Mirrors/ansible-collection-hardening
2
0
Fork 0
mirror of https://github.com/dev-sec/ansible-collection-hardening synced 2024-11-10 09:14:18 +00:00
Code Issues Projects Releases Packages Wiki Activity

Oracle support

Browse source 
- Add check for Oracle operating systems

- Add minus sign to remove whitespace
This commit is contained in:
Sebastian Gumprich 2015-04-27 21:14:50 +00:00
parent ccf58ca2e7
commit 45eb0e2f38
3 changed files with 19 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
roles/ansible-ssh-hardening/templates/openssh.conf.j2
View file

@ -9,15 +9,15 @@
# ===================
# Address family should always be limited to the active network configuration.
AddressFamily {% if network_ipv6_enable %}any{% else %}inet{% endif %}
AddressFamily {% if network_ipv6_enable -%}any{% else -%}inet{% endif %}
# Restrict the following configuration to be limited to this Host.
{% for host in ssh_remote_hosts %}
{% for host in ssh_remote_hosts -%}
Host {{host}}
{% endfor %}
# The port at the destination should be defined
{% for port in ssh_ports %}
{% for port in ssh_ports -%}
Port {{port}}
{% endfor %}
@ -48,15 +48,15 @@ StrictHostKeyChecking ask
# -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html)
#
{% if ssh_client_cbc_required %}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' %}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
Ciphers {{ciphers_66_weak}}
{% else %}
{% else -%}
Ciphers {{ciphers_53_weak}}
{% endif %}
{% else %}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' %}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
Ciphers {{ciphers_66_default}}
{% else %}
{% else -%}
Ciphers {{ciphers_53_default}}
{% endif %}
{% endif %}
@ -66,21 +66,21 @@ Ciphers {{ciphers_53_default}}
# eg Ruby's Net::SSH at around 2.2.* doesn't support sha2 for hmac, so this will have to be set true in this case.
#
{% if ssh_server_weak_hmac %}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' %}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
MACs {{macs_66_weak}}
{% elif ansible_os_family == 'RedHat' and ansible_distribution_major_version <= '6' %}
{% elif (ansible_os_family == 'RedHat' and ansible_distribution_major_version <= '6') or ansible_os_family == 'Oracle Linux' -%}
MACs {{macs_53_default}}
{% elif ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6' %}
{% elif ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6' -%}
MACs {{macs_53_default}}
{% else %}
MACs {{macs_59_weak}}
{% endif %}
{% else %}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' %}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
MACs {{macs_66_default}}
{% elif ansible_os_family == 'RedHat' and ansible_distribution_major_version <= '6' %}
{% elif (ansible_os_family == 'RedHat' and ansible_distribution_major_version <= '6') or ansible_os_family == 'Oracle Linux' -%}
MACs {{macs_53_default}}
{% elif ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6' %}
{% elif ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6' -%}
MACs {{macs_53_default}}
{% else %}
MACs {{macs_59_default}}
@ -101,7 +101,7 @@ MACs {{macs_59_default}}
KexAlgorithms {{kex_66_default}}
{% endif %}
{% else -%}
{% if ansible_os_family == 'RedHat' or (ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6') -%}
{% if ansible_os_family == 'RedHat' or (ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6') or ansible_os_family == 'Oracle Linux' -%}
#KexAlgorithms
{% else -%}
KexAlgorithms {{kex_59_default}}

8
roles/ansible-ssh-hardening/templates/opensshd.conf.j2
View file

@ -76,7 +76,7 @@ Ciphers {{ciphers_53_default}}
{% if ssh_server_weak_hmac -%}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
MACs {{macs_66_weak}}
{% elif ansible_os_family == 'RedHat' and ansible_distribution_major_version <= '6' -%}
{% elif (ansible_os_family == 'RedHat' and ansible_distribution_major_version <= '6') or ansible_os_family == 'Oracle Linux' -%}
MACs {{macs_53_default}}
{% elif ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6' -%}
MACs {{macs_53_default}}
@ -86,7 +86,7 @@ MACs {{macs_59_weak}}
{% else %}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
MACs {{macs_66_default}}
{% elif ansible_os_family == 'RedHat' and ansible_distribution_major_version <= '6' -%}
{% elif (ansible_os_family == 'RedHat' and ansible_distribution_major_version <= '6') or ansible_os_family == 'Oracle Linux' -%}
MACs {{macs_53_default}}
{% elif ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6' -%}
MACs {{macs_53_default}}
@ -109,7 +109,7 @@ MACs {{macs_59_default}}
KexAlgorithms {{kex_66_default}}
{% endif %}
{% else -%}
{% if ansible_os_family == 'RedHat' or (ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6') -%}
{% if ansible_os_family == 'RedHat' or ansible_os_family == 'Oracle Linux' or (ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6') -%}
#KexAlgorithms
{% else -%}
KexAlgorithms {{kex_59_default}}
@ -121,7 +121,7 @@ MACs {{macs_59_default}}
# Secure Login directives.
UseLogin no
UsePrivilegeSeparation {% if (ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6') or ansible_os_family == 'RedHat' -%}{{ssh_ps53}}{% else %}{{ssh_ps59}}{% endif %}
UsePrivilegeSeparation {% if (ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6') or ansible_os_family == 'RedHat' or ansible_os_family == 'Oracle Linux' -%}{{ssh_ps53}}{% else %}{{ssh_ps59}}{% endif %}
PermitUserEnvironment no
LoginGraceTime 30s

1
roles/ansible-ssh-hardening/vars/Oracle Linux.yml Normal file
View file

@ -0,0 +1 @@
sshd_service_name: sshd