Compare commits
4
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Sebastian Gumprich
|
c05fe8b520 | ||
|
Sebastian Gumprich
|
26e37cabc5 | ||
|
Sebastian Gumprich
|
862edbbe40 | ||
|
David James
|
9d6903e7ad |
No files matched your search
@@ -1,16 +1,11 @@
|
||||
---
|
||||
name: Ansible Lint # feel free to pick your own name
|
||||
|
||||
on: # yamllint disable-line rule:truthy
|
||||
# Run CI against all pushes (direct commits, also merged PRs), Pull Requests
|
||||
push:
|
||||
branches: [master]
|
||||
pull_request:
|
||||
# The branches below must be a subset of the branches above
|
||||
branches: [master]
|
||||
on: [push, pull_request] # yamllint disable-line rule:truthy
|
||||
|
||||
jobs:
|
||||
ansible-lint:
|
||||
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
@@ -21,4 +16,43 @@ jobs:
|
||||
# replace "master" with any valid ref
|
||||
uses: ansible/ansible-lint-action@main
|
||||
with:
|
||||
path: "roles/"
|
||||
# [required]
|
||||
# Paths to ansible files (i.e., playbooks, tasks, handlers etc..)
|
||||
# or valid Ansible directories according to the Ansible role
|
||||
# directory structure.
|
||||
# If you want to lint multiple ansible files, use the following syntax
|
||||
# targets: |
|
||||
# playbook_1.yml
|
||||
# playbook_2.yml
|
||||
targets: "roles/"
|
||||
# [optional]
|
||||
# Arguments to override a package and its version to be set explicitly.
|
||||
# Must follow the example syntax.
|
||||
# override-deps: |
|
||||
# ansible==2.9
|
||||
# ansible-lint==4.2.0
|
||||
override-deps: |
|
||||
rich>=9.5.1,<11.0.0
|
||||
# [optional]
|
||||
# Arguments to be passed to the ansible-lint
|
||||
|
||||
# Options:
|
||||
# -q quieter, although not silent output
|
||||
# -p parseable output in the format of pep8
|
||||
# --parseable-severity parseable output including severity of rule
|
||||
# -r RULESDIR specify one or more rules directories using one or
|
||||
# more -r arguments. Any -r flags override the default
|
||||
# rules in ansiblelint/rules, unless -R is also used.
|
||||
# -R Use default rules in ansiblelint/rules in addition to
|
||||
# any extra
|
||||
# rules directories specified with -r. There is no need
|
||||
# to specify this if no -r flags are used
|
||||
# -t TAGS only check rules whose id/tags match these values
|
||||
# -x SKIP_LIST only check rules whose id/tags do not match these
|
||||
# values
|
||||
# --nocolor disable colored output
|
||||
# --exclude=EXCLUDE_PATHS
|
||||
# path to directories or files to skip. This option is
|
||||
# repeatable.
|
||||
# -c C Specify configuration file to use. Defaults to ".ansible-lint"
|
||||
args: ""
|
||||
@@ -6,7 +6,6 @@ on: # yamllint disable-line rule:truthy
|
||||
types: [labeled, unlabeled, opened, edited, synchronize]
|
||||
jobs:
|
||||
enforce-label:
|
||||
if: github.repository == 'dev-sec/ansible-collection-hardening'
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/labeler@main
|
||||
|
||||
@@ -8,7 +8,6 @@ on: # yamllint disable-line rule:truthy
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
if: github.repository == 'dev-sec/ansible-collection-hardening'
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
|
||||
@@ -1,16 +1,13 @@
|
||||
---
|
||||
name: "devsec.mysql_hardening"
|
||||
|
||||
on: # yamllint disable-line rule:truthy
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/mysql_hardening/**'
|
||||
- 'molecule/mysql_hardening/**'
|
||||
- '.github/workflows/mysql_hardening.yml'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/mysql_hardening/**'
|
||||
- 'molecule/mysql_hardening/**'
|
||||
@@ -26,15 +23,11 @@ jobs:
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- debian9
|
||||
- debian10
|
||||
- debian11
|
||||
# - amazon # geerlingguy.mysql does not support fedora
|
||||
# - arch # needs to be fixed
|
||||
# - opensuse_tumbleweed # needs to be fixed
|
||||
|
||||
@@ -3,13 +3,11 @@ name: "devsec.nginx_hardening"
|
||||
on: # yamllint disable-line rule:truthy
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/nginx_hardening/**'
|
||||
- 'molecule/nginx_hardening/**'
|
||||
- '.github/workflows/nginx_hardening.yml'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/nginx_hardening/**'
|
||||
- 'molecule/nginx_hardening/**'
|
||||
@@ -25,15 +23,11 @@ jobs:
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- debian9
|
||||
- debian10
|
||||
- debian11
|
||||
- amazon
|
||||
# - arch # needs to be fixed
|
||||
# - opensuse_tumbleweed # needs to be fixed
|
||||
|
||||
@@ -3,13 +3,11 @@ name: "devsec.os_hardening"
|
||||
on: # yamllint disable-line rule:truthy
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening/**'
|
||||
- '.github/workflows/os_hardening.yml'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening/**'
|
||||
@@ -25,15 +23,11 @@ jobs:
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- debian9
|
||||
- debian10
|
||||
- debian11
|
||||
- amazon
|
||||
- opensuse_tumbleweed
|
||||
# - arch # needs to be fixed
|
||||
|
||||
@@ -3,13 +3,11 @@ name: "devsec.os_hardening VM"
|
||||
on: # yamllint disable-line rule:truthy
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening_vm/**'
|
||||
- '.github/workflows/os_hardening_vm.yml'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/os_hardening/**'
|
||||
- 'molecule/os_hardening_vm/**'
|
||||
@@ -25,15 +23,11 @@ jobs:
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- debian9
|
||||
- debian10
|
||||
- debian11
|
||||
# - opensuse42 # opensuse currently cannot get an ip address
|
||||
# - arch - arch is currently not supported by cinc-auditor
|
||||
steps:
|
||||
|
||||
@@ -4,13 +4,11 @@ name: Prettier markdown files
|
||||
|
||||
on: # yamllint disable-line rule:truthy
|
||||
push:
|
||||
branches: [master]
|
||||
paths:
|
||||
- '**.md'
|
||||
|
||||
jobs:
|
||||
prettier-md:
|
||||
if: github.repository == 'dev-sec/ansible-collection-hardening'
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 1
|
||||
|
||||
|
||||
@@ -9,9 +9,8 @@ on: # yamllint disable-line rule:truthy
|
||||
|
||||
jobs:
|
||||
generate_changelog:
|
||||
name: create release draft
|
||||
if: github.repository == 'dev-sec/ansible-collection-hardening'
|
||||
runs-on: ubuntu-latest
|
||||
name: create release draft
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
with:
|
||||
|
||||
@@ -3,13 +3,11 @@ name: "devsec.ssh_hardening"
|
||||
on: # yamllint disable-line rule:truthy
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening/**'
|
||||
- '.github/workflows/ssh_hardening.yml'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening/**'
|
||||
@@ -25,16 +23,12 @@ jobs:
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- fedora
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- debian9
|
||||
- debian10
|
||||
- debian11
|
||||
- amazon
|
||||
# - arch # needs to be fixed
|
||||
# - opensuse_tumbleweed # baseline is not compatible with suse
|
||||
|
||||
@@ -3,13 +3,11 @@ name: "devsec.ssh_hardening with custom tests"
|
||||
on: # yamllint disable-line rule:truthy
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_custom_tests/**'
|
||||
- '.github/workflows/ssh_hardening_custom_tests.yml'
|
||||
pull_request:
|
||||
branches: [master]
|
||||
paths:
|
||||
- 'roles/ssh_hardening/**'
|
||||
- 'molecule/ssh_hardening_custom_tests/**'
|
||||
@@ -25,16 +23,12 @@ jobs:
|
||||
matrix:
|
||||
molecule_distro:
|
||||
- centos7
|
||||
- centosstream8
|
||||
- centosstream9
|
||||
- rocky8
|
||||
- rocky9
|
||||
- fedora
|
||||
- ubuntu1804
|
||||
- ubuntu2004
|
||||
- ubuntu2204
|
||||
- debian9
|
||||
- debian10
|
||||
- debian11
|
||||
- amazon
|
||||
# - arch # needs to be fixed
|
||||
# - opensuse_tumbleweed # baseline is not compatible with suse
|
||||
|
||||
@@ -1,4 +1,3 @@
|
||||
.kitchen
|
||||
hosts
|
||||
Gemfile.lock
|
||||
.venv
|
||||
-100
@@ -1,105 +1,5 @@
|
||||
# Changelog
|
||||
|
||||
## [8.2.1](https://github.com/dev-sec/ansible-collection-hardening/tree/8.2.1) (2022-10-20)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.2.0...8.2.1)
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- do not manage trusted user ca keys if none exist [\#580](https://github.com/dev-sec/ansible-collection-hardening/pull/580) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([hollow](https://github.com/hollow))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- Trying to run the os\_hardening on Debian 11, but fails on privilege escalation [\#587](https://github.com/dev-sec/ansible-collection-hardening/issues/587)
|
||||
- auditd increasing logfiles [\#586](https://github.com/dev-sec/ansible-collection-hardening/issues/586)
|
||||
- Path to nginx.conf should be configurable in a variable [\#577](https://github.com/dev-sec/ansible-collection-hardening/issues/577)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- run tests only on pushes to master or to PRs [\#581](https://github.com/dev-sec/ansible-collection-hardening/pull/581) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [8.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.2.0) (2022-09-08)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.1.0...8.2.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Add nginx variables for config-path and owner/group [\#578](https://github.com/dev-sec/ansible-collection-hardening/pull/578) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([hagenbauer](https://github.com/hagenbauer))
|
||||
- add centos \>8 Support [\#573](https://github.com/dev-sec/ansible-collection-hardening/pull/573) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([sbaerlocher](https://github.com/sbaerlocher))
|
||||
- add always-tag to include so other tags can be used [\#569](https://github.com/dev-sec/ansible-collection-hardening/pull/569) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- Bug using os\_hardening "tags" [\#567](https://github.com/dev-sec/ansible-collection-hardening/issues/567)
|
||||
|
||||
## [8.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.1.0) (2022-08-26)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.0.0...8.1.0)
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- dev-sec CI bot should not update CHANGELOG.md in fork repository [\#566](https://github.com/dev-sec/ansible-collection-hardening/issues/566)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- update supported OS in meta and fix linting [\#572](https://github.com/dev-sec/ansible-collection-hardening/pull/572) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- fix misleading comment [\#571](https://github.com/dev-sec/ansible-collection-hardening/pull/571) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([donestefan](https://github.com/donestefan))
|
||||
- only run release actions on upstream-repo [\#568](https://github.com/dev-sec/ansible-collection-hardening/pull/568) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [8.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.0.0) (2022-08-22)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.16.0...8.0.0)
|
||||
|
||||
**Breaking changes:**
|
||||
|
||||
- change default to allow SFTP [\#564](https://github.com/dev-sec/ansible-collection-hardening/pull/564) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- add possibility to keep .netrc files in users homedir [\#563](https://github.com/dev-sec/ansible-collection-hardening/pull/563) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([PhilippFunk](https://github.com/PhilippFunk))
|
||||
- rework filesystem hardening [\#555](https://github.com/dev-sec/ansible-collection-hardening/pull/555) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([divialth](https://github.com/divialth))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- Error in Task 'Create sshd\_config and set permissions to root/600' [\#565](https://github.com/dev-sec/ansible-collection-hardening/issues/565) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
|
||||
- \[ssh\_hardening\] Debian 11 - Ansible cannot transfer files [\#557](https://github.com/dev-sec/ansible-collection-hardening/issues/557)
|
||||
- Add the old SFTP-Reminder to the stable ssh\_hardening role for ansible [\#521](https://github.com/dev-sec/ansible-collection-hardening/issues/521)
|
||||
|
||||
## [7.16.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.16.0) (2022-08-16)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.15.1...7.16.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- revert debian 9 change, only one tls variable now [\#562](https://github.com/dev-sec/ansible-collection-hardening/pull/562) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- add posibility to run ssh\_hardening as unprivileged user [\#561](https://github.com/dev-sec/ansible-collection-hardening/pull/561) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- add basic support for ubuntu22.04 [\#554](https://github.com/dev-sec/ansible-collection-hardening/pull/554) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
|
||||
- Add full support for Debian 11 [\#538](https://github.com/dev-sec/ansible-collection-hardening/pull/538) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([addianto](https://github.com/addianto))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- Replace default 2048 bits RSA keypair fails on Ubuntu 20.04 [\#459](https://github.com/dev-sec/ansible-collection-hardening/issues/459)
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- os-hardening: yum gpg-check fails if gpg-check already set [\#556](https://github.com/dev-sec/ansible-collection-hardening/issues/556)
|
||||
- Ubuntu 22.04 LTS [\#553](https://github.com/dev-sec/ansible-collection-hardening/issues/553)
|
||||
- Revert nginx ssl-protocol after deprecation of debian9 [\#528](https://github.com/dev-sec/ansible-collection-hardening/issues/528)
|
||||
- Support for Debian 11 [\#527](https://github.com/dev-sec/ansible-collection-hardening/issues/527)
|
||||
- Support baseline-control os-14 [\#507](https://github.com/dev-sec/ansible-collection-hardening/issues/507)
|
||||
|
||||
## [7.15.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.15.1) (2022-07-26)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.15.0...7.15.1)
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- Fix broken mode for /var/log/audit [\#552](https://github.com/dev-sec/ansible-collection-hardening/pull/552) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([hollow](https://github.com/hollow))
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Only run hardening if /var/log/audit exists [\#550](https://github.com/dev-sec/ansible-collection-hardening/pull/550) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([mego22](https://github.com/mego22))
|
||||
|
||||
## [7.15.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.15.0) (2022-07-11)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.3...7.15.0)
|
||||
|
||||
@@ -11,10 +11,10 @@
|
||||
This collection provides battle tested hardening for:
|
||||
|
||||
- Linux operating systems:
|
||||
- CentOS 7
|
||||
- CentOS 7/8
|
||||
- Rocky Linux 8
|
||||
- Debian 10/11
|
||||
- Ubuntu 18.04/20.04/22.04
|
||||
- Debian 9/10
|
||||
- Ubuntu 16.04/18.04/20.04
|
||||
- Amazon Linux (some roles supported)
|
||||
- Arch Linux (some roles supported)
|
||||
- Fedora (some roles supported)
|
||||
@@ -38,7 +38,7 @@ The roles are now part of the hardening-collection.
|
||||
We have kept the old releases of the `os-hardening` role in this repository, so you can find the them by exploring older tags.
|
||||
The last release of the standalone role was [6.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/6.2.0).
|
||||
|
||||
The other roles are in separate archives repositories:
|
||||
The other roles are in separate archives repositories
|
||||
|
||||
- [apache_hardening](https://github.com/dev-sec/ansible-apache-hardening)
|
||||
- [mysql_hardening](https://github.com/dev-sec/ansible-mysql-hardening)
|
||||
@@ -86,8 +86,8 @@ See the [changelog](https://github.com/dev-sec/ansible-os-hardening/tree/master/
|
||||
|
||||
Todos:
|
||||
|
||||
- Work on [apache_hardening](roles/apache_hardening/) and [windows_hardening](roles/windows_hardening/)
|
||||
- Add support for more operating systems
|
||||
- Work on [apache_hardening](roles/apache_hardening/) and [windows_hardening](roles/windows_hardening/).
|
||||
- Add support for more operating systems,
|
||||
|
||||
## More information
|
||||
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
namespace: devsec
|
||||
name: hardening
|
||||
version: 8.2.0
|
||||
version: 7.15.0
|
||||
readme: README.md
|
||||
authors:
|
||||
- dev-sec <[email protected]>
|
||||
|
||||
@@ -2,8 +2,6 @@
|
||||
- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
|
||||
hosts: all
|
||||
become: true
|
||||
collections:
|
||||
- devsec.hardening
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
|
||||
@@ -8,20 +8,6 @@
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
||||
tasks:
|
||||
- name: Use Python 3 on Debian 11
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when:
|
||||
- ansible_distribution == 'Debian'
|
||||
- ansible_distribution_major_version|int >= 11
|
||||
|
||||
- name: Use Python 2 on Debian 10
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python
|
||||
when:
|
||||
- ansible_distribution == 'Debian'
|
||||
- ansible_distribution_major_version|int == 10
|
||||
|
||||
- name: Run the equivalent of "apt-get update && apt-get upgrade"
|
||||
apt:
|
||||
name: "*"
|
||||
@@ -56,7 +42,6 @@
|
||||
- ansible_distribution != "Ubuntu"
|
||||
- ansible_distribution_major_version|int < 20
|
||||
|
||||
|
||||
- include_role:
|
||||
name: dev-sec.mysql
|
||||
|
||||
|
||||
@@ -27,7 +27,6 @@
|
||||
os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
|
||||
os_filesystem_whitelist: []
|
||||
os_yum_repo_file_whitelist: ['foo.repo']
|
||||
os_netrc_enabled: false
|
||||
sysctl_config:
|
||||
net.ipv4.ip_forward: 0
|
||||
net.ipv6.conf.all.forwarding: 0
|
||||
|
||||
@@ -58,7 +58,3 @@
|
||||
- name: include YUM prepare tasks
|
||||
include_tasks: prepare_tasks/yum.yml
|
||||
when: ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: include YUM prepare tasks
|
||||
include_tasks: prepare_tasks/netrc.yml
|
||||
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
- name: create '.netrc' in /root
|
||||
ansible.builtin.copy:
|
||||
dest: '/root/.netrc'
|
||||
mode: '0600'
|
||||
content: |
|
||||
machine localhost
|
||||
login root
|
||||
password ipsum
|
||||
@@ -37,9 +37,6 @@
|
||||
name: procps
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
|
||||
- name: include netrc tests
|
||||
include_tasks: verify_tasks/netrc.yml
|
||||
|
||||
- name: include PAM tests
|
||||
include_tasks: verify_tasks/pam.yml
|
||||
when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
|
||||
|
||||
@@ -1,19 +0,0 @@
|
||||
---
|
||||
- name: test that .netrc in root homedir exists
|
||||
ansible.builtin.file:
|
||||
path: '/root/.netrc'
|
||||
state: file
|
||||
register: result_test_netrc
|
||||
|
||||
- name: output result if .netrc for user root exists
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- "result_test_netrc.state == 'file'"
|
||||
fail_msg: ".netrc in /root/ not present"
|
||||
success_msg: ".netrc exists in /root/"
|
||||
|
||||
- name: delete '.netrc' in /root
|
||||
ansible.builtin.file:
|
||||
path: '/root/.netrc'
|
||||
state: absent
|
||||
when: result_test_netrc.state == 'file'
|
||||
@@ -10,7 +10,7 @@
|
||||
- devsec.hardening
|
||||
tasks:
|
||||
- name: override for arch
|
||||
set_fact:
|
||||
set_fact:
|
||||
os_mnt_boot_enabled: false
|
||||
when: ansible_facts.os_family == 'Archlinux'
|
||||
- include_role:
|
||||
@@ -21,3 +21,14 @@
|
||||
os_yum_repo_file_whitelist: ['foo.repo']
|
||||
os_mnt_boot_enabled: true
|
||||
os_mnt_boot_src: "/dev/vda1"
|
||||
os_mnt_var_log_audit_enabled: true
|
||||
os_auditd_enabled: true
|
||||
os_mnt_boot_enabled: true
|
||||
os_mnt_dev_enabled: true
|
||||
os_mnt_dev_shm_enabled: true
|
||||
os_mnt_home_enabled: true
|
||||
os_mnt_run_enabled: true
|
||||
os_mnt_var_enabled: true
|
||||
os_mnt_var_log_enabled: true
|
||||
os_mnt_var_log_audit_enabled: true
|
||||
os_mnt_var_tmp_enabled: true
|
||||
@@ -1,6 +1,7 @@
|
||||
---
|
||||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: all
|
||||
become: true
|
||||
environment:
|
||||
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
||||
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
||||
@@ -10,5 +11,3 @@
|
||||
tasks:
|
||||
- include_role:
|
||||
name: ssh_hardening
|
||||
vars:
|
||||
sftp_enabled: false
|
||||
@@ -29,12 +29,6 @@ provisioner:
|
||||
defaults:
|
||||
interpreter_python: auto_silent
|
||||
callback_whitelist: profile_tasks, timer, yaml
|
||||
inventory:
|
||||
host_vars:
|
||||
# https://molecule.readthedocs.io/en/latest/examples.html#docker-with-non-privileged-user
|
||||
# setting for the platform instance named 'instance'
|
||||
instance:
|
||||
ansible_user: ansible
|
||||
verifier:
|
||||
name: ansible
|
||||
|
||||
|
||||
@@ -42,7 +42,7 @@
|
||||
shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
|
||||
|
||||
- name: Execute cinc-auditor tests
|
||||
command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/simplify_crypto.zip"
|
||||
command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip"
|
||||
register: test_results
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
|
||||
@@ -48,6 +48,7 @@
|
||||
ssh_print_last_log: true
|
||||
ssh_banner: true
|
||||
ssh_server_password_login: true
|
||||
sftp_enabled: true
|
||||
sftp_chroot: true
|
||||
# ssh_server_enabled: false
|
||||
ssh_server_ports:
|
||||
|
||||
@@ -8,17 +8,15 @@ galaxy_info:
|
||||
platforms:
|
||||
- name: EL
|
||||
versions:
|
||||
- "7"
|
||||
- "8"
|
||||
- 6
|
||||
- 7
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- xenial
|
||||
- bionic
|
||||
- focal
|
||||
- jammy
|
||||
- name: Debian
|
||||
versions:
|
||||
- bullseye
|
||||
- buster
|
||||
- jessie
|
||||
- name: Amazon
|
||||
- name: Fedora
|
||||
galaxy_tags:
|
||||
|
||||
File renamed without changes.
@@ -0,0 +1,9 @@
|
||||
---
|
||||
mysql_daemon: mariadb
|
||||
mysql_hardening_mysql_conf_file: '/etc/my.cnf'
|
||||
mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
|
||||
|
||||
mysql_cnf_owner: 'root' # owner of /etc/mysql/*.cnf files
|
||||
mysql_cnf_group: 'mysql' # owner of /etc/mysql/*.cnf files
|
||||
|
||||
mysql_hardening_group: 'mysql'
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
mysql_daemon: mariadb
|
||||
mysql_hardening_mysql_conf_file: '/etc/my.cnf'
|
||||
mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
|
||||
|
||||
mysql_cnf_owner: 'root' # owner of /etc/mysql/*.cnf files
|
||||
mysql_cnf_group: 'mysql' # owner of /etc/mysql/*.cnf files
|
||||
|
||||
mysql_hardening_group: 'mysql'
|
||||
File renamed without changes.
@@ -0,0 +1,10 @@
|
||||
---
|
||||
mysql_daemon: mysql
|
||||
|
||||
mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
|
||||
mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
|
||||
|
||||
mysql_cnf_owner: 'root' # owner of /etc/mysql/*.cnf files
|
||||
mysql_cnf_group: 'mysql' # owner of /etc/mysql/*.cnf files
|
||||
|
||||
mysql_hardening_group: 'adm'
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
mysql_daemon: mysql
|
||||
|
||||
mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
|
||||
mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
|
||||
|
||||
mysql_cnf_owner: 'root' # owner of /etc/mysql/*.cnf files
|
||||
mysql_cnf_group: 'mysql' # owner of /etc/mysql/*.cnf files
|
||||
|
||||
mysql_hardening_group: 'adm'
|
||||
@@ -75,18 +75,6 @@ It works with the following nginx-roles, including, but not limited to:
|
||||
- [nginx_dh_size][]
|
||||
- Default: `2048`
|
||||
- Description: Specifies the length of DH parameters for EDH ciphers.
|
||||
- [nginx_configuration_dir][]
|
||||
- default: "/etc/nginx"
|
||||
- Description: The main location for all nginx configuration files
|
||||
- [nginx_configuration_hardening_dir][]
|
||||
- default: "/etc/nginx"
|
||||
- Description: The location for the nginx hardening configuration file (Could be different e.g. when used in jails)
|
||||
- [nginx_owner_user][]
|
||||
- default: "root"
|
||||
- Description: The owner user of the nginx configuration files
|
||||
- [nginx_owner_group][]
|
||||
- default: "root"
|
||||
- Description: The owner group of the nginx configuration files
|
||||
|
||||
## Example Playbook
|
||||
|
||||
|
||||
@@ -11,10 +11,6 @@ nginx_client_header_timeout: "10"
|
||||
nginx_send_timeout: "10"
|
||||
nginx_limit_conn_zone: "$binary_remote_addr zone=default:10m"
|
||||
nginx_limit_conn: "default 5"
|
||||
nginx_configuration_dir: "/etc/nginx"
|
||||
nginx_configuration_hardening_dir: "/etc/nginx"
|
||||
nginx_owner_user: "root"
|
||||
nginx_owner_group: "root"
|
||||
nginx_add_header:
|
||||
# avoid clickjacking
|
||||
- X-Frame-Options SAMEORIGIN
|
||||
@@ -27,7 +23,6 @@ nginx_add_header:
|
||||
|
||||
nginx_set_cookie_flag: "* HttpOnly secure"
|
||||
nginx_ssl_prefer_server_ciphers: "on"
|
||||
nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
|
||||
nginx_ssl_ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
|
||||
nginx_ssl_session_tickets: "off"
|
||||
nginx_dh_size: "4096"
|
||||
@@ -8,17 +8,16 @@ galaxy_info:
|
||||
platforms:
|
||||
- name: EL
|
||||
versions:
|
||||
- "7"
|
||||
- "8"
|
||||
- 6
|
||||
- 7
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- xenial
|
||||
- bionic
|
||||
- focal
|
||||
- jammy
|
||||
- name: Debian
|
||||
versions:
|
||||
- stretch
|
||||
- buster
|
||||
- bullseye
|
||||
galaxy_tags:
|
||||
- system
|
||||
- security
|
||||
|
||||
@@ -1,77 +1,100 @@
|
||||
---
|
||||
- name: Fetch OS dependent variables
|
||||
include_vars:
|
||||
file: '{{ item }}'
|
||||
name: 'os_vars'
|
||||
with_first_found:
|
||||
- files:
|
||||
- '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
|
||||
- '{{ ansible_facts.distribution }}.yml'
|
||||
- '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
|
||||
- '{{ ansible_facts.os_family }}.yml'
|
||||
skip: true
|
||||
tags: always
|
||||
|
||||
# we only override variables with our default, if they have not been specified already
|
||||
# by default the lookup functions finds all varnames containing the string, therefore
|
||||
# we add ^ and $ to denote start and end of string, so this returns only exact matches
|
||||
- name: Set OS dependent variables, if not already defined by user # noqa var-naming
|
||||
set_fact:
|
||||
'{{ item.key }}': '{{ item.value }}'
|
||||
when: "not lookup('varnames', '^' + item.key + '$')"
|
||||
with_dict: '{{ os_vars }}'
|
||||
tags: always
|
||||
|
||||
- name: Create additional configuration
|
||||
template:
|
||||
src: "hardening.conf.j2"
|
||||
dest: "{{ nginx_configuration_dir }}/conf.d/90.hardening.conf"
|
||||
dest: "/etc/nginx/conf.d/90.hardening.conf"
|
||||
mode: '0600'
|
||||
owner: "{{ nginx_owner_user }}"
|
||||
group: "{{ nginx_owner_group }}"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
notify: Restart nginx
|
||||
|
||||
- name: Change configuration in main nginx.conf
|
||||
lineinfile:
|
||||
dest: "{{ nginx_configuration_dir }}/nginx.conf"
|
||||
dest: "/etc/nginx/nginx.conf"
|
||||
regexp: '^\s*server_tokens'
|
||||
line: " server_tokens {{ nginx_server_tokens }};"
|
||||
insertafter: "http {"
|
||||
mode: '0640'
|
||||
owner: "{{ nginx_owner_user }}"
|
||||
group: "{{ nginx_owner_group }}"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
notify: Restart nginx
|
||||
|
||||
- name: Change ssl_protocols in main nginx.conf
|
||||
lineinfile:
|
||||
dest: "{{ nginx_configuration_dir }}/nginx.conf"
|
||||
dest: "/etc/nginx/nginx.conf"
|
||||
regexp: '^\s*ssl_protocols'
|
||||
line: " ssl_protocols {{ nginx_ssl_protocols }};"
|
||||
insertafter: "http {"
|
||||
mode: '0640'
|
||||
owner: "{{ nginx_owner_user }}"
|
||||
group: "{{ nginx_owner_group }}"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
notify: Restart nginx
|
||||
|
||||
- name: Change ssl_prefer_server_ciphers in main nginx.conf
|
||||
lineinfile:
|
||||
dest: "{{ nginx_configuration_dir }}/nginx.conf"
|
||||
dest: "/etc/nginx/nginx.conf"
|
||||
regexp: '^\s*ssl_prefer_server_ciphers'
|
||||
line: " ssl_prefer_server_ciphers {{ nginx_ssl_prefer_server_ciphers }};"
|
||||
insertafter: "http {"
|
||||
mode: '0640'
|
||||
owner: "{{ nginx_owner_user }}"
|
||||
group: "{{ nginx_owner_group }}"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
notify: Restart nginx
|
||||
|
||||
- name: Change client_max_body_size in main nginx.conf
|
||||
lineinfile:
|
||||
dest: "{{ nginx_configuration_dir }}/nginx.conf"
|
||||
dest: "/etc/nginx/nginx.conf"
|
||||
regexp: '^\s*client_max_body_size'
|
||||
line: " client_max_body_size {{ nginx_client_max_body_size }};"
|
||||
insertafter: "http {"
|
||||
mode: '0640'
|
||||
owner: "{{ nginx_owner_user }}"
|
||||
group: "{{ nginx_owner_group }}"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
notify: Restart nginx
|
||||
|
||||
- name: Change client_body_buffer_size in main nginx.conf
|
||||
lineinfile:
|
||||
dest: "{{ nginx_configuration_dir }}/nginx.conf"
|
||||
dest: "/etc/nginx/nginx.conf"
|
||||
regexp: '^\s*client_body_buffer_size'
|
||||
line: " client_body_buffer_size {{ nginx_client_body_buffer_size }};"
|
||||
insertafter: "http {"
|
||||
mode: '0640'
|
||||
owner: "{{ nginx_owner_user }}"
|
||||
group: "{{ nginx_owner_group }}"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
notify: Restart nginx
|
||||
|
||||
- name: Change keepalive_timeout in main nginx.conf
|
||||
lineinfile:
|
||||
dest: "{{ nginx_configuration_dir }}/nginx.conf"
|
||||
dest: "/etc/nginx/nginx.conf"
|
||||
regexp: '^\s*keepalive_timeout'
|
||||
line: " keepalive_timeout {{ nginx_keepalive_timeout }};"
|
||||
insertafter: "http {"
|
||||
mode: '0640'
|
||||
owner: "{{ nginx_owner_user }}"
|
||||
group: "{{ nginx_owner_group }}"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
notify: Restart nginx
|
||||
|
||||
- name: Remove default.conf
|
||||
@@ -81,14 +104,14 @@
|
||||
when: nginx_remove_default_site
|
||||
notify: Restart nginx
|
||||
loop:
|
||||
- "{{ nginx_configuration_dir }}/conf.d/default.conf"
|
||||
- "{{ nginx_configuration_dir }}/sites-enabled/default"
|
||||
- "/etc/nginx/conf.d/default.conf"
|
||||
- "/etc/nginx/sites-enabled/default"
|
||||
|
||||
- name: Generate dh group
|
||||
openssl_dhparam:
|
||||
path: "{{ nginx_configuration_dir }}/dh{{ nginx_dh_size }}.pem"
|
||||
path: "/etc/nginx/dh{{ nginx_dh_size }}.pem"
|
||||
size: "{{ nginx_dh_size }}"
|
||||
mode: '0640'
|
||||
owner: "{{ nginx_owner_user }}"
|
||||
group: "{{ nginx_owner_group }}"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
notify: Restart nginx
|
||||
@@ -11,7 +11,7 @@ limit_conn_zone {{ nginx_limit_conn_zone }};
|
||||
limit_conn {{ nginx_limit_conn }};
|
||||
ssl_ciphers '{{ nginx_ssl_ciphers }}';
|
||||
ssl_session_tickets {{ nginx_ssl_session_tickets }};
|
||||
ssl_dhparam {{ nginx_configuration_hardening_dir }}/dh{{ nginx_dh_size }}.pem;
|
||||
ssl_dhparam /etc/nginx/dh{{ nginx_dh_size }}.pem;
|
||||
{% for header in nginx_add_header %}
|
||||
add_header {{ header }};
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
nginx_ssl_protocols: "TLSv1.2"
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
|
||||
+20
-101
@@ -300,14 +300,8 @@ We know that this is the case on Raspberry Pi.
|
||||
- Default: `rw,nosuid,nodev,noexec`
|
||||
- Description: Configure mount options for /boot
|
||||
- `os_mnt_boot_filesystem`
|
||||
- Default: `""`
|
||||
- Description: Configure file system for fstab entry /boot. If empty, the current file system type will be used.
|
||||
- `os_mnt_boot_dump`
|
||||
- Default: ext3 + ext4 `1` / other `0`
|
||||
- Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
|
||||
- `os_mnt_boot_passno`
|
||||
- Default: ext3 + ext4 `2` / other `0`
|
||||
- Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
|
||||
- Default: `ext4`
|
||||
- Description: Configure file system for fstab entry /boot
|
||||
- `os_mnt_dev_dir_mode`
|
||||
- Default: `0755`
|
||||
- Description: Set default perimissions for /dev
|
||||
@@ -321,14 +315,8 @@ We know that this is the case on Raspberry Pi.
|
||||
- Default: `'rw,nosuid,noexec'`
|
||||
- Description: Configure mount options for /dev
|
||||
- `os_mnt_dev_filesystem`
|
||||
- Default: `devtmpfs`
|
||||
- Default: `ext4`
|
||||
- Description: Configure file system for fstab entry /dev
|
||||
- `os_mnt_dev_dump`
|
||||
- Default: `0`
|
||||
- Description: Configure dump for fstab entry /var/tmp.
|
||||
- `os_mnt_dev_passno`
|
||||
- Default: `0`
|
||||
- Description: Configure passno for fstab entry /var/tmp.
|
||||
- `os_mnt_dev_shm_dir_mode`
|
||||
- Default: `1777`
|
||||
- Description: Set default perimissions for /dev/shm
|
||||
@@ -342,14 +330,8 @@ We know that this is the case on Raspberry Pi.
|
||||
- Default: `rw,nosuid,nodev,noexec`
|
||||
- Description: Configure mount options for /dev/shm
|
||||
- `os_mnt_dev_shm_filesystem`
|
||||
- Default: `tmpfs`
|
||||
- Default: `ext4`
|
||||
- Description: Configure file system for fstab entry /dev/shm
|
||||
- `os_mnt_dev_shm_dump`
|
||||
- Default: `0`
|
||||
- Description: Configure dump for fstab entry /var/tmp.
|
||||
- `os_mnt_dev_shm_passno`
|
||||
- Default: `0`
|
||||
- Description: Configure passno for fstab entry /var/tmp.
|
||||
- `os_mnt_home_dir_mode`
|
||||
- Default: `0755`
|
||||
- Description: Set default perimissions for /home
|
||||
@@ -358,19 +340,13 @@ We know that this is the case on Raspberry Pi.
|
||||
- Description: Set to true to configure /home mountpoint
|
||||
- `os_mnt_home_src`
|
||||
- Default: `""`
|
||||
- Description: Set mount source for /home. If empty, the current file system source device will be used.
|
||||
- Description: Set mount source for /home
|
||||
- `os_mnt_home_options`
|
||||
- Default: `rw,nosuid,nodev`
|
||||
- Description: Configure mount options for /home
|
||||
- `os_mnt_home_filesystem`
|
||||
- Default: `""`
|
||||
- Description: Configure file system for fstab entry /home. If empty, the current file system type will be used.
|
||||
- `os_mnt_home_dump`
|
||||
- Default: ext3 + ext4 `1` / other `0`
|
||||
- Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
|
||||
- `os_mnt_home_passno`
|
||||
- Default: ext3 + ext4 `2` / other `0`
|
||||
- Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
|
||||
- Default: `ext4`
|
||||
- Description: Configure file system for fstab entry /home
|
||||
- `os_mnt_run_dir_mode`
|
||||
- Default: `0755`
|
||||
- Description: Set default perimissions for /run
|
||||
@@ -384,35 +360,8 @@ We know that this is the case on Raspberry Pi.
|
||||
- Default: `rw,nosuid,nodev`
|
||||
- Description: Configure mount options for /run
|
||||
- `os_mnt_run_filesystem`
|
||||
- Default: `tmpfs`
|
||||
- Default: `ext4`
|
||||
- Description: Configure file system for fstab entry /run
|
||||
- `os_mnt_run_dump`
|
||||
- Default: `0`
|
||||
- Description: Configure dump for fstab entry /var/tmp.
|
||||
- `os_mnt_run_passno`
|
||||
- Default: `0`
|
||||
- Description: Configure passno for fstab entry /var/tmp.
|
||||
- `os_mnt_tmp_dir_mode`
|
||||
- Default: `1777`
|
||||
- Description: Set default perimissions for /tmp
|
||||
- `os_mnt_tmp_enabled`
|
||||
- Default: `false`
|
||||
- Description: Set to true to configure /tmp mountpoint
|
||||
- `os_mnt_tmp_src`
|
||||
- Default: `""`
|
||||
- Description: Set mount source for /tmp. If empty, the current file system source device will be used.
|
||||
- `os_mnt_tmp_options`
|
||||
- Default: `rw,nosuid,nodev,noexec`
|
||||
- Description: Configure mount options for /tmp
|
||||
- `os_mnt_tmp_filesystem`
|
||||
- Default: `""`
|
||||
- Description: Configure file system for fstab entry /tmp. If empty, the current file system type will be used.
|
||||
- `os_mnt_tmp_dump`
|
||||
- Default: ext3 + ext4 `1` / other `0`
|
||||
- Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
|
||||
- `os_mnt_tmp_passno`
|
||||
- Default: ext3 + ext4 `2` / other `0`
|
||||
- Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
|
||||
- `os_mnt_var_dir_mode`
|
||||
- Default: `0755`
|
||||
- Description: Set default perimissions for /var
|
||||
@@ -421,19 +370,13 @@ We know that this is the case on Raspberry Pi.
|
||||
- Description: Set to true to configure /var mountpoint
|
||||
- `os_mnt_var_src`
|
||||
- Default: `""`
|
||||
- Description: Set mount source for /var. If empty, the current file system source device will be used.
|
||||
- Description: Set mount source for /var
|
||||
- `os_mnt_var_options`
|
||||
- Default: `rw,nosuid,nodev`
|
||||
- Description: Configure mount options for /var
|
||||
- `os_mnt_var_filesystem`
|
||||
- Default: `""`
|
||||
- Description: Configure file system for fstab entry /var. If empty, the current file system type will be used.
|
||||
- `os_mnt_var_dump`
|
||||
- Default: ext3 + ext4 `1` / other `0`
|
||||
- Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
|
||||
- `os_mnt_var_passno`
|
||||
- Default: ext3 + ext4 `2` / other `0`
|
||||
- Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
|
||||
- Default: `ext4`
|
||||
- Description: Configure file system for fstab entry /var
|
||||
- `os_mnt_var_log_dir_mode`
|
||||
- Default: `0755`
|
||||
- Description: Set default perimissions for /var/log
|
||||
@@ -442,19 +385,13 @@ We know that this is the case on Raspberry Pi.
|
||||
- Description: Set to true to configure /var/log mountpoint
|
||||
- `os_mnt_var_log_src`
|
||||
- Default: `""`
|
||||
- Description: Set mount source for /var/log. If empty, the current file system source device will be used.
|
||||
- Description: Set mount source for /var/log
|
||||
- `os_mnt_var_log_options`
|
||||
- Default: `rw,nosuid,nodev,noexec`
|
||||
- Description: Configure mount options for /var/log
|
||||
- `os_mnt_var_log_filesystem`
|
||||
- Default: `""`
|
||||
- Description: Configure file system for fstab entry /var/log. If empty, the current file system type will be used.
|
||||
- `os_mnt_var_log_dump`
|
||||
- Default: ext3 + ext4 `1` / other `0`
|
||||
- Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
|
||||
- `os_mnt_var_log_passno`
|
||||
- Default: ext3 + ext4 `2` / other `0`
|
||||
- Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
|
||||
- Default: `ext4`
|
||||
- Description: Configure file system for fstab entry /var/log
|
||||
- `os_mnt_var_log_audit_dir_mode`
|
||||
- Default: `0640`
|
||||
- Description: Set default perimissions for /var/log/audit
|
||||
@@ -463,19 +400,13 @@ We know that this is the case on Raspberry Pi.
|
||||
- Description: Set to true to configure /var/log/audit mountpoint
|
||||
- `os_mnt_var_log_audit_src`
|
||||
- Default: `""`
|
||||
- Description: Set mount source for /var/log/audit. If empty, the current file system source device will be used.
|
||||
- Description: Set mount source for /var/log/audit
|
||||
- `os_mnt_var_log_audit_options`
|
||||
- Default: `rw,nosuid,nodev,noexec`
|
||||
- Description: Configure mount options for /var/log/audit
|
||||
- `os_mnt_var_log_audit_filesystem`
|
||||
- Default: `""`
|
||||
- Description: Configure file system for fstab entry /var/log/audit. If empty, the current file system type will be used.
|
||||
- `os_mnt_var_log_audit_dump`
|
||||
- Default: ext3 + ext4 `1` / other `0`
|
||||
- Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
|
||||
- `os_mnt_var_log_audit_passno`
|
||||
- Default: ext3 + ext4 `2` / other `0`
|
||||
- Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
|
||||
- Default: `ext4`
|
||||
- Description: Configure file system for fstab entry /var/log/audit
|
||||
- `os_mnt_var_tmp_dir_mode`
|
||||
- Default: `1777`
|
||||
- Description: Set default perimissions for /var/tmp
|
||||
@@ -484,25 +415,13 @@ We know that this is the case on Raspberry Pi.
|
||||
- Description: Set to true to configure /var/tmp mountpoint
|
||||
- `os_mnt_var_tmp_src`
|
||||
- Default: `""`
|
||||
- Description: Set mount source for /var/tmp. If empty, the current file system source device will be used.
|
||||
- Description: Set mount source for /var/tmp
|
||||
- `os_mnt_var_tmp_options`
|
||||
- Default: `rw,nosuid,nodev,noexec`
|
||||
- Description: Configure mount options for /var/tmp
|
||||
- `os_mnt_var_tmp_filesystem`
|
||||
- Default: `""`
|
||||
- Description: Configure file system for fstab entry /var/tmp. If empty, the current file system type will be used.
|
||||
- `os_mnt_var_tmp_dump`
|
||||
- Default: ext3 + ext4 `1` / other `0`
|
||||
- Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
|
||||
- `os_mnt_var_tmp_passno`
|
||||
- Default: ext3 + ext4 `2` / other `0`
|
||||
- Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
|
||||
- `os_netrc_enabled`
|
||||
- Default: `True`
|
||||
- Description: Configure filesystem for existence of .netrc file in homedir
|
||||
- `os_netrc_whitelist_user`
|
||||
- Default: ``
|
||||
- Description: Add list of user to allow creation of .netrc in users homedir
|
||||
- Default: `ext4`
|
||||
- Description: Configure file system for fstab entry /var/tmp
|
||||
|
||||
## Packages
|
||||
|
||||
|
||||
@@ -9,7 +9,7 @@ os_auth_lockout_time: 600 # Seconds (600 = 10min)
|
||||
os_auth_timeout: 60
|
||||
os_auth_allow_homeless: false
|
||||
os_auth_pam_passwdqc_enable: true
|
||||
os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8' # Used in Debian
|
||||
os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8' # Used in RHEL6
|
||||
os_auth_pam_pwquality_options: 'try_first_pass retry=3 authtok_type=' # Used in RHEL7 and RHEL8
|
||||
os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]
|
||||
|
||||
@@ -390,84 +390,52 @@ os_mnt_boot_dir_mode: '0700'
|
||||
os_mnt_boot_enabled: false
|
||||
os_mnt_boot_src: ""
|
||||
os_mnt_boot_options: 'rw,nosuid,nodev,noexec'
|
||||
os_mnt_boot_filesystem: ""
|
||||
os_mnt_boot_dump: ""
|
||||
os_mnt_boot_passno: ""
|
||||
os_mnt_boot_filesystem: 'ext4'
|
||||
|
||||
os_mnt_dev_dir_mode: '0755'
|
||||
os_mnt_dev_enabled: true
|
||||
os_mnt_dev_src: "devtmpfs"
|
||||
os_mnt_dev_options: 'rw,nosuid,noexec'
|
||||
os_mnt_dev_filesystem: "devtmpfs"
|
||||
os_mnt_dev_dump: ""
|
||||
os_mnt_dev_passno: ""
|
||||
|
||||
os_mnt_dev_shm_dir_mode: '1777'
|
||||
os_mnt_dev_shm_enabled: true
|
||||
os_mnt_dev_shm_src: "tmpfs"
|
||||
os_mnt_dev_shm_options: 'rw,nosuid,nodev,noexec'
|
||||
os_mnt_dev_shm_filesystem: "tmpfs"
|
||||
os_mnt_dev_shm_dump: ""
|
||||
os_mnt_dev_shm_passno: ""
|
||||
|
||||
os_mnt_home_dir_mode: '0755'
|
||||
os_mnt_home_enabled: false
|
||||
os_mnt_home_src: ""
|
||||
os_mnt_home_options: 'rw,nosuid,nodev'
|
||||
os_mnt_home_filesystem: ""
|
||||
os_mnt_home_dump: ""
|
||||
os_mnt_home_passno: ""
|
||||
os_mnt_home_filesystem: "ext4"
|
||||
|
||||
os_mnt_run_dir_mode: '0755'
|
||||
os_mnt_run_enabled: true
|
||||
os_mnt_run_src: "tmpfs"
|
||||
os_mnt_run_options: 'rw,nosuid,nodev'
|
||||
os_mnt_run_filesystem: "tmpfs"
|
||||
os_mnt_run_dump: ""
|
||||
os_mnt_run_passno: ""
|
||||
|
||||
os_mnt_tmp_dir_mode: '1777'
|
||||
os_mnt_tmp_enabled: false
|
||||
os_mnt_tmp_src: ""
|
||||
os_mnt_tmp_options: 'rw,nosuid,nodev,noexec'
|
||||
os_mnt_tmp_filesystem: ""
|
||||
os_mnt_tmp_dump: ""
|
||||
os_mnt_tmp_passno: ""
|
||||
|
||||
os_mnt_var_dir_mode: '0755'
|
||||
os_mnt_var_enabled: false
|
||||
os_mnt_var_src: ""
|
||||
os_mnt_var_options: 'rw,nosuid,nodev'
|
||||
os_mnt_var_filesystem: ""
|
||||
os_mnt_var_dump: ""
|
||||
os_mnt_var_passno: ""
|
||||
os_mnt_var_filesystem: "ext4"
|
||||
|
||||
os_mnt_var_log_dir_mode: '0755'
|
||||
os_mnt_var_log_enabled: false
|
||||
os_mnt_var_log_src: ""
|
||||
os_mnt_var_log_options: 'rw,nosuid,nodev,noexec'
|
||||
os_mnt_var_log_filesystem: ""
|
||||
os_mnt_var_log_dump: ""
|
||||
os_mnt_var_log_passno: ""
|
||||
os_mnt_var_log_filesystem: "ext4"
|
||||
|
||||
os_mnt_var_log_audit_dir_mode: '0700'
|
||||
os_mnt_var_log_audit_dir_mode: '0640'
|
||||
os_mnt_var_log_audit_enabled: false
|
||||
os_mnt_var_log_audit_src: ""
|
||||
os_mnt_var_log_audit_options: 'rw,nosuid,nodev,noexec'
|
||||
os_mnt_var_log_audit_filesystem: ""
|
||||
os_mnt_var_log_audit_dump: ""
|
||||
os_mnt_var_log_audit_passno: ""
|
||||
os_mnt_var_log_audit_filesystem: "ext4"
|
||||
|
||||
os_mnt_var_tmp_dir_mode: '1777'
|
||||
os_mnt_var_tmp_enabled: false
|
||||
os_mnt_var_tmp_src: ""
|
||||
os_mnt_var_tmp_options: 'rw,nosuid,nodev,noexec'
|
||||
os_mnt_var_tmp_filesystem: ""
|
||||
os_mnt_var_tmp_dump: ""
|
||||
os_mnt_var_tmp_passno: ""
|
||||
|
||||
#
|
||||
# .netrc User whitelist
|
||||
# keep .netrc file for users in whitelist
|
||||
os_netrc_enabled: true
|
||||
os_netrc_whitelist_user: []
|
||||
os_mnt_var_tmp_filesystem: "ext4"
|
||||
@@ -11,9 +11,3 @@
|
||||
- name: Reload systemd
|
||||
systemd:
|
||||
daemon_reload: true
|
||||
|
||||
- name: Remount filesystems
|
||||
mount:
|
||||
path: "{{ item }}"
|
||||
state: remounted
|
||||
loop: "{{ mountpoints_changed }}"
|
||||
@@ -8,22 +8,21 @@ galaxy_info:
|
||||
platforms:
|
||||
- name: EL
|
||||
versions:
|
||||
- "7"
|
||||
- "8"
|
||||
- 7
|
||||
- 8
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- xenial
|
||||
- bionic
|
||||
- focal
|
||||
- jammy
|
||||
- name: Debian
|
||||
versions:
|
||||
- stretch
|
||||
- buster
|
||||
- bullseye
|
||||
- name: Amazon
|
||||
- name: Fedora
|
||||
- name: ArchLinux
|
||||
- name: Archlinux
|
||||
- name: SmartOS
|
||||
- name: opensuse
|
||||
- name: openSUSE
|
||||
galaxy_tags:
|
||||
- system
|
||||
- security
|
||||
|
||||
@@ -78,10 +78,6 @@
|
||||
tags: rhosts
|
||||
when: os_rhosts_enabled | bool
|
||||
|
||||
- import_tasks: netrc.yml
|
||||
tags: netrc
|
||||
when: os_netrc_enabled | bool
|
||||
|
||||
- import_tasks: yum.yml
|
||||
tags: yum
|
||||
when:
|
||||
|
||||
@@ -1,5 +1,3 @@
|
||||
---
|
||||
- include_tasks: hardening.yml
|
||||
when: os_hardening_enabled | bool
|
||||
tags:
|
||||
- always
|
||||
@@ -6,7 +6,7 @@
|
||||
# also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
|
||||
- name: Find files with write-permissions for group
|
||||
shell: "find -L {{ item }} -perm /go+w -type f" # noqa command-instead-of-shell
|
||||
with_community.general.flattened:
|
||||
with_flattened:
|
||||
- '/usr/local/sbin'
|
||||
- '/usr/local/bin'
|
||||
- '/usr/sbin'
|
||||
@@ -81,26 +81,194 @@
|
||||
opts: '{{ proc_mnt_options }}'
|
||||
state: mounted
|
||||
|
||||
- name: Generate list of current available mounted filesystems on the system
|
||||
set_fact:
|
||||
mountpoints_list: "{{ ansible_mounts | map(attribute='mount') | list }}"
|
||||
- name: Check if boot exists
|
||||
stat:
|
||||
path: /boot
|
||||
register: boot_exists
|
||||
|
||||
- name: Append special devices list to valid mountpoint list
|
||||
set_fact:
|
||||
mountpoints_list: "{{ mountpoints_list + ['/dev', '/dev/shm', '/run'] }}"
|
||||
- name: Mount /boot with hardened options
|
||||
mount:
|
||||
path: /boot
|
||||
src: '{{ os_mnt_boot_src }}'
|
||||
fstype: '{{ os_mnt_boot_filesystem }}'
|
||||
opts: '{{ os_mnt_boot_options }}'
|
||||
state: present
|
||||
register: bootmount
|
||||
when:
|
||||
- os_mnt_boot_enabled | bool
|
||||
- boot_exists.stat.exists | bool
|
||||
|
||||
- name: Minimize access for filesystems
|
||||
include_tasks: minimize_access_fs.yml
|
||||
- name: Harden permissions for /boot directory
|
||||
file:
|
||||
dest: /boot
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: '{{ os_mnt_boot_dir_mode }}'
|
||||
when: boot_exists.stat.exists | bool
|
||||
|
||||
- name: Mount /dev with hardened options
|
||||
mount:
|
||||
path: /dev
|
||||
src: '{{ os_mnt_dev_src }}'
|
||||
fstype: '{{ os_mnt_dev_filesystem }}'
|
||||
opts: '{{ os_mnt_dev_options }}'
|
||||
state: present
|
||||
register: devmount
|
||||
when: os_mnt_dev_enabled | bool
|
||||
|
||||
- name: Harden permissions for /dev directory
|
||||
file:
|
||||
dest: /dev
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: '{{ os_mnt_dev_dir_mode }}'
|
||||
|
||||
- name: Mount /dev/shm with hardened options
|
||||
mount:
|
||||
path: /dev/shm
|
||||
src: '{{ os_mnt_dev_shm_src }}'
|
||||
fstype: '{{ os_mnt_dev_shm_filesystem }}'
|
||||
opts: '{{ os_mnt_dev_shm_options }}'
|
||||
state: present
|
||||
register: devshmmount
|
||||
when: os_mnt_dev_shm_enabled | bool
|
||||
|
||||
- name: Harden permissions for /dev/shm directory
|
||||
file:
|
||||
dest: /dev/shm
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: '{{ os_mnt_dev_shm_dir_mode }}'
|
||||
|
||||
- name: Mount /home with hardened options
|
||||
mount:
|
||||
path: /home
|
||||
src: '{{ os_mnt_home_src }}'
|
||||
fstype: '{{ os_mnt_home_filesystem }}'
|
||||
opts: '{{ os_mnt_home_options }}'
|
||||
state: present
|
||||
register: homemount
|
||||
when: os_mnt_home_enabled | bool
|
||||
|
||||
- name: Harden permissions for /home directory
|
||||
file:
|
||||
dest: /home
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: '{{ os_mnt_home_dir_mode }}'
|
||||
|
||||
- name: Mount /run with hardened options
|
||||
mount:
|
||||
path: /run
|
||||
src: '{{ os_mnt_run_src }}'
|
||||
fstype: '{{ os_mnt_run_filesystem }}'
|
||||
opts: '{{ os_mnt_run_options }}'
|
||||
state: present
|
||||
register: runmount
|
||||
when: os_mnt_run_enabled | bool
|
||||
|
||||
- name: Harden permissions for /run directory
|
||||
file:
|
||||
dest: /run
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: '{{ os_mnt_run_dir_mode }}'
|
||||
|
||||
- name: Mount /var with hardened options
|
||||
mount:
|
||||
path: /var
|
||||
src: '{{ os_mnt_var_src }}'
|
||||
fstype: '{{ os_mnt_var_filesystem }}'
|
||||
opts: '{{ os_mnt_var_options }}'
|
||||
state: present
|
||||
register: varmount
|
||||
when: os_mnt_var_enabled | bool
|
||||
|
||||
- name: Harden permissions for /var directory
|
||||
file:
|
||||
dest: /var
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: '{{ os_mnt_var_dir_mode }}'
|
||||
|
||||
- name: Mount /var/log with hardened options
|
||||
mount:
|
||||
path: /var/log
|
||||
src: '{{ os_mnt_var_log_src }}'
|
||||
fstype: '{{ os_mnt_var_log_filesystem }}'
|
||||
opts: '{{ os_mnt_var_log_options }}'
|
||||
state: present
|
||||
register: varlogmount
|
||||
when: os_mnt_var_log_enabled | bool
|
||||
|
||||
- name: Harden permissions for /var/log directory
|
||||
file:
|
||||
dest: /var/log
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: '{{ os_mnt_var_log_dir_mode }}'
|
||||
|
||||
- name: Check if /var/log/audit exists
|
||||
stat:
|
||||
path: /var/log/audit
|
||||
register: var_log_audit_exists
|
||||
|
||||
- name: Mount /var/log/audit with hardened options
|
||||
mount:
|
||||
path: /var/log/audit
|
||||
src: '{{ os_mnt_var_log_audit_src }}'
|
||||
fstype: '{{ os_mnt_var_log_audit_filesystem }}'
|
||||
opts: '{{ os_mnt_var_log_audit_options }}'
|
||||
state: present
|
||||
register: varlogauditmount
|
||||
when:
|
||||
- os_mnt_var_log_audit_enabled | bool
|
||||
- var_log_audit_exists.stat.exists | bool
|
||||
- os_auditd_enabled | bool
|
||||
|
||||
- name: Harden permissions for /var/log/audit directory
|
||||
file:
|
||||
dest: /var/log/audit
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: '{{ os_mnt_var_log_audit_dir_mode }}'
|
||||
when:
|
||||
- os_mnt_var_log_audit_enabled | bool
|
||||
- var_log_audit_exists.stat.exists | bool
|
||||
- os_auditd_enabled | bool
|
||||
|
||||
- name: Mount /var/tmp with hardened options
|
||||
mount:
|
||||
path: /var/tmp
|
||||
src: '{{ os_mnt_var_tmp_src }}'
|
||||
fstype: '{{ os_mnt_var_tmp_filesystem }}'
|
||||
opts: '{{ os_mnt_var_tmp_options }}'
|
||||
state: present
|
||||
register: vartmpmount
|
||||
when: os_mnt_var_tmp_enabled | bool
|
||||
|
||||
- name: Harden permissions for /var/tmp directory
|
||||
file:
|
||||
dest: /var/tmp
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: '{{ os_mnt_var_tmp_dir_mode }}'
|
||||
|
||||
- name: remount all changed mountpoints
|
||||
mount:
|
||||
path: "{{ item.path }}"
|
||||
src: "{{ item.src }}"
|
||||
fstype: "{{ item.fstype }}"
|
||||
opts: "{{ item.opts }}"
|
||||
state: remounted
|
||||
when: item.when | bool
|
||||
loop:
|
||||
- { path: '/boot', src: '{{ os_mnt_boot_src }}', fstype: '{{ os_mnt_boot_filesystem }}', opts: '{{ os_mnt_boot_options }}', enabled: "{{ os_mnt_boot_enabled }}", mode: "{{ os_mnt_boot_dir_mode }}", dump: "{{ os_mnt_boot_dump }}", passno: "{{ os_mnt_boot_passno }}" }
|
||||
- { path: '/dev', src: '{{ os_mnt_dev_src }}', fstype: '{{ os_mnt_dev_filesystem }}', opts: '{{ os_mnt_dev_options }}', enabled: "{{ os_mnt_dev_enabled }}", mode: "{{ os_mnt_dev_dir_mode }}", dump: "{{ os_mnt_dev_dump }}", passno: "{{ os_mnt_dev_passno }}" }
|
||||
- { path: '/dev/shm', src: '{{ os_mnt_dev_shm_src }}', fstype: '{{ os_mnt_dev_shm_filesystem }}', opts: '{{ os_mnt_dev_shm_options }}', enabled: "{{ os_mnt_dev_shm_enabled }}", mode: "{{ os_mnt_dev_shm_dir_mode }}", dump: "{{ os_mnt_dev_shm_dump }}", passno: "{{ os_mnt_dev_shm_passno }}" }
|
||||
- { path: '/home', src: '{{ os_mnt_home_src }}', fstype: '{{ os_mnt_home_filesystem }}', opts: '{{ os_mnt_home_options }}', enabled: "{{ os_mnt_home_enabled }}", mode: "{{ os_mnt_home_dir_mode }}", dump: "{{ os_mnt_home_dump }}", passno: "{{ os_mnt_home_passno }}" }
|
||||
- { path: '/run', src: '{{ os_mnt_run_src }}', fstype: '{{ os_mnt_run_filesystem }}', opts: '{{ os_mnt_run_options }}', enabled: "{{ os_mnt_run_enabled }}", mode: "{{ os_mnt_run_dir_mode }}", dump: "{{ os_mnt_run_dump }}", passno: "{{ os_mnt_run_passno }}" }
|
||||
- { path: '/tmp', src: '{{ os_mnt_tmp_src }}', fstype: '{{ os_mnt_tmp_filesystem }}', opts: '{{ os_mnt_tmp_options }}', enabled: "{{ os_mnt_tmp_enabled }}", mode: "{{ os_mnt_tmp_dir_mode }}", dump: "{{ os_mnt_tmp_dump }}", passno: "{{ os_mnt_tmp_passno }}" }
|
||||
- { path: '/var', src: '{{ os_mnt_var_src }}', fstype: '{{ os_mnt_var_filesystem }}', opts: '{{ os_mnt_var_options }}', enabled: "{{ os_mnt_var_enabled }}", mode: "{{ os_mnt_var_dir_mode }}", dump: "{{ os_mnt_var_dump }}", passno: "{{ os_mnt_var_passno }}" }
|
||||
- { path: '/var/log', src: '{{ os_mnt_var_log_src }}', fstype: '{{ os_mnt_var_log_filesystem }}', opts: '{{ os_mnt_var_log_options }}', enabled: "{{ os_mnt_var_log_enabled }}", mode: "{{ os_mnt_var_log_dir_mode }}", dump: "{{ os_mnt_var_log_dump }}", passno: "{{ os_mnt_var_log_passno }}" }
|
||||
- { path: '/var/log/audit', src: '{{ os_mnt_var_log_audit_src }}', fstype: '{{ os_mnt_var_log_audit_filesystem }}', opts: '{{ os_mnt_var_log_audit_options }}', enabled: "{{ os_mnt_var_log_audit_enabled }}", mode: "{{ os_mnt_var_log_audit_dir_mode }}", dump: "{{ os_mnt_var_log_audit_dump }}", passno: "{{ os_mnt_var_log_audit_passno }}" }
|
||||
- { path: '/var/tmp', src: '{{ os_mnt_var_tmp_src }}', fstype: '{{ os_mnt_var_tmp_filesystem }}', opts: '{{ os_mnt_var_tmp_options }}', enabled: "{{ os_mnt_var_tmp_enabled }}", mode: "{{ os_mnt_var_tmp_dir_mode }}", dump: "{{ os_mnt_var_tmp_dump }}", passno: "{{ os_mnt_var_tmp_passno }}" }
|
||||
loop_control:
|
||||
loop_var: mount
|
||||
- { path: '/boot', src: '{{ os_mnt_boot_src }}', fstype: '{{ os_mnt_boot_filesystem }}', opts: '{{ os_mnt_boot_options }}', when: "{{ bootmount.changed }}" }
|
||||
- { path: '/dev', src: '{{ os_mnt_dev_src }}', fstype: '{{ os_mnt_dev_filesystem }}', opts: '{{ os_mnt_dev_options }}', when: "{{ devmount.changed }}" }
|
||||
- { path: '/dev/shm', src: '{{ os_mnt_dev_shm_src }}', fstype: '{{ os_mnt_dev_shm_filesystem }}', opts: '{{ os_mnt_dev_shm_options }}', when: "{{ devshmmount.changed }}" }
|
||||
- { path: '/home', src: '{{ os_mnt_home_src }}', fstype: '{{ os_mnt_home_filesystem }}', opts: '{{ os_mnt_home_options }}', when: "{{ homemount.changed }}" }
|
||||
- { path: '/run', src: '{{ os_mnt_run_src }}', fstype: '{{ os_mnt_run_filesystem }}', opts: '{{ os_mnt_run_options }}', when: "{{ runmount.changed }}" }
|
||||
- { path: '/var', src: '{{ os_mnt_var_src }}', fstype: '{{ os_mnt_var_filesystem }}', opts: '{{ os_mnt_var_options }}', when: "{{ varmount.changed }}" }
|
||||
- { path: '/var/log', src: '{{ os_mnt_var_log_src }}', fstype: '{{ os_mnt_var_log_filesystem }}', opts: '{{ os_mnt_var_log_options }}', when: "{{ varlogmount.changed }}" }
|
||||
- { path: '/var/log/audit', src: '{{ os_mnt_var_log_audit_src }}', fstype: '{{ os_mnt_var_log_audit_filesystem }}', opts: '{{ os_mnt_var_log_audit_options }}', when: "{{ varlogauditmount.changed }}" }
|
||||
- { path: '/var/tmp', src: '{{ os_mnt_var_tmp_src }}', fstype: '{{ os_mnt_var_tmp_filesystem }}', opts: '{{ os_mnt_var_tmp_options }}', when: "{{ vartmpmount.changed }}" }
|
||||
@@ -1,36 +0,0 @@
|
||||
---
|
||||
- name: "Configure mount {{ mount.path }} with hardened options"
|
||||
mount:
|
||||
path: "{{ mount.path }}"
|
||||
src: "{{ mount.src | default(mountinfo.device, true) }}"
|
||||
fstype: "{{ mount.fstype | default(mountinfo.fstype, true) }}"
|
||||
opts: "{{ mount.opts }}"
|
||||
dump: "{{ mount.dump | default('1' if mount.fstype | default(mountinfo.fstype, true) in ['ext3', 'ext4'] else '0', true) }}"
|
||||
passno: "{{ mount.passno | default('2' if mount.fstype | default(mountinfo.fstype, true) in ['ext3', 'ext4'] else '0', true) }}"
|
||||
state: present
|
||||
register: mountpoint
|
||||
when:
|
||||
- mount.enabled | bool
|
||||
- mount.path in mountpoints_list
|
||||
vars:
|
||||
mountinfo: "{{ ansible_mounts | selectattr('mount', 'equalto', mount.path) | list | first | default(None) }}"
|
||||
notify: Remount filesystems
|
||||
|
||||
- name: "Check if {{ mount.path }} exists"
|
||||
stat:
|
||||
path: "{{ mount.path }}"
|
||||
register: mountpoint_exists
|
||||
|
||||
- name: "Harden permissions for {{ mount.path }} directory"
|
||||
file:
|
||||
dest: "{{ mount.path }}"
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: "{{ mount.mode }}"
|
||||
when:
|
||||
- mountpoint_exists.stat.exists | bool
|
||||
|
||||
- name: "Register changed mountpoints"
|
||||
set_fact:
|
||||
mountpoints_changed: "{{ mountpoints_changed | default([]) + [mount.path] }}"
|
||||
when: mountpoint.changed # noqa no-handler
|
||||
@@ -1,13 +0,0 @@
|
||||
---
|
||||
- name: Get user accounts | os-09
|
||||
command: "awk -F: '{print $1}' /etc/passwd"
|
||||
changed_when: false
|
||||
check_mode: false
|
||||
register: users_accounts
|
||||
|
||||
- name: Delete .netrc-files from system | os-09
|
||||
file:
|
||||
dest: '~{{ item }}/.netrc'
|
||||
state: 'absent'
|
||||
loop: '{{ users_accounts.stdout_lines | flatten | default([]) }}'
|
||||
when: item not in os_netrc_whitelist_user
|
||||
@@ -9,9 +9,15 @@
|
||||
file:
|
||||
dest: '~{{ item }}/.rhosts'
|
||||
state: 'absent'
|
||||
loop: '{{ users_accounts.stdout_lines | flatten | default([]) }}'
|
||||
with_flattened: '{{ users_accounts.stdout_lines | default([]) }}'
|
||||
|
||||
- name: Delete hosts.equiv from system | os-01
|
||||
file:
|
||||
dest: '/etc/hosts.equiv'
|
||||
state: 'absent'
|
||||
|
||||
- name: Delete .netrc-files from system | os-09
|
||||
file:
|
||||
dest: '~{{ item }}/.netrc'
|
||||
state: 'absent'
|
||||
with_flattened: '{{ users_accounts.stdout_lines | default([]) }}'
|
||||
@@ -6,7 +6,7 @@
|
||||
state: 'file'
|
||||
follow: 'yes'
|
||||
failed_when: false
|
||||
with_community.general.flattened:
|
||||
with_flattened:
|
||||
- '{{ os_security_suid_sgid_system_blacklist }}'
|
||||
- '{{ os_security_suid_sgid_blacklist }}'
|
||||
|
||||
@@ -27,6 +27,6 @@
|
||||
mode: 'a-s'
|
||||
state: 'file'
|
||||
follow: 'yes'
|
||||
with_community.general.flattened:
|
||||
with_flattened:
|
||||
- '{{ suid | default([]) | difference(os_security_suid_sgid_whitelist) }}'
|
||||
when: os_security_suid_sgid_remove_from_unknown | bool
|
||||
@@ -43,7 +43,7 @@
|
||||
shell: '{{ os_nologin_shell_path }}'
|
||||
password: '*'
|
||||
createhome: false
|
||||
with_community.general.flattened:
|
||||
with_flattened:
|
||||
- '{{ sys_accs_cond | default([]) | difference(os_ignore_users) | list }}'
|
||||
|
||||
- name: get all home directories in /home, but skip ignored users
|
||||
|
||||
@@ -33,7 +33,7 @@ os_auth_sub_gid_min: 100000
|
||||
os_auth_sub_gid_max: 600100000
|
||||
os_auth_sub_gid_count: 65536
|
||||
|
||||
os_auth_pam_sssd_enable: true
|
||||
os_auth_pam_sssd_enable: false
|
||||
|
||||
# defaults for useradd
|
||||
os_useradd_mail_dir: /var/spool/mail
|
||||
|
||||
@@ -0,0 +1,45 @@
|
||||
---
|
||||
|
||||
os_packages_pam_ccreds: 'pam_ccreds'
|
||||
os_nologin_shell_path: '/sbin/nologin'
|
||||
|
||||
# Different distros use different standards for /etc/shadow perms, e.g.
|
||||
# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
|
||||
# You must provide key/value pairs for owner, group, and mode if overriding.
|
||||
os_shadow_perms:
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0000'
|
||||
|
||||
os_passwd_perms:
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
os_env_umask: '077'
|
||||
|
||||
os_auth_uid_min: 1000
|
||||
os_auth_uid_max: 60000
|
||||
os_auth_gid_min: 1000
|
||||
os_auth_gid_max: 60000
|
||||
os_auth_sys_uid_min: 201
|
||||
os_auth_sys_uid_max: 999
|
||||
os_auth_sys_gid_min: 201
|
||||
os_auth_sys_gid_max: 999
|
||||
os_auth_sub_uid_min: 100000
|
||||
os_auth_sub_uid_max: 600100000
|
||||
os_auth_sub_uid_count: 65536
|
||||
os_auth_sub_gid_min: 100000
|
||||
os_auth_sub_gid_max: 600100000
|
||||
os_auth_sub_gid_count: 65536
|
||||
|
||||
os_auth_pam_sssd_enable: true
|
||||
|
||||
# defaults for useradd
|
||||
os_useradd_mail_dir: /var/spool/mail
|
||||
os_useradd_create_home: true
|
||||
|
||||
modprobe_package: 'module-init-tools'
|
||||
auditd_package: 'audit'
|
||||
|
||||
hidepid_option: '2' # allowed values: 0, 1, 2
|
||||
@@ -0,0 +1,45 @@
|
||||
---
|
||||
|
||||
os_packages_pam_ccreds: 'pam_ccreds'
|
||||
os_nologin_shell_path: '/sbin/nologin'
|
||||
|
||||
# Different distros use different standards for /etc/shadow perms, e.g.
|
||||
# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
|
||||
# You must provide key/value pairs for owner, group, and mode if overriding.
|
||||
os_shadow_perms:
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0000'
|
||||
|
||||
os_passwd_perms:
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
os_env_umask: '077'
|
||||
|
||||
os_auth_uid_min: 1000
|
||||
os_auth_uid_max: 60000
|
||||
os_auth_gid_min: 1000
|
||||
os_auth_gid_max: 60000
|
||||
os_auth_sys_uid_min: 201
|
||||
os_auth_sys_uid_max: 999
|
||||
os_auth_sys_gid_min: 201
|
||||
os_auth_sys_gid_max: 999
|
||||
os_auth_sub_uid_min: 100000
|
||||
os_auth_sub_uid_max: 600100000
|
||||
os_auth_sub_uid_count: 65536
|
||||
os_auth_sub_gid_min: 100000
|
||||
os_auth_sub_gid_max: 600100000
|
||||
os_auth_sub_gid_count: 65536
|
||||
|
||||
os_auth_pam_sssd_enable: true
|
||||
|
||||
# defaults for useradd
|
||||
os_useradd_mail_dir: /var/spool/mail
|
||||
os_useradd_create_home: true
|
||||
|
||||
modprobe_package: 'module-init-tools'
|
||||
auditd_package: 'audit'
|
||||
|
||||
hidepid_option: '2' # allowed values: 0, 1, 2
|
||||
@@ -11,9 +11,6 @@ Warning: This role disables root-login on the target server! Please make sure yo
|
||||
## Requirements
|
||||
|
||||
- Ansible >= 2.9
|
||||
- root-privileges on the target system
|
||||
|
||||
As this role requires root-privileges, we added `become: true` to all tasks. So please make sure you run the role as root or as a user with become-privileges.
|
||||
|
||||
## Role Variables
|
||||
|
||||
@@ -126,8 +123,8 @@ As this role requires root-privileges, we added `become: true` to all tasks. So
|
||||
- Default: `false`
|
||||
- Description: false to disable display of last login information.
|
||||
- `sftp_enabled`
|
||||
- Default: `true`
|
||||
- Description: false to disable sftp configuration.
|
||||
- Default: `false`
|
||||
- Description: true to enable sftp configuration.
|
||||
- `sftp_umask`
|
||||
- Default: `'0027'`
|
||||
- Description: Specifies the umask for sftp.
|
||||
@@ -272,10 +269,6 @@ Example playbook:
|
||||
- "AcceptEnv LANG"
|
||||
```
|
||||
|
||||
## After using the role Ansibles template/copy/file module does not work anymore
|
||||
|
||||
If you use this role to disable SFTP (`sftp_enabled: false`) you will get errors. Ansible uses by default SFTP to transfer files to the remote hosts. You have to set `scp_if_ssh = True` in your ansible.cfg. This way Ansible uses SCP to copy files. If your control node uses OpenSSH version 9.0 or above, you also need to set `scp_extra_args = "-O"`, since starting with that version the `scp` utility also defaults to using SFTP.
|
||||
|
||||
## Changing the default port and idempotency
|
||||
|
||||
This role uses the default port 22 or the port configured in the inventory to connect to the server. If the default `ssh` port is changed via `ssh_server_ports`, once the ssh server is restarted, it will still try to connect using the previous port. In order to run this role again on the same server the inventory will have to be updated to use the new ssh port.
|
||||
|
||||
@@ -158,8 +158,8 @@ ssh_banner_path: '/etc/ssh/banner.txt'
|
||||
# false to disable distribution version leakage during initial protocol handshake
|
||||
ssh_print_debian_banner: false # sshd (Debian OS family only)
|
||||
|
||||
# false to disable sftp configuration
|
||||
sftp_enabled: true
|
||||
# true to enable sftp configuration
|
||||
sftp_enabled: false
|
||||
|
||||
# false to disable sftp chroot
|
||||
sftp_chroot: true
|
||||
|
||||
@@ -8,22 +8,21 @@ galaxy_info:
|
||||
platforms:
|
||||
- name: EL
|
||||
versions:
|
||||
- "7"
|
||||
- "8"
|
||||
- 7
|
||||
- 8
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- xenial
|
||||
- bionic
|
||||
- focal
|
||||
- jammy
|
||||
- name: Debian
|
||||
versions:
|
||||
- stretch
|
||||
- buster
|
||||
- bullseye
|
||||
- name: Amazon
|
||||
- name: Fedora
|
||||
- name: ArchLinux
|
||||
- name: Archlinux
|
||||
- name: SmartOS
|
||||
- name: opensuse
|
||||
- name: openSUSE
|
||||
galaxy_tags:
|
||||
- system
|
||||
- security
|
||||
|
||||
@@ -110,9 +110,7 @@
|
||||
|
||||
- name: Include tasks to setup ca keys and principals
|
||||
include_tasks: ca_keys_and_principals.yml
|
||||
when:
|
||||
- ssh_trusted_user_ca_keys_file | length > 0
|
||||
- ssh_trusted_user_ca_keys | length > 0
|
||||
when: ssh_trusted_user_ca_keys_file | length > 0
|
||||
|
||||
- name: Include selinux specific tasks
|
||||
include_tasks: selinux.yml
|
||||
|
||||
@@ -1,6 +1,3 @@
|
||||
---
|
||||
- include_tasks: hardening.yml
|
||||
args:
|
||||
apply:
|
||||
become: true
|
||||
when: ssh_hardening_enabled | bool
|
||||
@@ -7,7 +7,7 @@ ssh_group: root
|
||||
ssh_host_keys_owner: 'root'
|
||||
ssh_host_keys_group: 'ssh_keys'
|
||||
ssh_selinux_packages:
|
||||
- policycoreutils-python-utils
|
||||
- policycoreutils-python
|
||||
- checkpolicy
|
||||
|
||||
# true if SSH support Kerberos
|
||||
|
||||
@@ -7,7 +7,7 @@ ssh_group: root
|
||||
ssh_host_keys_owner: 'root'
|
||||
ssh_host_keys_group: 'ssh_keys'
|
||||
ssh_selinux_packages:
|
||||
- policycoreutils-python
|
||||
- python3-policycoreutils
|
||||
- checkpolicy
|
||||
|
||||
# true if SSH support Kerberos
|
||||
@@ -0,0 +1,23 @@
|
||||
---
|
||||
sshd_path: /usr/sbin/sshd
|
||||
ssh_host_keys_dir: '/etc/ssh'
|
||||
sshd_service_name: sshd
|
||||
ssh_owner: root
|
||||
ssh_group: root
|
||||
ssh_host_keys_owner: 'root'
|
||||
ssh_host_keys_group: 'ssh_keys'
|
||||
ssh_selinux_packages:
|
||||
- python3-policycoreutils
|
||||
- checkpolicy
|
||||
|
||||
# true if SSH support Kerberos
|
||||
ssh_kerberos_support: true
|
||||
|
||||
# true if SSH has PAM support
|
||||
ssh_pam_support: true
|
||||
|
||||
sshd_moduli_file: '/etc/ssh/moduli'
|
||||
|
||||
# disable CRYPTO_POLICY to take settings from sshd configuration
|
||||
# see: https://access.redhat.com/solutions/4410591
|
||||
sshd_disable_crypto_policy: true
|
||||
Reference in new issue
Block a user