add option to whitelist specific user that need a .netrc file in there home dirs
add test for .netrc files if option os_netrc_enabled is false
Signed-off-by: Philipp Funk <philipp.funk@t-systems.com>
Signed-off-by: Philipp Funk <philipp.funk@t-systems.com>
Co-authored-by: Philipp Funk <philipp.funk@t-systems.com>
* Include Debian 11 into Molecule test suites (#527)
Signed-off-by: Daya Adianto <dayaadianto@cs.ui.ac.id>
* Fix Ansible Lint GitHub Action version (#527)
Signed-off-by: Daya Adianto <dayaadianto@cs.ui.ac.id>
* Update .gitignore
Signed-off-by: Daya Adianto <dayaadianto@cs.ui.ac.id>
* mysql_hardening: Use Python 3 as Ansible interpreter (#527)
Signed-off-by: Daya Adianto <dayaadianto@cs.ui.ac.id>
* Note Debian 11 support for os_hardening & nginx_hardening (#527)
Signed-off-by: Daya Adianto <dayaadianto@cs.ui.ac.id>
* Fix lint issues & Ansible Lint configuration in CI
Signed-off-by: Daya Adianto <dayaadianto@cs.ui.ac.id>
* Try to fix YAML lint issues, again
Re-ordered YAML comments at the end of `.yamllint` file.
Signed-off-by: Daya Adianto <dayaadianto@cs.ui.ac.id>
* rm debian9 from tests, add debian 11 where missing
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
* fix mysql molecule tests
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
Signed-off-by: Daya Adianto <dayaadianto@cs.ui.ac.id>
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
Co-authored-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>
Co-authored-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
* add VM tests for ssh_hardening
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
* remove VM tests from ssh_hardening
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
* run ssh_hardening test as unprivileged user
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
* add link for documentation
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
* use different config
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
* remove become
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
* re-add become
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
* move become into role
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
* indentation
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
* try args apply
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
* fix linting
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
* add documentation
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
```
Unable to open /var/log/audit/audit.log (Permission denied)
```
This PR fixes the issue by using the default permission set by auditd (`0700`).
Signed-off-by: Benedikt Böhm <bb@xnull.de>
* Only run harding if /var/log/audit exists
Signed-off-by: GitHub <noreply@github.com>
* Update roles/os_hardening/tasks/minimize_access.yml
* add more conditionals to when auditd show be hardened
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
* add more tests to the os-hardening vm tests
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
* Revert "add more tests to the os-hardening vm tests"
This reverts commit c05fe8b520.
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
Co-authored-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>
Co-authored-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
* first testing with tasks and variables
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* update variables for dir options
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* updated permissions and defaults
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* fix home dir permissions
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* updated tasks with useful variables
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* reorder tasks. first remount, then manage fstab and fix permissions on directories. Renaming task names with mountpoints (slashes)
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* shorten tasks with list items
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* change defaults for /boot directory, because its a bad behaviour, if ansible changes boot entries with a default value
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* Update documentation for new parameters to manage mountpoints
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* Update roles/os_hardening/tasks/minimize_access.yml
Co-authored-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* Update roles/os_hardening/tasks/minimize_access.yml
Co-authored-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* Fix state on every new task
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* loop instead of list
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* testing remount with register
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* add remounts with loop over all changed folders
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* testing and solving trouble with variable names
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* optimize default permissions for var-log-audit
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* optimize default permissions for var-log-audit
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* change to new optimizied permissions of var-log-audit
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* fix some defaults in fstab to configure as mounted
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* add stat and check, if boot folder exists
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
Co-authored-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
Co-authored-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>
while this could be better solved by checking what nginx version is used, debian9 is eol'd in 4 months. if there will be again a need to check for nginx versions, we'll add it then
Signed-off-by: rndmh3ro <github@gumpri.ch>
Files in this whitelist should not be altered.
Currently this is only relevant for enforcing the gpg check.
Signed-off-by: René Scheibe <rene.scheibe@gmail.com>
* new function to disable ctrl-alt-del to avooid reboot virtual machines f.e.
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* fix variable documentation for ctrlaltdel
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* added ctrlaltdel variable for molecule
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* optimize ctrlaltdel function with a 'when' query. thanks to rndmh3ro
Signed-off-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
* fix typo in new file
Co-authored-by: Ludwig Bayerlein <bayerlein@bayerlein-networks.com>
Co-authored-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>
The tasks `Change shadow ownership to root and mode to 0600` and `Change
passwd ownership to root and mode to 0644` only handle
`/etc/shadow` and `/etc/passwd` respectively. But there multiple
adjacent files that should be handled with these rules as well:
- `/etc/gshadow`
- `/etc/shadow-`
- `/etc/gshadow-`
- `/etc/group`
- `/etc/shadow-`
- `/etc/group-`
This change adds those files to the rules, so that permissions are
handled in the same way.
Closes: #488
Signed-off-by: Claudius Heine <ch@denx.de>
* fix filter error in ansible.builtin.file mode parameter
* Change cinc supermarket
* fix link to baseline
* fix typo
Co-authored-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>
