Mirrors/ansible-collection-hardening
2
0
Fork 0
mirror of https://github.com/dev-sec/ansible-collection-hardening synced 2024-11-10 09:14:18 +00:00
Code Issues Projects Releases Packages Wiki Activity
1996 commits 15 branches 57 tags 4.6 MiB
Commit graph

1996 commits

This branch
This branch
All branches
Author SHA1 Message Date
dev-sec CI
f1169749f4 update changelog 2023-01-25 22:59:48 +00:00
schurzi
ee80418496
Merge pull request #618 from dev-sec/deprecate_intitramfs 
deprecate rebuilding of initramfs
 2023-01-25 23:56:36 +01:00
Martin Schurz
7f8e9919ee add readme 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2023-01-25 22:30:17 +01:00
dev-sec CI
bbee0b74ec update changelog 2023-01-25 12:21:00 +00:00
schurzi
0e8533049d
Merge pull request #620 from dev-sec/molecule_fixes 
Fixed problems with running molecule locally with cgroup v2
 2023-01-25 13:18:50 +01:00
Sebastian Gumprich
a1028c7504 deprecate initramfs 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2023-01-25 13:07:37 +01:00
dev-sec CI
aa555b9290 update changelog 2023-01-25 08:15:45 +00:00
mmitnyan
83a0a9242b
Support for Amazon Linux 2 (#624) 
Signed-off-by: Manuel Mitnyan <mmitnyan@videotron.ca>

Signed-off-by: Manuel Mitnyan <mmitnyan@videotron.ca>
 2023-01-25 09:12:25 +01:00
dev-sec CI
fdd0bfc72a update changelog 2023-01-24 13:27:02 +00:00
schurzi
154f862ccd
Merge pull request #622 from dev-sec/stop_old_tests 
cancel running tests if new commit to branch is made
 2023-01-24 13:21:18 +01:00
Sebastian Gumprich
db4bd32767 cancel running tests if new commit to branch is made 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2023-01-24 13:08:04 +01:00
Sebastian Gumprich
281d706660 add waiver to not test mounts 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2023-01-24 13:03:04 +01:00
dev-sec CI
85271c2375 update changelog 2023-01-24 12:01:58 +00:00
Sebastian Gumprich
d386bf36d2 Revert "manage tmp dir in tests" 
This reverts commit 966f2fe137.
 2023-01-24 12:53:39 +01:00
Sebastian Gumprich
bb588bd777
linting (#603) 
* linting

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* more linting

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* change line length issues

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* replace yes with true in tasks

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* add exception for task

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* remove trailing whitespace

* add back deleted params

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* add back deleted params

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* add back tasks

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2023-01-24 12:40:27 +01:00
Sebastian Gumprich
966f2fe137 manage tmp dir in tests 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2023-01-24 12:36:09 +01:00
Sebastian Gumprich
fa2e90c6f2 mount cgroup rw, as suse seems to need it 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2023-01-23 15:59:06 +01:00
Sebastian Gumprich
ed1cb1c2a7 add cgroupns: host mode to molecule 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2023-01-23 15:59:06 +01:00
Sebastian Gumprich
a0d11faa8a Fixed problems with running molecule locally with cgroup v2 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2023-01-23 15:59:06 +01:00
dev-sec CI
a94168c84f update changelog 2023-01-23 09:52:21 +00:00
DonEstefan
674be6dc6f
apply password age settings to exisiting regular users (#582) 
* apply password age settings to regular users

* add tests for password ageing

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* add debugging vars

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* add tests for password ageing

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* add tests for password ageing

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* Apply suggestions from code review

Co-authored-by: schurzi <github@drachen-server.de>

* add additional condtion for regular users

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
Co-authored-by: DonEstefan <donestefan@users.noreply.github.com>
Co-authored-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
Co-authored-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>
Co-authored-by: schurzi <github@drachen-server.de>
 2023-01-23 10:50:05 +01:00
dev-sec CI
c1080de135 update changelog 2023-01-23 08:37:51 +00:00
stdtom
9d2c68ef2f
Preserve default ownership and dir mode for /var/log on Ubuntu (#615) 
* Preserve default ownership and dir mode for /var/log on Ubuntu

Signed-off-by: stdtom <stdtom@gmx.net>

* linting

Signed-off-by: stdtom <stdtom@gmx.net>

* Define vars for each OS instead of using defaults.

Signed-off-by: stdtom <stdtom@gmx.net>

* Fix values for os_mnt_var_log_dir_mode and os_mnt_var_log_group

Signed-off-by: stdtom <stdtom@gmx.net>

Signed-off-by: stdtom <stdtom@gmx.net>
 2023-01-23 09:34:41 +01:00
dev-sec CI
c0b9c87dc1 update changelog 2023-01-19 12:47:40 +00:00
Sebastian Gumprich
142782bad6 add diff to molecule 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2023-01-19 13:46:16 +01:00
rndmh3ro
b3fbfcedbe Prettified Code! 2023-01-19 12:45:51 +00:00
Paweł Krawczyk
88ef3cf3af
Parametrize more auditd.conf options (#535) 
* Parametrize more auditd.conf options

* Parametrize more auditd.conf options

* Add `os_auditd` options

* Add os_auditd_log_group

* Add os_auditd_log_group

Co-authored-by: Paweł Krawczyk <p@krvtz.net>
Co-authored-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>
 2023-01-19 13:45:24 +01:00
dev-sec CI
ca25f50ba6 update changelog 2023-01-12 11:56:07 +00:00
richardlock
a82942a63a
Add support for /etc/auditd.conf num_logs to go with max_log_file_action. (#617) 
Signed-off-by: Richard Lock <r.j.lock@derby.ac.uk>

Signed-off-by: Richard Lock <r.j.lock@derby.ac.uk>
 2023-01-12 12:52:48 +01:00
dev-sec CI
fc060376ac update changelog 2022-12-24 09:43:18 +00:00
dependabot[bot]
16f78bc6be
Bump actions/setup-python from 1 to 4 (#611) 
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 1 to 4.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v1...v4)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2022-12-24 10:28:54 +01:00
dev-sec CI
764472ae33 update galaxy.yml with new version 2022-12-19 08:43:22 +00:00
dependabot[bot]
395091c41d
Bump creyD/prettier_action from 3.1 to 4.2 (#610) 
Bumps [creyD/prettier_action](https://github.com/creyD/prettier_action) from 3.1 to 4.2.
- [Release notes](https://github.com/creyD/prettier_action/releases)
- [Commits](https://github.com/creyD/prettier_action/compare/v3.1...v4.2)

---
updated-dependencies:
- dependency-name: creyD/prettier_action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2022-12-17 19:53:05 +01:00
dev-sec CI
0a589e5f51 update changelog 2022-12-17 18:49:42 +00:00
John Losito
9d0cc42039
Check for github action updates daily (#609) 
Signed-off-by: John Losito <lositojohnj@gmail.com>

Signed-off-by: John Losito <lositojohnj@gmail.com>
 2022-12-17 19:48:02 +01:00
dev-sec CI
5a7783defe update changelog 2022-12-07 07:55:29 +00:00
Sebastian Gumprich
be0642bcfb
add verify-task to check if mysql is running and enabled (#608) 
* add verify-task to check if mysql is running and enabled

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* Update molecule/mysql_hardening/verify_tasks/service.yml

Co-authored-by: schurzi <Martin.Schurz@t-systems.com>

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
Co-authored-by: schurzi <Martin.Schurz@t-systems.com>
 2022-12-07 08:49:07 +01:00
dev-sec CI
b0454fade2 update changelog 2022-11-30 15:15:52 +00:00
DonEstefan
bb3c63e321
fix IPv6 hardening (#607) 
Signed-off-by: DonEstefan <donestefan@users.noreply.github.com>

Signed-off-by: DonEstefan <donestefan@users.noreply.github.com>
Co-authored-by: donestefan <donestefan@users.noreply.github.com>
 2022-11-30 16:13:25 +01:00
dev-sec CI
d3e6df3dbf update changelog 2022-11-29 14:11:39 +00:00
Sebastian Gumprich
e66c2eb6bb
Add OpenSUSE support (#605) 
* Add variables for mariadb on opensuse

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* enable pipeline

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* add a note about the reuirement of the jmespath library.

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* Use python3 on opensuse

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* fix my yml.

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* use right ansible variable

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* Suse requires python-rpm

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* try zypper

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* python-xml

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* another try at fixing the install

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* fix my yml

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* another try

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* another try

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* another try now with rpm.

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* fix my yml...

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* typo

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* do the test for Suse on the shell and not in ansible

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* specify to use bash

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* specify to use bash

* try the removes keyword of builtin.shell

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* fix ansible syntax

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* fix zypper syntax

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* ensure pymysql is present

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>

* set ansible python interpreter in converge-step, too

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* move install task to prepare

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

Signed-off-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
Co-authored-by: Florian Goth <fgoth@physik.uni-wuerzburg.de>
 2022-11-29 15:09:27 +01:00
dev-sec CI
61e92aaaf6 update changelog 2022-11-24 07:41:20 +00:00
Jacob Sievert
ade6deeba2
Updates handlers for new ansible syntax and deprecated options for legacy commands (#602) 
* Update main.yml

fixes the handler file and set new syntax

Signed-off-by: Jacob Sievert <jacob.sievert@sievert-mail.de>

* changes command module from legacy to builtin.

Signed-off-by: Jacob Sievert <jacob.sievert@sievert-mail.de>

Signed-off-by: Jacob Sievert <jacob.sievert@sievert-mail.de>
 2022-11-24 08:39:05 +01:00
dev-sec CI
66f5c6b131 update changelog 2022-11-23 12:51:31 +00:00
Cristian Baldi
7d1da63c94
Allow ssh_allow_tcp_forwarding to be a boolean (#600) 
* Allow ssh_allow_tcp_forwarding to be a boolean

Signed-off-by: Cristian Baldi <cristian.baldi@scrive.com>

* Update documentation related to ssh_allow_tcp_forwarding

Signed-off-by: Cristian Baldi <cristian.baldi@scrive.com>

Signed-off-by: Cristian Baldi <cristian.baldi@scrive.com>
 2022-11-23 13:45:01 +01:00
dev-sec CI
03f3974f37 update changelog 2022-11-17 13:01:02 +00:00
schurzi
006e3bf75b
Merge pull request #601 from dev-sec/contribute_dco 
add notice to sign-off work to contributor guideline
 2022-11-17 13:58:08 +01:00
Martin Schurz
98c645db5f add notice to sign-off work to contributor guideline 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2022-11-17 13:47:11 +01:00
dev-sec CI
dd97a90b65 update changelog 2022-11-08 09:29:35 +00:00
schurzi
d982a89cc1
Merge pull request #598 from dennisse/master 
OpenBSD does not support GSSAPI Authentication
 2022-11-08 10:26:42 +01:00