Update Debian compatibility (#784)

* Update Ubuntu compatability Signed-off-by: Martin Schurz <Martin.Schurz@telekom.de> * reload systemd when disabling ssh socket Signed-off-by: Martin Schurz <Martin.Schurz@telekom.de> * manage systemd files Signed-off-by: Martin Schurz <Martin.Schurz@telekom.de> * Create privsep directory for Debian Signed-off-by: Martin Schurz <Martin.Schurz@telekom.de> * Use working Ubuntu 24.04 image for vm tests Signed-off-by: Martin Schurz <Martin.Schurz@telekom.de> * Remove deprecated Debian 10 Signed-off-by: Martin Schurz <Martin.Schurz@telekom.de> --------- Signed-off-by: Martin Schurz <Martin.Schurz@telekom.de>
2024-09-19 21:11:52 +00:00 · 2024-08-06 13:11:32 +02:00 · 2024-08-06 13:11:32 +02:00 · 69ab9e47ad
commit 69ab9e47ad
parent 118a0f07f6
17 changed files with 33 additions and 48 deletions
--- a/.github/workflows/mysql_hardening.yml
+++ b/.github/workflows/mysql_hardening.yml
@ -40,10 +40,9 @@ jobs:
          - centosstream9
          - rocky8
          - rocky9
-          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
-          - debian10
+          - ubuntu2404
          - debian11
          - debian12
          # - amazon  # geerlingguy.mysql does not support fedora
--- a/.github/workflows/nginx_hardening.yml
+++ b/.github/workflows/nginx_hardening.yml
@ -39,10 +39,9 @@ jobs:
          - centosstream9
          - rocky8
          - rocky9
-          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
-          - debian10
+          - ubuntu2404
          - debian11
          - debian12
          - amazon2023
--- a/.github/workflows/os_hardening.yml
+++ b/.github/workflows/os_hardening.yml
@ -41,10 +41,9 @@ jobs:
          - rocky9
          - fedora39
          - fedora40
-          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
-          - debian10
+          - ubuntu2404
          - debian11
          - debian12
          - amazon2023
--- a/.github/workflows/os_hardening_vm.yml
+++ b/.github/workflows/os_hardening_vm.yml
@ -41,10 +41,9 @@ jobs:
          - generic/rocky9
          - fedora/39-cloud-base
          - fedora/40-cloud-base
-          - generic/ubuntu1804
          - generic/ubuntu2004
          - generic/ubuntu2204
-          - generic/debian10
+          - alvistack/ubuntu-24.04
          - generic/debian11
          - generic/debian12
          - generic/opensuse15
--- a/.github/workflows/ssh_hardening.yml
+++ b/.github/workflows/ssh_hardening.yml
@ -41,10 +41,9 @@ jobs:
          - rocky9
          - fedora39
          - fedora40
-          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
-          - debian10
+          - ubuntu2404
          - debian11
          - debian12
          - amazon2023
--- a/.github/workflows/ssh_hardening_custom_tests.yml
+++ b/.github/workflows/ssh_hardening_custom_tests.yml
@ -41,10 +41,9 @@ jobs:
          - rocky9
          - fedora39
          - fedora40
-          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
-          - debian10
+          - ubuntu2404
          - debian11
          - debian12
          - amazon2023
--- a/README.md
+++ b/README.md
@ -15,8 +15,8 @@ This collection provides battle tested hardening for:
 - Linux operating systems:
  - CentOS 9
  - Rocky Linux 8/9
-  - Debian 10/11/12
-  - Ubuntu 18.04/20.04/22.04
+  - Debian 11/12
+  - Ubuntu 20.04/22.04/24.04
  - Amazon Linux (some roles supported)
  - Arch Linux (some roles supported)
  - Fedora 39/40 (some roles supported)
--- a/molecule/mysql_hardening/prepare.yml
+++ b/molecule/mysql_hardening/prepare.yml
@ -26,13 +26,6 @@
      when:
        - ansible_os_family == 'Suse'

-    - name: Use Python 2 on Debian 10
-      ansible.builtin.set_fact:
-        ansible_python_interpreter: /usr/bin/python
-      when:
-        - ansible_distribution == 'Debian'
-        - ansible_distribution_major_version|int == 10
-
    - name: Run the equivalent of "apt-get update && apt-get upgrade"
      ansible.builtin.apt:
        upgrade: safe
--- a/molecule/ssh_hardening/prepare.yml
+++ b/molecule/ssh_hardening/prepare.yml
@ -62,12 +62,6 @@
        update_cache: true
      when: ansible_facts.os_family == 'Archlinux'

-    - name: Created needed directory
-      ansible.builtin.file:
-        path: /var/run/sshd
-        state: directory
-        mode: "0755"
-
    - name: Create ssh host keys # noqa ignore-errors
      ansible.builtin.command: ssh-keygen -A
      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
--- a/molecule/ssh_hardening_bsd/prepare.yml
+++ b/molecule/ssh_hardening_bsd/prepare.yml
@ -18,12 +18,6 @@
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
-    - name: Created needed directory
-      ansible.builtin.file:
-        path: /var/run/sshd
-        state: directory
-        mode: "0755"
-
    - name: Create ssh host keys # noqa ignore-errors
      ansible.builtin.command: ssh-keygen -A
      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
--- a/molecule/ssh_hardening_custom_tests/prepare.yml
+++ b/molecule/ssh_hardening_custom_tests/prepare.yml
@ -62,12 +62,6 @@
        update_cache: true
      when: ansible_facts.os_family == 'Archlinux'

-    - name: Created needed directory
-      ansible.builtin.file:
-        path: /var/run/sshd
-        state: directory
-        mode: "0755"
-
    - name: Create ssh host keys # noqa ignore-errors
      ansible.builtin.command: ssh-keygen -A
      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
--- a/roles/mysql_hardening/meta/main.yml
+++ b/roles/mysql_hardening/meta/main.yml
@ -12,13 +12,13 @@ galaxy_info:
        - "9"
    - name: Ubuntu
      versions:
-        - bionic
        - focal
        - jammy
+        - noble
    - name: Debian
      versions:
        - bullseye
-        - buster
+        - bookworm
    - name: Amazon
    - name: opensuse
  galaxy_tags:
--- a/roles/nginx_hardening/meta/main.yml
+++ b/roles/nginx_hardening/meta/main.yml
@ -12,12 +12,12 @@ galaxy_info:
        - "9"
    - name: Ubuntu
      versions:
-        - bionic
        - focal
        - jammy
+        - noble
    - name: Debian
      versions:
-        - buster
+        - bookworm
        - bullseye
    - name: Amazon
  galaxy_tags:
--- a/roles/os_hardening/meta/main.yml
+++ b/roles/os_hardening/meta/main.yml
@ -12,12 +12,12 @@ galaxy_info:
        - "9"
    - name: Ubuntu
      versions:
-        - bionic
        - focal
        - jammy
+        - noble
    - name: Debian
      versions:
-        - buster
+        - bookworm
        - bullseye
    - name: Amazon
    - name: Fedora
--- a/roles/ssh_hardening/meta/main.yml
+++ b/roles/ssh_hardening/meta/main.yml
@ -12,12 +12,12 @@ galaxy_info:
        - "9"
    - name: Ubuntu
      versions:
-        - bionic
        - focal
        - jammy
+        - noble
    - name: Debian
      versions:
-        - buster
+        - bookworm
        - bullseye
    - name: Amazon
    - name: Fedora
--- a/roles/ssh_hardening/tasks/disable-systemd-socket.yml
+++ b/roles/ssh_hardening/tasks/disable-systemd-socket.yml
@ -1,8 +1,12 @@
 ---
 - name: Remove ssh service systemd-socket file
  ansible.builtin.file:
-    path: /etc/systemd/system/ssh.service.d/00-socket.conf
+    path: "{{ item }}"
    state: absent
+  loop:
+    - /etc/systemd/system/ssh.service.d/00-socket.conf
+    - /etc/systemd/system/ssh.service.requires/ssh.socket
+    - /etc/systemd/system/sockets.target.wants/ssh.socket

 - name: Disable systemd-socket activation
  ansible.builtin.systemd:
--- a/roles/ssh_hardening/tasks/install.yml
+++ b/roles/ssh_hardening/tasks/install.yml
@ -17,6 +17,18 @@
    - (ansible_facts.distribution == 'Ubuntu' and ansible_facts.distribution_major_version is version('22.04', '>=')) or
      (ansible_facts.os_family == 'Debian' and ansible_facts.distribution_major_version is version('12', '>='))

+- name: Ensure privilege separation directory exists
+  ansible.builtin.file:
+    path: /run/sshd
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  when:
+    - ssh_server_hardening | bool
+    - ssh_server_enabled | bool
+    - ansible_facts.os_family == 'Debian'
+
 - name: Enable or disable sshd service
  ansible.builtin.service:
    name: "{{ sshd_service_name }}"