#770](https://github.com/dev-sec/ansible-collection-hardening/pull/770) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- centos7 is eol, remove it [\#767](https://github.com/dev-sec/ansible-collection-hardening/pull/767) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- fix spelling [\#766](https://github.com/dev-sec/ansible-collection-hardening/pull/766) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- ci: define permissions for enforce-labels workflow [\#760](https://github.com/dev-sec/ansible-collection-hardening/pull/760) ([fgreinacher](https://github.com/fgreinacher))
|
||||
- Update dependency ansible-core to v2.16.5 [\#754](https://github.com/dev-sec/ansible-collection-hardening/pull/754) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update dependency ansible-core to v2.16.4 [\#751](https://github.com/dev-sec/ansible-collection-hardening/pull/751) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update ansible/ansible-lint action to v24 [\#745](https://github.com/dev-sec/ansible-collection-hardening/pull/745) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Always update Vagrant Boxes before using [\#744](https://github.com/dev-sec/ansible-collection-hardening/pull/744) ([schurzi](https://github.com/schurzi))
|
||||
- Remove Docker containers on self-hosted runner after tests [\#743](https://github.com/dev-sec/ansible-collection-hardening/pull/743) ([schurzi](https://github.com/schurzi))
|
||||
- Update dependency ansible-core to v2.16.3 [\#742](https://github.com/dev-sec/ansible-collection-hardening/pull/742) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
|
||||
## [9.0.1](https://github.com/dev-sec/ansible-collection-hardening/tree/9.0.1) (2024-01-15)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/9.0.0...9.0.1)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Extend ansible-lint testing to cover our test cases [\#731](https://github.com/dev-sec/ansible-collection-hardening/issues/731)
|
||||
- Complete tests for OS hardening [\#660](https://github.com/dev-sec/ansible-collection-hardening/issues/660)
|
||||
- support restarts of audit service on Arch linux [\#722](https://github.com/dev-sec/ansible-collection-hardening/pull/722) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- Fails to install [\#735](https://github.com/dev-sec/ansible-collection-hardening/issues/735)
|
||||
- Amazon Linux gpg check fails [\#734](https://github.com/dev-sec/ansible-collection-hardening/issues/734)
|
||||
- ssh\_hardening ipv6 [\#719](https://github.com/dev-sec/ansible-collection-hardening/issues/719)
|
||||
- boolean variable inconsistency? [\#330](https://github.com/dev-sec/ansible-collection-hardening/issues/330)
|
||||
- Restore idempotency for disabling unused filesystems with Ansible 2.16.0 [\#718](https://github.com/dev-sec/ansible-collection-hardening/pull/718) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([akikanellis](https://github.com/akikanellis))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- 9.0.0 version number in galaxy.yml file is wrong [\#740](https://github.com/dev-sec/ansible-collection-hardening/issues/740)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- restructure readme to move known limitations up top [\#739](https://github.com/dev-sec/ansible-collection-hardening/pull/739) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- release only on releases, not pre-releases [\#738](https://github.com/dev-sec/ansible-collection-hardening/pull/738) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Update dependency ansible-core to v2.16.2 [\#737](https://github.com/dev-sec/ansible-collection-hardening/pull/737) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- fix linting for github config [\#736](https://github.com/dev-sec/ansible-collection-hardening/pull/736) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Update actions/setup-python action to v5 [\#733](https://github.com/dev-sec/ansible-collection-hardening/pull/733) ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- Update ansible-lint action and revise configuration to scan all Ansible code [\#732](https://github.com/dev-sec/ansible-collection-hardening/pull/732) ([schurzi](https://github.com/schurzi))
|
||||
- update labeler to new config format [\#730](https://github.com/dev-sec/ansible-collection-hardening/pull/730) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Update dependency ansible-core to v2.16.1 [\#728](https://github.com/dev-sec/ansible-collection-hardening/pull/728) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- pin Ansible to always let Renovate update to the most current version in our tests [\#721](https://github.com/dev-sec/ansible-collection-hardening/pull/721) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
|
||||
## [9.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/9.0.0) (2023-11-16)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.8.0...9.0.0)
|
||||
|
||||
**Breaking changes:**
|
||||
|
||||
- make it possible to configure more then yes and no for PermitTunnel [\#715](https://github.com/dev-sec/ansible-collection-hardening/pull/715) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- add role argument spec for os, ssh, mysql [\#687](https://github.com/dev-sec/ansible-collection-hardening/pull/687) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Create role documentation with Automated-Ansible-Role-Documentation [\#694](https://github.com/dev-sec/ansible-collection-hardening/issues/694)
|
||||
- Minimize access user paths should be fully configurable [\#689](https://github.com/dev-sec/ansible-collection-hardening/issues/689)
|
||||
- Add support for Debian 12 [\#672](https://github.com/dev-sec/ansible-collection-hardening/issues/672)
|
||||
- add testing and support for current versions of Fedora and FreeBSD [\#709](https://github.com/dev-sec/ansible-collection-hardening/pull/709) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- feat: workflow for roles readme [\#705](https://github.com/dev-sec/ansible-collection-hardening/pull/705) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
|
||||
- do not try to drop roles in mysql hardening [\#649](https://github.com/dev-sec/ansible-collection-hardening/pull/649) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- nginx conf.d directory is missing on Rocky Linux 8 [\#707](https://github.com/dev-sec/ansible-collection-hardening/issues/707)
|
||||
- Default value of `ssh_client_alive_interval` is inconsistent with what documentation says [\#701](https://github.com/dev-sec/ansible-collection-hardening/issues/701)
|
||||
- \[devsec.hardening.os\_hardening : restart-auditd\] fails [\#698](https://github.com/dev-sec/ansible-collection-hardening/issues/698)
|
||||
- sshd\_hardening role cannot be used to build system images [\#697](https://github.com/dev-sec/ansible-collection-hardening/issues/697)
|
||||
- Error: No file was found when using first\_found on Ubuntu 20.04 [\#676](https://github.com/dev-sec/ansible-collection-hardening/issues/676)
|
||||
- PUBLIC-role breaks mysql-hardening [\#648](https://github.com/dev-sec/ansible-collection-hardening/issues/648)
|
||||
- Error deploying the playbook [\#630](https://github.com/dev-sec/ansible-collection-hardening/issues/630)
|
||||
- Gather facts when os\_hardening role is executed with tags [\#708](https://github.com/dev-sec/ansible-collection-hardening/pull/708) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- Add send-to-mailinglist to github release action [\#434](https://github.com/dev-sec/ansible-collection-hardening/issues/434)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- update status badges in README [\#714](https://github.com/dev-sec/ansible-collection-hardening/pull/714) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- fix CI test for os\_hardening [\#711](https://github.com/dev-sec/ansible-collection-hardening/pull/711) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- fix nginx CI tests [\#710](https://github.com/dev-sec/ansible-collection-hardening/pull/710) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- fix: roles-readme action default value [\#706](https://github.com/dev-sec/ansible-collection-hardening/pull/706) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
|
||||
- fix some wrong defaults and types in the readmes [\#703](https://github.com/dev-sec/ansible-collection-hardening/pull/703) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- update links to new Ansible Galaxy [\#702](https://github.com/dev-sec/ansible-collection-hardening/pull/702) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Fix typo in login.defs.j2 [\#700](https://github.com/dev-sec/ansible-collection-hardening/pull/700) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))
|
||||
- chore\(deps\): update actions/checkout action to v4 [\#696](https://github.com/dev-sec/ansible-collection-hardening/pull/696) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
|
||||
- test debian12 on VM [\#695](https://github.com/dev-sec/ansible-collection-hardening/pull/695) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- fix descriptions in readme [\#693](https://github.com/dev-sec/ansible-collection-hardening/pull/693) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- feat: customize user paths default [\#692](https://github.com/dev-sec/ansible-collection-hardening/pull/692) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([S0obi](https://github.com/S0obi))
|
||||
- disable PAM tests [\#691](https://github.com/dev-sec/ansible-collection-hardening/pull/691) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [8.8.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.8.0) (2023-08-04)
|
||||
## [8.8.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.8.0) (2023-06-20)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.7.0...8.8.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Add support for Fedora 38 [\#671](https://github.com/dev-sec/ansible-collection-hardening/issues/671)
|
||||
- auditd: add possibility to override config template [\#685](https://github.com/dev-sec/ansible-collection-hardening/pull/685) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Meecr0b](https://github.com/Meecr0b))
|
||||
- add debian 12 support [\#684](https://github.com/dev-sec/ansible-collection-hardening/pull/684) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- feat: explicitly support Fedora 37 and 38 [\#682](https://github.com/dev-sec/ansible-collection-hardening/pull/682) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([nejch](https://github.com/nejch))
|
||||
- Replace ssh\_keys group with root, where applicable and use less permissive file mode [\#677](https://github.com/dev-sec/ansible-collection-hardening/pull/677) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Add oddjob mkhomedir option rhel pam [\#675](https://github.com/dev-sec/ansible-collection-hardening/pull/675) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([imp1sh](https://github.com/imp1sh))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- How does one set `sshd_authenticationmethods` to include password authentication? [\#686](https://github.com/dev-sec/ansible-collection-hardening/issues/686)
|
||||
- FreeIPA environment mkhomedir fails [\#664](https://github.com/dev-sec/ansible-collection-hardening/issues/664)
|
||||
- Error: No file was found when using first\_found on Ubuntu 20.04 [\#676](https://github.com/dev-sec/ansible-collection-hardening/issues/676)
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- What is the uscase of sysctl\_overwrite over ansible.posix.sysctl? [\#683](https://github.com/dev-sec/ansible-collection-hardening/issues/683)
|
||||
- `Ensure permissions on mysql-logfile are correct` chokes when `log_error` is set to `stderr` [\#673](https://github.com/dev-sec/ansible-collection-hardening/issues/673)
|
||||
- TASK TASK FAILED: \[devsec.hardening.os\_hardening : Set password ageing for existing regular \(non-system, non-root\) accounts\] [\#670](https://github.com/dev-sec/ansible-collection-hardening/issues/670)
|
||||
- After os\_hardening ssh not working [\#663](https://github.com/dev-sec/ansible-collection-hardening/issues/663)
|
||||
@@ -272,6 +51,7 @@
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- Dependency Dashboard [\#655](https://github.com/dev-sec/ansible-collection-hardening/issues/655)
|
||||
- Invalid login.defs for RHEL6 [\#651](https://github.com/dev-sec/ansible-collection-hardening/issues/651)
|
||||
- Deprecation warnings for os\_hardening [\#638](https://github.com/dev-sec/ansible-collection-hardening/issues/638)
|
||||
- Write tests for MySQL user-deletion [\#445](https://github.com/dev-sec/ansible-collection-hardening/issues/445)
|
||||
|
||||
@@ -93,21 +93,6 @@ We generally include test for coding guidelines:
|
||||
|
||||
Remember: Code is generally read much more often than written.
|
||||
|
||||
### Local testing of roles in this collection
|
||||
|
||||
We are using Molecule to test our roles.
|
||||
If you want to execute the tests on your machine you need Docker and Molecule.
|
||||
You will also need to set the `MOLECULE_DISTRO` environment variable to execute the tests.
|
||||
To find valid values for the variable you can take a look at our GitHub Action workflows in `.github/workflows/`.
|
||||
|
||||
Example for executing tests locally:
|
||||
|
||||
```bash
|
||||
pip install -r requirements.txt
|
||||
export MOLECULE_DISTRO="debian12"
|
||||
molecule test -s os_hardening
|
||||
```
|
||||
|
||||
### Use Markdown
|
||||
|
||||
Wherever possible, please refrain from any other formats and stick to simple markdown.
|
||||
@@ -1,25 +1,23 @@
|
||||
# Ansible Collection - devsec.hardening
|
||||
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml)
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Description
|
||||
|
||||
This collection provides battle tested hardening for:
|
||||
|
||||
- Linux operating systems:
|
||||
- CentOS 9
|
||||
- CentOS 7/8/9
|
||||
- Rocky Linux 8/9
|
||||
- Debian 11/12
|
||||
- Ubuntu 20.04/22.04/24.04
|
||||
- Debian 10/11/12
|
||||
- Ubuntu 18.04/20.04/22.04
|
||||
- Amazon Linux (some roles supported)
|
||||
- Arch Linux (some roles supported)
|
||||
- Fedora 39/40 (some roles supported)
|
||||
- Fedora 37/38 (some roles supported)
|
||||
- Suse Tumbleweed (some roles supported)
|
||||
- MySQL
|
||||
- MariaDB >= 5.5.65, >= 10.1.45, >= 10.3.17
|
||||
|
||||
+1
-4
@@ -1,6 +1,6 @@
|
||||
namespace: devsec
|
||||
name: hardening
|
||||
version: 10.2.0
|
||||
version: 8.7.0
|
||||
readme: README.md
|
||||
authors:
|
||||
- dev-sec <[email protected]>
|
||||
@@ -22,9 +22,6 @@ tags:
|
||||
- nginx_hardening
|
||||
- os_hardening
|
||||
- ssh_hardening
|
||||
- database
|
||||
- linux
|
||||
- security
|
||||
dependencies:
|
||||
ansible.posix: '>=1.0.0'
|
||||
community.crypto: '>=1.0.0'
|
||||
|
||||
@@ -1,37 +1,38 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-mysql-hardening"
|
||||
- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
|
||||
hosts: all
|
||||
become: true
|
||||
collections:
|
||||
- devsec.hardening
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
|
||||
ansible.builtin.set_fact:
|
||||
mysql_python_package_debian: python3-pymysql
|
||||
set_fact:
|
||||
mysql_python_package_debian: "python3-pymysql"
|
||||
when:
|
||||
- mysql_python_package_debian is not defined
|
||||
- ansible_distribution == "Ubuntu"
|
||||
- ansible_distribution_major_version|int > 19
|
||||
|
||||
- name: Determine required MySQL Python libraries.
|
||||
ansible.builtin.set_fact:
|
||||
mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
|
||||
set_fact:
|
||||
mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
|
||||
when:
|
||||
- mysql_python_package_debian is not defined
|
||||
- ansible_distribution != "Ubuntu"
|
||||
- ansible_distribution_major_version|int < 20
|
||||
|
||||
- name: Use Python 3 on Suse
|
||||
ansible.builtin.set_fact:
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when:
|
||||
- ansible_os_family == 'Suse'
|
||||
|
||||
- name: Include mysql_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.mysql_hardening
|
||||
- include_role:
|
||||
name: mysql_hardening
|
||||
vars:
|
||||
overwrite_global_mycnf: false
|
||||
mysql_root_password: iloverandompasswordsbutthiswilldo
|
||||
|
||||
@@ -8,7 +8,7 @@ driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: instance
|
||||
image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
|
||||
image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
||||
@@ -33,7 +33,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -49,7 +48,6 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
|
||||
@@ -1,74 +1,80 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-mysql-hardening"
|
||||
|
||||
- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
vars:
|
||||
overwrite_global_mycnf: false
|
||||
mysql_root_password: iloverandompasswordsbutthiswilldo
|
||||
mysql_user_password: iloverandompasswordsbutthiswilldo
|
||||
mysql_config_file: /etc/mysql/mariadb.cnf
|
||||
mysql_root_password_update: true
|
||||
tasks:
|
||||
- name: Use Python 3 on Debian 11
|
||||
ansible.builtin.set_fact:
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when:
|
||||
- ansible_distribution == 'Debian'
|
||||
- ansible_distribution_major_version|int >= 11
|
||||
|
||||
- name: Use Python 3 on Suse
|
||||
ansible.builtin.set_fact:
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when:
|
||||
- ansible_os_family == 'Suse'
|
||||
|
||||
- name: Use Python 2 on Debian 10
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python
|
||||
when:
|
||||
- ansible_distribution == 'Debian'
|
||||
- ansible_distribution_major_version|int == 10
|
||||
|
||||
- name: Run the equivalent of "apt-get update && apt-get upgrade"
|
||||
ansible.builtin.apt:
|
||||
upgrade: safe
|
||||
apt:
|
||||
name: "*"
|
||||
state: latest
|
||||
update_cache: true
|
||||
when: ansible_os_family == 'Debian'
|
||||
|
||||
- name: Install required python packages on Suse
|
||||
ansible.builtin.command: zypper -n install python311-rpm python311-PyMySQL
|
||||
changed_when: false
|
||||
ansible.builtin.shell: zypper -n install python-xml python3-rpm python3-PyMySQL
|
||||
when: ansible_os_family == 'Suse'
|
||||
|
||||
- name: Create missing directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/mysql
|
||||
- name: create missing directory
|
||||
file:
|
||||
path: "/etc/mysql/conf.d"
|
||||
state: directory
|
||||
mode: "0755"
|
||||
|
||||
- name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
|
||||
ansible.builtin.set_fact:
|
||||
mysql_python_package_debian: python3-pymysql
|
||||
set_fact:
|
||||
mysql_python_package_debian: "python3-pymysql"
|
||||
when:
|
||||
- mysql_python_package_debian is not defined
|
||||
- ansible_distribution == "Ubuntu"
|
||||
- ansible_distribution_major_version|int > 19
|
||||
|
||||
- name: Determine required MySQL Python libraries.
|
||||
ansible.builtin.set_fact:
|
||||
mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
|
||||
set_fact:
|
||||
mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
|
||||
when:
|
||||
- mysql_python_package_debian is not defined
|
||||
- ansible_distribution != "Ubuntu"
|
||||
- ansible_distribution_major_version|int < 20
|
||||
|
||||
- name: Install required MySQL Python libraries on RHEL
|
||||
ansible.builtin.dnf:
|
||||
name: "{% if 'python3' in ansible_python_interpreter | default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
|
||||
yum:
|
||||
name: "{% if 'python3' in ansible_python_interpreter|default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
|
||||
when:
|
||||
- ansible_os_family == "RedHat"
|
||||
- ansible_distribution_major_version == "7"
|
||||
|
||||
- name: Install mysql with a generic Ansible role
|
||||
ansible.builtin.include_role:
|
||||
- include_role:
|
||||
name: dev-sec.mysql
|
||||
|
||||
- name: Include MySQL user prepare tasks
|
||||
ansible.builtin.include_tasks: prepare_tasks/mysql_users.yml
|
||||
- name: include MySQL user prepare tasks
|
||||
include_tasks: prepare_tasks/mysql_users.yml
|
||||
vars:
|
||||
overwrite_global_mycnf: false
|
||||
mysql_root_password: iloverandompasswordsbutthiswilldo
|
||||
mysql_user_password: iloverandompasswordsbutthiswilldo
|
||||
mysql_config_file: /etc/mysql/mariadb.cnf
|
||||
mysql_root_password_update: true
|
||||
@@ -1,32 +1,15 @@
|
||||
---
|
||||
- name: Create users for test
|
||||
- name: create users for test
|
||||
community.mysql.mysql_query:
|
||||
query:
|
||||
- CREATE USER 'user'@'delete';
|
||||
- CREATE USER 'user'@'127.0.0.1';
|
||||
- CREATE USER 'user'@'::1';
|
||||
- CREATE USER 'user'@'%';
|
||||
- CREATE USER 'user'@'192.168.0.%';
|
||||
- CREATE USER 'user'@'192.168.0.1';
|
||||
- CREATE USER '%'@'192.168.0.1';
|
||||
- CREATE USER 'user'@'192.168.0.2' IDENTIFIED BY 'keep';
|
||||
- CREATE USER 'user'@'keep' IDENTIFIED BY 'keep';
|
||||
- CREATE USER 'user'@'192.168.%' IDENTIFIED BY 'keep';
|
||||
- "CREATE USER 'user'@'delete';"
|
||||
- "CREATE USER 'user'@'127.0.0.1';"
|
||||
- "CREATE USER 'user'@'::1';"
|
||||
- "CREATE USER 'user'@'%';"
|
||||
- "CREATE USER 'user'@'192.168.0.%';"
|
||||
- "CREATE USER 'user'@'192.168.0.1';"
|
||||
- "CREATE USER '%'@'192.168.0.1';"
|
||||
- "CREATE USER 'user'@'192.168.0.2' IDENTIFIED BY 'keep';"
|
||||
- "CREATE USER 'user'@'keep' IDENTIFIED BY 'keep';"
|
||||
- "CREATE USER 'user'@'192.168.%' IDENTIFIED BY 'keep';"
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
|
||||
- name: Detect role support on MySQL
|
||||
community.mysql.mysql_query:
|
||||
query: >
|
||||
SELECT 1 FROM information_schema.COLUMNS
|
||||
WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
|
||||
AND COLUMN_NAME = 'is_role';
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_role_support
|
||||
|
||||
- name: Create roles for test
|
||||
community.mysql.mysql_query:
|
||||
query:
|
||||
- CREATE ROLE 'role_keep';
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
when:
|
||||
- mysql_role_support.rowcount[0] > 0
|
||||
@@ -8,23 +8,23 @@
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Use Python 3 on Suse
|
||||
ansible.builtin.set_fact:
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when:
|
||||
- ansible_os_family == 'Suse'
|
||||
|
||||
- name: Install procps for debian systems
|
||||
ansible.builtin.apt:
|
||||
- name: install procps for debian systems
|
||||
apt:
|
||||
name: procps
|
||||
state: present
|
||||
update_cache: true
|
||||
when: ansible_distribution == 'Debian'
|
||||
|
||||
- name: Include tests for the service
|
||||
ansible.builtin.include_tasks: verify_tasks/service.yml
|
||||
- name: include tests for the service
|
||||
include_tasks: verify_tasks/service.yml
|
||||
|
||||
- name: Include tests for MySQL user
|
||||
ansible.builtin.include_tasks: verify_tasks/mysql_users.yml
|
||||
- name: include tests for MySQL user
|
||||
include_tasks: verify_tasks/mysql_users.yml
|
||||
|
||||
- name: Verify
|
||||
hosts: localhost
|
||||
@@ -34,7 +34,7 @@
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Execute cinc-auditor tests
|
||||
ansible.builtin.command: >
|
||||
command: >
|
||||
docker run
|
||||
--volume /run/docker.sock:/run/docker.sock
|
||||
docker.io/cincproject/auditor exec
|
||||
@@ -46,10 +46,10 @@
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display details about the cinc-auditor results
|
||||
ansible.builtin.debug:
|
||||
debug:
|
||||
msg: "{{ test_results.stdout_lines }}"
|
||||
|
||||
- name: Fail when tests fail
|
||||
ansible.builtin.fail:
|
||||
msg: Inspec failed to validate
|
||||
fail:
|
||||
msg: "Inspec failed to validate"
|
||||
when: test_results.rc != 0
|
||||
@@ -6,11 +6,11 @@
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_users
|
||||
|
||||
- name: Create list of users from mysql query
|
||||
ansible.builtin.set_fact:
|
||||
- name: create list of users from mysql query
|
||||
set_fact:
|
||||
mysql_users_list: "{{ mysql_users.query_result.0 | json_query('[*].users') | list }}"
|
||||
|
||||
- name: Assert that only accounts with password remain
|
||||
- name: assert that only accounts with password remain
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- '"user@delete" not in mysql_users_list'
|
||||
@@ -23,19 +23,3 @@
|
||||
- '"[email protected]" in mysql_users_list'
|
||||
- '"user@keep" in mysql_users_list'
|
||||
- '"[email protected].%" in mysql_users_list'
|
||||
|
||||
- name: Detect role support on MySQL
|
||||
community.mysql.mysql_query:
|
||||
query: >
|
||||
SELECT 1 FROM information_schema.COLUMNS
|
||||
WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
|
||||
AND COLUMN_NAME = 'is_role';
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_role_support
|
||||
|
||||
- name: Assert that roles remain
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- '"role_keep@" in mysql_users_list'
|
||||
when:
|
||||
- mysql_role_support.rowcount[0] > 0
|
||||
@@ -10,7 +10,7 @@
|
||||
ansible.builtin.service_facts:
|
||||
|
||||
- name: Check if MySQL is running and enabled
|
||||
ansible.builtin.assert:
|
||||
assert:
|
||||
that:
|
||||
- ansible_facts.services[mysql_daemon + '.service'].state == 'running'
|
||||
- ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'
|
||||
- "ansible_facts.services[mysql_daemon + '.service'].state == 'running'"
|
||||
- "ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'"
|
||||
@@ -1,15 +1,16 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
become: true
|
||||
hosts: all
|
||||
collections:
|
||||
- devsec.hardening
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
vars:
|
||||
nginx_ppa_use: true
|
||||
nginx_ppa_version: stable
|
||||
- nginx_ppa_use: true
|
||||
- nginx_ppa_version: stable
|
||||
tasks:
|
||||
- name: Include nginx_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.nginx_hardening
|
||||
- include_role:
|
||||
name: nginx_hardening
|
||||
@@ -7,7 +7,7 @@ driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: instance
|
||||
image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
|
||||
image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
||||
@@ -32,7 +32,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -48,7 +47,6 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
hosts: localhost
|
||||
vars:
|
||||
nginx_main_template_enable: true
|
||||
nginx_main_template:
|
||||
- nginx_main_template_enable: true
|
||||
- nginx_main_template:
|
||||
template_file: nginx.conf.j2
|
||||
conf_file_name: nginx.conf
|
||||
conf_file_location: /etc/nginx/
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
hosts: localhost
|
||||
roles:
|
||||
- nginxinc.nginx
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
- name: prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
|
||||
become: true
|
||||
hosts: all
|
||||
environment:
|
||||
@@ -7,17 +7,22 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Install required packages
|
||||
ansible.builtin.package:
|
||||
name: python3-apt
|
||||
- name: install required tools on SuSE
|
||||
community.general.zypper:
|
||||
name: "python-xml"
|
||||
state: present
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: install required packages
|
||||
package:
|
||||
name: "python3-apt"
|
||||
update_cache: true
|
||||
ignore_errors: true # noqa ignore-errors
|
||||
|
||||
- name: Set correct distribution Version for Amazon Linux
|
||||
ansible.builtin.set_fact:
|
||||
set_fact:
|
||||
ansible_distribution_major_version: 7
|
||||
when: ansible_distribution == 'Amazon'
|
||||
|
||||
- name: Install nginx with a generic Ansible role
|
||||
ansible.builtin.include_role:
|
||||
- include_role:
|
||||
name: geerlingguy.nginx
|
||||
@@ -1,3 +1,3 @@
|
||||
---
|
||||
roles:
|
||||
- name: geerlingguy.nginx
|
||||
- geerlingguy.nginx
|
||||
@@ -7,8 +7,8 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Install procps for debian systems
|
||||
ansible.builtin.apt:
|
||||
- name: install procps for debian systems
|
||||
apt:
|
||||
name: procps
|
||||
state: present
|
||||
update_cache: true
|
||||
@@ -22,7 +22,7 @@
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Execute cinc-auditor tests
|
||||
ansible.builtin.command: >
|
||||
command: >
|
||||
docker run
|
||||
--volume /run/docker.sock:/run/docker.sock
|
||||
docker.io/cincproject/auditor exec
|
||||
@@ -34,10 +34,10 @@
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display details about the cinc-auditor results
|
||||
ansible.builtin.debug:
|
||||
debug:
|
||||
msg: "{{ test_results.stdout_lines }}"
|
||||
|
||||
- name: Fail when tests fail
|
||||
ansible.builtin.fail:
|
||||
msg: Inspec failed to validate
|
||||
fail:
|
||||
msg: "Inspec failed to validate"
|
||||
when: test_results.rc != 0
|
||||
@@ -1,36 +1,38 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
collections:
|
||||
- devsec.hardening
|
||||
tasks:
|
||||
- name: Workaround for https://github.com/ansible/ansible/issues/66304
|
||||
ansible.builtin.set_fact:
|
||||
ansible_virtualization_type: docker
|
||||
- name: Include os_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.os_hardening
|
||||
- name: workaround for https://github.com/ansible/ansible/issues/66304
|
||||
set_fact:
|
||||
ansible_virtualization_type: "docker"
|
||||
- include_role:
|
||||
name: os_hardening
|
||||
vars:
|
||||
os_security_users_allow: change_user
|
||||
os_security_kernel_enable_core_dump: false
|
||||
os_auditd_enabled: false
|
||||
os_auditd_num_logs: 10
|
||||
os_security_suid_sgid_remove_from_unknown: true
|
||||
os_auth_pam_passwdqc_enable: false
|
||||
os_auth_lockout_time: 15
|
||||
os_env_extra_user_paths: [/home]
|
||||
os_desktop_enable: true
|
||||
os_env_extra_user_paths: ['/home']
|
||||
os_auth_allow_homeless: true
|
||||
os_security_suid_sgid_blacklist: [/bin/umount]
|
||||
os_security_suid_sgid_whitelist: [/usr/bin/rlogin]
|
||||
os_security_suid_sgid_blacklist: ['/bin/umount']
|
||||
os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
|
||||
os_filesystem_whitelist: []
|
||||
os_yum_repo_file_whitelist: [foo.repo]
|
||||
os_users_without_password_ageing: [pw_no_ageing]
|
||||
os_yum_repo_file_whitelist: ['foo.repo']
|
||||
os_users_without_password_ageing: ['pw_no_ageing']
|
||||
os_auth_pw_warn_age: 7
|
||||
os_netrc_enabled: false
|
||||
os_ignore_users: [shell_sys_acc]
|
||||
os_ignore_home_folder_users: [user_with_777_home]
|
||||
os_ignore_users: ["shell_sys_acc"]
|
||||
os_ignore_home_folder_users: ["user_with_777_home"]
|
||||
sysctl_config:
|
||||
net.ipv4.ip_forward: 0
|
||||
net.ipv6.conf.all.forwarding: 0
|
||||
@@ -71,6 +73,8 @@
|
||||
# - name: wrapper playbook for kitchen testing "ansible-os-hardening"
|
||||
# hosts: all
|
||||
# become: true
|
||||
# collections:
|
||||
# - devsec.hardening
|
||||
# vars:
|
||||
# os_auditd_enabled: false
|
||||
# tasks:
|
||||
@@ -80,9 +84,9 @@
|
||||
# when: ansible_facts.distribution == 'Fedora'
|
||||
#
|
||||
# - name: Run the equivalent of "apt-get update" as a separate step
|
||||
# ansible.builtin.apt:
|
||||
# apt:
|
||||
# update_cache: yes
|
||||
# when: ansible_facts.os_family == 'Debian'
|
||||
#
|
||||
# - include_role:
|
||||
# name: devsec.hardening.os_hardening
|
||||
# name: os_hardening
|
||||
@@ -3,7 +3,7 @@ driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: instance
|
||||
image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
|
||||
image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
||||
@@ -28,7 +28,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -44,7 +43,6 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
@@ -7,32 +7,32 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Set ansible_python_interpreter to "/usr/bin/python3" on fedora
|
||||
ansible.builtin.set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
- name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
|
||||
set_fact:
|
||||
ansible_python_interpreter: "/usr/bin/python3"
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Run the equivalent of "apt-get update && apt-get upgrade"
|
||||
ansible.builtin.apt:
|
||||
upgrade: safe
|
||||
apt:
|
||||
name: "*"
|
||||
state: latest
|
||||
update_cache: true
|
||||
when: ansible_os_family == 'Debian'
|
||||
|
||||
- name: Install required tools on SuSE
|
||||
- name: install required tools on SuSE
|
||||
# cannot use zypper module, since it depends on python-xml
|
||||
ansible.builtin.command: zypper -n install awk
|
||||
changed_when: false
|
||||
shell: "zypper -n install python-xml"
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Install required tools on fedora
|
||||
ansible.builtin.dnf:
|
||||
- name: install required tools on fedora
|
||||
dnf:
|
||||
name:
|
||||
- python
|
||||
- findutils
|
||||
- procps-ng
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Install required tools on Arch
|
||||
- name: install required tools on Arch
|
||||
community.general.pacman:
|
||||
name:
|
||||
- awk
|
||||
@@ -40,8 +40,8 @@
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Archlinux'
|
||||
|
||||
- name: Install required tools on RHEL # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
- name: install required tools on RHEL # noqa ignore-errors
|
||||
yum:
|
||||
name:
|
||||
- openssh-clients
|
||||
- openssh
|
||||
@@ -49,15 +49,15 @@
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Create recursing symlink to test minimize access
|
||||
ansible.builtin.shell: rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz
|
||||
- name: create recursing symlink to test minimize access
|
||||
shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
|
||||
changed_when: false
|
||||
|
||||
- name: Include YUM prepare tasks
|
||||
ansible.builtin.include_tasks: prepare_tasks/yum.yml
|
||||
- name: include YUM prepare tasks
|
||||
include_tasks: prepare_tasks/yum.yml
|
||||
when: ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Include preparation tasks
|
||||
- name: include preparation tasks
|
||||
ansible.builtin.include_tasks:
|
||||
file: "{{ item }}"
|
||||
loop:
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
- name: Create user whose home-folder should not be touched
|
||||
ansible.builtin.user:
|
||||
name: user_with_777_home
|
||||
name: "user_with_777_home"
|
||||
|
||||
- name: Change mode of home-folder for user to 777
|
||||
ansible.builtin.file:
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
---
|
||||
- name: create '.netrc' in /root
|
||||
ansible.builtin.copy:
|
||||
dest: /root/.netrc
|
||||
mode: "0600"
|
||||
dest: '/root/.netrc'
|
||||
mode: '0600'
|
||||
content: |
|
||||
machine localhost
|
||||
login root
|
||||
|
||||
@@ -1,10 +1,9 @@
|
||||
---
|
||||
- name: Create user those password ageing should not be changed
|
||||
user:
|
||||
name: pw_no_ageing
|
||||
password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
|
||||
name: "pw_no_ageing"
|
||||
password: "$6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1"
|
||||
|
||||
- name: Create user those password ageing should be changed
|
||||
user:
|
||||
name: pw_ageing
|
||||
password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
|
||||
name: "pw_ageing"
|
||||
password: "$6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1"
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Create system user with shell that should keep it
|
||||
user:
|
||||
name: shell_sys_acc
|
||||
shell: /bin/bash
|
||||
name: "shell_sys_acc"
|
||||
shell: "/bin/bash"
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Create 'foo' repository
|
||||
- name: create 'foo' repository
|
||||
ansible.builtin.yum_repository:
|
||||
name: foo
|
||||
description: mandatory description
|
||||
@@ -7,7 +7,7 @@
|
||||
enabled: false
|
||||
gpgcheck: false
|
||||
|
||||
- name: Create 'bar' repository
|
||||
- name: create 'bar' repository
|
||||
ansible.builtin.yum_repository:
|
||||
name: bar
|
||||
description: mandatory description
|
||||
|
||||
@@ -7,12 +7,11 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Set ansible_python_interpreter to "/usr/bin/python3"
|
||||
ansible.builtin.set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
- name: set ansible_python_interpreter to "/usr/bin/python3"
|
||||
set_fact:
|
||||
ansible_python_interpreter: "/usr/bin/python3"
|
||||
|
||||
- name: Include verification tasks
|
||||
- name: include verification tasks
|
||||
ansible.builtin.include_tasks:
|
||||
file: "{{ item }}"
|
||||
loop:
|
||||
@@ -20,15 +19,13 @@
|
||||
- verify_tasks/pw_ageing.yml
|
||||
- verify_tasks/netrc.yml
|
||||
- verify_tasks/ignore_home_folders.yml
|
||||
- verify_tasks/ssh_auth_locked.yml
|
||||
|
||||
# temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
|
||||
# - name: Include PAM tests
|
||||
# ansible.builtin.include_tasks: verify_tasks/pam.yml
|
||||
# when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
|
||||
- name: include PAM tests
|
||||
include_tasks: verify_tasks/pam.yml
|
||||
when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Include YUM tests
|
||||
ansible.builtin.include_tasks: verify_tasks/yum.yml
|
||||
- name: include YUM tests
|
||||
include_tasks: verify_tasks/yum.yml
|
||||
when: ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Verify
|
||||
@@ -39,7 +36,7 @@
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Execute cinc-auditor tests
|
||||
ansible.builtin.command: >
|
||||
command: >
|
||||
docker run
|
||||
--volume /run/docker.sock:/run/docker.sock
|
||||
--volume {{ playbook_dir }}/waivers.yaml:/waivers.yaml
|
||||
@@ -53,12 +50,12 @@
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display details about the cinc-auditor results
|
||||
ansible.builtin.debug:
|
||||
debug:
|
||||
msg: "{{ test_results.stdout_lines }}"
|
||||
|
||||
- name: Fail when tests fail
|
||||
ansible.builtin.fail:
|
||||
msg: Inspec failed to validate
|
||||
fail:
|
||||
msg: "Inspec failed to validate"
|
||||
when: test_results.rc != 0
|
||||
|
||||
- name: Verify
|
||||
@@ -68,20 +65,19 @@
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
vars:
|
||||
os_auditd_enabled: false
|
||||
os_env_umask: "027 #override"
|
||||
collections:
|
||||
- devsec.hardening
|
||||
tasks:
|
||||
# test if variable can be overridden
|
||||
- name: Workaround for https://github.com/ansible/ansible/issues/66304
|
||||
ansible.builtin.set_fact:
|
||||
ansible_virtualization_type: docker
|
||||
- name: workaround for https://github.com/ansible/ansible/issues/66304
|
||||
set_fact:
|
||||
ansible_virtualization_type: "docker"
|
||||
os_env_umask: "027 #override"
|
||||
|
||||
- name: Include os_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.os_hardening
|
||||
- include_role:
|
||||
name: os_hardening
|
||||
|
||||
- name: Verify os_env_umask
|
||||
ansible.builtin.command:
|
||||
- name: verify os_env_umask
|
||||
shell:
|
||||
cmd: "grep '027 #override' /etc/login.defs"
|
||||
changed_when: false
|
||||
@@ -1,19 +1,19 @@
|
||||
---
|
||||
- name: Test that .netrc in root homedir exists
|
||||
- name: test that .netrc in root homedir exists
|
||||
ansible.builtin.file:
|
||||
path: /root/.netrc
|
||||
path: '/root/.netrc'
|
||||
state: file
|
||||
register: result_test_netrc
|
||||
|
||||
- name: Output result if .netrc for user root exists
|
||||
- name: output result if .netrc for user root exists
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- result_test_netrc.state == 'file'
|
||||
fail_msg: .netrc in /root/ not present
|
||||
success_msg: .netrc exists in /root/
|
||||
- "result_test_netrc.state == 'file'"
|
||||
fail_msg: ".netrc in /root/ not present"
|
||||
success_msg: ".netrc exists in /root/"
|
||||
|
||||
- name: Delete '.netrc' in /root
|
||||
- name: delete '.netrc' in /root
|
||||
ansible.builtin.file:
|
||||
path: /root/.netrc
|
||||
path: '/root/.netrc'
|
||||
state: absent
|
||||
when: result_test_netrc.state == 'file'
|
||||
@@ -1,4 +1,5 @@
|
||||
---
|
||||
|
||||
- name: install pip
|
||||
package:
|
||||
name:
|
||||
@@ -13,12 +14,12 @@
|
||||
executable: /usr/bin/pip3
|
||||
|
||||
- name: set password for test
|
||||
ansible.builtin.set_fact:
|
||||
test_pw: myTest!pw
|
||||
set_fact:
|
||||
test_pw: "myTest!pw"
|
||||
|
||||
- name: set locale for test
|
||||
ansible.builtin.set_fact:
|
||||
locale: en_US.UTF-8
|
||||
set_fact:
|
||||
locale: "en_US.UTF-8"
|
||||
when:
|
||||
- ansible_facts.os_family == 'RedHat'
|
||||
- ansible_facts.distribution_major_version < '8'
|
||||
@@ -29,16 +30,16 @@
|
||||
password: "{{ test_pw | password_hash('sha512') }}"
|
||||
|
||||
- name: check successful login with correct password
|
||||
ansible.builtin.shell:
|
||||
cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
|
||||
shell:
|
||||
cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
LANG: "{{ locale | default('C.UTF-8') }}"
|
||||
|
||||
- name: check unsuccessful login with incorrect password
|
||||
ansible.builtin.shell:
|
||||
cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail
|
||||
shell:
|
||||
cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
@@ -46,8 +47,8 @@
|
||||
with_sequence: count=6
|
||||
|
||||
- name: check unsuccessful login, with correct password (lockout)
|
||||
ansible.builtin.shell:
|
||||
cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail
|
||||
shell:
|
||||
cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
@@ -58,8 +59,8 @@
|
||||
seconds: 20
|
||||
|
||||
- name: check successful login
|
||||
ansible.builtin.shell:
|
||||
cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
|
||||
shell:
|
||||
cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
- name: Check that the expiry date of pw_no_ageing is "never"
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- expiry_date.stdout | trim == 'never'
|
||||
- "expiry_date.stdout | trim == 'never'"
|
||||
|
||||
- name: Get Password Expiry date for pw_ageing
|
||||
ansible.builtin.shell: chage -l pw_ageing | grep "Password expires" | cut -d ":" -f 2
|
||||
@@ -19,7 +19,7 @@
|
||||
# this uses the date from the expire_date variable and subtracts the current date.
|
||||
# it should be bigger that the password_expire_min of the user "pw_no_ageing"
|
||||
that:
|
||||
- ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_date_time.date | to_datetime('%Y-%m-%d')).days == 60
|
||||
- "{{ ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_date_time.date | to_datetime('%Y-%m-%d')).days }} == 60"
|
||||
|
||||
- name: Get Password Expiry warning days for pw_ageing
|
||||
ansible.builtin.shell: chage -l pw_ageing | grep "warning before password expires" | cut -d ":" -f 2
|
||||
@@ -29,4 +29,4 @@
|
||||
- name: Check that number of days of warning before password expires is 7 days
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- expiry_warndays.stdout | trim == '7'
|
||||
- "expiry_warndays.stdout | trim == '7'"
|
||||
@@ -1,90 +0,0 @@
|
||||
---
|
||||
- name: Install tools
|
||||
package:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
ignore_errors: true
|
||||
loop:
|
||||
- sshpass
|
||||
- openssh
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
|
||||
- name: Allow password Login for sshd
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
search_string: PasswordAuthentication no
|
||||
line: PasswordAuthentication yes
|
||||
when:
|
||||
- ansible_facts.distribution == "Amazon"
|
||||
|
||||
- name: Start sshd service
|
||||
ansible.builtin.service:
|
||||
name: "{{ item }}"
|
||||
state: started
|
||||
ignore_errors: true
|
||||
loop:
|
||||
- sshd
|
||||
- ssh
|
||||
|
||||
- name: Set password for test
|
||||
ansible.builtin.set_fact:
|
||||
test_pw: myTest!pw
|
||||
|
||||
- name: Create locked_user
|
||||
user:
|
||||
name: locked_user
|
||||
password: "{{ test_pw | password_hash('sha512') }}"
|
||||
|
||||
- name: Create ssh-client-keypair
|
||||
community.crypto.openssh_keypair:
|
||||
path: /root/locked_user_id
|
||||
type: ed25519
|
||||
state: present
|
||||
register: generated_key
|
||||
|
||||
- name: Add ssh-public-key to locked_user
|
||||
ansible.posix.authorized_key:
|
||||
user: locked_user
|
||||
key: "{{ generated_key.public_key }}"
|
||||
state: present
|
||||
|
||||
- name: Check successful login with password
|
||||
ansible.builtin.shell:
|
||||
cmd: sshpass -p {{ test_pw }} ssh -o StrictHostKeyChecking=no locked_user@localhost echo "success"
|
||||
|
||||
- name: Check successful login with ssh key
|
||||
ansible.builtin.shell:
|
||||
cmd: ssh -i /root/locked_user_id -o StrictHostKeyChecking=no locked_user@localhost echo "success"
|
||||
|
||||
- name: Set password change date for locked_user
|
||||
ansible.builtin.shell:
|
||||
cmd: chage -d 2020-01-01 locked_user
|
||||
|
||||
- name: Check unsuccessful login with password
|
||||
ansible.builtin.shell:
|
||||
cmd: sshpass -p {{ test_pw }} ssh -o StrictHostKeyChecking=no locked_user@localhost echo "success"
|
||||
register: output
|
||||
ignore_errors: true
|
||||
|
||||
- name: Assert check unsuccessful login
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- output.rc | int == 1
|
||||
- "'WARNING: Your password has expired.' in output.stderr"
|
||||
- "'success' not in output.stdout"
|
||||
when:
|
||||
- ansible_facts.os_family != "Suse"
|
||||
|
||||
- name: Assert check unsuccessful login
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- output.rc | int == 5
|
||||
- output.stderr | length == 0
|
||||
- output.stdout | length == 0
|
||||
when:
|
||||
- ansible_facts.os_family == "Suse"
|
||||
|
||||
- name: Check successful login with ssh key
|
||||
ansible.builtin.shell:
|
||||
cmd: ssh -i /root/locked_user_id -o StrictHostKeyChecking=no locked_user@localhost echo "success"
|
||||
@@ -1,9 +1,8 @@
|
||||
---
|
||||
- name: Read local linux user database
|
||||
getent:
|
||||
database: passwd
|
||||
|
||||
- name: Check that shell_sys_acc's shell is still bash
|
||||
ansible.builtin.assert:
|
||||
assert:
|
||||
that:
|
||||
- getent_passwd['shell_sys_acc'][5] == "/bin/bash"
|
||||
@@ -1,8 +1,8 @@
|
||||
---
|
||||
- name: Verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
|
||||
ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
|
||||
- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
|
||||
command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
|
||||
changed_when: false
|
||||
|
||||
- name: Verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
|
||||
ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
|
||||
- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
|
||||
command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
|
||||
changed_when: false
|
||||
@@ -1,44 +1,23 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
collections:
|
||||
- devsec.hardening
|
||||
tasks:
|
||||
- name: Override for arch
|
||||
ansible.builtin.set_fact:
|
||||
- name: override for arch
|
||||
set_fact:
|
||||
os_mnt_boot_enabled: false
|
||||
os_mnt_tmp_enabled: true
|
||||
os_mnt_tmp_src: tmpfs
|
||||
os_mnt_tmp_filesystem: tmpfs
|
||||
when: ansible_facts.os_family == 'Archlinux'
|
||||
|
||||
- name: Overrides for Fedora image
|
||||
ansible.builtin.set_fact:
|
||||
os_mnt_tmp_enabled: true
|
||||
os_mnt_tmp_src: tmpfs
|
||||
os_mnt_tmp_filesystem: tmpfs
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Overrides for Fedora 40 image
|
||||
ansible.builtin.set_fact:
|
||||
os_mnt_var_enabled: true
|
||||
os_mnt_var_src: UUID=282c6d73-afc2-4113-9856-c7679ad51920
|
||||
os_mnt_var_filesystem: btrfs
|
||||
os_mnt_var_options: rw,nosuid,nodev,compress=zstd:1,subvol=var
|
||||
when:
|
||||
- ansible_facts.distribution == 'Fedora'
|
||||
- ansible_distribution_major_version|int == 40
|
||||
|
||||
- name: Include os_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.os_hardening
|
||||
- include_role:
|
||||
name: os_hardening
|
||||
vars:
|
||||
os_auth_pam_passwdqc_enable: false
|
||||
os_auth_lockout_time: 15
|
||||
os_yum_repo_file_whitelist: [foo.repo]
|
||||
os_yum_repo_file_whitelist: ['foo.repo']
|
||||
os_mnt_boot_enabled: true
|
||||
os_mnt_home_enabled: true
|
||||
os_mnt_boot_src: /dev/vda1
|
||||
os_mnt_boot_src: "/dev/vda1"
|
||||
@@ -2,7 +2,7 @@
|
||||
dependency:
|
||||
name: galaxy
|
||||
options:
|
||||
role-file: molecule/os_hardening_vm/requirements.yml
|
||||
role-file: molecule/os_hardening/requirements.yml
|
||||
driver:
|
||||
name: vagrant
|
||||
provider:
|
||||
@@ -11,8 +11,8 @@ platforms:
|
||||
# we need to name every instance differently to start multiple VMs on the same host (parallelization)
|
||||
# since we also need to use different OS users to run the tests because of how molecule operates,
|
||||
# the VM names must be predictable by OS user (to clean up canceled runs)
|
||||
- name: ${USER}
|
||||
box: ${MOLECULE_DISTRO}
|
||||
- name: "${USER}"
|
||||
box: "generic/${MOLECULE_DISTRO}"
|
||||
memory: 1024
|
||||
cpus: 2
|
||||
provisioner:
|
||||
@@ -37,7 +37,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -53,7 +52,6 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
|
||||
@@ -1,15 +1,5 @@
|
||||
---
|
||||
- name: Prepare Archliux host
|
||||
hosts: all
|
||||
become: true
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Install python, since it's not installed by default
|
||||
ansible.builtin.raw: pacman --noconfirm -Sy python
|
||||
changed_when: false
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
|
||||
|
||||
- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
@@ -17,49 +7,30 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Set ansible_python_interpreter to "/usr/bin/python3" on fedora
|
||||
ansible.builtin.set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
- name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
|
||||
set_fact:
|
||||
ansible_python_interpreter: "/usr/bin/python3"
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Block update of Grub, because of error
|
||||
ansible.builtin.dpkg_selections:
|
||||
name: grub-pc
|
||||
selection: hold
|
||||
when: ansible_os_family == 'Debian'
|
||||
|
||||
# we need to free up space, since the /boot partition in some Vagrant images is
|
||||
# pretty small and system updates might fail
|
||||
- name: Find all initrd.img to delete them
|
||||
ansible.builtin.find:
|
||||
paths: /boot
|
||||
patterns: "initrd.img*"
|
||||
register: find_results
|
||||
when: ansible_os_family == 'Debian'
|
||||
|
||||
- name: Delete all initrd.img to free space on /boot
|
||||
ansible.builtin.file:
|
||||
path: "{{ item['path'] }}"
|
||||
state: absent
|
||||
with_items: "{{ find_results['files'] }}"
|
||||
when: ansible_os_family == 'Debian'
|
||||
|
||||
- name: Run the equivalent of "apt-get update && apt-get upgrade"
|
||||
ansible.builtin.apt:
|
||||
upgrade: safe
|
||||
apt:
|
||||
update_cache: true
|
||||
when: ansible_os_family == 'Debian'
|
||||
|
||||
- name: Install required tools on fedora
|
||||
ansible.builtin.dnf:
|
||||
- name: install required tools on SuSE
|
||||
# cannot use zypper module, since it depends on python-xml
|
||||
shell: "zypper -n install python-xml"
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: install required tools on fedora
|
||||
dnf:
|
||||
name:
|
||||
- python
|
||||
- findutils
|
||||
- procps-ng
|
||||
- python3-libselinux
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Install required tools on Arch
|
||||
- name: install required tools on Arch
|
||||
community.general.pacman:
|
||||
name:
|
||||
- awk
|
||||
@@ -67,8 +38,8 @@
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Archlinux'
|
||||
|
||||
- name: Install required tools on RHEL # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
- name: install required tools on RHEL # noqa ignore-errors
|
||||
yum:
|
||||
name:
|
||||
- openssh-clients
|
||||
- openssh
|
||||
@@ -76,16 +47,10 @@
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Create recursing symlink to test minimize access
|
||||
ansible.builtin.shell: rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz
|
||||
- name: create recursing symlink to test minimize access
|
||||
shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
|
||||
changed_when: false
|
||||
|
||||
- name: Unmount EFI partition to get rid of vfat filesystem (qemu has no firmware image that inspec can detect)
|
||||
ansible.posix.mount:
|
||||
path: /boot/efi
|
||||
state: unmounted
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Include YUM prepare tasks
|
||||
ansible.builtin.include_tasks: prepare_tasks/yum.yml
|
||||
- name: include YUM prepare tasks
|
||||
include_tasks: prepare_tasks/yum.yml
|
||||
when: ansible_facts.os_family == 'RedHat'
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Create 'foo' repository
|
||||
- name: create 'foo' repository
|
||||
ansible.builtin.yum_repository:
|
||||
name: foo
|
||||
description: mandatory description
|
||||
@@ -7,7 +7,7 @@
|
||||
enabled: false
|
||||
gpgcheck: false
|
||||
|
||||
- name: Create 'bar' repository
|
||||
- name: create 'bar' repository
|
||||
ansible.builtin.yum_repository:
|
||||
name: bar
|
||||
description: mandatory description
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
---
|
||||
roles:
|
||||
- name: geerlingguy.git
|
||||
- geerlingguy.git
|
||||
@@ -7,13 +7,13 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
# temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
|
||||
# - name: Include PAM tests
|
||||
# ansible.builtin.include_tasks: verify_tasks/pam.yml
|
||||
# when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Include YUM tests
|
||||
ansible.builtin.include_tasks: verify_tasks/yum.yml
|
||||
- name: include PAM tests
|
||||
include_tasks: verify_tasks/pam.yml
|
||||
when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: include YUM tests
|
||||
include_tasks: verify_tasks/yum.yml
|
||||
when: ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Verify
|
||||
@@ -23,23 +23,22 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Get ssh-config
|
||||
ansible.builtin.command:
|
||||
cmd: vagrant ssh-config
|
||||
- name: get ssh-config
|
||||
command:
|
||||
cmd: "vagrant ssh-config"
|
||||
chdir: "{{ molecule_ephemeral_directory }}"
|
||||
register: ssh_config
|
||||
changed_when: false
|
||||
|
||||
- name: Create ssh-config file
|
||||
ansible.builtin.copy:
|
||||
- name: create ssh-config file
|
||||
copy:
|
||||
content: "{{ ssh_config.stdout_lines | join ('\n') }}"
|
||||
dest: "{{ molecule_ephemeral_directory }}/ssh-config"
|
||||
mode: "0400"
|
||||
changed_when: false
|
||||
|
||||
- name: Execute cinc-auditor tests
|
||||
ansible.builtin.command: >
|
||||
docker run --rm
|
||||
command: >
|
||||
docker run
|
||||
--volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
|
||||
docker.io/cincproject/auditor exec
|
||||
--ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
|
||||
@@ -51,10 +50,10 @@
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display details about the cinc-auditor results
|
||||
ansible.builtin.debug:
|
||||
debug:
|
||||
msg: "{{ test_results.stdout_lines }}"
|
||||
|
||||
- name: Fail when tests fail
|
||||
ansible.builtin.fail:
|
||||
msg: Inspec failed to validate
|
||||
fail:
|
||||
msg: "Inspec failed to validate"
|
||||
when: test_results.rc != 0
|
||||
@@ -12,12 +12,12 @@
|
||||
state: present
|
||||
|
||||
- name: set password for test
|
||||
ansible.builtin.set_fact:
|
||||
test_pw: myTest!pw
|
||||
set_fact:
|
||||
test_pw: "myTest!pw"
|
||||
|
||||
- name: set locale for test
|
||||
ansible.builtin.set_fact:
|
||||
locale: en_US.UTF-8
|
||||
set_fact:
|
||||
locale: "en_US.UTF-8"
|
||||
when:
|
||||
- ansible_facts.os_family == 'RedHat'
|
||||
- ansible_facts.distribution_major_version < '8'
|
||||
@@ -28,16 +28,16 @@
|
||||
password: "{{ test_pw | password_hash('sha512') }}"
|
||||
|
||||
- name: check successful login with correct password
|
||||
ansible.builtin.shell:
|
||||
cmd: pam-tester --user testuser --password {{ test_pw }}
|
||||
shell:
|
||||
cmd: "pam-tester --user testuser --password {{ test_pw }}"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
LANG: "{{ locale | default('C.UTF-8') }}"
|
||||
|
||||
- name: check unsuccessful login with incorrect password
|
||||
ansible.builtin.shell:
|
||||
cmd: pam-tester --user testuser --password {{ test_pw }}fail --expectfail
|
||||
shell:
|
||||
cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
@@ -45,8 +45,8 @@
|
||||
with_sequence: count=6
|
||||
|
||||
- name: check unsuccessful login, with correct password (lockout)
|
||||
ansible.builtin.shell:
|
||||
cmd: pam-tester --user testuser --password {{ test_pw }} --expectfail
|
||||
shell:
|
||||
cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
@@ -57,8 +57,8 @@
|
||||
seconds: 20
|
||||
|
||||
- name: check successful login
|
||||
ansible.builtin.shell:
|
||||
cmd: pam-tester --user testuser --password {{ test_pw }}
|
||||
shell:
|
||||
cmd: "pam-tester --user testuser --password {{ test_pw }}"
|
||||
environment:
|
||||
TMPDIR: /var/tmp
|
||||
LC_ALL: "{{ locale | default('C.UTF-8') }}"
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
---
|
||||
- name: Verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
|
||||
ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
|
||||
- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
|
||||
command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
|
||||
changed_when: false
|
||||
|
||||
- name: Verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
|
||||
ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
|
||||
- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
|
||||
command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
|
||||
changed_when: false
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
- name: Verify prerequisites
|
||||
hosts: localhost
|
||||
tasks:
|
||||
- name: Make sure environment variable for MOLECULE_DISTRO is set
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- "lookup('env','MOLECULE_DISTRO')"
|
||||
fail_msg: "You need to set MOLECULE_DISTRO to a supported image name. See CONTRIBUTING.md"
|
||||
@@ -1,13 +1,14 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: all
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
collections:
|
||||
- devsec.hardening
|
||||
tasks:
|
||||
- name: Include ssh_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.ssh_hardening
|
||||
- include_role:
|
||||
name: ssh_hardening
|
||||
vars:
|
||||
sftp_enabled: false
|
||||
@@ -3,7 +3,7 @@ driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: instance
|
||||
image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
|
||||
image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
||||
@@ -34,7 +34,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -50,7 +49,6 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Prepare the molecule container for the role
|
||||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
@@ -7,13 +7,13 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Use python3
|
||||
ansible.builtin.set_fact:
|
||||
- name: use python3
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Install packages # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
- name: install packages # noqa ignore-errors
|
||||
yum:
|
||||
name:
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
@@ -22,8 +22,8 @@
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install packages # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
- name: install packages # noqa ignore-errors
|
||||
dnf:
|
||||
name:
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
@@ -32,8 +32,8 @@
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install packages # noqa ignore-errors
|
||||
ansible.builtin.apt:
|
||||
- name: install packages # noqa ignore-errors
|
||||
apt:
|
||||
name:
|
||||
- openssh-client
|
||||
- openssh-server
|
||||
@@ -41,28 +41,19 @@
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install required tools on SuSE
|
||||
- name: install required tools on SuSE
|
||||
# cannot use zypper module, since it depends on python-xml
|
||||
ansible.builtin.command: zypper -n install python-xml
|
||||
changed_when: false
|
||||
shell: "zypper -n install python-xml"
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Install packages
|
||||
community.general.zypper:
|
||||
- name: install packages
|
||||
zypper:
|
||||
name:
|
||||
- openssh
|
||||
- "openssh"
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Install required tools on Alpine
|
||||
community.general.apk:
|
||||
name:
|
||||
- openssh
|
||||
state: present
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Alpine'
|
||||
|
||||
- name: Install required tools on Arch
|
||||
community.general.pacman:
|
||||
- name: install required tools on Arch
|
||||
pacman:
|
||||
name:
|
||||
- openssh
|
||||
- awk
|
||||
@@ -70,11 +61,16 @@
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Archlinux'
|
||||
|
||||
- name: Create ssh host keys # noqa ignore-errors
|
||||
ansible.builtin.command: ssh-keygen -A
|
||||
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
|
||||
or ansible_facts.distribution == "Fedora"
|
||||
or ansible_facts.distribution == "Amazon"
|
||||
or ansible_facts.os_family == "Suse"
|
||||
- name: created needed directory
|
||||
file:
|
||||
path: "/var/run/sshd"
|
||||
state: directory
|
||||
|
||||
- name: create ssh host keys # noqa ignore-errors
|
||||
command: "ssh-keygen -A"
|
||||
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
|
||||
ansible_facts.distribution == "Fedora" or
|
||||
ansible_facts.distribution == "Amazon" or
|
||||
ansible_facts.os_family == "Suse"
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
@@ -7,7 +7,7 @@
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Execute cinc-auditor tests
|
||||
ansible.builtin.command: >
|
||||
command: >
|
||||
docker run
|
||||
--volume /run/docker.sock:/run/docker.sock
|
||||
docker.io/cincproject/auditor exec
|
||||
@@ -19,10 +19,10 @@
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display details about the cinc-auditor results
|
||||
ansible.builtin.debug:
|
||||
debug:
|
||||
msg: "{{ test_results.stdout_lines }}"
|
||||
|
||||
- name: Fail when tests fail
|
||||
ansible.builtin.fail:
|
||||
msg: Inspec failed to validate
|
||||
fail:
|
||||
msg: "Inspec failed to validate"
|
||||
when: test_results.rc != 0
|
||||
@@ -1,13 +1,14 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: all
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
collections:
|
||||
- devsec.hardening
|
||||
tasks:
|
||||
- name: Include ssh_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.ssh_hardening
|
||||
- include_role:
|
||||
name: ssh_hardening
|
||||
vars:
|
||||
sftp_enabled: false
|
||||
@@ -7,8 +7,8 @@ platforms:
|
||||
# we need to name every instance differently to start multiple VMs on the same host (parallelization)
|
||||
# since we also need to use different OS users to run the tests because of how molecule operates,
|
||||
# the VM names must be predictable by OS user (to clean up canceled runs)
|
||||
- name: ${USER}
|
||||
box: generic/${MOLECULE_DISTRO}
|
||||
- name: "${USER}"
|
||||
box: "generic/${MOLECULE_DISTRO}"
|
||||
memory: 1024
|
||||
cpus: 2
|
||||
provisioner:
|
||||
@@ -33,7 +33,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -49,7 +48,6 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
|
||||
@@ -1,22 +1,15 @@
|
||||
---
|
||||
- name: Prepare OpenBSD host
|
||||
- name: prepare OpenBSD host
|
||||
hosts: all
|
||||
become: true
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Change installation source
|
||||
# temporary fix for https://github.com/lavabit/robox/issues/305
|
||||
ansible.builtin.raw: echo "https://ftp.eu.openbsd.org/pub/OpenBSD" > /etc/installurl
|
||||
changed_when: false
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
|
||||
|
||||
- name: Install python
|
||||
- name: install python
|
||||
# BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
|
||||
ansible.builtin.raw: pkg_add python%3.10
|
||||
changed_when: false
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
|
||||
raw: "pkg_add python%3.10"
|
||||
when: "lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'"
|
||||
|
||||
- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
@@ -24,11 +17,16 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Create ssh host keys # noqa ignore-errors
|
||||
ansible.builtin.command: ssh-keygen -A
|
||||
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
|
||||
or ansible_facts.distribution == "Fedora"
|
||||
or ansible_facts.distribution == "Amazon"
|
||||
or ansible_facts.os_family == "Suse"
|
||||
- name: created needed directory
|
||||
file:
|
||||
path: "/var/run/sshd"
|
||||
state: directory
|
||||
|
||||
- name: create ssh host keys # noqa ignore-errors
|
||||
command: "ssh-keygen -A"
|
||||
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
|
||||
ansible_facts.distribution == "Fedora" or
|
||||
ansible_facts.distribution == "Amazon" or
|
||||
ansible_facts.os_family == "Suse"
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
@@ -3,13 +3,12 @@
|
||||
hosts: all
|
||||
become: true
|
||||
tasks:
|
||||
- name: Use the type command instead of which to detect existing commands
|
||||
ansible.builtin.file:
|
||||
src: /usr/bin/which
|
||||
dest: /usr/bin/type
|
||||
- name: use the type command instead of which to detect existing commands
|
||||
file:
|
||||
src: "/usr/bin/which"
|
||||
dest: "/usr/bin/type"
|
||||
state: hard
|
||||
mode: "0770"
|
||||
when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
|
||||
when: "lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'"
|
||||
|
||||
- name: Verify
|
||||
hosts: localhost
|
||||
@@ -18,23 +17,22 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Get ssh-config
|
||||
ansible.builtin.command:
|
||||
cmd: vagrant ssh-config
|
||||
- name: get ssh-config
|
||||
command:
|
||||
cmd: "vagrant ssh-config"
|
||||
chdir: "{{ molecule_ephemeral_directory }}"
|
||||
register: ssh_config
|
||||
changed_when: false
|
||||
|
||||
- name: Create ssh-config file
|
||||
ansible.builtin.copy:
|
||||
- name: create ssh-config file
|
||||
copy:
|
||||
content: "{{ ssh_config.stdout_lines | join ('\n') }}"
|
||||
dest: "{{ molecule_ephemeral_directory }}/ssh-config"
|
||||
mode: "0400"
|
||||
changed_when: false
|
||||
|
||||
- name: Execute cinc-auditor tests
|
||||
ansible.builtin.command: >
|
||||
docker run --rm
|
||||
command: >
|
||||
docker run
|
||||
--volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
|
||||
--volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') }}.yaml:/waivers.yaml
|
||||
docker.io/cincproject/auditor exec
|
||||
@@ -48,10 +46,10 @@
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display details about the cinc-auditor results
|
||||
ansible.builtin.debug:
|
||||
debug:
|
||||
msg: "{{ test_results.stdout_lines }}"
|
||||
|
||||
- name: Fail when tests fail
|
||||
ansible.builtin.fail:
|
||||
msg: Inspec failed to validate
|
||||
fail:
|
||||
msg: "Inspec failed to validate"
|
||||
when: test_results.rc != 0
|
||||
File renamed without changes.
@@ -1,3 +0,0 @@
|
||||
sshd-45:
|
||||
run: false
|
||||
justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"
|
||||
@@ -1,43 +1,49 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
collections:
|
||||
- devsec.hardening
|
||||
tasks:
|
||||
- name: Include ssh_hardening role
|
||||
ansible.builtin.include_role:
|
||||
name: devsec.hardening.ssh_hardening
|
||||
- include_role:
|
||||
name: ssh_hardening
|
||||
vars:
|
||||
ssh_trusted_user_ca_keys_file: /etc/ssh/ca.pub
|
||||
ssh_trusted_user_ca_keys_file: '/etc/ssh/ca.pub'
|
||||
ssh_trusted_user_ca_keys:
|
||||
- "# ssh-rsa ..."
|
||||
ssh_authorized_principals_file: /etc/ssh/auth_principals/%u
|
||||
- '# ssh-rsa ...'
|
||||
ssh_authorized_principals_file: '/etc/ssh/auth_principals/%u'
|
||||
ssh_authorized_principals:
|
||||
- path: /etc/ssh/auth_principals/root
|
||||
- path: "/etc/ssh/auth_principals/root"
|
||||
principals:
|
||||
- root
|
||||
- "root"
|
||||
owner: "{{ ssh_owner }}"
|
||||
group: "{{ ssh_group }}"
|
||||
directoryowner: "{{ ssh_owner }}"
|
||||
directorygroup: "{{ ssh_group }}"
|
||||
directorymode: "0700"
|
||||
network_ipv6_enable: true
|
||||
ssh_allow_tcp_forwarding: "yes"
|
||||
ssh_gateway_ports: "clientspecified"
|
||||
ssh_allow_tcp_forwarding: 'yes'
|
||||
ssh_gateway_ports: true
|
||||
ssh_allow_agent_forwarding: true
|
||||
ssh_server_permit_environment_vars: "yes"
|
||||
ssh_server_accept_env_vars: PWD HTTP_PROXY
|
||||
ssh_server_permit_environment_vars: 'yes'
|
||||
ssh_server_accept_env_vars: 'PWD HTTP_PROXY'
|
||||
ssh_client_alive_interval: 100
|
||||
ssh_client_alive_count: 10
|
||||
ssh_client_password_login: true
|
||||
ssh_challengeresponseauthentication: true
|
||||
ssh_compression: true
|
||||
ssh_allow_users: root kitchen vagrant
|
||||
ssh_allow_groups: root kitchen vagrant
|
||||
ssh_deny_users: foo bar
|
||||
ssh_deny_groups: foo bar
|
||||
ssh_authorized_keys_file: /etc/ssh/authorized_keys/%u
|
||||
ssh_allow_users: 'root kitchen vagrant'
|
||||
ssh_allow_groups: 'root kitchen vagrant'
|
||||
ssh_deny_users: 'foo bar'
|
||||
ssh_deny_groups: 'foo bar'
|
||||
ssh_authorized_keys_file: '/etc/ssh/authorized_keys/%u'
|
||||
ssh_max_auth_retries: 10
|
||||
ssh_permit_root_login: without-password
|
||||
ssh_permit_tunnel: "yes"
|
||||
ssh_permit_root_login: "without-password"
|
||||
ssh_permit_tunnel: true
|
||||
ssh_print_motd: true
|
||||
ssh_print_last_log: true
|
||||
ssh_banner: true
|
||||
@@ -48,33 +54,33 @@
|
||||
- 22
|
||||
- 222
|
||||
ssh_server_match_address:
|
||||
- address: 192.168.1.0/24
|
||||
- address: '192.168.1.0/24'
|
||||
rules:
|
||||
- AllowTcpForwarding yes
|
||||
- AllowAgentForwarding no
|
||||
- 'AllowTcpForwarding yes'
|
||||
- 'AllowAgentForwarding no'
|
||||
ssh_server_match_group:
|
||||
- group: root
|
||||
- group: 'root'
|
||||
rules:
|
||||
- AllowTcpForwarding yes
|
||||
- AllowAgentForwarding no
|
||||
- 'AllowTcpForwarding yes'
|
||||
- 'AllowAgentForwarding no'
|
||||
ssh_server_match_user:
|
||||
- user: root
|
||||
- user: 'root'
|
||||
rules:
|
||||
- AllowTcpForwarding yes
|
||||
- AllowAgentForwarding no
|
||||
- 'AllowTcpForwarding yes'
|
||||
- 'AllowAgentForwarding no'
|
||||
ssh_server_match_local_port:
|
||||
- port: 222
|
||||
rules:
|
||||
- AllowTcpForwarding yes
|
||||
- AllowAgentForwarding no
|
||||
- 'AllowTcpForwarding yes'
|
||||
- 'AllowAgentForwarding no'
|
||||
ssh_remote_hosts:
|
||||
- names: [example.com, example2.com]
|
||||
options: [Port 2222, ForwardAgent yes]
|
||||
- names: [example3.com]
|
||||
options: [StrictHostKeyChecking no]
|
||||
- names: ['example.com', 'example2.com']
|
||||
options: ['Port 2222', 'ForwardAgent yes']
|
||||
- names: ['example3.com']
|
||||
options: ['StrictHostKeyChecking no']
|
||||
ssh_use_dns: true
|
||||
ssh_use_pam: true
|
||||
ssh_max_startups: 10:30:60
|
||||
ssh_max_startups: '10:30:60'
|
||||
ssh_host_key_algorithms:
|
||||
- ssh-ed25519
|
||||
- rsa-sha2-512
|
||||
@@ -88,9 +94,10 @@
|
||||
- aes192-ctr
|
||||
- aes128-ctr
|
||||
- aes256-cbc
|
||||
# these should not be set in the final sshd_config
|
||||
ssh_kex: false
|
||||
ssh_kex:
|
||||
- diffie-hellman-group-exchange-sha256
|
||||
- diffie-hellman-group-exchange-sha1
|
||||
ssh_custom_options:
|
||||
- Include /etc/ssh/ssh_config.d/*
|
||||
- "Include /etc/ssh/ssh_config.d/*"
|
||||
sshd_custom_options:
|
||||
- AcceptEnv LANG
|
||||
- "AcceptEnv LANG"
|
||||
@@ -3,7 +3,7 @@ driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: instance
|
||||
image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
|
||||
image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
||||
@@ -28,7 +28,6 @@ scenario:
|
||||
- prepare
|
||||
check_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- create
|
||||
- prepare
|
||||
@@ -44,7 +43,6 @@ scenario:
|
||||
- destroy
|
||||
test_sequence:
|
||||
- dependency
|
||||
- verify ../shared/prerequisites.yml
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
@@ -52,4 +50,5 @@ scenario:
|
||||
- check
|
||||
- converge
|
||||
- idempotence
|
||||
- verify
|
||||
- destroy
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
@@ -7,13 +7,13 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Use python3
|
||||
ansible.builtin.set_fact:
|
||||
- name: use python3
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Install packages # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
- name: install packages # noqa ignore-errors
|
||||
yum:
|
||||
name:
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
@@ -22,8 +22,8 @@
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install packages # noqa ignore-errors
|
||||
ansible.builtin.dnf:
|
||||
- name: install packages # noqa ignore-errors
|
||||
dnf:
|
||||
name:
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
@@ -32,8 +32,8 @@
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install packages # noqa ignore-errors
|
||||
ansible.builtin.apt:
|
||||
- name: install packages # noqa ignore-errors
|
||||
apt:
|
||||
name:
|
||||
- openssh-client
|
||||
- openssh-server
|
||||
@@ -41,20 +41,19 @@
|
||||
update_cache: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install required tools on SuSE
|
||||
- name: install required tools on SuSE
|
||||
# cannot use zypper module, since it depends on python-xml
|
||||
ansible.builtin.command: zypper -n install python-xml
|
||||
changed_when: false
|
||||
shell: "zypper -n install python-xml"
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Install packages
|
||||
community.general.zypper:
|
||||
- name: install packages
|
||||
zypper:
|
||||
name:
|
||||
- openssh
|
||||
- "openssh"
|
||||
when: ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: Install required tools on Arch
|
||||
community.general.pacman:
|
||||
- name: install required tools on Arch
|
||||
pacman:
|
||||
name:
|
||||
- openssh
|
||||
- awk
|
||||
@@ -62,19 +61,16 @@
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Archlinux'
|
||||
|
||||
- name: Install required tools on Alpine
|
||||
community.general.apk:
|
||||
name:
|
||||
- openssh
|
||||
state: present
|
||||
update_cache: true
|
||||
when: ansible_facts.os_family == 'Alpine'
|
||||
- name: created needed directory
|
||||
file:
|
||||
path: "/var/run/sshd"
|
||||
state: directory
|
||||
|
||||
- name: Create ssh host keys # noqa ignore-errors
|
||||
ansible.builtin.command: ssh-keygen -A
|
||||
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
|
||||
or ansible_facts.distribution == "Fedora"
|
||||
or ansible_facts.distribution == "Amazon"
|
||||
or ansible_facts.os_family == "Suse"
|
||||
- name: create ssh host keys # noqa ignore-errors
|
||||
command: "ssh-keygen -A"
|
||||
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
|
||||
ansible_facts.distribution == "Fedora" or
|
||||
ansible_facts.distribution == "Amazon" or
|
||||
ansible_facts.os_family == "Suse"
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
||||
"extends": [
|
||||
"config:best-practices",
|
||||
"config:base",
|
||||
":gitSignOff"
|
||||
],
|
||||
"dependencyDashboard": true,
|
||||
|
||||
+8
-7
@@ -1,7 +1,8 @@
|
||||
molecule==25.1.0
|
||||
molecule-plugins[docker]==23.7.0
|
||||
ansible-core==2.18.2
|
||||
docker==7.1.0
|
||||
jmespath==1.0.1
|
||||
aar-doc==2.0.1
|
||||
passlib==1.7.4
|
||||
molecule
|
||||
molecule-plugins[docker]
|
||||
yamllint
|
||||
ansible
|
||||
ansible-lint
|
||||
docker
|
||||
flake8
|
||||
jmespath
|
||||
+48
-106
@@ -1,6 +1,6 @@
|
||||
# devsec.mysql_hardening
|
||||
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
|
||||
|
||||
|
||||
## Description
|
||||
|
||||
@@ -12,132 +12,74 @@ It configures:
|
||||
- Removes anonymous users, users without a password or authentication_string and test databases
|
||||
- various hardening options inside MySQL
|
||||
|
||||
Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.
|
||||
|
||||
Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
|
||||
|
||||
## Requirements
|
||||
|
||||
- An existing installation of MySQL or MariaDB.
|
||||
- Ansible 2.9.0
|
||||
- An existing MySQL installation
|
||||
- python-jmespath on the ansible host
|
||||
|
||||
<!-- BEGIN_ANSIBLE_DOCS -->
|
||||
### Example playbook
|
||||
|
||||
## Supported Operating Systems
|
||||
```yml
|
||||
- hosts: localhost
|
||||
collections:
|
||||
- devsec.hardening
|
||||
roles:
|
||||
- mysql_hardening
|
||||
```
|
||||
|
||||
- EL
|
||||
- 8, 9
|
||||
- Ubuntu
|
||||
- focal, jammy, noble
|
||||
- Debian
|
||||
- bullseye, bookworm
|
||||
- Amazon
|
||||
- opensuse
|
||||
This role expects an existing installation of MySQL or MariaDB. Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.
|
||||
Please ensure that the following variables are set accordingly:
|
||||
|
||||
- `mysql_hardening_enabled: yes` role is enabled by default and can be disabled without removing it from a playbook. You can use conditional variable, for example: `mysql_hardening_enabled: "{{ true if mysql_enabled else false }}"`
|
||||
- `mysql_hardening_user: 'mysql'` The user that mysql runs as.
|
||||
- `mysql_hardening_mysql_hardening_conf_file: '/etc/mysql/conf.d/hardening.cnf'` The path to the configuration file where the hardening will be performed
|
||||
- _deprecated: `mysql_datadir: '/var/lib/mysql'` The MySQL data directory_
|
||||
- `mysql_datadir` is no longer necessary, as MySQL data directory is automatically taken from `mysql_info`. But it can still be defined and will also be checked for correct permissions.
|
||||
|
||||
## Role Variables
|
||||
|
||||
- `mysql_daemon_enabled`
|
||||
- Default: `True`
|
||||
- Description: Whether to enable the MySQL-service so it starts on boot
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `mysql_hardening_chroot`
|
||||
- Default: ``
|
||||
- Default: ""
|
||||
- Description: [chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `mysql_hardening_chroot.automatic-sp-privileges`
|
||||
- Default: `0`
|
||||
- Description: [automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `mysql_hardening_enabled`
|
||||
- Default: `True`
|
||||
- Description: Whether to run the hardening
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `mysql_hardening_options.allow-suspicious-udfs`
|
||||
- Default: `0`
|
||||
- Description: [allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `mysql_hardening_options.local-infile`
|
||||
- Default: `0`
|
||||
- Description: [local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `mysql_hardening_options.safe-user-create`
|
||||
- Default: `1`
|
||||
- Default: 1
|
||||
- Description: [safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `mysql_hardening_options.secure-auth`
|
||||
- Default: `1`
|
||||
- Default: 1
|
||||
- Description: [secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `mysql_hardening_options.secure-file-priv`
|
||||
- Default: `/tmp`
|
||||
- Description: [secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `mysql_hardening_options.skip-symbolic-links`
|
||||
- Default: `1`
|
||||
- Default: 1
|
||||
- Description: [skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `mysql_hardening_restart_mysql`
|
||||
- Default: `True`
|
||||
- Description: Restart mysql after running this role
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `mysql_hardening_skip_grant_tables:`
|
||||
- Default: `False`
|
||||
- Default: false
|
||||
- Description: [skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `mysql_hardening_skip_show_database`
|
||||
- Default: `1`
|
||||
- Default: 1
|
||||
- Description: [skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `mysql_hardening_options.local-infile`
|
||||
- Default: 0
|
||||
- Description: [local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)
|
||||
- `mysql_hardening_options.allow-suspicious-udfs`
|
||||
- Default: 0
|
||||
- Description: [allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)
|
||||
- `mysql_hardening_chroot.automatic-sp-privileges`
|
||||
- Default: 0
|
||||
- Description: [automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)
|
||||
- `mysql_hardening_options.secure-file-priv`
|
||||
- Default: /tmp
|
||||
- Description: [secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)
|
||||
- `mysql_allow_remote_root`
|
||||
- Default: false
|
||||
- Description: delete remote root users
|
||||
- `mysql_remove_anonymous_users`
|
||||
- Default: `True`
|
||||
- Description: Set to `false` to keep users without authentication
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `mysql_remove_remote_root`
|
||||
- Default: `True`
|
||||
- Description: If `true`, root can only connect from localhost. Set to `false` to not remove remote root users.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- Default: true
|
||||
- Description: remove users without authentication
|
||||
- `mysql_remove_test_database`
|
||||
- Default: `True`
|
||||
- Description: Set to `false` to keep the test database
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `mysql_root_password`
|
||||
- Default: `-----====>SetR00tPa$$wordH3r3!!!<====-----`
|
||||
- Description: The default password. Please change or overwrite it
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `mysql_user_home`
|
||||
- Default: `{{ ansible_env.HOME }}`
|
||||
- Description: The path where the `.my.cnf` will be stored
|
||||
- Type: str
|
||||
- Required: no
|
||||
- Default: true
|
||||
- Description: remove test database
|
||||
- `mysql_hardening_restart_mysql`
|
||||
- Default: true
|
||||
- Description: Restart mysql after running this role
|
||||
|
||||
## Dependencies
|
||||
|
||||
None.
|
||||
|
||||
## Example Playbook
|
||||
|
||||
```
|
||||
- hosts: all
|
||||
become: true
|
||||
roles:
|
||||
- name: devsec.hardening.mysql_hardening
|
||||
```
|
||||
|
||||
<!-- END_ANSIBLE_DOCS -->
|
||||
Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
|
||||
@@ -6,6 +6,8 @@ mysql_daemon_enabled: true
|
||||
|
||||
mysql_hardening_restart_mysql: true
|
||||
|
||||
# general configuration
|
||||
mysql_hardening_mysql_hardening_conf_file: "{{ mysql_hardening_mysql_confd_dir }}/hardening.cnf"
|
||||
# You have to change this to your own strong enough mysql root password
|
||||
mysql_root_password: "-----====>SetR00tPa$$wordH3r3!!!<====-----"
|
||||
# There .my.cnf with mysql root credentials will be installed
|
||||
|
||||
@@ -1,79 +0,0 @@
|
||||
---
|
||||
argument_specs:
|
||||
main:
|
||||
short_description: The main entry point for the mysql hardening role.
|
||||
version_added: 8.8.0
|
||||
options:
|
||||
mysql_hardening_chroot:
|
||||
default: ''
|
||||
type: str
|
||||
description: '[chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)'
|
||||
mysql_hardening_options.safe-user-create:
|
||||
default: 1
|
||||
type: int
|
||||
description: '[safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)'
|
||||
mysql_hardening_options.secure-auth:
|
||||
default: 1
|
||||
type: int
|
||||
description: '[secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)'
|
||||
mysql_hardening_options.skip-symbolic-links:
|
||||
default: 1
|
||||
type: int
|
||||
description: '[skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)'
|
||||
'mysql_hardening_skip_grant_tables:':
|
||||
default: false
|
||||
type: bool
|
||||
description: '[skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)'
|
||||
mysql_hardening_skip_show_database:
|
||||
default: 1
|
||||
type: int
|
||||
description: '[skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)'
|
||||
mysql_hardening_options.local-infile:
|
||||
default: 0
|
||||
type: int
|
||||
description: '[local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)'
|
||||
mysql_hardening_options.allow-suspicious-udfs:
|
||||
default: 0
|
||||
type: int
|
||||
description: '[allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)'
|
||||
mysql_hardening_chroot.automatic-sp-privileges:
|
||||
default: 0
|
||||
type: int
|
||||
description: '[automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)'
|
||||
mysql_hardening_options.secure-file-priv:
|
||||
default: /tmp
|
||||
type: str
|
||||
description: '[secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)'
|
||||
mysql_remove_anonymous_users:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to `false` to keep users without authentication
|
||||
mysql_remove_test_database:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to `false` to keep the test database
|
||||
mysql_hardening_restart_mysql:
|
||||
default: true
|
||||
type: bool
|
||||
description: Restart mysql after running this role
|
||||
mysql_hardening_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Whether to run the hardening
|
||||
mysql_daemon_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Whether to enable the MySQL-service so it starts on boot
|
||||
mysql_root_password:
|
||||
default: '-----====>SetR00tPa$$wordH3r3!!!<====-----'
|
||||
type: str
|
||||
description: The default password. Please change or overwrite it
|
||||
mysql_user_home:
|
||||
default: '{{ ansible_env.HOME }}'
|
||||
type: str
|
||||
description: The path where the `.my.cnf` will be stored
|
||||
mysql_remove_remote_root:
|
||||
default: true
|
||||
type: bool
|
||||
description: If `true`, root can only connect from localhost. Set to `false`
|
||||
to not remove remote root users.
|
||||
@@ -8,17 +8,18 @@ galaxy_info:
|
||||
platforms:
|
||||
- name: EL
|
||||
versions:
|
||||
- "7"
|
||||
- "8"
|
||||
- "9"
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- bionic
|
||||
- focal
|
||||
- jammy
|
||||
- noble
|
||||
- name: Debian
|
||||
versions:
|
||||
- bullseye
|
||||
- bookworm
|
||||
- buster
|
||||
- name: Amazon
|
||||
- name: opensuse
|
||||
galaxy_tags:
|
||||
|
||||
@@ -56,7 +56,7 @@
|
||||
- name: Apply hardening configuration
|
||||
ansible.builtin.template:
|
||||
src: hardening.cnf.j2
|
||||
dest: "{{ mysql_hardening_mysql_confd_dir + '/hardening.cnf' }}"
|
||||
dest: "{{ mysql_hardening_mysql_hardening_conf_file }}"
|
||||
owner: "{{ mysql_cnf_owner }}"
|
||||
group: "{{ mysql_cnf_group }}"
|
||||
mode: "0640"
|
||||
|
||||
@@ -46,16 +46,6 @@
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
when: mysql_remove_remote_root
|
||||
|
||||
- name: Detect role support on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
|
||||
community.mysql.mysql_query:
|
||||
query: >
|
||||
SELECT 1 FROM information_schema.COLUMNS
|
||||
WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
|
||||
AND COLUMN_NAME = 'is_role';
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_role_support
|
||||
check_mode: false
|
||||
|
||||
- name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
|
||||
community.mysql.mysql_query:
|
||||
query: >
|
||||
@@ -65,8 +55,7 @@
|
||||
OR authentication_string="")
|
||||
AND USER NOT IN ('mysql.sys',
|
||||
'mysqlxsys',
|
||||
'mariadb.sys')
|
||||
{{ 'AND CONVERT(is_role USING utf8) = "N"' if mysql_role_support.rowcount[0] > 0 }};
|
||||
'mariadb.sys');
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_users_wo_passwords_or_auth_string
|
||||
check_mode: false
|
||||
@@ -86,8 +75,7 @@
|
||||
OR authentication_string="")
|
||||
AND USER NOT IN ('mysql.sys',
|
||||
'mysqlxsys',
|
||||
'mariadb.sys')
|
||||
{{ 'AND is_role = "N"' if mysql_role_support.rowcount[0] > 0 }};
|
||||
'mariadb.sys');
|
||||
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
||||
register: mysql_users_wo_passwords
|
||||
check_mode: false
|
||||
|
||||
+90
-123
@@ -1,6 +1,6 @@
|
||||
# devsec.nginx_hardening
|
||||
|
||||
[](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml)
|
||||
|
||||
|
||||
## Description
|
||||
|
||||
@@ -8,143 +8,110 @@ This role provides secure nginx configuration. It is intended to be compliant wi
|
||||
|
||||
It works with the following nginx-roles, including, but not limited to:
|
||||
|
||||
- [nginxinc.nginx](https://galaxy.ansible.com/ui/standalone/roles/nginxinc/nginx/)
|
||||
- [geerlinggux.nginx](https://galaxy.ansible.com/ui/standalone/roles/geerlingguy/nginx/)
|
||||
- [jdauphant.nginx](https://galaxy.ansible.com/ui/standalone/roles/jdauphant/nginx/)
|
||||
- [geerlingguy.nginx](https://galaxy.ansible.com/geerlingguy/nginx/)
|
||||
- [nginxinc.nginx](https://galaxy.ansible.com/nginxinc/nginx)
|
||||
- [jdauphant.nginx](https://galaxy.ansible.com/jdauphant/nginx/)
|
||||
- [franklinkim.nginx](https://galaxy.ansible.com/franklinkim/nginx/)
|
||||
|
||||
**NOTE: This role does not work with nginx 1.0.15 or older! Please use the latest version from the official nginx repositories!**
|
||||
|
||||
<!-- BEGIN_ANSIBLE_DOCS -->
|
||||
## Requirements
|
||||
|
||||
## Supported Operating Systems
|
||||
|
||||
- EL
|
||||
- 8, 9
|
||||
- Ubuntu
|
||||
- focal, jammy, noble
|
||||
- Debian
|
||||
- bookworm, bullseye
|
||||
- Amazon
|
||||
- Ansible >= 2.9
|
||||
|
||||
## Role Variables
|
||||
|
||||
- `nginx_add_header`
|
||||
- Default: `['X-Frame-Options SAMEORIGIN', 'X-Content-Type-Options nosniff', 'X-XSS-Protection "1; mode=block"', 'Content-Security-Policy \\"script-src \'self\'; object-src \'self\'\\"']`
|
||||
- Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See [nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
|
||||
- Type: list of ''
|
||||
- Required: no
|
||||
- `nginx_client_body_buffer_size`
|
||||
- [nginx_client_body_buffer_size][]
|
||||
- Default: `1k`
|
||||
- Description: Sets buffer size for reading client request body. In case the request body is larger than the buffer, the whole body or only its part is written to a temporary file. See [nginx_client_body_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size)
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `nginx_client_body_timeout`
|
||||
- Default: `10`
|
||||
- Description: Defines a timeout for reading client request body. See [nginx_client_body_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout)
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `nginx_client_header_buffer_size`
|
||||
- Default: `1k`
|
||||
- Description: Sets buffer size for reading client request header. For most requests, a buffer of 1K bytes is enough. See [nginx_client_header_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `nginx_client_header_timeout`
|
||||
- Default: `10`
|
||||
- Description: Defines a timeout for reading client request header. See [nginx_client_header_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout)
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `nginx_client_max_body_size`
|
||||
- Default: `1k`
|
||||
- Description: Sets the maximum allowed size of the client request body, specified in the "Content-Length" request header field. If the size in a request exceeds the configured value, the 413 (Request Entity Too Large) error is returned to the client. See [nginx_client_max_body_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size)
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `nginx_configuration_dir`
|
||||
- Default: `/etc/nginx`
|
||||
- Description: The main location for all nginx configuration files
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `nginx_configuration_hardening_dir`
|
||||
- Default: `/etc/nginx`
|
||||
- Description: The location for the nginx hardening configuration file (Could be different e.g. when used in jails)
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `nginx_dh_size`
|
||||
- Default: `2048`
|
||||
- Description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam)
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `nginx_keepalive_timeout`
|
||||
- Default: `5 5`
|
||||
- Description: The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The optional second parameter sets a value in the "Keep-Alive timeout=time" response header field. See [nginx_keepalive_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout)
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `nginx_large_client_header_buffers`
|
||||
- Default: `2 1k`
|
||||
- Description: Sets the maximum number and size of buffers used for reading large client request header. See [nginx_large_client_header_buffers](http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers)
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `nginx_limit_conn`
|
||||
- Default: `default 5`
|
||||
- Description: Sets the shared memory zone and the maximum allowed number of connections for a given key value. See [nginx_limit_conn](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn)
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `nginx_limit_conn_zone`
|
||||
- Default: `$binary_remote_addr zone=default:10m`
|
||||
- Description: Sets parameters for a shared memory zone that will keep states for various keys. See [nginx_limit_conn_zone](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone)
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `nginx_owner_group`
|
||||
- Default: `root`
|
||||
- Description: The owner group of the nginx configuration files
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `nginx_owner_user`
|
||||
- Default: `root`
|
||||
- Description: The owner user of the nginx configuration files
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `nginx_remove_default_site`
|
||||
- Default: `True`
|
||||
- Description: Sets buffer size for reading client request body. In case the request body is larger than the buffer, the whole body or only its part is written to a temporary file.
|
||||
- nginx_remove_default_site
|
||||
- Default: `true`
|
||||
- Description: Disables the default site. Set to false to enable the default site in nginx.
|
||||
- Type: bool
|
||||
- Required: no
|
||||
- `nginx_send_timeout`
|
||||
- Default: `10`
|
||||
- Description: Sets a timeout for transmitting a response to the client. See [nginx_send_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout)
|
||||
- Type: int
|
||||
- Required: no
|
||||
- `nginx_server_tokens`
|
||||
- [nginx_client_max_body_size][]
|
||||
- Default: `1k`
|
||||
- Description: Sets the maximum allowed size of the client request body, specified in the “Content-Length” request header field. If the size in a request exceeds the configured value, the 41
|
||||
3 (Request Entity Too Large) error is returned to the client.
|
||||
- [nginx_keepalive_timeout][]
|
||||
- Default: `5 5`
|
||||
- Description: The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The op
|
||||
tional second parameter sets a value in the “Keep-Alive: timeout=time” response header field.
|
||||
- [nginx_server_tokens][]
|
||||
- Default: `off`
|
||||
- Description: Disables emitting nginx version in error messages and in the "Server" response header field. Set to on to enable the nginx version in error messages and "Server" response header. See [nginx_server_tokens](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens)
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `nginx_ssl_ciphers`
|
||||
- Default: `ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256`
|
||||
- Description: Specifies the TLS ciphers which should be used. See [nginx_ssl_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers)
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `nginx_ssl_prefer_server_ciphers`
|
||||
- Default: `on`
|
||||
- Description: Specifies that server ciphers should be preferred over client ciphers when using the TLS protocols. Set to false to disable it. See [nginx_ssl_prefer_server_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers)
|
||||
- Type: str
|
||||
- Required: no
|
||||
- `nginx_ssl_protocols`
|
||||
- Description: Disables emitting nginx version in error messages and in the "Server" response header field. Set to on to enable the nginx version in error messages and "Server" response head
|
||||
er.
|
||||
- [nginx_client_header_buffer_size][]
|
||||
- Default: `1k`
|
||||
- Description: Sets buffer size for reading client request header. For most requests, a buffer of 1K bytes is enough.
|
||||
- [nginx_large_client_header_buffers][]
|
||||
- Default: `2 1k`
|
||||
- Description: Sets the maximum number and size of buffers used for reading large client request header.
|
||||
- [nginx_client_body_timeout][]
|
||||
- Default: `10`
|
||||
- Description: Defines a timeout for reading client request body.
|
||||
- [nginx_client_header_timeout][]
|
||||
- Default: `10`
|
||||
- Description: Defines a timeout for reading client request header.
|
||||
- [nginx_send_timeout][]
|
||||
- Default: `10`
|
||||
- Description: Sets a timeout for transmitting a response to the client.
|
||||
- [nginx_limit_conn_zone][]
|
||||
- Default: `$binary_remote_addr zone=default:10m`
|
||||
- Description: Sets parameters for a shared memory zone that will keep states for various keys.
|
||||
- [nginx_limit_conn][]
|
||||
- Default: `default 5`
|
||||
- Description: Sets the shared memory zone and the maximum allowed number of connections for a given key value.
|
||||
- [nginx_add_header][]
|
||||
- Default: `[ "X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"", Content-Security-Policy \"script-src 'self'; object-src 'self'\" ]`
|
||||
- Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307.
|
||||
- [nginx_ssl_protocols][]
|
||||
- Default: `TLSv1.2`
|
||||
- Description: Specifies the SSL protocol which should be used. See [nginx_ssl_protocols](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols)
|
||||
- Type: str
|
||||
- Required: no
|
||||
|
||||
## Dependencies
|
||||
|
||||
None.
|
||||
- Description: Specifies the SSL protocol which should be used.
|
||||
- [nginx_ssl_ciphers][]
|
||||
- Default: _see defaults.yml_
|
||||
- Description: Specifies the TLS ciphers which should be used.
|
||||
- [nginx_ssl_prefer_server_ciphers][]
|
||||
- Default: `on`
|
||||
- Description: Specifies that server ciphers should be preferred over client ciphers when using the TLS protocols. Set to false to disable it.
|
||||
- [nginx_dh_size][]
|
||||
- Default: `2048`
|
||||
- Description: Specifies the length of DH parameters for EDH ciphers.
|
||||
- [nginx_configuration_dir][]
|
||||
- default: "/etc/nginx"
|
||||
- Description: The main location for all nginx configuration files
|
||||
- [nginx_configuration_hardening_dir][]
|
||||
- default: "/etc/nginx"
|
||||
- Description: The location for the nginx hardening configuration file (Could be different e.g. when used in jails)
|
||||
- [nginx_owner_user][]
|
||||
- default: "root"
|
||||
- Description: The owner user of the nginx configuration files
|
||||
- [nginx_owner_group][]
|
||||
- default: "root"
|
||||
- Description: The owner group of the nginx configuration files
|
||||
|
||||
## Example Playbook
|
||||
|
||||
```
|
||||
- hosts: all
|
||||
become: true
|
||||
- hosts: localhost
|
||||
collections:
|
||||
- devsec.hardening
|
||||
roles:
|
||||
- name: devsec.hardening.nginx_hardening
|
||||
- nginx_hardening
|
||||
```
|
||||
|
||||
<!-- END_ANSIBLE_DOCS -->
|
||||
[nginx_client_body_buffer_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size
|
||||
[nginx_client_max_body_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
|
||||
[nginx_keepalive_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout
|
||||
[nginx_server_tokens]: http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens
|
||||
[nginx_more_clear_headers]: http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header
|
||||
[nginx_client_header_buffer_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_buffer_size
|
||||
[nginx_large_client_header_buffers]: http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers
|
||||
[nginx_client_body_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout
|
||||
[nginx_client_header_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout
|
||||
[nginx_send_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout
|
||||
[nginx_limit_conn_zone]: http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone
|
||||
[nginx_limit_conn]: http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn
|
||||
[nginx_add_header]: http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header
|
||||
[nginx_ssl_protocols]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols
|
||||
[nginx_ssl_ciphers]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers
|
||||
[nginx_ssl_prefer_server_ciphers]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers
|
||||
[nginx_dh_size]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam
|
||||
@@ -25,6 +25,7 @@ nginx_add_header:
|
||||
- Strict-Transport-Security max-age=15768000
|
||||
- Content-Security-Policy "script-src 'self'; object-src 'self'"
|
||||
|
||||
nginx_set_cookie_flag: "* HttpOnly secure"
|
||||
nginx_ssl_prefer_server_ciphers: "on"
|
||||
nginx_ssl_protocols: TLSv1.2 TLSv1.3
|
||||
# yamllint disable-line rule:line-length
|
||||
|
||||
@@ -1,112 +0,0 @@
|
||||
---
|
||||
argument_specs:
|
||||
main:
|
||||
short_description: The main entry point for the nginx hardening role.
|
||||
version_added: 8.8.0
|
||||
options:
|
||||
nginx_client_body_buffer_size:
|
||||
default: 1k
|
||||
type: str
|
||||
description: Sets buffer size for reading client request body. In case the
|
||||
request body is larger than the buffer, the whole body or only its part
|
||||
is written to a temporary file. See [nginx_client_body_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size)
|
||||
nginx_remove_default_site:
|
||||
default: true
|
||||
type: bool
|
||||
description: Disables the default site. Set to false to enable the default
|
||||
site in nginx.
|
||||
nginx_client_max_body_size:
|
||||
default: 1k
|
||||
type: str
|
||||
description: Sets the maximum allowed size of the client request body, specified
|
||||
in the "Content-Length" request header field. If the size in a request exceeds
|
||||
the configured value, the 413 (Request Entity Too Large) error is returned
|
||||
to the client. See [nginx_client_max_body_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size)
|
||||
nginx_keepalive_timeout:
|
||||
default: 5 5
|
||||
type: str
|
||||
description: The first parameter sets a timeout during which a keep-alive
|
||||
client connection will stay open on the server side. The zero value disables
|
||||
keep-alive client connections. The optional second parameter sets a value
|
||||
in the "Keep-Alive timeout=time" response header field. See [nginx_keepalive_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout) # noqa yaml[line-length]
|
||||
nginx_server_tokens:
|
||||
default: 'off'
|
||||
type: str
|
||||
description: Disables emitting nginx version in error messages and in the
|
||||
"Server" response header field. Set to on to enable the nginx version in
|
||||
error messages and "Server" response header. See [nginx_server_tokens](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens)
|
||||
nginx_client_header_buffer_size:
|
||||
default: 1k
|
||||
type: str
|
||||
description: Sets buffer size for reading client request header. For most
|
||||
requests, a buffer of 1K bytes is enough. See [nginx_client_header_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client
|
||||
nginx_large_client_header_buffers:
|
||||
default: 2 1k
|
||||
type: str
|
||||
description: Sets the maximum number and size of buffers used for reading
|
||||
large client request header. See [nginx_large_client_header_buffers](http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers) # noqa yaml[line-length]
|
||||
nginx_client_body_timeout:
|
||||
default: 10
|
||||
type: int
|
||||
description: Defines a timeout for reading client request body. See [nginx_client_body_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout) # noqa yaml[line-length]
|
||||
nginx_client_header_timeout:
|
||||
default: 10
|
||||
type: int
|
||||
description: Defines a timeout for reading client request header. See [nginx_client_header_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout) # noqa yaml[line-length]
|
||||
nginx_send_timeout:
|
||||
default: 10
|
||||
type: int
|
||||
description: Sets a timeout for transmitting a response to the client. See
|
||||
[nginx_send_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout)
|
||||
nginx_limit_conn_zone:
|
||||
default: $binary_remote_addr zone=default:10m
|
||||
type: str
|
||||
description: Sets parameters for a shared memory zone that will keep states
|
||||
for various keys. See [nginx_limit_conn_zone](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone)
|
||||
nginx_limit_conn:
|
||||
default: default 5
|
||||
type: str
|
||||
description: Sets the shared memory zone and the maximum allowed number of
|
||||
connections for a given key value. See [nginx_limit_conn](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn)
|
||||
nginx_add_header:
|
||||
default: [X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff, X-XSS-Protection
|
||||
"1; mode=block", Content-Security-Policy \"script-src 'self'; object-src
|
||||
'self'\"]
|
||||
type: list
|
||||
description: Adds the specified field to a response header provided that the
|
||||
response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See
|
||||
[nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
|
||||
nginx_ssl_protocols:
|
||||
default: TLSv1.2
|
||||
type: str
|
||||
description: Specifies the SSL protocol which should be used. See [nginx_ssl_protocols](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols) # noqa yaml[line-length]
|
||||
nginx_ssl_ciphers:
|
||||
default: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 # noqa yaml[line-length]
|
||||
type: str
|
||||
description: Specifies the TLS ciphers which should be used. See [nginx_ssl_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers)
|
||||
nginx_ssl_prefer_server_ciphers:
|
||||
default: 'on'
|
||||
type: str
|
||||
description: Specifies that server ciphers should be preferred over client
|
||||
ciphers when using the TLS protocols. Set to false to disable it. See [nginx_ssl_prefer_server_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers) # noqa yaml[line-length]
|
||||
nginx_dh_size:
|
||||
default: 2048
|
||||
type: int
|
||||
description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam) # noqa yaml[line-length]
|
||||
nginx_configuration_dir:
|
||||
default: /etc/nginx
|
||||
type: str
|
||||
description: The main location for all nginx configuration files
|
||||
nginx_configuration_hardening_dir:
|
||||
default: /etc/nginx
|
||||
type: str
|
||||
description: The location for the nginx hardening configuration file (Could
|
||||
be different e.g. when used in jails)
|
||||
nginx_owner_user:
|
||||
default: root
|
||||
type: str
|
||||
description: The owner user of the nginx configuration files
|
||||
nginx_owner_group:
|
||||
default: root
|
||||
type: str
|
||||
description: The owner group of the nginx configuration files
|
||||
@@ -8,16 +8,17 @@ galaxy_info:
|
||||
platforms:
|
||||
- name: EL
|
||||
versions:
|
||||
- "7"
|
||||
- "8"
|
||||
- "9"
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- bionic
|
||||
- focal
|
||||
- jammy
|
||||
- noble
|
||||
- name: Debian
|
||||
versions:
|
||||
- bookworm
|
||||
- buster
|
||||
- bullseye
|
||||
- name: Amazon
|
||||
galaxy_tags:
|
||||
|
||||
+523
-914
File diff suppressed because it is too large.
Load diff
@@ -1,5 +1,5 @@
|
||||
---
|
||||
os_env_user_paths: [/usr/local/sbin, /usr/local/bin, /usr/sbin, /usr/bin, /sbin, /bin]
|
||||
os_desktop_enable: false
|
||||
os_env_extra_user_paths: []
|
||||
os_auth_pw_max_age: 60
|
||||
os_auth_pw_min_age: 7 # Discourage password cycling
|
||||
@@ -39,6 +39,7 @@ os_users_without_password_ageing: []
|
||||
|
||||
# Specify system accounts whose login should not be disabled and password not changed
|
||||
os_ignore_users: [vagrant, kitchen]
|
||||
os_security_kernel_enable_module_loading: true
|
||||
os_security_kernel_enable_core_dump: false
|
||||
os_security_suid_sgid_enforce: true
|
||||
# User-defined blacklist and whitelist
|
||||
@@ -146,7 +147,7 @@ sysctl_config:
|
||||
# The PTRACE system is used for debugging. With it, a single user process
|
||||
# can attach to any other dumpable process owned by the same user. In the
|
||||
# case of malicious software, it is possible to use PTRACE to access
|
||||
# credentials that exist in memory (reusing existing SSH connections,
|
||||
# credentials that exist in memory (re-using existing SSH connections,
|
||||
# extracting GPG agent information, etc).
|
||||
#
|
||||
# A PTRACE scope of "0" is the more permissive mode. A scope of "1" limits
|
||||
@@ -305,7 +306,7 @@ sysctl_config:
|
||||
|
||||
# Do not delete the following line or otherwise the playbook will fail
|
||||
# at task 'create a combined sysctl-dict if overwrites are defined'
|
||||
sysctl_overwrite: {}
|
||||
sysctl_overwrite:
|
||||
# Disable unused filesystems
|
||||
os_unused_filesystems:
|
||||
- cramfs
|
||||
@@ -331,13 +332,9 @@ os_hardening_enabled: true
|
||||
|
||||
# Set to false to disable installing and configuring auditd.
|
||||
os_auditd_enabled: true
|
||||
os_auditd_template: etc/audit/auditd.conf.j2
|
||||
os_auditd_flush: INCREMENTAL
|
||||
os_auditd_freq: 20
|
||||
os_auditd_max_log_file: 6
|
||||
os_auditd_max_log_file_action: keep_logs
|
||||
os_auditd_write_logs: true
|
||||
os_auditd_log_file: /var/log/audit/audit.log
|
||||
os_auditd_log_format: RAW
|
||||
os_auditd_admin_space_left: 50
|
||||
os_auditd_space_left: 75
|
||||
@@ -348,7 +345,6 @@ os_auditd_disk_error_action: SUSPEND
|
||||
os_auditd_action_mail_acct: root
|
||||
os_auditd_log_group: root
|
||||
os_auditd_num_logs: 5
|
||||
os_auditd_name_format: NONE
|
||||
|
||||
# Set the SELinux state, which can be either disabled, permissive, or enforcing.
|
||||
os_selinux_state: enforcing
|
||||
@@ -356,7 +352,7 @@ os_selinux_state: enforcing
|
||||
os_selinux_policy: targeted
|
||||
|
||||
# Mount options for proc in /etc/fstab.
|
||||
proc_mnt_options: rw,nosuid,nodev,noexec,relatime
|
||||
proc_mnt_options: rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}
|
||||
|
||||
# Set to false to disable installing and configuring cron.
|
||||
os_cron_enabled: true
|
||||
|
||||
@@ -2,26 +2,15 @@
|
||||
- name: Update-initramfs # noqa no-changed-when
|
||||
ansible.builtin.command: update-initramfs -u
|
||||
|
||||
- name: Restart auditd # noqa command-instead-of-module no-changed-when
|
||||
ansible.builtin.command:
|
||||
cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
|
||||
when: molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
|
||||
|
||||
- name: Reload systemd
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: true
|
||||
|
||||
- name: Restart auditd via systemd
|
||||
ansible.builtin.systemd:
|
||||
name: auditd.service
|
||||
state: restarted
|
||||
ignore_errors: "{{ ansible_check_mode }}"
|
||||
when:
|
||||
- molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
|
||||
- not ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Restart auditd via service # noqa command-instead-of-module no-changed-when
|
||||
ansible.builtin.command:
|
||||
cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
|
||||
when:
|
||||
- molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
|
||||
- ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Remount filesystems
|
||||
ansible.posix.mount:
|
||||
path: "{{ item }}"
|
||||
|
||||
@@ -1,846 +0,0 @@
|
||||
---
|
||||
argument_specs:
|
||||
main:
|
||||
short_description: The main entry point for the os hardening role.
|
||||
version_added: 8.8.0
|
||||
options:
|
||||
os_env_user_paths:
|
||||
default: [/usr/local/sbin, /usr/local/bin, /usr/sbin, /usr/bin, /sbin, /bin]
|
||||
type: list
|
||||
description: Specify paths that should be checked for binaries where access will be minimized
|
||||
os_env_extra_user_paths:
|
||||
default: '[]'
|
||||
type: list
|
||||
description: Specify additional paths that should be checked for binaries where access will be minimized
|
||||
os_auth_pw_max_age:
|
||||
default: 60
|
||||
type: int
|
||||
description: maximum password age (set to `99999` to effectively disable it).
|
||||
os_auth_pw_min_age:
|
||||
default: 7
|
||||
type: int
|
||||
description: minimum password age (before allowing any other password change).
|
||||
os_auth_pw_warn_age:
|
||||
default: 7
|
||||
type: int
|
||||
description: number of days of warning before password expires.
|
||||
os_auth_pw_remember:
|
||||
default: 5
|
||||
type: int
|
||||
description: how many used passwords are record.
|
||||
os_auth_retries:
|
||||
default: 5
|
||||
type: int
|
||||
description: the maximum number of authentication attempts, before the account
|
||||
is locked for some time.
|
||||
os_auth_lockout_time:
|
||||
default: 600
|
||||
type: int
|
||||
description: time in seconds that needs to pass, if the account was locked
|
||||
due to too many failed authentication attempts.
|
||||
os_auth_timeout:
|
||||
default: 60
|
||||
type: int
|
||||
description: authentication timeout in seconds, so login will exit if this
|
||||
time passes.
|
||||
os_auth_allow_homeless:
|
||||
default: false
|
||||
type: bool
|
||||
description: true if to allow users without home to login.
|
||||
os_auth_pam_passwdqc_enable:
|
||||
default: true
|
||||
type: bool
|
||||
description: true if you want to use strong password checking in PAM using
|
||||
passwdqc.
|
||||
os_auth_pam_passwdqc_options:
|
||||
default: min=disabled,disabled,16,12,8
|
||||
type: str
|
||||
description: set to any option line (as a string) that you want to pass to
|
||||
passwdqc.
|
||||
os_auth_pam_oddjob_mkhomedir:
|
||||
default: false
|
||||
type: bool
|
||||
description: Enables automatic homedir e.g. in FreeIPA environments
|
||||
os_auth_pam_pwquality_options:
|
||||
default: try_first_pass retry=3 authtok_type=
|
||||
type: str
|
||||
description: Options to pass to the PAM module pwquality
|
||||
os_security_users_allow:
|
||||
default: '[]'
|
||||
type: list
|
||||
description: list of things, that a user is allowed to do. May contain `change_user`.
|
||||
os_security_kernel_enable_core_dump:
|
||||
default: false
|
||||
type: bool
|
||||
description: kernel is crashing or otherwise misbehaving and a kernel core
|
||||
dump is created.
|
||||
os_security_suid_sgid_enforce:
|
||||
default: true
|
||||
type: bool
|
||||
description: true if you want to reduce SUID/SGID bits. There is already a
|
||||
list of items which are searched for configured, but you can also add your
|
||||
own.
|
||||
os_security_suid_sgid_blacklist:
|
||||
default: '[]'
|
||||
type: list
|
||||
description: a list of paths which should have their SUID/SGID bits removed.
|
||||
os_security_suid_sgid_whitelist:
|
||||
default: '[]'
|
||||
type: list
|
||||
description: a list of paths which should not have their SUID/SGID bits altered.
|
||||
os_security_suid_sgid_remove_from_unknown:
|
||||
default: false
|
||||
type: bool
|
||||
description: true if you want to remove SUID/SGID bits from any file, that
|
||||
is not explicitly configured in a `blacklist`. This will make every Ansible-run
|
||||
search through the mounted filesystems looking for SUID/SGID bits that are
|
||||
not configured in the default and user blacklist. If it finds an SUID/SGID
|
||||
bit, it will be removed, unless this file is in your `whitelist`.
|
||||
os_auth_uid_min:
|
||||
default: 1000
|
||||
type: int
|
||||
description: minimum number for automatic uid selection in useradd.
|
||||
os_auth_uid_max:
|
||||
default: 60000
|
||||
type: int
|
||||
description: maximum number for automatic uid selection in useradd.
|
||||
os_auth_gid_min:
|
||||
default: 1000
|
||||
type: int
|
||||
description: minimum number for automatic gid selection in groupadd.
|
||||
os_auth_gid_max:
|
||||
default: 60000
|
||||
type: int
|
||||
description: maximum number for automatic gid selection in groupadd.
|
||||
os_auth_sub_uid_count:
|
||||
default: 65536
|
||||
type: int
|
||||
description: If /etc/subuid exists, the commands useradd and newusers (unless
|
||||
the user already have subordinate user IDs) allocate SUB_UID_COUNT unused
|
||||
user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user. See
|
||||
also `os_auth_sub_uid_min` and `os_auth_sub_uid_max`.
|
||||
os_auth_sub_uid_min:
|
||||
default: 100000
|
||||
type: int
|
||||
description: minimum number for automatic subordinate uid selection in useradd
|
||||
and newusers.
|
||||
os_auth_sub_uid_max:
|
||||
default: 600100000
|
||||
type: int
|
||||
description: maximum number for automatic subordinate uid selection in useradd
|
||||
and newusers.
|
||||
os_auth_sub_gid_count:
|
||||
default: 65536
|
||||
type: int
|
||||
description: If /etc/subuid exists, the commands useradd and newusers (unless
|
||||
the user already have subordinate group IDs) allocate SUB_GID_COUNT unused
|
||||
group IDs from the range SUB_GID_MIN to SUB_GID_MAX for each new user. See
|
||||
also `os_auth_sub_gid_min` and `os_auth_sub_gid_max`.
|
||||
os_auth_sub_gid_min:
|
||||
default: 100000
|
||||
type: int
|
||||
description: minimum number for automatic subordinate gid selection in useradd
|
||||
and newusers.
|
||||
os_auth_sub_gid_max:
|
||||
default: 600100000
|
||||
type: int
|
||||
description: maximum number for automatic subordinate gid selection in useradd
|
||||
and newusers.
|
||||
os_security_packages_clean:
|
||||
default: true
|
||||
type: bool
|
||||
description: removes packages with known issues. See section packages.
|
||||
os_selinux_state:
|
||||
default: enforcing
|
||||
type: str
|
||||
description: Set the SELinux state, can be either disabled, permissive, or
|
||||
enforcing.
|
||||
os_selinux_policy:
|
||||
default: targeted
|
||||
type: str
|
||||
description: Set the SELinux polixy.
|
||||
ufw_manage_defaults:
|
||||
default: true
|
||||
type: bool
|
||||
description: true means apply all settings with `ufw_` prefix.
|
||||
ufw_ipt_sysctl:
|
||||
default: "''"
|
||||
type: str
|
||||
description: by default it disables IPT_SYSCTL in /etc/default/ufw. If you
|
||||
want to overwrite /etc/sysctl.conf values using ufw - set it to your sysctl
|
||||
dictionary, for example `/etc/ufw/sysctl.conf`.
|
||||
ufw_default_input_policy:
|
||||
default: DROP
|
||||
type: str
|
||||
description: set default input policy of ufw to `DROP`.
|
||||
ufw_default_output_policy:
|
||||
default: ACCEPT
|
||||
type: str
|
||||
description: set default output policy of ufw to `ACCEPT`.
|
||||
ufw_default_forward_policy:
|
||||
default: DROP
|
||||
type: str
|
||||
description: set default forward policy of ufw to `DROP`.
|
||||
ufw_enable_ipv6:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to `true` to apply rules to support IPv6 (no means only IPv6
|
||||
on loopback accepted).
|
||||
os_auditd_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to disable installing and configuring auditd.
|
||||
os_auditd_log_format:
|
||||
default: RAW
|
||||
type: str
|
||||
description: Describes how the information should be stored on disk. There
|
||||
are 2 options - raw and enriched.
|
||||
os_auditd_max_log_file_action:
|
||||
default: keep_logs
|
||||
type: str
|
||||
description: Defines the behaviour of auditd when its log file is filled up.
|
||||
Possible other values are described in the auditd.conf man page. The most
|
||||
common alternative to the default may be `rotate`.
|
||||
os_auditd_max_log_file:
|
||||
default: 6
|
||||
type: int
|
||||
description: This keyword specifies the maximum file size in megabytes. When
|
||||
this limit is reached, it will trigger a configurable action. The value
|
||||
given must be numeric.
|
||||
os_auditd_name_format:
|
||||
default: NONE
|
||||
type: str
|
||||
description: This keyword specifies how computer node names are inserted
|
||||
into the audit event stream.
|
||||
choices:
|
||||
- NONE
|
||||
- hostname
|
||||
- fqd
|
||||
- numeric
|
||||
os_auditd_num_logs:
|
||||
default: 5
|
||||
type: int
|
||||
description: This keyword specifies the number of log files to keep if `rotate`
|
||||
is given as the max_log_file_action. The value given must be numeric.
|
||||
os_auditd_flush:
|
||||
default: INCREMENTAL
|
||||
type: str
|
||||
description: Valid values are none, incremental, incremental_async, data,
|
||||
and sync.
|
||||
os_auditd_admin_space_left:
|
||||
default: 50
|
||||
type: int
|
||||
description: This is a numeric value in megabytes that tells the audit daemon
|
||||
when to perform a configurable action because the system is running low
|
||||
on disk space.
|
||||
os_auditd_admin_space_left_action:
|
||||
default: SUSPEND
|
||||
type: str
|
||||
description: This parameter tells the system what action to take when the
|
||||
system has detected that it is low on disk space. Valid values are ignore,
|
||||
syslog, rotate, email, exec, suspend, single, and halt.
|
||||
os_auditd_space_left:
|
||||
default: 75
|
||||
type: int
|
||||
description: If the free space in the filesystem containing log_file drops
|
||||
below this value, the audit daemon takes the action specified by space_left_action.
|
||||
os_auditd_space_left_action:
|
||||
default: SYSLOG
|
||||
type: str
|
||||
description: This parameter tells the system what action to take when the
|
||||
system has detected that it is starting to get low on disk space. Valid
|
||||
values are ignore, syslog, rotate, email, exec, suspend, single, and halt.
|
||||
os_auditd_action_mail_acct:
|
||||
default: root
|
||||
type: str
|
||||
description: If `space_left_action` or `admin_space_left_action` are set to
|
||||
`email`, uses the address or alias to send the email using `/usr/lib/sendmail`.
|
||||
of events created on one system but reported/analyzed on another system.
|
||||
os_auditd_disk_error_action:
|
||||
default: SUSPEND
|
||||
type: str
|
||||
description: This parameter tells the system what action to take whenever
|
||||
there is an error detected when writing audit events to disk or rotating
|
||||
logs. Valid values are ignore, syslog, exec, suspend, single, and halt.
|
||||
os_auditd_disk_full_action:
|
||||
default: SUSPEND
|
||||
type: str
|
||||
description: This parameter tells the system what action to take when the
|
||||
system has detected that the partition to which log files are written has
|
||||
become full. Valid values are ignore, syslog, rotate, exec, suspend, single,
|
||||
and halt.
|
||||
os_auditd_log_group:
|
||||
default: root
|
||||
type: str
|
||||
description: specifies the group that is applied to the log file's permissions.
|
||||
The group name can be either numeric or spelled out.
|
||||
proc_mnt_options:
|
||||
default: rw,nosuid,nodev,noexec,relatime
|
||||
type: str
|
||||
description: Mount proc with hardenized options. Note that the hidepid option
|
||||
is set separately in vars/.
|
||||
os_ignore_users:
|
||||
default: [vagrant, kitchen]
|
||||
type: list
|
||||
description: Specify system accounts whose login should not be disabled and
|
||||
password not changed
|
||||
os_chmod_home_folders:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to `false` to disable "chmod 700" of home folders for regular
|
||||
users
|
||||
os_ignore_home_folder_users:
|
||||
default: '[]'
|
||||
type: list
|
||||
description: Specify user accounts, whose home folders shouldn't be chmodded
|
||||
to 700 when "os_chmod_home_folders" is enabled.
|
||||
os_chmod_rootuser_home_folder:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to `false` to disable "chmod 700" of root's home folder
|
||||
os_rootuser_pw_ageing:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to true to enforce password age settings for root user(s)
|
||||
os_remove_additional_root_users:
|
||||
default: false
|
||||
type: bool
|
||||
description: When enabled and there are multiple users with UID=0, only "root"
|
||||
will be kept. Others will be deleted.
|
||||
os_user_pw_ageing:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to disable password age enforcement on existing
|
||||
users
|
||||
os_users_without_password_ageing:
|
||||
default: '[]'
|
||||
type: list
|
||||
description: List of users, where password ageing should not be enforced even
|
||||
if "os_user_pw_ageing" is enabled
|
||||
os_cron_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to disable installing and configuring cron.
|
||||
os_ctrlaltdel_disabled:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to true to disable ctrl-alt-delete key combination.
|
||||
os_limits_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to disable installing and configuring limits.
|
||||
os_login_defs_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to disable installing and configuring login_defs
|
||||
for newly created users.
|
||||
os_minimize_access_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to disable installing and configuring minimize_access.
|
||||
os_pam_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to disable installing and configuring pam.
|
||||
os_modprobe_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to disable installing and configuring modprobe.
|
||||
os_profile_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to disable installing and configuring profile.
|
||||
os_security_auto_logout:
|
||||
default: 0
|
||||
type: int
|
||||
description: Set timeout in seconds for logout users automatically after time.
|
||||
Setting this to `0` disables the timeout.
|
||||
os_securetty_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to disable installing and configuring securetty.
|
||||
os_sysctl_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to disable installing and configuring sysctl.
|
||||
os_user_accounts_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to disable installing and configuring user_accounts.
|
||||
os_rhosts_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to disable installing and configuring rhosts.
|
||||
os_yum_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to disable installing and configuring yum.
|
||||
os_yum_repo_file_whitelist:
|
||||
default: '[]'
|
||||
type: list
|
||||
description: List of yum repository files under /etc/yum.repos.d/ which should
|
||||
not be altered.
|
||||
os_apt_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to disable installing and configuring apt.
|
||||
os_selinux_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to disable installing and configuring selinux.
|
||||
os_sha_crypt_min_rounds:
|
||||
default: 640000
|
||||
type: int
|
||||
description: Define the number of minimum SHA rounds. With a lot of rounds
|
||||
brute forcing the password is more difficult. But note also that it more
|
||||
CPU resources will be needed to authenticate users. The values must be inside
|
||||
the 1000-999999999 range.
|
||||
os_sha_crypt_max_rounds:
|
||||
default: 640000
|
||||
type: int
|
||||
description: Define the number of maximum SHA rounds. With a lot of rounds
|
||||
brute forcing the password is more difficult. But note also that it more
|
||||
CPU resources will be needed to authenticate users. The values must be inside
|
||||
the 1000-999999999 range.
|
||||
os_mnt_boot_dir_mode:
|
||||
default: '0700'
|
||||
type: str
|
||||
description: Set default perimissions for /boot
|
||||
os_mnt_boot_enabled:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to true to configure /boot mountpoint
|
||||
os_mnt_boot_src:
|
||||
default: "''"
|
||||
type: str
|
||||
description: Set mount source for /boot
|
||||
os_mnt_boot_options:
|
||||
default: rw,nosuid,nodev,noexec
|
||||
description: Configure mount options for /boot
|
||||
os_mnt_boot_filesystem:
|
||||
default: "''"
|
||||
type: str
|
||||
description: Configure file system for fstab entry /boot. If empty, the current
|
||||
file system type will be used.
|
||||
os_mnt_boot_dump:
|
||||
default: ext3 + ext4 = 1 / other = 0
|
||||
type: str
|
||||
description: Configure dump for fstab entry /var/tmp. If empty, the default
|
||||
depends on fstype.
|
||||
os_mnt_boot_passno:
|
||||
default: ext3 + ext4 = 2 / other = 0
|
||||
type: str
|
||||
description: Configure passno for fstab entry /var/tmp. If empty, the default
|
||||
depends on fstype.
|
||||
os_mnt_dev_dir_mode:
|
||||
default: '0755'
|
||||
type: str
|
||||
description: Set default perimissions for /dev
|
||||
os_mnt_dev_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to ignore /dev mountpoint
|
||||
os_mnt_dev_src:
|
||||
default: devtmpfs
|
||||
type: str
|
||||
description: Set mount source for /dev
|
||||
os_mnt_dev_options:
|
||||
default: rw,nosuid,noexec
|
||||
type: str
|
||||
description: Configure mount options for /dev
|
||||
os_mnt_dev_filesystem:
|
||||
default: devtmpfs
|
||||
type: str
|
||||
description: Configure file system for fstab entry /dev
|
||||
os_mnt_dev_dump:
|
||||
default: '0'
|
||||
type: str
|
||||
description: Configure dump for fstab entry /var/tmp.
|
||||
os_mnt_dev_passno:
|
||||
default: '0'
|
||||
type: str
|
||||
description: Configure passno for fstab entry /var/tmp.
|
||||
os_mnt_dev_shm_dir_mode:
|
||||
default: '1777'
|
||||
type: str
|
||||
description: Set default perimissions for /dev/shm
|
||||
os_mnt_dev_shm_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to ignore /dev/shm mountpoint
|
||||
os_mnt_dev_shm_src:
|
||||
default: tmpfs
|
||||
type: str
|
||||
description: Set mount source for /dev/shm
|
||||
os_mnt_dev_shm_options:
|
||||
default: rw,nosuid,nodev,noexec
|
||||
type: str
|
||||
description: Configure mount options for /dev/shm
|
||||
os_mnt_dev_shm_filesystem:
|
||||
default: tmpfs
|
||||
type: str
|
||||
description: Configure file system for fstab entry /dev/shm
|
||||
os_mnt_dev_shm_dump:
|
||||
default: '0'
|
||||
type: str
|
||||
description: Configure dump for fstab entry /var/tmp.
|
||||
os_mnt_dev_shm_passno:
|
||||
default: '0'
|
||||
type: str
|
||||
description: Configure passno for fstab entry /var/tmp.
|
||||
os_mnt_home_dir_mode:
|
||||
default: '0755'
|
||||
type: str
|
||||
description: Set default perimissions for /home
|
||||
os_mnt_home_enabled:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to true to configure /home mountpoint
|
||||
os_mnt_home_src:
|
||||
default: "''"
|
||||
type: str
|
||||
description: Set mount source for /home. If empty, the current file system
|
||||
source device will be used.
|
||||
os_mnt_home_options:
|
||||
default: rw,nosuid,nodev
|
||||
type: str
|
||||
description: Configure mount options for /home
|
||||
os_mnt_home_filesystem:
|
||||
default: "''"
|
||||
type: str
|
||||
description: Configure file system for fstab entry /home. If empty, the current
|
||||
file system type will be used.
|
||||
os_mnt_home_dump:
|
||||
default: ext3/4 = 1, others = 0
|
||||
type: str
|
||||
description: Configure dump for fstab entry /var/tmp. If empty, the default
|
||||
depends on fstype.
|
||||
os_mnt_home_passno:
|
||||
default: ext3/4 = 2, others = 0
|
||||
type: str
|
||||
description: Configure passno for fstab entry /var/tmp. If empty, the default
|
||||
depends on fstype.
|
||||
os_mnt_run_dir_mode:
|
||||
default: '0755'
|
||||
type: str
|
||||
description: Set default perimissions for /run
|
||||
os_mnt_run_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to false to ignore /run mountpoint
|
||||
os_mnt_run_src:
|
||||
default: tmpfs
|
||||
type: str
|
||||
description: Set mount source for /run
|
||||
os_mnt_run_options:
|
||||
default: rw,nosuid,nodev
|
||||
type: str
|
||||
description: Configure mount options for /run
|
||||
os_mnt_run_filesystem:
|
||||
default: tmpfs
|
||||
type: str
|
||||
description: Configure file system for fstab entry /run
|
||||
os_mnt_run_dump:
|
||||
default: '0'
|
||||
type: str
|
||||
description: Configure dump for fstab entry /var/tmp.
|
||||
os_mnt_run_passno:
|
||||
default: '0'
|
||||
type: str
|
||||
description: Configure passno for fstab entry /var/tmp.
|
||||
os_mnt_tmp_dir_mode:
|
||||
default: '1777'
|
||||
type: str
|
||||
description: Set default perimissions for /tmp
|
||||
os_mnt_tmp_enabled:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to true to configure /tmp mountpoint
|
||||
os_mnt_tmp_src:
|
||||
default: "''"
|
||||
type: str
|
||||
description: Set mount source for /tmp. If empty, the current file system
|
||||
source device will be used.
|
||||
os_mnt_tmp_options:
|
||||
default: rw,nosuid,nodev,noexec
|
||||
type: str
|
||||
description: Configure mount options for /tmp
|
||||
os_mnt_tmp_filesystem:
|
||||
default: "''"
|
||||
type: str
|
||||
description: Configure file system for fstab entry /tmp. If empty, the current
|
||||
file system type will be used.
|
||||
os_mnt_tmp_dump:
|
||||
default: ext3/4 = 1, others = 0
|
||||
type: str
|
||||
description: Configure dump for fstab entry /var/tmp. If empty, the default
|
||||
depends on fstype.
|
||||
os_mnt_tmp_passno:
|
||||
default: ext3/4 = 2, others = 0
|
||||
type: str
|
||||
description: Configure passno for fstab entry /var/tmp. If empty, the default
|
||||
depends on fstype.
|
||||
os_mnt_var_dir_mode:
|
||||
default: '0755'
|
||||
type: str
|
||||
description: Set default perimissions for /var
|
||||
os_mnt_var_enabled:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to true to configure /var mountpoint
|
||||
os_mnt_var_src:
|
||||
default: "''"
|
||||
type: str
|
||||
description: Set mount source for /var. If empty, the current file system
|
||||
source device will be used.
|
||||
os_mnt_var_options:
|
||||
default: rw,nosuid,nodev
|
||||
type: str
|
||||
description: Configure mount options for /var
|
||||
os_mnt_var_filesystem:
|
||||
default: "''"
|
||||
type: str
|
||||
description: Configure file system for fstab entry /var. If empty, the current
|
||||
file system type will be used.
|
||||
os_mnt_var_dump:
|
||||
default: ext3/4 = 1, others = 0
|
||||
type: str
|
||||
description: Configure dump for fstab entry /var/tmp. If empty, the default
|
||||
depends on fstype.
|
||||
os_mnt_var_passno:
|
||||
default: ext3/4 = 2, others = 0
|
||||
type: str
|
||||
description: Configure passno for fstab entry /var/tmp. If empty, the default
|
||||
depends on fstype.
|
||||
os_mnt_var_log_dir_mode:
|
||||
default: '0755'
|
||||
type: str
|
||||
description: Set default perimissions for /var/log
|
||||
os_mnt_var_log_enabled:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to true to configure /var/log mountpoint
|
||||
os_mnt_var_log_src:
|
||||
default: "''"
|
||||
type: str
|
||||
description: Set mount source for /var/log. If empty, the current file system
|
||||
source device will be used.
|
||||
os_mnt_var_log_options:
|
||||
default: rw,nosuid,nodev,noexec
|
||||
type: str
|
||||
description: Configure mount options for /var/log
|
||||
os_mnt_var_log_filesystem:
|
||||
default: "''"
|
||||
type: str
|
||||
description: Configure file system for fstab entry /var/log. If empty, the
|
||||
current file system type will be used.
|
||||
os_mnt_var_log_dump:
|
||||
default: ext3/4 = 1, others = 0
|
||||
type: str
|
||||
description: Configure dump for fstab entry /var/tmp. If empty, the default
|
||||
depends on fstype.
|
||||
os_mnt_var_log_passno:
|
||||
default: ext3/4 = 2, others = 0
|
||||
type: str
|
||||
description: Configure passno for fstab entry /var/tmp. If empty, the default
|
||||
depends on fstype.
|
||||
os_mnt_var_log_audit_dir_mode:
|
||||
default: '0640'
|
||||
type: str
|
||||
description: Set default perimissions for /var/log/audit
|
||||
os_mnt_var_log_audit_enabled:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to true to configure /var/log/audit mountpoint
|
||||
os_mnt_var_log_audit_src:
|
||||
default: "''"
|
||||
type: str
|
||||
description: Set mount source for /var/log/audit. If empty, the current file
|
||||
system source device will be used.
|
||||
os_mnt_var_log_audit_options:
|
||||
default: rw,nosuid,nodev,noexec
|
||||
type: str
|
||||
description: Configure mount options for /var/log/audit
|
||||
os_mnt_var_log_audit_filesystem:
|
||||
default: "''"
|
||||
type: str
|
||||
description: Configure file system for fstab entry /var/log/audit. If empty,
|
||||
the current file system type will be used.
|
||||
os_mnt_var_log_audit_dump:
|
||||
default: ext3/4 = 1, others = 0
|
||||
type: str
|
||||
description: Configure dump for fstab entry /var/tmp. If empty, the default
|
||||
depends on fstype.
|
||||
os_mnt_var_log_audit_passno:
|
||||
default: ext3/4 = 2, others = 0
|
||||
type: str
|
||||
description: Configure passno for fstab entry /var/tmp. If empty, the default
|
||||
depends on fstype.
|
||||
os_mnt_var_tmp_dir_mode:
|
||||
default: '1777'
|
||||
type: str
|
||||
description: Set default perimissions for /var/tmp
|
||||
os_mnt_var_tmp_enabled:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to true to configure /var/tmp mountpoint
|
||||
os_mnt_var_tmp_src:
|
||||
default: "''"
|
||||
type: str
|
||||
description: Set mount source for /var/tmp. If empty, the current file system
|
||||
source device will be used.
|
||||
os_mnt_var_tmp_options:
|
||||
default: rw,nosuid,nodev,noexec
|
||||
type: str
|
||||
description: Configure mount options for /var/tmp
|
||||
os_mnt_var_tmp_filesystem:
|
||||
default: "''"
|
||||
type: str
|
||||
description: Configure file system for fstab entry /var/tmp. If empty, the
|
||||
current file system type will be used.
|
||||
os_mnt_var_tmp_dump:
|
||||
default: ext3/4 = 1, others = 0
|
||||
type: str
|
||||
description: Configure dump for fstab entry /var/tmp. If empty, the default
|
||||
depends on fstype.
|
||||
os_mnt_var_tmp_passno:
|
||||
default: ext3/4 = 2, others = 0
|
||||
type: str
|
||||
description: Configure passno for fstab entry /var/tmp. If empty, the default
|
||||
depends on fstype.
|
||||
os_netrc_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Configure filesystem for existence of .netrc file in homedir
|
||||
os_netrc_whitelist_user:
|
||||
default: '[]'
|
||||
type: list
|
||||
description: Add list of user to allow creation of .netrc in users homedir
|
||||
sysctl_overwrite:
|
||||
default: '{}'
|
||||
type: dict
|
||||
description: To overwrite options in the `sysctl_config`-dict, overwrite them
|
||||
here.
|
||||
sysctl_config:
|
||||
type: dict
|
||||
description: various sysctl-settings
|
||||
default:
|
||||
fs.protected_hardlinks: 1
|
||||
fs.protected_symlinks: 1
|
||||
fs.protected_fifos: 1
|
||||
fs.protected_regular: 2
|
||||
fs.suid_dumpable: 0
|
||||
kernel.core_uses_pid: 1
|
||||
kernel.kptr_restrict: 2
|
||||
kernel.kexec_load_disabled: 1
|
||||
kernel.sysrq: 0
|
||||
kernel.randomize_va_space: 2
|
||||
kernel.yama.ptrace_scope: 1
|
||||
net.ipv4.ip_forward: 0
|
||||
net.ipv6.conf.all.forwarding: 0
|
||||
net.ipv4.conf.all.rp_filter: 1
|
||||
net.ipv4.conf.default.rp_filter: 1
|
||||
net.ipv4.icmp_echo_ignore_broadcasts: 1
|
||||
net.ipv4.icmp_ignore_bogus_error_responses: 1
|
||||
net.ipv4.icmp_ratelimit: 100
|
||||
net.ipv4.icmp_ratemask: 88089
|
||||
net.ipv4.tcp_timestamps: 0
|
||||
net.ipv4.conf.all.arp_ignore: 1
|
||||
net.ipv4.conf.all.arp_announce: 2
|
||||
net.ipv4.tcp_rfc1337: 1
|
||||
net.ipv4.tcp_syncookies: 1
|
||||
net.ipv4.conf.all.shared_media: 1
|
||||
net.ipv4.conf.default.shared_media: 1
|
||||
net.ipv4.conf.all.accept_source_route: 0
|
||||
net.ipv4.conf.default.accept_source_route: 0
|
||||
net.ipv6.conf.all.accept_source_route: 0
|
||||
net.ipv6.conf.default.accept_source_route: 0
|
||||
net.ipv4.conf.all.send_redirects: 0
|
||||
net.ipv4.conf.default.send_redirects: 0
|
||||
net.ipv4.conf.all.log_martians: 1
|
||||
net.ipv4.conf.default.log_martians: 1
|
||||
net.ipv4.conf.default.accept_redirects: 0
|
||||
net.ipv4.conf.all.accept_redirects: 0
|
||||
net.ipv4.conf.all.secure_redirects: 0
|
||||
net.ipv4.conf.default.secure_redirects: 0
|
||||
net.ipv6.conf.default.accept_redirects: 0
|
||||
net.ipv6.conf.all.accept_redirects: 0
|
||||
net.ipv6.conf.all.accept_ra: 0
|
||||
net.ipv6.conf.default.accept_ra: 0
|
||||
net.ipv6.conf.default.router_solicitations: 0
|
||||
net.ipv6.conf.all.router_solicitations: 0
|
||||
net.ipv6.conf.default.accept_ra_rtr_pref: 0
|
||||
net.ipv6.conf.default.accept_ra_pinfo: 0
|
||||
net.ipv6.conf.default.accept_ra_defrtr: 0
|
||||
net.ipv6.conf.default.autoconf: 0
|
||||
net.ipv6.conf.all.autoconf: 0
|
||||
net.ipv6.conf.default.dad_transmits: 0
|
||||
net.ipv6.conf.default.max_addresses: 1
|
||||
vm.mmap_min_addr: 65536
|
||||
vm.mmap_rnd_bits: 32
|
||||
vm.mmap_rnd_compat_bits: 16
|
||||
os_unused_filesystems:
|
||||
default:
|
||||
- cramfs
|
||||
- freevxfs
|
||||
- jffs2
|
||||
- hfs
|
||||
- hfsplus
|
||||
- squashfs
|
||||
- udf
|
||||
- vfat
|
||||
- dccp
|
||||
- rds
|
||||
- sctp
|
||||
- tipc
|
||||
type: list
|
||||
description: Disable this list of unused filesystems
|
||||
os_filesystem_whitelist:
|
||||
default: '[]'
|
||||
type: list
|
||||
description: A list of filesystems that should not be disabled
|
||||
os_hardening_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Whether to run the hardening
|
||||
os_auth_root_ttys:
|
||||
default: [console, tty1, tty2, tty3, tty4, tty5, tty6]
|
||||
type: list
|
||||
description: A list of TTYs, from which root can log in, see `man securetty`
|
||||
for reference
|
||||
os_chfn_restrict:
|
||||
default: "''"
|
||||
type: str
|
||||
description: Indicate which fields are changeable by chfn.
|
||||
os_security_init_prompt:
|
||||
default: true
|
||||
type: bool
|
||||
description: The PROMPT option provides console users the ability to interactively
|
||||
boot the system and select which services to start on boot.
|
||||
os_security_init_single:
|
||||
default: false
|
||||
type: bool
|
||||
description: Single-user mode is intended as a system recovery method, providing
|
||||
a single user root access to the system by providing a boot option at startup.
|
||||
By default, no authentication is performed if single-user mode is selected.
|
||||
To require entry of the root password even if the system is started in single-user
|
||||
mode, set this to false
|
||||
os_security_packages_list:
|
||||
default: [xinetd, inetd, ypserv, telnet-server, rsh-server, prelink]
|
||||
type: list
|
||||
description: List of deprecated or insecure packages to remove
|
||||
ufw_default_application_policy:
|
||||
default: SKIP
|
||||
type: str
|
||||
description: The default application policy is skip, which means that the
|
||||
update --add-new command will do nothing
|
||||
ufw_ipt_modules:
|
||||
default: nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns
|
||||
type: str
|
||||
description: Define which netfilter modules to load
|
||||
ufw_manage_builtins:
|
||||
default: 'no'
|
||||
type: str
|
||||
description: If this variable is set to 'yes', on stop and reload the built-in
|
||||
chains are flushed. If it is set to 'no', on stop and reload the ufw secondary
|
||||
chains are removed and the ufw primary chains are flushed
|
||||
@@ -8,16 +8,17 @@ galaxy_info:
|
||||
platforms:
|
||||
- name: EL
|
||||
versions:
|
||||
- "7"
|
||||
- "8"
|
||||
- "9"
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- bionic
|
||||
- focal
|
||||
- jammy
|
||||
- noble
|
||||
- name: Debian
|
||||
versions:
|
||||
- bookworm
|
||||
- buster
|
||||
- bullseye
|
||||
- name: Amazon
|
||||
- name: Fedora
|
||||
|
||||
@@ -7,12 +7,10 @@
|
||||
|
||||
- name: Configure auditd | package-08
|
||||
ansible.builtin.template:
|
||||
src: "{{ os_auditd_template }}"
|
||||
src: etc/audit/auditd.conf.j2
|
||||
dest: /etc/audit/auditd.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0640"
|
||||
notify:
|
||||
- Restart auditd via service
|
||||
- Restart auditd via systemd
|
||||
notify: Restart auditd
|
||||
tags: auditd
|
||||
@@ -1,10 +1,4 @@
|
||||
---
|
||||
- name: Gather facts, if not present
|
||||
ansible.builtin.setup:
|
||||
when: not ansible_facts
|
||||
tags:
|
||||
- always
|
||||
|
||||
- name: Fetch OS dependent variables
|
||||
ansible.builtin.include_vars:
|
||||
file: "{{ item }}"
|
||||
@@ -123,3 +117,13 @@
|
||||
when:
|
||||
- ansible_facts.selinux.status == 'enabled'
|
||||
- os_selinux_enabled | bool
|
||||
|
||||
- name: Raise deprecation warning for initramfs tasks # noqa ignore-errors
|
||||
ansible.builtin.fail:
|
||||
msg: "WARNING: Rebuilding initramfs is deprecated and will be removed
|
||||
in the next major release. For more information take a look at this issue:
|
||||
https://github.com/dev-sec/ansible-collection-hardening/pull/591"
|
||||
when:
|
||||
- os_security_kernel_enable_module_loading
|
||||
ignore_errors: true
|
||||
tags: always
|
||||
@@ -7,7 +7,12 @@
|
||||
- name: Find files with write-permissions for group # noqa command-instead-of-shell
|
||||
ansible.builtin.shell: find -L {{ item }} -perm /go+w -type f
|
||||
with_community.general.flattened:
|
||||
- "{{ os_env_user_paths }}"
|
||||
- /usr/local/sbin
|
||||
- /usr/local/bin
|
||||
- /usr/sbin
|
||||
- /usr/bin
|
||||
- /sbin
|
||||
- /bin
|
||||
- "{{ os_env_extra_user_paths }}"
|
||||
register: minimize_access_directories
|
||||
ignore_errors: true
|
||||
@@ -68,23 +73,12 @@
|
||||
mode: "0750"
|
||||
when: '"change_user" not in os_security_users_allow'
|
||||
|
||||
# we have to define this combined variable here, because when defining it
|
||||
# in the defaults like this:
|
||||
# proc_mnt_options: rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}
|
||||
# the role argument validator complains about the missing hidepid_option-variable.
|
||||
# If we define the hidepid_option-variable in the defaults, we cannot
|
||||
# overwrite it anymore in the vars (for some reason).
|
||||
|
||||
- name: Define proc_mnt_options including hidepid_option
|
||||
ansible.builtin.set_fact:
|
||||
_proc_mnt_options: "{{ proc_mnt_options }},hidepid={{ hidepid_option }}"
|
||||
|
||||
- name: Set option hidepid for proc filesystem
|
||||
ansible.posix.mount:
|
||||
path: /proc
|
||||
src: proc
|
||||
fstype: proc
|
||||
opts: "{{ _proc_mnt_options }}"
|
||||
opts: "{{ proc_mnt_options }}"
|
||||
state: mounted
|
||||
|
||||
- name: Generate list of current available mounted filesystems on the system
|
||||
@@ -93,7 +87,7 @@
|
||||
|
||||
- name: Append special devices list to valid mountpoint list
|
||||
ansible.builtin.set_fact:
|
||||
mountpoints_list: "{{ mountpoints_list + ['/dev', '/dev/shm', '/run', '/tmp'] }}"
|
||||
mountpoints_list: "{{ mountpoints_list + ['/dev', '/dev/shm', '/run'] }}"
|
||||
|
||||
- name: Minimize access for filesystems
|
||||
ansible.builtin.include_tasks: minimize_access_fs.yml
|
||||
|
||||
@@ -27,24 +27,6 @@
|
||||
when:
|
||||
- ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Allow Login with SSH Keys, when user password is expired
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/pam.d/system-auth
|
||||
backrefs: true
|
||||
regexp: "^(account.*pam_unix.so(?!.*no_pass_expiry).*)$"
|
||||
line: '\1 no_pass_expiry'
|
||||
when:
|
||||
- ansible_facts.os_family == 'Archlinux'
|
||||
|
||||
- name: Allow Login with SSH Keys, when user password is expired
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/pam.d/common-account
|
||||
backrefs: true
|
||||
regexp: "^(account.*pam_unix.so(?!.*no_pass_expiry).*)$"
|
||||
line: '\1 no_pass_expiry'
|
||||
when:
|
||||
- ansible_facts.os_family == 'Suse'
|
||||
|
||||
- name: NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
|
||||
ansible.builtin.template:
|
||||
src: etc/libuser.conf.j2
|
||||
|
||||
@@ -118,10 +118,3 @@
|
||||
state: absent
|
||||
when:
|
||||
- not os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: Allow Login with SSH Keys, when user password is expired
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/pam.d/common-account
|
||||
backrefs: true
|
||||
regexp: "^(account.*pam_unix.so(?!.*no_pass_expiry).*)$"
|
||||
line: '\1 no_pass_expiry'
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
- name: Install sssd-clients
|
||||
ansible.builtin.dnf:
|
||||
ansible.builtin.yum:
|
||||
name: sssd-client
|
||||
state: present
|
||||
when:
|
||||
|
||||
@@ -18,9 +18,48 @@
|
||||
mode: "0544"
|
||||
when: ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Install initramfs-tools
|
||||
ansible.builtin.apt:
|
||||
name: initramfs-tools
|
||||
state: present
|
||||
update_cache: true
|
||||
when:
|
||||
- ansible_facts.os_family == 'Debian'
|
||||
- os_security_kernel_enable_module_loading
|
||||
|
||||
- name: Rebuild initramfs with starting pack of modules, if module loading at runtime is disabled
|
||||
ansible.builtin.template:
|
||||
src: etc/initramfs-tools/modules.j2
|
||||
dest: /etc/initramfs-tools/modules
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0440"
|
||||
notify:
|
||||
- Update-initramfs
|
||||
when:
|
||||
- ansible_facts.os_family == 'Debian'
|
||||
- os_security_kernel_enable_module_loading
|
||||
register: initramfs
|
||||
|
||||
- name: Change sysctls
|
||||
when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']
|
||||
block:
|
||||
- name: Create a combined sysctl-dict if os-dependent sysctls are defined
|
||||
ansible.builtin.set_fact:
|
||||
sysctl_config: "{{ sysctl_config | combine(sysctl_custom_config) }}"
|
||||
when: sysctl_custom_config | default()
|
||||
|
||||
# sysctl_rhel_config is kept for backwards-compatibility. use sysctl_custom_config instead
|
||||
- name: Create a combined sysctl-dict if os-dependent sysctls are defined
|
||||
ansible.builtin.set_fact:
|
||||
sysctl_config: "{{ sysctl_config | combine(sysctl_rhel_config) }}"
|
||||
when: sysctl_rhel_config | default()
|
||||
|
||||
- name: Create a combined sysctl-dict if overwrites are defined
|
||||
ansible.builtin.set_fact:
|
||||
sysctl_config: "{{ sysctl_config | combine(sysctl_overwrite) }}"
|
||||
when: sysctl_overwrite | default()
|
||||
|
||||
- name: Change various sysctl-settings, look at the sysctl-vars file for documentation
|
||||
ansible.posix.sysctl:
|
||||
name: "{{ item.key }}"
|
||||
@@ -29,12 +68,7 @@
|
||||
state: present
|
||||
reload: true
|
||||
ignoreerrors: true
|
||||
# sysctl_rhel_config is kept for backwards-compatibility. use sysctl_custom_config instead
|
||||
# combines all sysctl-dicts into one, adds empty dicts if they are not defined
|
||||
with_dict: "{{ ((sysctl_config
|
||||
| combine(sysctl_custom_config | default({})))
|
||||
| combine(sysctl_rhel_config | default({})))
|
||||
| combine(sysctl_overwrite | default({})) }}"
|
||||
with_dict: "{{ sysctl_config }}"
|
||||
when: item.key not in sysctl_unsupported_entries | default()
|
||||
|
||||
- name: Apply ufw defaults
|
||||
|
||||
@@ -45,7 +45,7 @@
|
||||
- /etc/yum/pluginconf.d/rhnplugin.conf
|
||||
|
||||
- name: Remove deprecated or insecure packages | package-01 - package-09
|
||||
ansible.builtin.dnf:
|
||||
ansible.builtin.yum:
|
||||
name: "{{ os_security_packages_list }}"
|
||||
state: absent
|
||||
when: os_security_packages_clean | bool
|
||||
@@ -1,17 +1,16 @@
|
||||
{{ ansible_managed | comment }}
|
||||
# Generated by Ansible role {{ ansible_role_name }}
|
||||
|
||||
write_logs = {{ os_auditd_write_logs | bool | ternary('yes', 'no') }}
|
||||
log_file = {{ os_auditd_log_file }}
|
||||
log_file = /var/log/audit/audit.log
|
||||
log_format = {{ os_auditd_log_format }}
|
||||
log_group = {{ os_auditd_log_group }}
|
||||
priority_boost = 4
|
||||
flush = {{ os_auditd_flush }}
|
||||
freq = {{ os_auditd_freq }}
|
||||
freq = 20
|
||||
num_logs = {{ os_auditd_num_logs }}
|
||||
disp_qos = lossy
|
||||
dispatcher = /sbin/audispd
|
||||
name_format = {{ os_auditd_name_format }}
|
||||
name_format = NONE
|
||||
max_log_file = {{ os_auditd_max_log_file }}
|
||||
max_log_file_action = {{ os_auditd_max_log_file_action }}
|
||||
space_left = {{ os_auditd_space_left }}
|
||||
|
||||
Loaded 100 of 129 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user