Commit graph

25 commits

Author SHA1 Message Date
Sebastian Gumprich
296f46cc80
centos7 is eol, remove it (#767)
* centos7 is eol, remove it

Signed-off-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>

* change workflow to update readmes when meta/main.yml is changed

Signed-off-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>

* remove mention of centos 7 from readme

Signed-off-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>

---------

Signed-off-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>
2024-05-31 11:25:01 +02:00
Martin Schurz
7259d6b5fd fix spelling errors
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
2023-04-14 23:51:53 +02:00
schurzi
1ef9171393
remove unneccessary tasks for VM based test (#629)
* add remaining platforms to test

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* remove unneccessary tasks for test

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* use current opensuse version

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* disable sysctl for missing yama in opensuse

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

---------

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
2023-02-06 08:37:40 +01:00
Sebastian Gumprich
bb588bd777
linting (#603)
* linting

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* more linting

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* change line length issues

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* replace yes with true in tasks

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* add exception for task

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* remove trailing whitespace

* add back deleted params

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* add back deleted params

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* add back tasks

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
2023-01-24 12:40:27 +01:00
stdtom
9d2c68ef2f
Preserve default ownership and dir mode for /var/log on Ubuntu (#615)
* Preserve default ownership and dir mode for /var/log on Ubuntu

Signed-off-by: stdtom <stdtom@gmx.net>

* linting

Signed-off-by: stdtom <stdtom@gmx.net>

* Define vars for each OS instead of using defaults.

Signed-off-by: stdtom <stdtom@gmx.net>

* Fix values for os_mnt_var_log_dir_mode and os_mnt_var_log_group

Signed-off-by: stdtom <stdtom@gmx.net>

Signed-off-by: stdtom <stdtom@gmx.net>
2023-01-23 09:34:41 +01:00
Sebastian Gumprich
dac66f4a88 simplify OS-vars files
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
2022-10-25 18:59:11 +02:00
Martin Schurz
5d50b5b130 add sysctl exclude
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
2022-07-11 09:32:02 +02:00
Martin Schurz
4b519e8b13 add sysctl exclude
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
2022-07-11 09:13:26 +02:00
Martin Schurz
92dc094022 add sysctl exclude
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
2022-07-11 09:05:58 +02:00
Sebastian Gumprich
2ba40b0891
move sysctls to debian specific vars (#524)
* fix ansible-lint issue

https://github.com/ansible-community/ansible-lint/issues/1795
Signed-off-by: rndmh3ro <github@gumpri.ch>

* move 2 sysctls to debian specific

Signed-off-by: rndmh3ro <github@gumpri.ch>

* fix ansible-lint issue

https://github.com/ansible-community/ansible-lint/issues/1795
Signed-off-by: rndmh3ro <github@gumpri.ch>

* add arch linux sysctls

* simplify sysctl settings

Signed-off-by: rndmh3ro <github@gumpri.ch>

* ove overwrite to the bottom to let it acutally overwrite something

Signed-off-by: rndmh3ro <github@gumpri.ch>

* fix typo

Signed-off-by: rndmh3ro <github@gumpri.ch>
2022-02-18 15:30:32 +01:00
Leo Gallucci
585f1dc227
Add SUB_UID_MIN/MAX/COUNT, SUB_GID_MIN/MAX/COUNT (#463)
* add SUB_UID_MIN/MAX/COUNT, SUB_GID_MIN/MAX/COUNT

Similar reason as #461

> If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate user IDs)
> allocate SUB_UID_COUNT unused user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user.
> The default values for SUB_UID_MIN, SUB_UID_MAX, SUB_UID_COUNT are respectively 100000, 600100000 and 65536.

Signed-off-by: Leo Gallucci <elgalu3@gmail.com>

* document SUB_UID_MIN/MAX/COUNT, etc

Signed-off-by: Leo Gallucci <elgalu3@gmail.com>
2021-07-16 09:41:37 +02:00
Leo Gallucci
f92d193d3d
add os_auth_uid_max, os_auth_gid_max (#461)
Signed-off-by: Leo Gallucci <elgalu3@gmail.com>
2021-07-12 15:32:02 +02:00
Sherwin Daganato
350b5891d1
Add support for Rocky Linux 8 (#454)
Signed-off-by: Sherwin Daganato <sherwin@daganato.com>
2021-06-30 10:12:07 +02:00
Martin Schurz
ec9d7d2cb8 cleanup and typos
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
2021-03-15 23:39:12 +01:00
Martin Schurz
75fc31b80c remove cracklib
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
2021-02-22 19:10:45 +01:00
Martin Schurz
dba53718cf sssd is disabled on Amazonlinus
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
2021-02-16 20:44:28 +01:00
Martin Schurz
b9e33091e2 fix problems with auth
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
2021-02-14 21:30:35 +01:00
Martin Schurz
30f0839513 add support for rhel8 and sssd
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
2021-02-14 12:44:20 +01:00
Martin Schurz
b210df1233 re-add debian tally config
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
2021-02-08 10:51:03 +01:00
Martin Schurz
a55a4d2024 remove pam_tally2
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
2021-02-08 08:09:43 +01:00
Farid Joubbi
d01abb44c0
Syncookie (#372)
* Enabled SYN cookie sysctl.

Signed-off-by: Farid Joubbi <farid@joubbi.se>

* Removed SYN cookies from here since it's a default now.

Signed-off-by: Farid Joubbi <farid@joubbi.se>
2021-01-15 09:56:29 +01:00
schurzi
b4ca950122
set hidepid=0 on RHEL/CentOS 7 (#369)
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
2021-01-03 12:53:08 +01:00
schurzi
a75e2c028b
change inclusion of os specific defaults (#353)
* change inclusion of os specific defaults

we now include the os specific options into a separate variable and
merge this with the default ansible namespace, when the corresponding
keys do not already exist (eg. are defined by default oder by user)

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* simplify check for os specific variables

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* add test for variable override

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* move tests to verify stage

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* correct grep

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* linting

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* fix typo

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* Revert "Merge pull request #351 from sprat/fix-umask"

This reverts commit 9e8e0bc8fb, reversing
changes made to 98c7553016.

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* move immutable ssh vars to internal vars

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* move vars to OS files

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* change default handling for all roles

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* fix issues

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* add documentation

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* Update main.yml

Co-authored-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>
2020-12-20 20:46:57 +01:00
Sylvain Prat
ea471b38b7 Fix #344: make the os_env_umask variable usable again
Signed-off-by: Sylvain Prat <sylvain.prat@gmail.com>
2020-12-15 21:31:51 +01:00
Sebastian Gumprich
dd3959276b merge os-hardening role into collection 2020-11-07 22:09:28 +01:00