89138be4ec
* rewrite system account detection and hardening * resolve failures created when resolving merge conflicts Signed-off-by: Sebastian Gumprich <[email protected]> * add tests for shell removal tasks Signed-off-by: Sebastian Gumprich <[email protected]> * Update molecule/os_hardening/prepare.yml Signed-off-by: Martin Schurz <[email protected]> * split tasks for locking and setting shell Signed-off-by: Martin Schurz <[email protected]> * fix some more linting Signed-off-by: Sebastian Gumprich <[email protected]> Signed-off-by: Sebastian Gumprich <[email protected]> Signed-off-by: Martin Schurz <[email protected]> Co-authored-by: donestefan <[email protected]> Co-authored-by: schurzi <[email protected]>
65 lines
2.4 KiB
YAML
65 lines
2.4 KiB
YAML
---
|
|
- name: Install selinux dependencies when selinux is installed
|
|
ansible.builtin.package:
|
|
name: "{{ ssh_selinux_packages }}"
|
|
state: present
|
|
|
|
- name: Authorize the following ports for selinux - {{ ssh_server_ports }}
|
|
community.general.seport:
|
|
ports: "{{ item }}"
|
|
proto: tcp
|
|
setype: ssh_port_t
|
|
state: present
|
|
loop: "{{ ssh_server_ports }}"
|
|
|
|
- name: Check if ssh_password module is already installed
|
|
ansible.builtin.shell: set -o pipefail && semodule -l | grep ssh_password
|
|
args:
|
|
executable: /bin/bash
|
|
register: ssh_password_module
|
|
failed_when: false
|
|
changed_when: false
|
|
check_mode: false
|
|
|
|
# The following tasks only get executed when selinux is in state enforcing,
|
|
# UsePam is 'no' and the ssh_password module is not installed. See this issue for
|
|
# more info: https://github.com/hardening-io/ansible-ssh-hardening/issues/23
|
|
- name: Run selinux tasks
|
|
when:
|
|
- not (ssh_use_pam | bool)
|
|
- ('ssh_password' not in ssh_password_module.stdout)
|
|
block:
|
|
- name: Create selinux custom policy drop folder
|
|
ansible.builtin.file:
|
|
path: "{{ ssh_custom_selinux_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0750"
|
|
|
|
- name: Distributing custom selinux policies
|
|
ansible.builtin.copy:
|
|
src: ssh_password
|
|
dest: "{{ ssh_custom_selinux_dir }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
|
|
- name: Check and compile policy # noqa no-changed-when
|
|
ansible.builtin.command: checkmodule -M -m -o {{ ssh_custom_selinux_dir }}/ssh_password.mod {{ ssh_custom_selinux_dir }}/ssh_password
|
|
|
|
- name: Create selinux policy module package # noqa no-changed-when
|
|
ansible.builtin.command: semodule_package -o {{ ssh_custom_selinux_dir }}/ssh_password.pp -m {{ ssh_custom_selinux_dir }}/ssh_password.mod
|
|
|
|
- name: Install selinux policy # noqa no-changed-when
|
|
ansible.builtin.command: semodule -i {{ ssh_custom_selinux_dir }}/ssh_password.pp
|
|
|
|
# The following tasks only get executed when selinux is installed, UsePam is
|
|
# 'yes' and the ssh_password module is installed. See
|
|
# http://danwalsh.livejournal.com/12333.html for more info
|
|
- name: Remove selinux-policy when Pam is used, because Allowing sshd to read the shadow file directly is considered a potential security risk
|
|
ansible.builtin.command: semodule -r ssh_password
|
|
when:
|
|
- ssh_use_pam | bool
|
|
- ('ssh_password' in ssh_password_module.stdout)
|