Mirrors/ansible-collection-hardening
2
0
Fork 0
mirror of https://github.com/dev-sec/ansible-collection-hardening synced 2024-09-20 13:21:52 +00:00
Code Issues Projects Releases Packages Wiki Activity
1586 commits 12 branches 56 tags 3.7 MiB
Commit graph

200 commits

Author SHA1 Message Date
Lars Düsing
0beeb3ee03 Removed sysctl that tries to disable IPv6. #416 
Signed-off-by: Lars Düsing <lars@camelotsweb.de>
 2021-05-24 13:33:38 +02:00
rndmh3ro
07a0943c5a Prettified Code! 2021-04-30 12:50:12 +00:00
alimli
4f42e0d396
ssh_allow_tcp_forwarding remote option added (#447) 
Signed-off-by: Haldun ALIMLI <haldun.alimli@upandrunning.cloud>

Co-authored-by: Haldun ALIMLI <haldun.alimli@upandrunning.cloud>
 2021-04-30 14:49:42 +02:00
Martin Neubert
0324273dce
Check for MariaDB Version when selecting users without passwords (#444) 
* added version check for MariaDB in Query

MariaDB Uses the authentication_string field since 10.4.0, added this in version check in query for users to delete

Signed-off-by: Martin Neubert <martin.neubert@t-systems.com>

* Update roles/mysql_hardening/tasks/mysql_secure_installation.yml

Co-authored-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>

* Update roles/mysql_hardening/tasks/mysql_secure_installation.yml

Co-authored-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>

Co-authored-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>
 2021-04-28 09:52:09 +02:00
Martin Neubert
284943b699
USER and HOST should be quoted (#443) 
USER and HOST should be quoted to avoid errors in drop user statement

Signed-off-by: Martin Neubert <martin.neubert@t-systems.com>
 2021-04-27 21:16:50 +02:00
Paul Seidler
b12ee4d23b
ssh: Client HostKeyAlgorithms configuration variable (#442) 
* ssh: Client HostKeyAlgorithms configuration variable

Introduce a new variable ssh_client_host_key_algorithms to be able to configure
it for the client like for the server.
This fixes #441

Signed-off-by: Paul Seidler <705535+sepek@users.noreply.github.com>

* sshd: Adapt the ssh_host_key_algorithms description

Linking to the latest version may lead to a broken config so be a bit more
  dynamic

Signed-off-by: Paul Seidler <705535+sepek@users.noreply.github.com>
 2021-04-23 15:54:30 +02:00
Sina Tak Tehrani
4313d6fbfb
fixed a typo in comments (#439) 
Signed-off-by: Sina Tak Tehrani <ssttehrani@gmail.com>
 2021-04-09 08:15:11 +02:00
Sebastian Gumprich
d6a99c995e use fqcn for mysql tasks 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich
c6febf3249 fix linting 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich
7d68c6036c use single ansible fact to delete user 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich
d4a4faa16d fix syntax of mysql queries 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich
5e7a0a60f1 fix linting 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich
c3b954a2ab add new tasks to delete users without passwords 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2021-04-01 21:16:04 +02:00
schurzi
add303f2be
Merge pull request #437 from BenjaminBoehm/bugfix/ssh-kex-sntrup-openssh8.5 
Fix ssh kex sntrup761x25519-sha512@openssh.com for openssh >= 8.5
 2021-04-01 21:13:50 +02:00
Sebastian Gumprich
2fb54bd224 remove secure-auth param if mysql => 8.0.3 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

install collection in molecule

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

remove deprecated ubuntu 16.04 from tests

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2021-04-01 13:20:58 +02:00
Benjamin
29ee683069 Fix ssh kex sntrup761x25519-sha512@openssh.com for openssh >= 8.5 
fix #433

Signed-off-by: Benjamin <gitlab@lnxkiste.de>
Signed-off-by: Benjamin Boehm <git@lnxkiste.de>
 2021-04-01 02:08:24 +02:00
schurzi
2882a15ee1
Merge pull request #427 from dev-sec/snoopotic-fix/add_auditd_restart_handler 
add restart-auditd handler after configuration change
 2021-03-29 21:15:46 +02:00
Sebastian Gumprich
812c6c5974 skip auditd restart in molecule tests 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2021-03-29 10:00:15 +02:00
Sebastian Gumprich
ae68f73965 skip auditd restart in molecule tests 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2021-03-29 09:29:37 +02:00
Farid Joubbi
7af432e1cf
Uppercased first letter of task names. (#422) 
Signed-off-by: Farid Joubbi <farid@joubbi.se>
 2021-03-25 13:52:56 +01:00
Farid Joubbi
c90bbd2c23
Improved comments. (#436) 
Signed-off-by: Farid Joubbi <farid@joubbi.se>
 2021-03-24 14:31:58 +01:00
Farid Joubbi
d1143a06b1
Not accepting source routing for IPv6. This was already done for IPv4. (#424) 
Signed-off-by: Farid Joubbi <farid@joubbi.se>
 2021-03-24 07:55:29 +01:00
Farid Joubbi
240d8acc0c Changed os_auth_pam_pwquality_options type to authtok_type. 
Signed-off-by: Farid Joubbi <farid@joubbi.se>
 2021-03-23 11:16:05 +01:00
Martin Schurz
d693a8e200 also use requisite for pwhistory 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2021-03-23 08:53:49 +01:00
Martin Schurz
0ac56e4c00 Merge branch 'master' into pwhistory 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2021-03-23 08:53:23 +01:00
schurzi
5be13e878f
Merge pull request #430 from joubbi/comment 
Remove comments from PAM config file, but keep it in the template
 2021-03-23 08:40:20 +01:00
Farid Joubbi
659e5ada6a Changed to pam_pwhistory.so instead of pam_unix.so for remembering old passwords. 
Signed-off-by: Farid Joubbi <farid@joubbi.se>
 2021-03-22 22:28:25 +01:00
Farid Joubbi
0010715039 Remove comment from output file, but keep it in the template. 
Signed-off-by: Farid Joubbi <farid@joubbi.se>
 2021-03-22 19:39:49 +01:00
rndmh3ro
369c2986c6 Prettified Code! 2021-03-22 10:23:03 +00:00
Sebastian Gumprich
02c689eaa0 fix loop for home_directories 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2021-03-22 11:18:51 +01:00
Sebastian Gumprich
bf82736787 Update roles/os_hardening/tasks/user_accounts.yml 
Co-authored-by: schurzi <Martin.Schurz@t-systems.com>
 2021-03-22 11:18:51 +01:00
Sebastian Gumprich
c86bdcb4c7 linting 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2021-03-22 11:18:51 +01:00
Sebastian Gumprich
b5ca78a9cd chmod /home directories to 0700 
This is based on https://github.com/dev-sec/ansible-collection-hardening/pull/277
and updated to work with the new collection.

Thanks to @aardbol for this initial implementation!

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2021-03-22 11:18:51 +01:00
Sebastian Gumprich
390f7ad6cc fix linting 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2021-03-19 14:46:42 +01:00
Felix Herzog
eca93cc80b add restart-auditd handler as after configuration change (e.g. of os_auditd_max_log_file_action) you need to restart. Sadly on rhel7 systems you cannot use systemd. And as debian derivates use service as alias and it works I kept it that simple. also adding 'auditd'-tag to make it easy only run that config change if needed. 
Signed-off-by: Felix Herzog <snoopotic@gmail.com>
 2021-03-19 14:42:31 +01:00
schurzi
a64838272c
Merge pull request #418 from joubbi/documentation2 
Improve Documentation for sysctl defaults
 2021-03-16 15:49:55 +01:00
Martin Schurz
b2dd73d27e remove unneeded tasks 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2021-03-15 23:53:40 +01:00
Martin Schurz
ec9d7d2cb8 cleanup and typos 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2021-03-15 23:39:12 +01:00
Farid Joubbi
97c55d6e55 Documented rationale for sysctl values set. 
Signed-off-by: Farid Joubbi <farid@joubbi.se>
 2021-03-15 14:01:19 +01:00
Martin Schurz
5f97dffddf Merge branch 'master' into tally 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2021-03-11 19:26:37 +01:00
schurzi
103135ce9a fix task naming 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2021-03-11 17:21:32 +01:00
Farid Joubbi
4158e0bfb4 Created a list of files/dirs to be looped instead of two tasks per file/dir. 
Signed-off-by: Farid Joubbi <farid@joubbi.se>
 2021-03-11 16:54:25 +01:00
Farid Joubbi
4bad4779cd Fixed copy-paste error by doing og-rwx instead of numerical. 
Signed-off-by: Farid Joubbi <farid@joubbi.se>
 2021-02-22 22:13:18 +01:00
Martin Schurz
75fc31b80c remove cracklib 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2021-02-22 19:10:45 +01:00
Farid Joubbi
91a0d62305 Ensure permissions on /etc/crontab are configured. #375 
Signed-off-by: Farid Joubbi <farid@joubbi.se>
 2021-02-19 23:19:00 +01:00
Farid Joubbi
60d24db460 Ensure permissions on /etc/crontab are configured. #375 
Signed-off-by: Farid Joubbi <farid@joubbi.se>
 2021-02-19 22:40:16 +01:00
schurzi
8e4c22d8d9
remove FQCN from roles in examples (#404) 
Ansible does not work with FQCN and collections sepcified for including
roles. It is currently expecting to only get the role name in this
context.

Verified with Ansible 2.10.5

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2021-02-17 11:34:37 +01:00
Martin Schurz
dba53718cf sssd is disabled on Amazonlinus 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2021-02-16 20:44:28 +01:00
Martin Schurz
4a5fa70507 default faillock to yes 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2021-02-16 19:31:51 +01:00
Martin Schurz
64713ce75d add default for new variable 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2021-02-15 11:17:01 +01:00