Mirrors/ansible-collection-hardening
2
0
Fork 0
mirror of https://github.com/dev-sec/ansible-collection-hardening synced 2024-11-10 09:14:18 +00:00
Code Issues Projects Releases Packages Wiki Activity
2140 commits 15 branches 57 tags 4.6 MiB
Commit graph

2140 commits

This branch
This branch
All branches
Author SHA1 Message Date
Martin Schurz
4c7e189e5d add custom renovate config 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2023-03-30 18:05:39 +02:00
renovate[bot]
cb15672c59
Add renovate.json 2023-03-30 00:02:32 +00:00
dev-sec CI
0b989fa0ab update changelog 2023-03-09 08:41:34 +00:00
schurzi
5ed3f399f2
add check mode to molecule tests (#644) 
* add check mode to molecule tests

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* bail on undefined variables

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* bail on undefined variables

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* execute tasks in check mode

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* fix error in check mode on SuSE

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* use when condition on task

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

---------

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2023-03-09 09:37:59 +01:00
dev-sec CI
cd6be79f89 update changelog 2023-03-06 11:10:57 +00:00
George Bolo
3d0b6670d1
fixes #646 - add another condition to getent task (#647) 
Signed-off-by: gbolo <george.bolo@gmail.com>
 2023-03-06 12:07:40 +01:00
dev-sec CI
879ecefd8c update changelog 2023-03-01 13:23:09 +00:00
schurzi
6e5621cdc9
simplify MySQL queries for user deletion (#641) 
* use rowcount to determine mysql results

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* use correct list level

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* remove json_query

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* remove intermediate vars

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* add check for count

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* drop condition, since one result must exist

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* move rowcount in condition

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* do loop in ansible to report each deleted user

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* add idempotency check

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* additional tests to verify user deletion

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* actually iterate the whole user list when deleting

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* fix tests for SuSE

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* adopt suggestions

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

---------

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2023-03-01 14:19:50 +01:00
dev-sec CI
2d721248a1 update changelog 2023-02-21 13:11:23 +00:00
schurzi
271414bf44
Merge pull request #639 from dev-sec/dependabot/github_actions/creyD/prettier_action-4.3 
Bump creyD/prettier_action from 4.2 to 4.3
 2023-02-21 14:08:08 +01:00
dependabot[bot]
3a907b2921
Bump creyD/prettier_action from 4.2 to 4.3 
Bumps [creyD/prettier_action](https://github.com/creyD/prettier_action) from 4.2 to 4.3.
- [Release notes](https://github.com/creyD/prettier_action/releases)
- [Commits](https://github.com/creyD/prettier_action/compare/v4.2...v4.3)

---
updated-dependencies:
- dependency-name: creyD/prettier_action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-02-21 12:07:33 +00:00
dev-sec CI
3c6806057c update changelog 2023-02-15 17:02:08 +00:00
Nejc Habjan
9e4ea20c67
Only skip audit restart handler in docker (#637) 
Signed-off-by: Nejc Habjan <nejc.habjan@siemens.com>
 2023-02-15 17:58:52 +01:00
dev-sec CI
f245030ead update changelog 2023-02-14 10:18:47 +00:00
Sebastian Gumprich
988e5322cd
Fix molecule tests for EL7 (#636) 
* Fix molecule tests for EL7

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* Apply suggestions from code review

Co-authored-by: schurzi <Martin.Schurz@t-systems.com>

* try to fix tests in centos 7

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* try to fix tests in centos 7

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

---------

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
Co-authored-by: dev-sec CI <hello@dev-sec.io>
Co-authored-by: schurzi <Martin.Schurz@t-systems.com>
 2023-02-14 11:15:21 +01:00
dev-sec CI
0cd3b0d02e update changelog 2023-02-07 08:41:03 +00:00
schurzi
9b32aca0ca
run our CI tests periodically (#634) 
* allow multiple instances for os vm tests

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* add scheduled trigger to all test actions

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* use different scenario names

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* use different scenario names

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* use different scenario names

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* use username to create uniqe vms

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* use compatible name

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* add explaination

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

---------

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2023-02-07 09:27:46 +01:00
dev-sec CI
8d667aa069 update changelog 2023-02-06 13:04:41 +00:00
Sebastian Gumprich
c2e9c9a8dd
try to fix molecule local tests (#632) 
these settings are probably not necessary (geerlingguys images dont have them either)

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2023-02-06 14:01:40 +01:00
dev-sec CI
3d9dfc90df update changelog 2023-02-06 12:53:51 +00:00
Nejc Habjan
1fc2809307
Make action_mail_acct configurable in auditd (#631) 
Signed-off-by: Nejc Habjan <nejc.habjan@siemens.com>
 2023-02-06 13:24:43 +01:00
dev-sec CI
071b270b94 update changelog 2023-02-06 07:40:43 +00:00
schurzi
1ef9171393
remove unneccessary tasks for VM based test (#629) 
* add remaining platforms to test

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* remove unneccessary tasks for test

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* use current opensuse version

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* disable sysctl for missing yama in opensuse

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

---------

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2023-02-06 08:37:40 +01:00
dev-sec CI
a505c3039d update galaxy.yml with new version 2023-02-06 07:37:06 +00:00
dev-sec CI
965013efed update changelog 2023-02-04 17:25:00 +00:00
schurzi
0705a9cc90
Merge pull request #628 from Normo/add-password-warn-age-option 
Set number of warning days before user password expires
 2023-02-04 18:21:52 +01:00
Norman Ziegner
c594a1fe6a
os_hardening: Add test for setting password warning days via variable os_auth_pw_warn_age 
Signed-off-by: Norman Ziegner <norman.ziegner@ufz.de>
 2023-02-03 14:47:27 +01:00
Norman Ziegner
2f60b44cca
os_hardening: Add variable to set the number of days of warning before user password expires 
Signed-off-by: Norman Ziegner <norman.ziegner@ufz.de>
 2023-02-01 16:17:36 +01:00
dev-sec CI
1b1b0e10f2 update changelog 2023-02-01 11:40:40 +00:00
dependabot[bot]
f34f24deb7
Bump hugo19941994/delete-draft-releases from 1.0.0 to 1.0.1 (#627) 
Bumps [hugo19941994/delete-draft-releases](https://github.com/hugo19941994/delete-draft-releases) from 1.0.0 to 1.0.1.
- [Release notes](https://github.com/hugo19941994/delete-draft-releases/releases)
- [Commits](https://github.com/hugo19941994/delete-draft-releases/compare/v1.0.0...v1.0.1)

---
updated-dependencies:
- dependency-name: hugo19941994/delete-draft-releases
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-02-01 12:37:31 +01:00
dev-sec CI
6ccdaee45d update galaxy.yml with new version 2023-01-31 06:55:37 +00:00
dev-sec CI
e8d16766ad update changelog 2023-01-31 06:48:47 +00:00
schurzi
e6bc422f5b
Merge pull request #626 from dev-sec/dependabot_labels 
do not let dependabot label our prs
 2023-01-30 16:21:11 +01:00
Sebastian Gumprich
bfedba6907 do not let dependabot label our prs 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2023-01-30 16:20:35 +01:00
dev-sec CI
1fe0677b0b update changelog 2023-01-30 14:59:08 +00:00
schurzi
894c6117a0
Merge pull request #625 from dev-sec/linting_roles 
run linting only when files inside roles change
 2023-01-30 10:48:22 +01:00
Sebastian Gumprich
330a1eb94d run linting only when files inside roles change 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2023-01-30 10:23:25 +01:00
dev-sec CI
52d08ff009 update changelog 2023-01-29 12:39:47 +00:00
dev-sec CI
01cb20d644 update changelog 2023-01-28 21:01:52 +00:00
rndmh3ro
bc096e58e5 Prettified Code! 2023-01-28 20:59:35 +00:00
DonEstefan
16e00b02db
rewrite user home dir hardening (#584) 
* rewrite user home dir hardening

* delete duplicate var that was missed in a merge conflict

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* linting

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* add tests for home rewrites

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* Apply suggestions from code review

Co-authored-by: schurzi <github@drachen-server.de>

---------

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
Co-authored-by: donestefan <donestefan@users.noreply.github.com>
Co-authored-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>
Co-authored-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
Co-authored-by: schurzi <github@drachen-server.de>
 2023-01-28 21:59:19 +01:00
Sebastian Gumprich
a75b339526 fix more linting errors 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2023-01-27 11:27:35 +01:00
dev-sec CI
9fe8ca7294 update changelog 2023-01-27 10:04:18 +00:00
Sebastian Gumprich
89138be4ec
Rewrite system account detection and hardening and create tests (#621) 
* rewrite system account detection and hardening

* resolve failures created when resolving merge conflicts

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* add tests for shell removal tasks

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* Update molecule/os_hardening/prepare.yml

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* split tasks for locking and setting shell

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* fix some more linting

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Co-authored-by: donestefan <donestefan@users.noreply.github.com>
Co-authored-by: schurzi <Martin.Schurz@t-systems.com>
 2023-01-27 11:01:03 +01:00
dev-sec CI
f1169749f4 update changelog 2023-01-25 22:59:48 +00:00
schurzi
ee80418496
Merge pull request #618 from dev-sec/deprecate_intitramfs 
deprecate rebuilding of initramfs
 2023-01-25 23:56:36 +01:00
Martin Schurz
7f8e9919ee add readme 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2023-01-25 22:30:17 +01:00
dev-sec CI
bbee0b74ec update changelog 2023-01-25 12:21:00 +00:00
schurzi
0e8533049d
Merge pull request #620 from dev-sec/molecule_fixes 
Fixed problems with running molecule locally with cgroup v2
 2023-01-25 13:18:50 +01:00
Sebastian Gumprich
a1028c7504 deprecate initramfs 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2023-01-25 13:07:37 +01:00