Mirrors/ansible-collection-hardening
2
0
Fork 0
mirror of https://github.com/dev-sec/ansible-collection-hardening synced 2024-11-14 02:47:06 +00:00
Code Issues Projects Releases Packages Wiki Activity
2044 commits 16 branches 57 tags 4.7 MiB
Commit graph

2044 commits

This branch
This branch
All branches
Author SHA1 Message Date
renovate[bot]
32cc9665dd
Update dependency geerlingguy.git to v3.0.1 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2023-03-31 07:15:43 +00:00
schurzi
0bfd5f7fa0
Merge pull request #653 from dev-sec/renovate/configure 
Configure Renovate
 2023-03-31 09:15:10 +02:00
Martin Schurz
e9fa44c243 remove dependabot 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2023-03-31 09:12:55 +02:00
Martin Schurz
7456e441fc ignore jenovate in galaxy build 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2023-03-30 18:09:20 +02:00
Martin Schurz
4c7e189e5d add custom renovate config 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2023-03-30 18:05:39 +02:00
renovate[bot]
cb15672c59
Add renovate.json 2023-03-30 00:02:32 +00:00
dev-sec CI
0b989fa0ab update changelog 2023-03-09 08:41:34 +00:00
schurzi
5ed3f399f2
add check mode to molecule tests (#644) 
* add check mode to molecule tests

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* bail on undefined variables

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* bail on undefined variables

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* execute tasks in check mode

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* fix error in check mode on SuSE

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* use when condition on task

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

---------

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2023-03-09 09:37:59 +01:00
dev-sec CI
cd6be79f89 update changelog 2023-03-06 11:10:57 +00:00
George Bolo
3d0b6670d1
fixes #646 - add another condition to getent task (#647) 
Signed-off-by: gbolo <george.bolo@gmail.com>
 2023-03-06 12:07:40 +01:00
dev-sec CI
879ecefd8c update changelog 2023-03-01 13:23:09 +00:00
schurzi
6e5621cdc9
simplify MySQL queries for user deletion (#641) 
* use rowcount to determine mysql results

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* use correct list level

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* remove json_query

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* remove intermediate vars

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* add check for count

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* drop condition, since one result must exist

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* move rowcount in condition

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* do loop in ansible to report each deleted user

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* add idempotency check

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* additional tests to verify user deletion

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* actually iterate the whole user list when deleting

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* fix tests for SuSE

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* adopt suggestions

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

---------

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2023-03-01 14:19:50 +01:00
dev-sec CI
2d721248a1 update changelog 2023-02-21 13:11:23 +00:00
schurzi
271414bf44
Merge pull request #639 from dev-sec/dependabot/github_actions/creyD/prettier_action-4.3 
Bump creyD/prettier_action from 4.2 to 4.3
 2023-02-21 14:08:08 +01:00
dependabot[bot]
3a907b2921
Bump creyD/prettier_action from 4.2 to 4.3 
Bumps [creyD/prettier_action](https://github.com/creyD/prettier_action) from 4.2 to 4.3.
- [Release notes](https://github.com/creyD/prettier_action/releases)
- [Commits](https://github.com/creyD/prettier_action/compare/v4.2...v4.3)

---
updated-dependencies:
- dependency-name: creyD/prettier_action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-02-21 12:07:33 +00:00
dev-sec CI
3c6806057c update changelog 2023-02-15 17:02:08 +00:00
Nejc Habjan
9e4ea20c67
Only skip audit restart handler in docker (#637) 
Signed-off-by: Nejc Habjan <nejc.habjan@siemens.com>
 2023-02-15 17:58:52 +01:00
dev-sec CI
f245030ead update changelog 2023-02-14 10:18:47 +00:00
Sebastian Gumprich
988e5322cd
Fix molecule tests for EL7 (#636) 
* Fix molecule tests for EL7

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* Apply suggestions from code review

Co-authored-by: schurzi <Martin.Schurz@t-systems.com>

* try to fix tests in centos 7

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* try to fix tests in centos 7

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

---------

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
Co-authored-by: dev-sec CI <hello@dev-sec.io>
Co-authored-by: schurzi <Martin.Schurz@t-systems.com>
 2023-02-14 11:15:21 +01:00
dev-sec CI
0cd3b0d02e update changelog 2023-02-07 08:41:03 +00:00
schurzi
9b32aca0ca
run our CI tests periodically (#634) 
* allow multiple instances for os vm tests

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* add scheduled trigger to all test actions

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* use different scenario names

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* use different scenario names

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* use different scenario names

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* use username to create uniqe vms

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* use compatible name

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* add explaination

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

---------

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2023-02-07 09:27:46 +01:00
dev-sec CI
8d667aa069 update changelog 2023-02-06 13:04:41 +00:00
Sebastian Gumprich
c2e9c9a8dd
try to fix molecule local tests (#632) 
these settings are probably not necessary (geerlingguys images dont have them either)

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2023-02-06 14:01:40 +01:00
dev-sec CI
3d9dfc90df update changelog 2023-02-06 12:53:51 +00:00
Nejc Habjan
1fc2809307
Make action_mail_acct configurable in auditd (#631) 
Signed-off-by: Nejc Habjan <nejc.habjan@siemens.com>
 2023-02-06 13:24:43 +01:00
dev-sec CI
071b270b94 update changelog 2023-02-06 07:40:43 +00:00
schurzi
1ef9171393
remove unneccessary tasks for VM based test (#629) 
* add remaining platforms to test

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* remove unneccessary tasks for test

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* use current opensuse version

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* disable sysctl for missing yama in opensuse

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

---------

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2023-02-06 08:37:40 +01:00
dev-sec CI
a505c3039d update galaxy.yml with new version 2023-02-06 07:37:06 +00:00
dev-sec CI
965013efed update changelog 2023-02-04 17:25:00 +00:00
schurzi
0705a9cc90
Merge pull request #628 from Normo/add-password-warn-age-option 
Set number of warning days before user password expires
 2023-02-04 18:21:52 +01:00
Norman Ziegner
c594a1fe6a
os_hardening: Add test for setting password warning days via variable os_auth_pw_warn_age 
Signed-off-by: Norman Ziegner <norman.ziegner@ufz.de>
 2023-02-03 14:47:27 +01:00
Norman Ziegner
2f60b44cca
os_hardening: Add variable to set the number of days of warning before user password expires 
Signed-off-by: Norman Ziegner <norman.ziegner@ufz.de>
 2023-02-01 16:17:36 +01:00
dev-sec CI
1b1b0e10f2 update changelog 2023-02-01 11:40:40 +00:00
dependabot[bot]
f34f24deb7
Bump hugo19941994/delete-draft-releases from 1.0.0 to 1.0.1 (#627) 
Bumps [hugo19941994/delete-draft-releases](https://github.com/hugo19941994/delete-draft-releases) from 1.0.0 to 1.0.1.
- [Release notes](https://github.com/hugo19941994/delete-draft-releases/releases)
- [Commits](https://github.com/hugo19941994/delete-draft-releases/compare/v1.0.0...v1.0.1)

---
updated-dependencies:
- dependency-name: hugo19941994/delete-draft-releases
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-02-01 12:37:31 +01:00
dev-sec CI
6ccdaee45d update galaxy.yml with new version 2023-01-31 06:55:37 +00:00
dev-sec CI
e8d16766ad update changelog 2023-01-31 06:48:47 +00:00
schurzi
e6bc422f5b
Merge pull request #626 from dev-sec/dependabot_labels 
do not let dependabot label our prs
 2023-01-30 16:21:11 +01:00
Sebastian Gumprich
bfedba6907 do not let dependabot label our prs 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2023-01-30 16:20:35 +01:00
dev-sec CI
1fe0677b0b update changelog 2023-01-30 14:59:08 +00:00
schurzi
894c6117a0
Merge pull request #625 from dev-sec/linting_roles 
run linting only when files inside roles change
 2023-01-30 10:48:22 +01:00
Sebastian Gumprich
330a1eb94d run linting only when files inside roles change 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2023-01-30 10:23:25 +01:00
dev-sec CI
52d08ff009 update changelog 2023-01-29 12:39:47 +00:00
dev-sec CI
01cb20d644 update changelog 2023-01-28 21:01:52 +00:00
rndmh3ro
bc096e58e5 Prettified Code! 2023-01-28 20:59:35 +00:00
DonEstefan
16e00b02db
rewrite user home dir hardening (#584) 
* rewrite user home dir hardening

* delete duplicate var that was missed in a merge conflict

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* linting

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* add tests for home rewrites

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* Apply suggestions from code review

Co-authored-by: schurzi <github@drachen-server.de>

---------

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
Co-authored-by: donestefan <donestefan@users.noreply.github.com>
Co-authored-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>
Co-authored-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
Co-authored-by: schurzi <github@drachen-server.de>
 2023-01-28 21:59:19 +01:00
Sebastian Gumprich
a75b339526 fix more linting errors 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2023-01-27 11:27:35 +01:00
dev-sec CI
9fe8ca7294 update changelog 2023-01-27 10:04:18 +00:00
Sebastian Gumprich
89138be4ec
Rewrite system account detection and hardening and create tests (#621) 
* rewrite system account detection and hardening

* resolve failures created when resolving merge conflicts

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* add tests for shell removal tasks

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* Update molecule/os_hardening/prepare.yml

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* split tasks for locking and setting shell

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* fix some more linting

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Co-authored-by: donestefan <donestefan@users.noreply.github.com>
Co-authored-by: schurzi <Martin.Schurz@t-systems.com>
 2023-01-27 11:01:03 +01:00
dev-sec CI
f1169749f4 update changelog 2023-01-25 22:59:48 +00:00
schurzi
ee80418496
Merge pull request #618 from dev-sec/deprecate_intitramfs 
deprecate rebuilding of initramfs
 2023-01-25 23:56:36 +01:00