GitHub
commit
5f2b31ecef
330 changed files with 9859 additions and 2139 deletions
36
Makefile
36
Makefile
|
|
@ -1,8 +1,13 @@
|
|||
export COMPOSE_FILE=./docker-compose.yml
|
||||
export COMPOSE_PROJECT_NAME=publichealth
|
||||
export EMAIL=change_me@localhost.localhost
|
||||
|
||||
default: build
|
||||
|
||||
local-loaddata:
|
||||
sed -i 's/\"is_default_site\": true/\"is_default_site\": false/g' publichealth.home.json
|
||||
python manage.py loaddata publichealth.home.json
|
||||
|
||||
upgrade:
|
||||
docker-compose pull
|
||||
|
||||
|
|
@ -19,12 +24,10 @@ run-here:
|
|||
run:
|
||||
docker-compose up -d # detach by default
|
||||
|
||||
restart:
|
||||
docker-compose stop web
|
||||
docker-compose up -d web
|
||||
|
||||
stop:
|
||||
docker-compose stop
|
||||
docker-compose stop web
|
||||
|
||||
restart: stop run
|
||||
|
||||
migrate:
|
||||
docker-compose exec web ./manage.py migrate
|
||||
|
|
@ -36,19 +39,20 @@ apply-migrations: migrations migrate
|
|||
|
||||
setup:
|
||||
docker-compose exec web ./manage.py migrate
|
||||
docker-compose exec web ./manage.py createsuperuser
|
||||
docker-compose exec web ./manage.py compress
|
||||
docker-compose exec web ./manage.py collectstatic
|
||||
docker-compose exec web ./manage.py createsuperuser --username admin --email $(EMAIL) --noinput
|
||||
|
||||
release:
|
||||
rebuild:
|
||||
docker-compose pull
|
||||
sudo docker-compose build web
|
||||
docker-compose build web
|
||||
docker-compose stop web
|
||||
docker-compose kill web
|
||||
docker-compose up -d web
|
||||
|
||||
compress:
|
||||
docker-compose exec web ./manage.py collectstatic --noinput -i media
|
||||
docker-compose exec web ./manage.py compress
|
||||
|
||||
release: rebuild compress run
|
||||
|
||||
reindex:
|
||||
docker-compose exec web ./manage.py update_index
|
||||
|
||||
|
|
@ -67,10 +71,13 @@ django-shell:
|
|||
docker-compose exec web ./manage.py shell
|
||||
|
||||
logs:
|
||||
docker-compose exec web tail /var/log/wagtail/publichealth.log /var/log/wagtail/wagtail.log /var/log/wagtail/error.log
|
||||
|
||||
docker-logs:
|
||||
docker-compose logs -f --tail=500
|
||||
|
||||
backup-data:
|
||||
docker-compose exec web ./manage.py dumpdata --natural-foreign -e auth.permission -e contenttypes -e wagtailcore.GroupCollectionPermission -e wagtailimages.rendition -e sessions -e feedler.feedlysettings > ~/publichealth.home.json
|
||||
docker-compose exec web ./manage.py dumpdata --natural-foreign -e auth.permission -e contenttypes -e wagtailcore.GroupCollectionPermission -e wagtailcore.GroupPagePermission -e wagtailimages.rendition -e sessions -e feedler.feedlysettings > ~/publichealth.home.json
|
||||
zip ~/publichealth.home.json.`date +"%d%m%Y-%H%M"`.zip ~/publichealth.home.json
|
||||
rm ~/publichealth.home.json
|
||||
|
||||
|
|
@ -81,9 +88,8 @@ backup-images:
|
|||
|
||||
backup: backup-data backup-images
|
||||
|
||||
django-loaddata:
|
||||
gunzip ~/publichealth.home.json.gz
|
||||
docker-compose exec web ./manage.py loaddata ~/publichealth.home.json
|
||||
loaddata:
|
||||
docker-compose exec web ./manage.py loaddata publichealth.home.json
|
||||
|
||||
restore: django-loaddata restart
|
||||
|
||||
|
|
|
|||
1
Pipfile
1
Pipfile
|
|
@ -21,6 +21,7 @@ django-el-pagination = "*"
|
|||
django-libsass = "*"
|
||||
django-redis = "*"
|
||||
django-social-share = "*"
|
||||
django-contrib-comments = "*"
|
||||
elasticsearch = ">=5.0.0,<6.0.0"
|
||||
guess_language-spirit = "*"
|
||||
gunicorn = "*"
|
||||
|
|
|
|||
567
Pipfile.lock
generated
567
Pipfile.lock
generated
|
|
@ -1,7 +1,7 @@
|
|||
{
|
||||
"_meta": {
|
||||
"hash": {
|
||||
"sha256": "670dd22850b5e780924acfba7cfdff5652cf2c97365d58aa7d0c44c3e16feca3"
|
||||
"sha256": "b30c946ad74676a15cd9f3aaa0bf918a2f094e4b9b578ea447e456133a02e48d"
|
||||
},
|
||||
"pipfile-spec": 6,
|
||||
"requires": {},
|
||||
|
|
@ -16,18 +16,18 @@
|
|||
"default": {
|
||||
"beautifulsoup4": {
|
||||
"hashes": [
|
||||
"sha256:11a9a27b7d3bddc6d86f59fb76afb70e921a25ac2d6cc55b40d072bd68435a76",
|
||||
"sha256:7015e76bf32f1f574636c4288399a6de66ce08fb7b2457f628a8d70c0fbabb11",
|
||||
"sha256:808b6ac932dccb0a4126558f7dfdcf41710dd44a4ef497a0bb59a77f9f078e89"
|
||||
"sha256:05fd825eb01c290877657a56df4c6e4c311b3965bda790c613a3d6fb01a5462a",
|
||||
"sha256:9fbb4d6e48ecd30bcacc5b63b94088192dcda178513b2ae3c394229f8911b887",
|
||||
"sha256:e1505eeed31b0f4ce2dbb3bc8eb256c04cc2b3b72af7d551a4ab6efd5cbe5dae"
|
||||
],
|
||||
"version": "==4.6.0"
|
||||
"version": "==4.8.2"
|
||||
},
|
||||
"certifi": {
|
||||
"hashes": [
|
||||
"sha256:017c25db2a153ce562900032d5bc68e9f191e44e9a0f762f373977de9df1fbb3",
|
||||
"sha256:25b64c7da4cd7479594d035c08c2d809eb4aab3a26e5a990ea98cc450c320f1f"
|
||||
"sha256:1d987a998c75633c40847cc966fcf5904906c920a7f17ef374f5aa4282abd304",
|
||||
"sha256:51fcb31174be6e6664c5f69e3e1691a2d72a1a12e90f872cbdb1567eb47b6519"
|
||||
],
|
||||
"version": "==2019.11.28"
|
||||
"version": "==2020.4.5.1"
|
||||
},
|
||||
"chardet": {
|
||||
"hashes": [
|
||||
|
|
@ -38,10 +38,10 @@
|
|||
},
|
||||
"click": {
|
||||
"hashes": [
|
||||
"sha256:2335065e6395b9e67ca716de5f7526736bfa6ceead690adf616d925bdc622b13",
|
||||
"sha256:5b94b49521f6456670fdb30cd82a4eca9412788a93fa6dd6df72c94d5a8ff2d7"
|
||||
"sha256:d2b5255c7c6349bc1bd1e59e08cd12acbbd63ce649f2588755783aa94dfb6b1a",
|
||||
"sha256:dacca89f4bfadd5de3d7489b7c8a566eee0d3676333fbb50030263894c38c0dc"
|
||||
],
|
||||
"version": "==7.0"
|
||||
"version": "==7.1.2"
|
||||
},
|
||||
"concurrentloghandler": {
|
||||
"hashes": [
|
||||
|
|
@ -52,10 +52,10 @@
|
|||
},
|
||||
"contextlib2": {
|
||||
"hashes": [
|
||||
"sha256:509f9419ee91cdd00ba34443217d5ca51f5a364a404e1dce9e8979cea969ca48",
|
||||
"sha256:f5260a6e679d2ff42ec91ec5252f4eeffdcf21053db9113bd0a8e4d953769c00"
|
||||
"sha256:01f490098c18b19d2bd5bb5dc445b2054d2fa97f09a4280ba2c5f3c394c8162e",
|
||||
"sha256:3355078a159fbb44ee60ea80abd0d87b80b78c248643b49aa6d94673b413609b"
|
||||
],
|
||||
"version": "==0.5.5"
|
||||
"version": "==0.6.0.post1"
|
||||
},
|
||||
"dj-database-url": {
|
||||
"hashes": [
|
||||
|
|
@ -73,26 +73,26 @@
|
|||
},
|
||||
"django": {
|
||||
"hashes": [
|
||||
"sha256:1226168be1b1c7efd0e66ee79b0e0b58b2caa7ed87717909cd8a57bb13a7079a",
|
||||
"sha256:9a4635813e2d498a3c01b10c701fe4a515d76dd290aaa792ccb65ca4ccb6b038"
|
||||
"sha256:69897097095f336d5aeef45b4103dceae51c00afa6d3ae198a2a18e519791b7a",
|
||||
"sha256:6ecd229e1815d4fc5240fc98f1cca78c41e7a8cd3e3f2eefadc4735031077916"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==2.2.10"
|
||||
"version": "==2.2.12"
|
||||
},
|
||||
"django-anymail": {
|
||||
"hashes": [
|
||||
"sha256:7930d5f841c9be7e044a9e6bf3492aedf7aa641716b6c1f8f52411658f674131",
|
||||
"sha256:dfa4a00a1608d40893cf818ed3632046a0bb01cf2a2bb3a64d31ff146151533a"
|
||||
"sha256:7af1076f383fb3b62b301949ea8f7d87a41376015309ffc35a246a1726060429",
|
||||
"sha256:a2bd7a40aa91a1033892630652d3ca8148de70fa2927eb4eebde239fe705f0f4"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==7.0.0"
|
||||
"version": "==7.1.0"
|
||||
},
|
||||
"django-appconf": {
|
||||
"hashes": [
|
||||
"sha256:35f13ca4d567f132b960e2cd4c832c2d03cb6543452d34e29b7ba10371ba80e3",
|
||||
"sha256:c98a7af40062e996b921f5962a1c4f3f0c979fa7885f7be4710cceb90ebe13a6"
|
||||
"sha256:1b1d0e1069c843ebe8ae5aa48ec52403b1440402b320c3e3a206a0907e97bb06",
|
||||
"sha256:be58deb54a43d77d2e1621fe59f787681376d3cd0b8bd8e4758ef6c3a6453380"
|
||||
],
|
||||
"version": "==1.0.3"
|
||||
"version": "==1.0.4"
|
||||
},
|
||||
"django-colorful": {
|
||||
"hashes": [
|
||||
|
|
@ -109,57 +109,66 @@
|
|||
],
|
||||
"version": "==2.4"
|
||||
},
|
||||
"django-crispy-forms": {
|
||||
"django-contrib-comments": {
|
||||
"hashes": [
|
||||
"sha256:5952bab971110d0b86c278132dae0aa095beee8f723e625c3d3fa28888f1675f",
|
||||
"sha256:705ededc554ad8736157c666681165fe22ead2dec0d5446d65fc9dd976a5a876"
|
||||
"sha256:b83320a86081a76bc0570e6cc0f924c0ced40b46ae9f5dd783ab2c745b449529",
|
||||
"sha256:d1232bade3094de07dcc205fc833204384e71ba9d30caadcb5bb2882ce8e8d31"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==1.7.2"
|
||||
"version": "==1.9.2"
|
||||
},
|
||||
"django-crispy-forms": {
|
||||
"hashes": [
|
||||
"sha256:ad943285508f0ed0e271d00399b9399c22b8795a4f969029bce0fd29522a8e2d",
|
||||
"sha256:fbe9c2c9698b6590afe37940cb08194d1e722015f6bc5bee83f679362406ea30"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==1.9.1"
|
||||
},
|
||||
"django-el-pagination": {
|
||||
"hashes": [
|
||||
"sha256:4ef652f65350b754028f0c23d72dcd60461215b589f269bc23f78ee00b96d0f8"
|
||||
"sha256:46cb7311b4c7a35690ff0a972e71c782f3cfcd42968ef78993b7980377e9860e"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==3.2.4"
|
||||
"version": "==3.3.0"
|
||||
},
|
||||
"django-libsass": {
|
||||
"hashes": [
|
||||
"sha256:49db3334b87e1f7955c4f9fb9945bc296f8bfd27a14d6d89706e4b0e5dc5de1c"
|
||||
"sha256:38fab4ce1245542f3afd7248dc48f8a0b261f5f6c61e7cc43969a9c9079b5ffd",
|
||||
"sha256:3e74fd8e75ac0e6ebc0443efc3e530167981bf279fecc2294094c820ae266fbb"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==0.7"
|
||||
"version": "==0.8"
|
||||
},
|
||||
"django-modelcluster": {
|
||||
"hashes": [
|
||||
"sha256:09483ff1ede3cd87b56b0e6f732d33334c843adc6506dfed26c02998222751fe",
|
||||
"sha256:de1b5cd348fd4929491ef2a9ba29d9b5a3fccd3bf6a15218fa1aa5be49d06070"
|
||||
"sha256:09e4242119f04e81bfab25c77b09cb6e9d469dc14b14e71f04cd358c7256bc2a",
|
||||
"sha256:6f857bb0251c0982afeb35474aeedb3ec72260df81a0262188df8108067467ba"
|
||||
],
|
||||
"version": "==4.4.1"
|
||||
"version": "==5.0.1"
|
||||
},
|
||||
"django-redis": {
|
||||
"hashes": [
|
||||
"sha256:af0b393864e91228dd30d8c85b5c44d670b5524cb161b7f9e41acc98b6e5ace7",
|
||||
"sha256:f46115577063d00a890867c6964ba096057f07cb756e78e0503b89cd18e4e083"
|
||||
"sha256:a5b1e3ffd3198735e6c529d9bdf38ca3fcb3155515249b98dc4d966b8ddf9d2b",
|
||||
"sha256:e1aad4cc5bd743d8d0b13d5cae0cef5410eaace33e83bff5fc3a139ad8db50b4"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==4.10.0"
|
||||
"version": "==4.11.0"
|
||||
},
|
||||
"django-social-share": {
|
||||
"hashes": [
|
||||
"sha256:27ce07b885e087ee7fa0fffc82d295b06a7b0bcf18d693ff8a619337bf7069e5",
|
||||
"sha256:3627eb7fc8425dd45dabb7dfa17da5edec976e0d2c609c342aa763c7a24a69f0"
|
||||
"sha256:605f96810a4f736df8113c8da6f65307e4f53bec5c7af28ba08095e49778c3de",
|
||||
"sha256:74a472a61b33992f03db339a76978cdc379a41d86437451ab64e686f3a6ddb63"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==1.3.2"
|
||||
"version": "==1.4.0"
|
||||
},
|
||||
"django-taggit": {
|
||||
"hashes": [
|
||||
"sha256:710b4d15ec1996550cc68a0abbc41903ca7d832540e52b1336e6858737e410d8",
|
||||
"sha256:bb8f27684814cd1414b2af75b857b5e26a40912631904038a7ecacd2bfafc3ac"
|
||||
"sha256:4186a6ce1e1e9af5e2db8dd3479c5d31fa11a87d216a2ce5089ba3afde24a2c5",
|
||||
"sha256:bd1ec80b813d60adadaa94dcce4bfd971cb4ae717b07e69fedbd38d417deb6e9"
|
||||
],
|
||||
"version": "==0.24.0"
|
||||
"version": "==1.2.0"
|
||||
},
|
||||
"django-toolbelt": {
|
||||
"hashes": [
|
||||
|
|
@ -204,11 +213,11 @@
|
|||
},
|
||||
"gunicorn": {
|
||||
"hashes": [
|
||||
"sha256:aa8e0b40b4157b36a5df5e599f45c9c76d6af43845ba3b3b0efe2c70473c2471",
|
||||
"sha256:fa2662097c66f920f53f70621c6c58ca4a3c4d3434205e608e121b5b3b71f4f3"
|
||||
"sha256:1904bb2b8a43658807108d59c3f3d56c2b6121a701161de0ddf9ad140073c626",
|
||||
"sha256:cd4a810dd51bf497552cf3f863b575dabd73d6ad6a91075b65936b151cbf4f9c"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==19.9.0"
|
||||
"version": "==20.0.4"
|
||||
},
|
||||
"html5lib": {
|
||||
"hashes": [
|
||||
|
|
@ -219,178 +228,178 @@
|
|||
},
|
||||
"humanize": {
|
||||
"hashes": [
|
||||
"sha256:3478104dcb9e111991ad141b15c9bf9522aa00ccfc5144561d639b3372e1d064",
|
||||
"sha256:38ace9b66bcaeb7f8186b9dbf0b3448e00148e5b4fbaf726f96c789e52c3e741"
|
||||
"sha256:07dd1293bac6c77daa5ccdc22c0b41b2315bee0e339a9f035ba86a9f1a272002",
|
||||
"sha256:42ae7d54b398c01bd100847f6cb0fc9e381c21be8ad3f8e2929135e48dbff026"
|
||||
],
|
||||
"version": "==1.0.0"
|
||||
"version": "==2.4.0"
|
||||
},
|
||||
"idna": {
|
||||
"hashes": [
|
||||
"sha256:c357b3f628cf53ae2c4c05627ecc484553142ca23264e593d327bcde5e9c3407",
|
||||
"sha256:ea8b7f6188e6fa117537c3df7da9fc686d485087abf6ac197f9c46432f7e4a3c"
|
||||
"sha256:7588d1c14ae4c77d74036e8c22ff447b26d0fde8f007354fd48a7814db15b7cb",
|
||||
"sha256:a068a21ceac8a4d63dbfd964670474107f541babbd2250d61922f029858365fa"
|
||||
],
|
||||
"version": "==2.8"
|
||||
"version": "==2.9"
|
||||
},
|
||||
"l18n": {
|
||||
"hashes": [
|
||||
"sha256:46e72c980d06a7511726f1da10a32fa524f7e2937c0af5ad52d39577024a4382"
|
||||
],
|
||||
"version": "==2018.5"
|
||||
},
|
||||
"libsass": {
|
||||
"hashes": [
|
||||
"sha256:1877d9ac68fd13dddb15406ef4872ba833fd828e87a2ac27f74bfba45390f4ce",
|
||||
"sha256:2457723fe04f4e690105f758aa125e809afc840812965095fa3f4edccd6275ef",
|
||||
"sha256:2974772e7984b27a51a6d91ebc140183ddd574a9663bd02154ddfb75f13a3eed",
|
||||
"sha256:2d067ce4f393fee2ce52bb810a364deac5454dfdb7945d31d1f4265f21f03ab8",
|
||||
"sha256:57d0b99c4e3512233a44141f1bf852570d359724a606dfc4550eccd0f570460d",
|
||||
"sha256:5b604e4f5befdecc76240c2ba243fd7e23c642ffc2dd86cbfd094a44ead6b08d",
|
||||
"sha256:5dd647ffa1319a2a18572f41fee3bb561d7f77d8d4784074a00b2eb22c61a859",
|
||||
"sha256:78f3f14e47612be4fa4b161278f2a3e880a19b6a3367f749e9ae240434b7e7f5",
|
||||
"sha256:8d423e4b4c0e219488104b4ec4267688dbd816f3ae806beb4201918eff059b2d",
|
||||
"sha256:a20473b0427d82e37fa68f0b3a8d219f0bb5ca6d3f7d93b0f5342219285e7064",
|
||||
"sha256:c1f76c2a0993914f3c3088e9b6c7031f22e879c5d27a060cdc8c5aa1318eb9b6",
|
||||
"sha256:c99fbc950f1955e8b6370aafdb9d84d324e4984a2e00a2b47f04dbcc3706a9d1",
|
||||
"sha256:cb50f385117535f7671ac7ff3144c1ef0b8e088778c58d269ce6f31b87bfad72",
|
||||
"sha256:f0f033a8154be60e1a2e1f79ee849ea69a1d62e5d476a78f69e4c7d8fd7c20e1",
|
||||
"sha256:f2572b73b2e13e74b28388ae86c4fabb853ddbfc12279b4444243bd614710ce8",
|
||||
"sha256:f8790db67e00c5bc7be1bdd81ed477563a4b191e839193ecc0c2c5ec679ec481"
|
||||
"sha256:107c409524c6a4ed14410fa9dafa9ee59c6bd3ecae75d73af749ab2b75685726",
|
||||
"sha256:3bc0d68778b30b5fa83199e18795314f64b26ca5871e026343e63934f616f7f7",
|
||||
"sha256:5c8ff562b233734fbc72b23bb862cc6a6f70b1e9bf85a58422aa75108b94783b",
|
||||
"sha256:74f6fb8da58179b5d86586bc045c16d93d55074bc7bb48b6354a4da7ac9f9dfd",
|
||||
"sha256:7555d9b24e79943cfafac44dbb4ca7e62105c038de7c6b999838c9ff7b88645d",
|
||||
"sha256:794f4f4661667263e7feafe5cc866e3746c7c8a9192b2aa9afffdadcbc91c687",
|
||||
"sha256:8cf72552b39e78a1852132e16b706406bc76029fe3001583284ece8d8752a60a",
|
||||
"sha256:98f6dee9850b29e62977a963e3beb3cfeb98b128a267d59d2c3d675e298c8d57",
|
||||
"sha256:a43f3830d83ad9a7f5013c05ce239ca71744d0780dad906587302ac5257bce60",
|
||||
"sha256:b077261a04ba1c213e932943208471972c5230222acb7fa97373e55a40872cbb",
|
||||
"sha256:b7452f1df274b166dc22ee2e9154c4adca619bcbbdf8041a7aa05f372a1dacbc",
|
||||
"sha256:e6a547c0aa731dcb4ed71f198e814bee0400ce04d553f3f12a53bc3a17f2a481",
|
||||
"sha256:fd19c8f73f70ffc6cbcca8139da08ea9a71fc48e7dfc4bb236ad88ab2d6558f1"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==0.19.2"
|
||||
"version": "==0.20.0"
|
||||
},
|
||||
"pillow": {
|
||||
"hashes": [
|
||||
"sha256:00fdeb23820f30e43bba78eb9abb00b7a937a655de7760b2e09101d63708b64e",
|
||||
"sha256:01f948e8220c85eae1aa1a7f8edddcec193918f933fb07aaebe0bfbbcffefbf1",
|
||||
"sha256:08abf39948d4b5017a137be58f1a52b7101700431f0777bec3d897c3949f74e6",
|
||||
"sha256:099a61618b145ecb50c6f279666bbc398e189b8bc97544ae32b8fcb49ad6b830",
|
||||
"sha256:2c1c61546e73de62747e65807d2cc4980c395d4c5600ecb1f47a650c6fa78c79",
|
||||
"sha256:2ed9c4f694861642401f27dc3cb99772be67cd190e84845c749dae0a06c3bfae",
|
||||
"sha256:338581b30b908e111be578f0297255f6b57a51358cd16fa0e6f664c9a1f88bff",
|
||||
"sha256:38c7d48a21cd06fdeee93987147b9b1c55b73b4cfcbf83240568bfbd5adee447",
|
||||
"sha256:43fd026f613c8e48a25eba1a92f4d2ad7f3903c95d8c33a11611a7717d2ab654",
|
||||
"sha256:4548236844327a718ce3bb182ab32a16fa2050c61e334e959f554cac052fb0df",
|
||||
"sha256:5090857876c58885cfa388dc649e5db30aae98a068c26f3fd0ac9d7d9a4d9572",
|
||||
"sha256:5bbba34f97a26a93f5e8dec469ca4ddd712451418add43da946dbaed7f7a98d2",
|
||||
"sha256:65a28969a025a0eb4594637b6103201dc4ed2a9508bdab56ac33e43e3081c404",
|
||||
"sha256:892bb52b70bd5ea9dbbc3ac44f38e84f5a04e9d8b1bff48159d96cb795b81159",
|
||||
"sha256:8a9becd5cbd5062f973bcd2e7bc79483af310222de112b6541f8af1f93a3cc42",
|
||||
"sha256:972a7aaeb7c4a2795b52eef52ee991ef040b31009f36deca6207a986607b55f3",
|
||||
"sha256:97b119c436bfa96a92ac2ca525f7025836d4d4e64b1c9f9eff8dbaf3ff1d86f3",
|
||||
"sha256:9ba37698e242223f8053cc158f130aee046a96feacbeab65893dbe94f5530118",
|
||||
"sha256:b1b0e1f626a0f079c0d3696db70132fb1f29aa87c66aecb6501a9b8be64ce9f7",
|
||||
"sha256:c14c1224fd1a5be2733530d648a316974dbbb3c946913562c6005a76f21ca042",
|
||||
"sha256:c79a8546c48ae6465189e54e3245a97ddf21161e33ff7eaa42787353417bb2b6",
|
||||
"sha256:ceb76935ac4ebdf6d7bc845482a4450b284c6ccfb281e34da51d510658ab34d8",
|
||||
"sha256:e22bffaad04b4d16e1c091baed7f2733fc1ebb91e0c602abf1b6834d17158b1f",
|
||||
"sha256:ec883b8e44d877bda6f94a36313a1c6063f8b1997aa091628ae2f34c7f97c8d5",
|
||||
"sha256:f1baa54d50ec031d1a9beb89974108f8f2c0706f49798f4777df879df0e1adb6",
|
||||
"sha256:f53a5385932cda1e2c862d89460992911a89768c65d176ff8c50cddca4d29bed"
|
||||
"sha256:04766c4930c174b46fd72d450674612ab44cca977ebbcc2dde722c6933290107",
|
||||
"sha256:0e2a3bceb0fd4e0cb17192ae506d5f082b309ffe5fc370a5667959c9b2f85fa3",
|
||||
"sha256:0f01e63c34f0e1e2580cc0b24e86a5ccbbfa8830909a52ee17624c4193224cd9",
|
||||
"sha256:12e4bad6bddd8546a2f9771485c7e3d2b546b458ae8ff79621214119ac244523",
|
||||
"sha256:1f694e28c169655c50bb89a3fa07f3b854d71eb47f50783621de813979ba87f3",
|
||||
"sha256:3d25dd8d688f7318dca6d8cd4f962a360ee40346c15893ae3b95c061cdbc4079",
|
||||
"sha256:4b02b9c27fad2054932e89f39703646d0c543f21d3cc5b8e05434215121c28cd",
|
||||
"sha256:9744350687459234867cbebfe9df8f35ef9e1538f3e729adbd8fde0761adb705",
|
||||
"sha256:a0b49960110bc6ff5fead46013bcb8825d101026d466f3a4de3476defe0fb0dd",
|
||||
"sha256:ae2b270f9a0b8822b98655cb3a59cdb1bd54a34807c6c56b76dd2e786c3b7db3",
|
||||
"sha256:b37bb3bd35edf53125b0ff257822afa6962649995cbdfde2791ddb62b239f891",
|
||||
"sha256:b532bcc2f008e96fd9241177ec580829dee817b090532f43e54074ecffdcd97f",
|
||||
"sha256:b67a6c47ed963c709ed24566daa3f95a18f07d3831334da570c71da53d97d088",
|
||||
"sha256:b943e71c2065ade6fef223358e56c167fc6ce31c50bc7a02dd5c17ee4338e8ac",
|
||||
"sha256:ccc9ad2460eb5bee5642eaf75a0438d7f8887d484490d5117b98edd7f33118b7",
|
||||
"sha256:d23e2aa9b969cf9c26edfb4b56307792b8b374202810bd949effd1c6e11ebd6d",
|
||||
"sha256:eaa83729eab9c60884f362ada982d3a06beaa6cc8b084cf9f76cae7739481dfa",
|
||||
"sha256:ee94fce8d003ac9fd206496f2707efe9eadcb278d94c271f129ab36aa7181344",
|
||||
"sha256:f455efb7a98557412dc6f8e463c1faf1f1911ec2432059fa3e582b6000fc90e2",
|
||||
"sha256:f46e0e024346e1474083c729d50de909974237c72daca05393ee32389dabe457",
|
||||
"sha256:f54be399340aa602066adb63a86a6a5d4f395adfdd9da2b9a0162ea808c7b276",
|
||||
"sha256:f784aad988f12c80aacfa5b381ec21fd3f38f851720f652b9f33facc5101cf4d"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==6.2.0"
|
||||
"version": "==7.1.2"
|
||||
},
|
||||
"psutil": {
|
||||
"hashes": [
|
||||
"sha256:094f899ac3ef72422b7e00411b4ed174e3c5a2e04c267db6643937ddba67a05b",
|
||||
"sha256:10b7f75cc8bd676cfc6fa40cd7d5c25b3f45a0e06d43becd7c2d2871cbb5e806",
|
||||
"sha256:1b1575240ca9a90b437e5a40db662acd87bbf181f6aa02f0204978737b913c6b",
|
||||
"sha256:21231ef1c1a89728e29b98a885b8e0a8e00d09018f6da5cdc1f43f988471a995",
|
||||
"sha256:28f771129bfee9fc6b63d83a15d857663bbdcae3828e1cb926e91320a9b5b5cd",
|
||||
"sha256:70387772f84fa5c3bb6a106915a2445e20ac8f9821c5914d7cbde148f4d7ff73",
|
||||
"sha256:b560f5cd86cf8df7bcd258a851ca1ad98f0d5b8b98748e877a0aec4e9032b465",
|
||||
"sha256:b74b43fecce384a57094a83d2778cdfc2e2d9a6afaadd1ebecb2e75e0d34e10d",
|
||||
"sha256:e85f727ffb21539849e6012f47b12f6dd4c44965e56591d8dec6e8bc9ab96f4a",
|
||||
"sha256:fd2e09bb593ad9bdd7429e779699d2d47c1268cbde4dda95fcd1bd17544a0217",
|
||||
"sha256:ffad8eb2ac614518bbe3c0b8eb9dffdb3a8d2e3a7d5da51c5b974fb723a5c5aa"
|
||||
"sha256:1413f4158eb50e110777c4f15d7c759521703bd6beb58926f1d562da40180058",
|
||||
"sha256:298af2f14b635c3c7118fd9183843f4e73e681bb6f01e12284d4d70d48a60953",
|
||||
"sha256:60b86f327c198561f101a92be1995f9ae0399736b6eced8f24af41ec64fb88d4",
|
||||
"sha256:685ec16ca14d079455892f25bd124df26ff9137664af445563c1bd36629b5e0e",
|
||||
"sha256:73f35ab66c6c7a9ce82ba44b1e9b1050be2a80cd4dcc3352cc108656b115c74f",
|
||||
"sha256:75e22717d4dbc7ca529ec5063000b2b294fc9a367f9c9ede1f65846c7955fd38",
|
||||
"sha256:a02f4ac50d4a23253b68233b07e7cdb567bd025b982d5cf0ee78296990c22d9e",
|
||||
"sha256:d008ddc00c6906ec80040d26dc2d3e3962109e40ad07fd8a12d0284ce5e0e4f8",
|
||||
"sha256:d84029b190c8a66a946e28b4d3934d2ca1528ec94764b180f7d6ea57b0e75e26",
|
||||
"sha256:e2d0c5b07c6fe5a87fa27b7855017edb0d52ee73b71e6ee368fae268605cc3f5",
|
||||
"sha256:f344ca230dd8e8d5eee16827596f1c22ec0876127c28e800d7ae20ed44c4b310"
|
||||
],
|
||||
"version": "==5.6.7"
|
||||
"version": "==5.7.0"
|
||||
},
|
||||
"psycopg2": {
|
||||
"hashes": [
|
||||
"sha256:4212ca404c4445dc5746c0d68db27d2cbfb87b523fe233dc84ecd24062e35677",
|
||||
"sha256:47fc642bf6f427805daf52d6e52619fe0637648fe27017062d898f3bf891419d",
|
||||
"sha256:72772181d9bad1fa349792a1e7384dde56742c14af2b9986013eb94a240f005b",
|
||||
"sha256:8396be6e5ff844282d4d49b81631772f80dabae5658d432202faf101f5283b7c",
|
||||
"sha256:893c11064b347b24ecdd277a094413e1954f8a4e8cdaf7ffbe7ca3db87c103f0",
|
||||
"sha256:92a07dfd4d7c325dd177548c4134052d4842222833576c8391aab6f74038fc3f",
|
||||
"sha256:965c4c93e33e6984d8031f74e51227bd755376a9df6993774fd5b6fb3288b1f4",
|
||||
"sha256:9ab75e0b2820880ae24b7136c4d230383e07db014456a476d096591172569c38",
|
||||
"sha256:b0845e3bdd4aa18dc2f9b6fb78fbd3d9d371ad167fd6d1b7ad01c0a6cdad4fc6",
|
||||
"sha256:dca2d7203f0dfce8ea4b3efd668f8ea65cd2b35112638e488a4c12594015f67b",
|
||||
"sha256:ed686e5926929887e2c7ae0a700e32c6129abb798b4ad2b846e933de21508151",
|
||||
"sha256:ef6df7e14698e79c59c7ee7cf94cd62e5b869db369ed4b1b8f7b729ea825712a",
|
||||
"sha256:f898e5cc0a662a9e12bde6f931263a1bbd350cfb18e1d5336a12927851825bb6"
|
||||
"sha256:132efc7ee46a763e68a815f4d26223d9c679953cd190f1f218187cb60decf535",
|
||||
"sha256:2327bf42c1744a434ed8ed0bbaa9168cac7ee5a22a9001f6fc85c33b8a4a14b7",
|
||||
"sha256:27c633f2d5db0fc27b51f1b08f410715b59fa3802987aec91aeb8f562724e95c",
|
||||
"sha256:2c0afb40cfb4d53487ee2ebe128649028c9a78d2476d14a67781e45dc287f080",
|
||||
"sha256:2df2bf1b87305bd95eb3ac666ee1f00a9c83d10927b8144e8e39644218f4cf81",
|
||||
"sha256:440a3ea2c955e89321a138eb7582aa1d22fe286c7d65e26a2c5411af0a88ae72",
|
||||
"sha256:6a471d4d2a6f14c97a882e8d3124869bc623f3df6177eefe02994ea41fd45b52",
|
||||
"sha256:6b306dae53ec7f4f67a10942cf8ac85de930ea90e9903e2df4001f69b7833f7e",
|
||||
"sha256:a0984ff49e176062fcdc8a5a2a670c9bb1704a2f69548bce8f8a7bad41c661bf",
|
||||
"sha256:ac5b23d0199c012ad91ed1bbb971b7666da651c6371529b1be8cbe2a7bf3c3a9",
|
||||
"sha256:acf56d564e443e3dea152efe972b1434058244298a94348fc518d6dd6a9fb0bb",
|
||||
"sha256:d3b29d717d39d3580efd760a9a46a7418408acebbb784717c90d708c9ed5f055",
|
||||
"sha256:f7d46240f7a1ae1dd95aab38bd74f7428d46531f69219954266d669da60c0818"
|
||||
],
|
||||
"version": "==2.8.4"
|
||||
"version": "==2.8.5"
|
||||
},
|
||||
"psycopg2-binary": {
|
||||
"hashes": [
|
||||
"sha256:080c72714784989474f97be9ab0ddf7b2ad2984527e77f2909fcd04d4df53809",
|
||||
"sha256:110457be80b63ff4915febb06faa7be002b93a76e5ba19bf3f27636a2ef58598",
|
||||
"sha256:171352a03b22fc099f15103959b52ee77d9a27e028895d7e5fde127aa8e3bac5",
|
||||
"sha256:19d013e7b0817087517a4b3cab39c084d78898369e5c46258aab7be4f233d6a1",
|
||||
"sha256:249b6b21ae4eb0f7b8423b330aa80fab5f821b9ffc3f7561a5e2fd6bb142cf5d",
|
||||
"sha256:2ac0731d2d84b05c7bb39e85b7e123c3a0acd4cda631d8d542802c88deb9e87e",
|
||||
"sha256:2b6d561193f0dc3f50acfb22dd52ea8c8dfbc64bcafe3938b5f209cc17cb6f00",
|
||||
"sha256:2bd23e242e954214944481124755cbefe7c2cf563b1a54cd8d196d502f2578bf",
|
||||
"sha256:3e1239242ca60b3725e65ab2f13765fc199b03af9eaf1b5572f0e97bdcee5b43",
|
||||
"sha256:3eb70bb697abbe86b1d2b1316370c02ba320bfd1e9e35cf3b9566a855ea8e4e5",
|
||||
"sha256:51a2fc7e94b98bd1bb5d4570936f24fc2b0541b63eccadf8fdea266db8ad2f70",
|
||||
"sha256:52f1bdafdc764b7447e393ed39bb263eccb12bfda25a4ac06d82e3a9056251f6",
|
||||
"sha256:5b3581319a3951f1e866f4f6c5e42023db0fae0284273b82e97dfd32c51985cd",
|
||||
"sha256:63c1b66e3b2a3a336288e4bcec499e0dc310cd1dceaed1c46fa7419764c68877",
|
||||
"sha256:8123a99f24ecee469e5c1339427bcdb2a33920a18bb5c0d58b7c13f3b0298ba3",
|
||||
"sha256:85e699fcabe7f817c0f0a412d4e7c6627e00c412b418da7666ff353f38e30f67",
|
||||
"sha256:8dbff4557bbef963697583366400822387cccf794ccb001f1f2307ed21854c68",
|
||||
"sha256:908d21d08d6b81f1b7e056bbf40b2f77f8c499ab29e64ec5113052819ef1c89b",
|
||||
"sha256:af39d0237b17d0a5a5f638e9dffb34013ce2b1d41441fd30283e42b22d16858a",
|
||||
"sha256:af51bb9f055a3f4af0187149a8f60c9d516cf7d5565b3dac53358796a8fb2a5b",
|
||||
"sha256:b2ecac57eb49e461e86c092761e6b8e1fd9654dbaaddf71a076dcc869f7014e2",
|
||||
"sha256:cd37cc170678a4609becb26b53a2bc1edea65177be70c48dd7b39a1149cabd6e",
|
||||
"sha256:d17e3054b17e1a6cb8c1140f76310f6ede811e75b7a9d461922d2c72973f583e",
|
||||
"sha256:d305313c5a9695f40c46294d4315ed3a07c7d2b55e48a9010dad7db7a66c8b7f",
|
||||
"sha256:dd0ef0eb1f7dd18a3f4187226e226a7284bda6af5671937a221766e6ef1ee88f",
|
||||
"sha256:e1adff53b56db9905db48a972fb89370ad5736e0450b96f91bcf99cadd96cfd7",
|
||||
"sha256:f0d43828003c82dbc9269de87aa449e9896077a71954fbbb10a614c017e65737",
|
||||
"sha256:f78e8b487de4d92640105c1389e5b90be3496b1d75c90a666edd8737cc2dbab7"
|
||||
"sha256:008da3ab51adc70a5f1cfbbe5db3a22607ab030eb44bcecf517ad11a0c2b3cac",
|
||||
"sha256:07cf82c870ec2d2ce94d18e70c13323c89f2f2a2628cbf1feee700630be2519a",
|
||||
"sha256:08507efbe532029adee21b8d4c999170a83760d38249936038bd0602327029b5",
|
||||
"sha256:107d9be3b614e52a192719c6bf32e8813030020ea1d1215daa86ded9a24d8b04",
|
||||
"sha256:17a0ea0b0eabf07035e5e0d520dabc7950aeb15a17c6d36128ba99b2721b25b1",
|
||||
"sha256:3286541b9d85a340ee4ed42732d15fc1bb441dc500c97243a768154ab8505bb5",
|
||||
"sha256:3939cf75fc89c5e9ed836e228c4a63604dff95ad19aed2bbf71d5d04c15ed5ce",
|
||||
"sha256:40abc319f7f26c042a11658bf3dd3b0b3bceccf883ec1c565d5c909a90204434",
|
||||
"sha256:51f7823f1b087d2020d8e8c9e6687473d3d239ba9afc162d9b2ab6e80b53f9f9",
|
||||
"sha256:6bb2dd006a46a4a4ce95201f836194eb6a1e863f69ee5bab506673e0ca767057",
|
||||
"sha256:702f09d8f77dc4794651f650828791af82f7c2efd8c91ae79e3d9fe4bb7d4c98",
|
||||
"sha256:7036ccf715925251fac969f4da9ad37e4b7e211b1e920860148a10c0de963522",
|
||||
"sha256:7b832d76cc65c092abd9505cc670c4e3421fd136fb6ea5b94efbe4c146572505",
|
||||
"sha256:8f74e631b67482d504d7e9cf364071fc5d54c28e79a093ff402d5f8f81e23bfa",
|
||||
"sha256:930315ac53dc65cbf52ab6b6d27422611f5fb461d763c531db229c7e1af6c0b3",
|
||||
"sha256:96d3038f5bd061401996614f65d27a4ecb62d843eb4f48e212e6d129171a721f",
|
||||
"sha256:a20299ee0ea2f9cca494396ac472d6e636745652a64a418b39522c120fd0a0a4",
|
||||
"sha256:a34826d6465c2e2bbe9d0605f944f19d2480589f89863ed5f091943be27c9de4",
|
||||
"sha256:a69970ee896e21db4c57e398646af9edc71c003bc52a3cc77fb150240fefd266",
|
||||
"sha256:b9a8b391c2b0321e0cd7ec6b4cfcc3dd6349347bd1207d48bcb752aa6c553a66",
|
||||
"sha256:ba13346ff6d3eb2dca0b6fa0d8a9d999eff3dcd9b55f3a890f12b0b6362b2b38",
|
||||
"sha256:bb0608694a91db1e230b4a314e8ed00ad07ed0c518f9a69b83af2717e31291a3",
|
||||
"sha256:c8830b7d5f16fd79d39b21e3d94f247219036b29b30c8270314c46bf8b732389",
|
||||
"sha256:cac918cd7c4c498a60f5d2a61d4f0a6091c2c9490d81bc805c963444032d0dab",
|
||||
"sha256:cc30cb900f42c8a246e2cb76539d9726f407330bc244ca7729c41a44e8d807fb",
|
||||
"sha256:ccdc6a87f32b491129ada4b87a43b1895cf2c20fdb7f98ad979647506ffc41b6",
|
||||
"sha256:d1a8b01f6a964fec702d6b6dac1f91f2b9f9fe41b310cbb16c7ef1fac82df06d",
|
||||
"sha256:e004db88e5a75e5fdab1620fb9f90c9598c2a195a594225ac4ed2a6f1c23e162",
|
||||
"sha256:eb2f43ae3037f1ef5e19339c41cf56947021ac892f668765cd65f8ab9814192e",
|
||||
"sha256:fa466306fcf6b39b8a61d003123d442b23707d635a5cb05ac4e1b62cc79105cd"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==2.8.3"
|
||||
"version": "==2.8.5"
|
||||
},
|
||||
"puput": {
|
||||
"hashes": [
|
||||
"sha256:4d952767b60b0a4969b0146a548586e9485b55ea3b047589d89d3dafd1fd0d0b",
|
||||
"sha256:ffdcde19b0e08cc1d0a97da6df110a6428db9d2505ba387033ad5ba197eec05d"
|
||||
"sha256:7562bd70b0cbeedb02b0991b72ce7a947b4167bb23dc5fe20d7b38f399bc7f95"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==1.0.5"
|
||||
"version": "==1.1.0"
|
||||
},
|
||||
"python-dotenv": {
|
||||
"hashes": [
|
||||
"sha256:debd928b49dbc2bf68040566f55cdb3252458036464806f4094487244e2a4093",
|
||||
"sha256:f157d71d5fec9d4bd5f51c82746b6344dffa680ee85217c123f4a0c8117c4544"
|
||||
"sha256:25c0ff1a3e12f4bde8d592cc254ab075cfe734fc5dd989036716fd17ee7e5ec7",
|
||||
"sha256:3b9909bc96b0edc6b01586e1eed05e71174ef4e04c71da5786370cebea53ad74"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==0.10.3"
|
||||
"version": "==0.13.0"
|
||||
},
|
||||
"pytz": {
|
||||
"hashes": [
|
||||
"sha256:1c557d7d0e871de1f5ccd5833f60fb2550652da6be2693c1e02300743d21500d",
|
||||
"sha256:b02c06db6cf09c12dd25137e563b31700d3b80fcc4ad23abb7a315f2789819be"
|
||||
"sha256:a494d53b6d39c3c6e44c3bec237336e14305e4f29bbf800b599253057fbb79ed",
|
||||
"sha256:c35965d010ce31b23eeb663ed3cc8c906275d6be1a34393a1d73a41febf4a048"
|
||||
],
|
||||
"version": "==2019.3"
|
||||
"version": "==2020.1"
|
||||
},
|
||||
"pyyaml": {
|
||||
"hashes": [
|
||||
"sha256:059b2ee3194d718896c0ad077dd8c043e5e909d9180f387ce42012662a4946d6",
|
||||
"sha256:1cf708e2ac57f3aabc87405f04b86354f66799c8e62c28c5fc5f88b5521b2dbf",
|
||||
"sha256:24521fa2890642614558b492b473bee0ac1f8057a7263156b02e8b14c88ce6f5",
|
||||
"sha256:4fee71aa5bc6ed9d5f116327c04273e25ae31a3020386916905767ec4fc5317e",
|
||||
"sha256:70024e02197337533eef7b85b068212420f950319cc8c580261963aefc75f811",
|
||||
"sha256:74782fbd4d4f87ff04159e986886931456a1894c61229be9eaf4de6f6e44b99e",
|
||||
"sha256:940532b111b1952befd7db542c370887a8611660d2b9becff75d39355303d82d",
|
||||
"sha256:cb1f2f5e426dc9f07a7681419fe39cee823bb74f723f36f70399123f439e9b20",
|
||||
"sha256:dbbb2379c19ed6042e8f11f2a2c66d39cceb8aeace421bfc29d085d93eda3689",
|
||||
"sha256:e3a057b7a64f1222b56e47bcff5e4b94c4f61faac04c7c4ecb1985e18caa3994",
|
||||
"sha256:e9f45bd5b92c7974e59bcd2dcc8631a6b6cc380a904725fce7bc08872e691615"
|
||||
"sha256:06a0d7ba600ce0b2d2fe2e78453a470b5a6e000a985dd4a4e54e436cc36b0e97",
|
||||
"sha256:240097ff019d7c70a4922b6869d8a86407758333f02203e0fc6ff79c5dcede76",
|
||||
"sha256:4f4b913ca1a7319b33cfb1369e91e50354d6f07a135f3b901aca02aa95940bd2",
|
||||
"sha256:69f00dca373f240f842b2931fb2c7e14ddbacd1397d57157a9b005a6a9942648",
|
||||
"sha256:73f099454b799e05e5ab51423c7bcf361c58d3206fa7b0d555426b1f4d9a3eaf",
|
||||
"sha256:74809a57b329d6cc0fdccee6318f44b9b8649961fa73144a98735b0aaf029f1f",
|
||||
"sha256:7739fc0fa8205b3ee8808aea45e968bc90082c10aef6ea95e855e10abf4a37b2",
|
||||
"sha256:95f71d2af0ff4227885f7a6605c37fd53d3a106fcab511b8860ecca9fcf400ee",
|
||||
"sha256:b8eac752c5e14d3eca0e6dd9199cd627518cb5ec06add0de9d32baeee6fe645d",
|
||||
"sha256:cc8955cfbfc7a115fa81d85284ee61147059a753344bc51098f3ccd69b0d7e0c",
|
||||
"sha256:d13155f591e6fcc1ec3b30685d50bf0711574e2c0dfffd7644babf8b5102ca1a"
|
||||
],
|
||||
"version": "==5.3"
|
||||
"version": "==5.3.1"
|
||||
},
|
||||
"rcssmin": {
|
||||
"hashes": [
|
||||
|
|
@ -400,17 +409,17 @@
|
|||
},
|
||||
"redis": {
|
||||
"hashes": [
|
||||
"sha256:0dcfb335921b88a850d461dc255ff4708294943322bd55de6cfd68972490ca1f",
|
||||
"sha256:b205cffd05ebfd0a468db74f0eedbff8df1a7bfc47521516ade4692991bb0833"
|
||||
"sha256:2ef11f489003f151777c064c5dbc6653dfb9f3eade159bcadc524619fddc2242",
|
||||
"sha256:6d65e84bc58091140081ee9d9c187aab0480097750fac44239307a3bdf0b1251"
|
||||
],
|
||||
"version": "==3.4.1"
|
||||
"version": "==3.5.2"
|
||||
},
|
||||
"requests": {
|
||||
"hashes": [
|
||||
"sha256:11e007a8a2aa0323f5a921e9e6a2d7e4e67d9877e85773fba9ba6419025cbeb4",
|
||||
"sha256:9cf5292fcd0f598c671cfc1e0d7d1a7f13bb8085e9a590f48c010551dc6c4b31"
|
||||
"sha256:43999036bfa82904b6af1d99e4882b560e5e2c68e5c4b0aa03b655f3d7d73fee",
|
||||
"sha256:b3f43d496c6daba4493e7c431722aeb7dbc6288f52a6e04e7b6023b0247817e6"
|
||||
],
|
||||
"version": "==2.22.0"
|
||||
"version": "==2.23.0"
|
||||
},
|
||||
"rjsmin": {
|
||||
"hashes": [
|
||||
|
|
@ -432,10 +441,10 @@
|
|||
},
|
||||
"schema": {
|
||||
"hashes": [
|
||||
"sha256:10b550886f5ff402e1fdef85bd7be761b0e09a35a43633311807a57a5bc4db50",
|
||||
"sha256:c9dc8f4624e287c7d1435f8fd758f6a0aabbb7eff442db9192cd46f0e2b6d959"
|
||||
"sha256:3a03c2e2b22e6a331ae73750ab1da46916da6ca861b16e6f073ac1d1eba43b71",
|
||||
"sha256:b536f2375b49fdf56f36279addae98bd86a8afbd58b3c32ce363c464bed5fc1c"
|
||||
],
|
||||
"version": "==0.7.1"
|
||||
"version": "==0.7.2"
|
||||
},
|
||||
"six": {
|
||||
"hashes": [
|
||||
|
|
@ -444,24 +453,58 @@
|
|||
],
|
||||
"version": "==1.14.0"
|
||||
},
|
||||
"soupsieve": {
|
||||
"hashes": [
|
||||
"sha256:1634eea42ab371d3d346309b93df7870a88610f0725d47528be902a0d95ecc55",
|
||||
"sha256:a59dc181727e95d25f781f0eb4fd1825ff45590ec8ff49eadfd7f1a537cc0232"
|
||||
],
|
||||
"version": "==2.0.1"
|
||||
},
|
||||
"sqlalchemy": {
|
||||
"hashes": [
|
||||
"sha256:64a7b71846db6423807e96820993fa12a03b89127d278290ca25c0b11ed7b4fb"
|
||||
"sha256:128bc917ed20d78143a45024455ff0aed7d3b96772eba13d5dbaf9cc57e5c41b",
|
||||
"sha256:156a27548ba4e1fed944ff9fcdc150633e61d350d673ae7baaf6c25c04ac1f71",
|
||||
"sha256:27e2efc8f77661c9af2681755974205e7462f1ae126f498f4fe12a8b24761d15",
|
||||
"sha256:2a12f8be25b9ea3d1d5b165202181f2b7da4b3395289000284e5bb86154ce87c",
|
||||
"sha256:31c043d5211aa0e0773821fcc318eb5cbe2ec916dfbc4c6eea0c5188971988eb",
|
||||
"sha256:65eb3b03229f684af0cf0ad3bcc771970c1260a82a791a8d07bffb63d8c95bcc",
|
||||
"sha256:6cd157ce74a911325e164441ff2d9b4e244659a25b3146310518d83202f15f7a",
|
||||
"sha256:703c002277f0fbc3c04d0ae4989a174753a7554b2963c584ce2ec0cddcf2bc53",
|
||||
"sha256:869bbb637de58ab0a912b7f20e9192132f9fbc47fc6b5111cd1e0f6cdf5cf9b0",
|
||||
"sha256:8a0e0cd21da047ea10267c37caf12add400a92f0620c8bc09e4a6531a765d6d7",
|
||||
"sha256:8d01e949a5d22e5c4800d59b50617c56125fc187fbeb8fa423e99858546de616",
|
||||
"sha256:925b4fe5e7c03ed76912b75a9a41dfd682d59c0be43bce88d3b27f7f5ba028fb",
|
||||
"sha256:9cb1819008f0225a7c066cac8bb0cf90847b2c4a6eb9ebb7431dbd00c56c06c5",
|
||||
"sha256:a87d496884f40c94c85a647c385f4fd5887941d2609f71043e2b73f2436d9c65",
|
||||
"sha256:a9030cd30caf848a13a192c5e45367e3c6f363726569a56e75dc1151ee26d859",
|
||||
"sha256:a9e75e49a0f1583eee0ce93270232b8e7bb4b1edc89cc70b07600d525aef4f43",
|
||||
"sha256:b50f45d0e82b4562f59f0e0ca511f65e412f2a97d790eea5f60e34e5f1aabc9a",
|
||||
"sha256:b7878e59ec31f12d54b3797689402ee3b5cfcb5598f2ebf26491732758751908",
|
||||
"sha256:ce1ddaadee913543ff0154021d31b134551f63428065168e756d90bdc4c686f5",
|
||||
"sha256:ce2646e4c0807f3461be0653502bb48c6e91a5171d6e450367082c79e12868bf",
|
||||
"sha256:ce6c3d18b2a8ce364013d47b9cad71db815df31d55918403f8db7d890c9d07ae",
|
||||
"sha256:e4e2664232005bd306f878b0f167a31f944a07c4de0152c444f8c61bbe3cfb38",
|
||||
"sha256:e8aa395482728de8bdcca9cc0faf3765ab483e81e01923aaa736b42f0294f570",
|
||||
"sha256:eb4fcf7105bf071c71068c6eee47499ab8d4b8f5a11fc35147c934f0faa60f23",
|
||||
"sha256:ed375a79f06cad285166e5be74745df1ed6845c5624aafadec4b7a29c25866ef",
|
||||
"sha256:f35248f7e0d63b234a109dd72fbfb4b5cb6cb6840b221d0df0ecbf54ab087654",
|
||||
"sha256:f502ef245c492b391e0e23e94cba030ab91722dcc56963c85bfd7f3441ea2bbe",
|
||||
"sha256:fe01bac7226499aedf472c62fa3b85b2c619365f3f14dd222ffe4f3aa91e5f98"
|
||||
],
|
||||
"version": "==1.3.13"
|
||||
"version": "==1.3.17"
|
||||
},
|
||||
"sqlalchemy-utils": {
|
||||
"hashes": [
|
||||
"sha256:4e637c88bf3ac5f99b7d72342092a1f636bea1287b2e3e17d441b0413771f86e"
|
||||
"sha256:680068c4b671225c183815e19b6f4adc765a9989dd5d9e8e9c900ede30cc7434"
|
||||
],
|
||||
"version": "==0.36.1"
|
||||
"version": "==0.36.5"
|
||||
},
|
||||
"sqlparse": {
|
||||
"hashes": [
|
||||
"sha256:40afe6b8d4b1117e7dff5504d7a8ce07d9a1b15aeeade8a2d10f130a834f8177",
|
||||
"sha256:7c3dca29c022744e95b547e867cee89f4fce4373f3549ccd8797d8eb52cdb873"
|
||||
"sha256:022fb9c87b524d1f7862b3037e541f68597a730a8843245c349fc93e1643dc4e",
|
||||
"sha256:e162203737712307dfe78860cc56c8da8a852ab2ee33750e33aeadf38d12c548"
|
||||
],
|
||||
"version": "==0.3.0"
|
||||
"version": "==0.3.1"
|
||||
},
|
||||
"static3": {
|
||||
"hashes": [
|
||||
|
|
@ -485,18 +528,18 @@
|
|||
},
|
||||
"urllib3": {
|
||||
"hashes": [
|
||||
"sha256:2f3db8b19923a873b3e5256dc9c2dedfa883e33d87c690d9c7913e1f40673cdc",
|
||||
"sha256:87716c2d2a7121198ebcb7ce7cccf6ce5e9ba539041cfbaeecfb641dc0bf6acc"
|
||||
"sha256:3018294ebefce6572a474f0604c2021e33b3fd8006ecd11d62107a5d2a963527",
|
||||
"sha256:88206b0eb87e6d677d424843ac5209e3fb9d0190d0ee169599165ec25e9d9115"
|
||||
],
|
||||
"version": "==1.25.8"
|
||||
"version": "==1.25.9"
|
||||
},
|
||||
"wagtail": {
|
||||
"hashes": [
|
||||
"sha256:8b66ecf74d40ccc7070944ff2e5a3ae33e42ecf92eb98b92c155410e48f4c974",
|
||||
"sha256:f0793d4de7d9064df04f6086e93992a5c1b07fb97f76996ea1a550bce3d57a16"
|
||||
"sha256:23c5514d530ad2dbe81360e53abd38cfe4b42671e03018a9dd95ee941b4327f4",
|
||||
"sha256:ec5305aba6bf75ca9313287ddf159b43ac4e7cdff771cfe0a9413b481baa433f"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==2.6.1"
|
||||
"version": "==2.9"
|
||||
},
|
||||
"webencodings": {
|
||||
"hashes": [
|
||||
|
|
@ -507,41 +550,41 @@
|
|||
},
|
||||
"whitenoise": {
|
||||
"hashes": [
|
||||
"sha256:59d880d25d0e90bcc6554fe0504a11195bd2e59b3d690b6fb42a8040d4e67ef5",
|
||||
"sha256:c9b7c47fdc1dba4d37bf2787a01a844dc7a521e174fcd22a2d429e0be65e1782"
|
||||
"sha256:0f9137f74bd95fa54329ace88d8dc695fbe895369a632e35f7a136e003e41d73",
|
||||
"sha256:62556265ec1011bd87113fb81b7516f52688887b7a010ee899ff1fd18fd22700"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==4.1.3"
|
||||
"version": "==5.0.1"
|
||||
},
|
||||
"willow": {
|
||||
"hashes": [
|
||||
"sha256:76a8874304356b7d86923405f5ca1df125c3540fb55b32747e7a33ba59bc1744",
|
||||
"sha256:818ee11803c90a0a6d49c94b0453d6266be1ef83ae00de72731c45fae4d3e78c"
|
||||
"sha256:4f84c46f65b6a1982e63dbd4d94c6bae705ff21f839164c31e105c3e251bec37",
|
||||
"sha256:8897a6827c0bb7dee2ac908af53f0d358720bd6032ed20bab3175507e34d739a"
|
||||
],
|
||||
"version": "==1.1"
|
||||
"version": "==1.3"
|
||||
},
|
||||
"xlsxwriter": {
|
||||
"hashes": [
|
||||
"sha256:488e1988ab16ff3a9cd58c7656d0a58f8abe46ee58b98eecea78c022db28656b",
|
||||
"sha256:97ab487b81534415c5313154203f3e8a637d792b1e6a8201e8f7f71da0203c2a"
|
||||
],
|
||||
"version": "==1.2.8"
|
||||
}
|
||||
},
|
||||
"develop": {
|
||||
"appdirs": {
|
||||
"hashes": [
|
||||
"sha256:9e5896d1372858f8dd3344faf4e5014d21849c756c8d5701f78f8a103b372d92",
|
||||
"sha256:d8b24664561d0d34ddfaec54636d502d7cea6e29c3eaf68f3df6180863e2166e"
|
||||
"sha256:7d5d0167b2b1ba821647616af46a749d1c653740dd0d2415100fe26e27afdf41",
|
||||
"sha256:a841dacd6b99318a741b166adb07e19ee71a274450e68237b4650ca1055ab128"
|
||||
],
|
||||
"version": "==1.4.3"
|
||||
"version": "==1.4.4"
|
||||
},
|
||||
"asgiref": {
|
||||
"hashes": [
|
||||
"sha256:7e06d934a7718bf3975acbf87780ba678957b87c7adc056f13b6215d610695a0",
|
||||
"sha256:ea448f92fc35a0ef4b1508f53a04c4670255a3f33d22a81c8fc9c872036adbe5"
|
||||
"sha256:8036f90603c54e93521e5777b2b9a39ba1bad05773fcf2d208f0299d1df58ce5",
|
||||
"sha256:9ca8b952a0a9afa61d30aa6d3d9b570bb3fd6bafcf7ec9e6bed43b936133db1c"
|
||||
],
|
||||
"version": "==3.2.3"
|
||||
},
|
||||
"atomicwrites": {
|
||||
"hashes": [
|
||||
"sha256:03472c30eb2c5d1ba9227e4c2ca66ab8287fbfbbda3888aa93dc2e28fc6811b4",
|
||||
"sha256:75a9445bac02d8d058d5e1fe689654ba5a6556a1dfd8ce6ec55a0ed79866cfa6"
|
||||
],
|
||||
"version": "==1.3.0"
|
||||
"version": "==3.2.7"
|
||||
},
|
||||
"attrs": {
|
||||
"hashes": [
|
||||
|
|
@ -558,19 +601,19 @@
|
|||
},
|
||||
"django": {
|
||||
"hashes": [
|
||||
"sha256:1226168be1b1c7efd0e66ee79b0e0b58b2caa7ed87717909cd8a57bb13a7079a",
|
||||
"sha256:9a4635813e2d498a3c01b10c701fe4a515d76dd290aaa792ccb65ca4ccb6b038"
|
||||
"sha256:69897097095f336d5aeef45b4103dceae51c00afa6d3ae198a2a18e519791b7a",
|
||||
"sha256:6ecd229e1815d4fc5240fc98f1cca78c41e7a8cd3e3f2eefadc4735031077916"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==2.2.10"
|
||||
"version": "==2.2.12"
|
||||
},
|
||||
"django-debug-toolbar": {
|
||||
"hashes": [
|
||||
"sha256:17c53cd6bf4e7d69902aedf9a1d26c5d3b7369b54c5718744704f27b5a72f35d",
|
||||
"sha256:9a23ada2e43cd989195db3c18710b5d7451134a0d48127ab64c1d2ad81700342"
|
||||
"sha256:eabbefe89881bbe4ca7c980ff102e3c35c8e8ad6eb725041f538988f2f39a943",
|
||||
"sha256:ff94725e7aae74b133d0599b9bf89bd4eb8f5d2c964106e61d11750228c8774c"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==2.0"
|
||||
"version": "==2.2"
|
||||
},
|
||||
"filelock": {
|
||||
"hashes": [
|
||||
|
|
@ -581,33 +624,25 @@
|
|||
},
|
||||
"importlib-metadata": {
|
||||
"hashes": [
|
||||
"sha256:aa18d7378b00b40847790e7c27e11673d7fed219354109d0e7b9e5b25dc3ad26",
|
||||
"sha256:d5f18a79777f3aa179c145737780282e27b508fc8fd688cb17c7a813e8bd39af"
|
||||
"sha256:2a688cbaa90e0cc587f1df48bdc97a6eadccdcd9c35fb3f976a09e3b5016d90f",
|
||||
"sha256:34513a8a0c4962bc66d35b359558fd8a5e10cd472d37aec5f66858addef32c1e"
|
||||
],
|
||||
"markers": "python_version < '3.8'",
|
||||
"version": "==0.23"
|
||||
},
|
||||
"importlib-resources": {
|
||||
"hashes": [
|
||||
"sha256:6e2783b2538bd5a14678284a3962b0660c715e5a0f10243fd5e00a4b5974f50b",
|
||||
"sha256:d3279fd0f6f847cced9f7acc19bd3e5df54d34f93a2e7bb5f238f81545787078"
|
||||
],
|
||||
"markers": "python_version < '3.7'",
|
||||
"version": "==1.0.2"
|
||||
"version": "==1.6.0"
|
||||
},
|
||||
"more-itertools": {
|
||||
"hashes": [
|
||||
"sha256:5dd8bcf33e5f9513ffa06d5ad33d78f31e1931ac9a18f33d37e77a180d393a7c",
|
||||
"sha256:b1ddb932186d8a6ac451e1d95844b382f55e12686d51ca0c68b6f61f2ab7a507"
|
||||
"sha256:558bb897a2232f5e4f8e2399089e35aecb746e1f9191b6584a151647e89267be",
|
||||
"sha256:7818f596b1e87be009031c7653d01acc46ed422e6656b394b0f765ce66ed4982"
|
||||
],
|
||||
"version": "==8.2.0"
|
||||
"version": "==8.3.0"
|
||||
},
|
||||
"packaging": {
|
||||
"hashes": [
|
||||
"sha256:170748228214b70b672c581a3dd610ee51f733018650740e98c7df862a583f73",
|
||||
"sha256:e665345f9eef0c621aa0bf2f8d78cf6d21904eef16a93f020240b704a57f1334"
|
||||
"sha256:3c292b474fda1671ec57d46d739d072bfd495a4f51ad01a055121d81e952b7a3",
|
||||
"sha256:82f77b9bee21c1bafbf35a84905d604d5d1223801d639cf3ed140bd651c08752"
|
||||
],
|
||||
"version": "==20.1"
|
||||
"version": "==20.3"
|
||||
},
|
||||
"pluggy": {
|
||||
"hashes": [
|
||||
|
|
@ -625,18 +660,18 @@
|
|||
},
|
||||
"pyparsing": {
|
||||
"hashes": [
|
||||
"sha256:4c830582a84fb022400b85429791bc551f1f4871c33f23e44f353119e92f969f",
|
||||
"sha256:c342dccb5250c08d45fd6f8b4a559613ca603b57498511740e65cd11a2e7dcec"
|
||||
"sha256:c203ec8783bf771a155b207279b9bccb8dea02d8f0c9e5f8ead507bc3246ecc1",
|
||||
"sha256:ef9d7589ef3c200abe66653d3f1ab1033c3c419ae9b9bdb1240a85b024efc88b"
|
||||
],
|
||||
"version": "==2.4.6"
|
||||
"version": "==2.4.7"
|
||||
},
|
||||
"pytest": {
|
||||
"hashes": [
|
||||
"sha256:95d13143cc14174ca1a01ec68e84d76ba5d9d493ac02716fd9706c949a505210",
|
||||
"sha256:b78fe2881323bd44fd9bd76e5317173d4316577e7b1cddebae9136a4495ec865"
|
||||
"sha256:95c710d0a72d91c13fae35dce195633c929c3792f54125919847fdcdf7caa0d3",
|
||||
"sha256:eb2b5e935f6a019317e455b6da83dd8650ac9ffd2ee73a7b657a30873d67a698"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==5.1.2"
|
||||
"version": "==5.4.2"
|
||||
},
|
||||
"pytest-splinter": {
|
||||
"hashes": [
|
||||
|
|
@ -647,10 +682,10 @@
|
|||
},
|
||||
"pytz": {
|
||||
"hashes": [
|
||||
"sha256:1c557d7d0e871de1f5ccd5833f60fb2550652da6be2693c1e02300743d21500d",
|
||||
"sha256:b02c06db6cf09c12dd25137e563b31700d3b80fcc4ad23abb7a315f2789819be"
|
||||
"sha256:a494d53b6d39c3c6e44c3bec237336e14305e4f29bbf800b599253057fbb79ed",
|
||||
"sha256:c35965d010ce31b23eeb663ed3cc8c906275d6be1a34393a1d73a41febf4a048"
|
||||
],
|
||||
"version": "==2019.3"
|
||||
"version": "==2020.1"
|
||||
},
|
||||
"selenium": {
|
||||
"hashes": [
|
||||
|
|
@ -675,53 +710,53 @@
|
|||
},
|
||||
"sqlparse": {
|
||||
"hashes": [
|
||||
"sha256:40afe6b8d4b1117e7dff5504d7a8ce07d9a1b15aeeade8a2d10f130a834f8177",
|
||||
"sha256:7c3dca29c022744e95b547e867cee89f4fce4373f3549ccd8797d8eb52cdb873"
|
||||
"sha256:022fb9c87b524d1f7862b3037e541f68597a730a8843245c349fc93e1643dc4e",
|
||||
"sha256:e162203737712307dfe78860cc56c8da8a852ab2ee33750e33aeadf38d12c548"
|
||||
],
|
||||
"version": "==0.3.0"
|
||||
"version": "==0.3.1"
|
||||
},
|
||||
"toml": {
|
||||
"hashes": [
|
||||
"sha256:229f81c57791a41d65e399fc06bf0848bab550a9dfd5ed66df18ce5f05e73d5c",
|
||||
"sha256:235682dd292d5899d361a811df37e04a8828a5b1da3115886b73cf81ebc9100e"
|
||||
"sha256:926b612be1e5ce0634a2ca03470f95169cf16f939018233a670519cb4ac58b0f",
|
||||
"sha256:bda89d5935c2eac546d648028b9901107a595863cb36bae0c73ac804a9b4ce88"
|
||||
],
|
||||
"version": "==0.10.0"
|
||||
"version": "==0.10.1"
|
||||
},
|
||||
"tox": {
|
||||
"hashes": [
|
||||
"sha256:0bc216b6a2e6afe764476b4a07edf2c1dab99ed82bb146a1130b2e828f5bff5e",
|
||||
"sha256:c4f6b319c20ba4913dbfe71ebfd14ff95d1853c4231493608182f66e566ecfe1"
|
||||
"sha256:8d97bfaf70053ed3db56f57377288621f1bcc7621446d301927d18df93b1c4c3",
|
||||
"sha256:af09c19478e8fc7ce7555b3d802ddf601b82684b874812c5857f774b8aee1b67"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==3.14.0"
|
||||
"version": "==3.15.0"
|
||||
},
|
||||
"urllib3": {
|
||||
"hashes": [
|
||||
"sha256:2f3db8b19923a873b3e5256dc9c2dedfa883e33d87c690d9c7913e1f40673cdc",
|
||||
"sha256:87716c2d2a7121198ebcb7ce7cccf6ce5e9ba539041cfbaeecfb641dc0bf6acc"
|
||||
"sha256:3018294ebefce6572a474f0604c2021e33b3fd8006ecd11d62107a5d2a963527",
|
||||
"sha256:88206b0eb87e6d677d424843ac5209e3fb9d0190d0ee169599165ec25e9d9115"
|
||||
],
|
||||
"version": "==1.25.8"
|
||||
"version": "==1.25.9"
|
||||
},
|
||||
"virtualenv": {
|
||||
"hashes": [
|
||||
"sha256:7e4e234e1f27755685dc54063d989756790b0682d60e304db589fa1604938013",
|
||||
"sha256:e0099edd03c77e14a8ac9be62e45af28759984075d9409bb2c3a4edeb7420a23"
|
||||
"sha256:b4c14d4d73a0c23db267095383c4276ef60e161f94fde0427f2f21a0132dde74",
|
||||
"sha256:fd0e54dec8ac96c1c7c87daba85f0a59a7c37fe38748e154306ca21c73244637"
|
||||
],
|
||||
"version": "==20.0.2"
|
||||
"version": "==20.0.20"
|
||||
},
|
||||
"wcwidth": {
|
||||
"hashes": [
|
||||
"sha256:8fd29383f539be45b20bd4df0dc29c20ba48654a41e661925e612311e9f3c603",
|
||||
"sha256:f28b3e8a6483e5d49e7f8949ac1a78314e740333ae305b4ba5defd3e74fb37a8"
|
||||
"sha256:cafe2186b3c009a04067022ce1dcd79cb38d8d65ee4f4791b8888d6599d1bbe1",
|
||||
"sha256:ee73862862a156bf77ff92b09034fc4825dd3af9cf81bc5b360668d425f3c5f1"
|
||||
],
|
||||
"version": "==0.1.8"
|
||||
"version": "==0.1.9"
|
||||
},
|
||||
"zipp": {
|
||||
"hashes": [
|
||||
"sha256:5c56e330306215cd3553342cfafc73dda2c60792384117893f3a83f8a1209f50",
|
||||
"sha256:d65287feb793213ffe11c0f31b81602be31448f38aeb8ffc2eb286c4f6f6657e"
|
||||
"sha256:aa36550ff0c0b7ef7fa639055d797116ee891440eac1a56f378e2d3179e0320b",
|
||||
"sha256:c599e4d75c98f6798c509911d08a22e6c021d074469042177c8c86fb92eefd96"
|
||||
],
|
||||
"version": "==2.2.0"
|
||||
"version": "==3.1.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
48
README.md
48
README.md
|
|
@ -89,58 +89,54 @@ Install or update the following roles from [Ansible Galaxy](https://docs.ansible
|
|||
|
||||
```
|
||||
ansible-galaxy install \
|
||||
dev-sec.nginx-hardening dev-sec.ssh-hardening dev-sec.os-hardening \
|
||||
geerlingguy.nodejs geerlingguy.certbot
|
||||
dev-sec.nginx-hardening \
|
||||
dev-sec.ssh-hardening \
|
||||
dev-sec.os-hardening \
|
||||
geerlingguy.nodejs
|
||||
```
|
||||
|
||||
To check that the scripts and roles are correctly installed, use this command to do a "dry run":
|
||||
|
||||
```
|
||||
ansible-playbook -s ansible/*.yaml -i ansible/inventories/production --syntax-check --list-tasks
|
||||
ansible-playbook ansible/*.yaml -i ansible/inventories/production --list-tasks
|
||||
```
|
||||
|
||||
If you only want to run a certain set of actions, subset the tags which you see in the output above. For example, to only update the NGINX configuration:
|
||||
|
||||
```
|
||||
ansible-playbook ansible/web.yaml -i ansible/inventories/production --tags "nginx_template_config"
|
||||
```
|
||||
|
||||
To do production deployments, you need to obtain SSH and vault keys from your system administrator (who has followed the Ansible guide to set up a vault..), and place these in a `.keys` folder. To deploy a site:
|
||||
|
||||
```
|
||||
ansible-playbook -s ansible/<*.yaml> -i ansible/inventories/production
|
||||
ansible-playbook ansible/*.yaml -i ansible/inventories/production
|
||||
```
|
||||
|
||||
For an update release with a specific version, use:
|
||||
For an update release with a specific version (tag or branch), use (the `-v` parameter showing output of commands):
|
||||
|
||||
```
|
||||
ansible-playbook -s ansible/site.yaml -i ansible/inventories/production --tags release -e gitversion=<v*.*.*>
|
||||
ansible-playbook ansible/site.yaml -i ansible/inventories/production --tags release -v -e gitversion=<v*.*.*>
|
||||
```
|
||||
|
||||
We use a StackScript to deploy to Linode, the basic system set up is to have a user in the sudoers and docker group, and a few basic system packages ready.
|
||||
You can also use the `gitrepo` parameter to use a different fork of the source code.
|
||||
|
||||
For example, on Ubuntu:
|
||||
Once the basic system set up, i.e. you have an `ansible` user in the sudoers and docker group, you are ready to run the playbook.
|
||||
|
||||
```
|
||||
apt-get install -q -y zip git nginx python-virtualenv python-dev
|
||||
```
|
||||
The typical order of deployment is:
|
||||
|
||||
The order of deployment is:
|
||||
|
||||
- docker.yaml (base system)
|
||||
- internet.yaml
|
||||
- docker.yaml
|
||||
- node.yaml
|
||||
- site.yaml
|
||||
- harden.yaml
|
||||
- certbot.yaml
|
||||
|
||||
The last line adds support for Let's Encrypt, which you can configure and enable (updating your Nginx setup) with:
|
||||
|
||||
```
|
||||
sudo /opt/certbot/certbot-auto --nginx certonly
|
||||
```
|
||||
|
||||
If you do **not** wish to use SSL, delete the last part of your nginx site configuration (/etc/nginx/sites-enabled/...).
|
||||
- web.yaml
|
||||
- wagtail.yaml
|
||||
|
||||
### Production releases
|
||||
|
||||
For further deployment and system maintenance we have a `Makefile` which automates Docker Compose tasks. This should be converted to use [Ansible Container](http://docs.ansible.com/ansible-container/getting_started.html). In the meantime, start a release with Ansible, then complete it using `make`, i.e.:
|
||||
|
||||
```
|
||||
ansible-playbook -s ansible/site.yaml -i ansible/inventories/production --tags release
|
||||
ansible-playbook -i ansible/inventories/production --tags release ansible/wagtail.yaml
|
||||
ssh -i .keys/ansible.pem ansible@<server-ip> "cd <release_dir> && make release"
|
||||
```
|
||||
|
||||
|
|
|
|||
|
|
@ -2,3 +2,7 @@
|
|||
retry_files_enabled = False
|
||||
roles_path = ansible/roles:~/.ansible/roles
|
||||
vault_password_file = .keys/ansible.vault
|
||||
interpreter_python = /usr/bin/python3
|
||||
|
||||
[ssh_connection]
|
||||
scp_if_ssh=True
|
||||
|
|
|
|||
|
|
@ -1,13 +0,0 @@
|
|||
- hosts: webservers
|
||||
become: true
|
||||
become_method: 'sudo'
|
||||
gather_facts: yes
|
||||
vars:
|
||||
certbot_auto_renew_user: ansible
|
||||
certbot_auto_renew_minute: 20
|
||||
certbot_auto_renew_hour: 5
|
||||
certbot_dir: /opt/certbot
|
||||
certbot_install_from_source: yes
|
||||
certbot_version: v0.14.2
|
||||
roles:
|
||||
- geerlingguy.certbot
|
||||
|
|
@ -3,7 +3,5 @@
|
|||
become_method: 'sudo'
|
||||
gather_facts: yes
|
||||
roles:
|
||||
- role: docker-ubuntu
|
||||
- role: geerlingguy.docker
|
||||
docker_users: ansible
|
||||
- role: docker-compose
|
||||
docker_compose_version: 1.12.0
|
||||
|
|
|
|||
90
ansible/files/cloudflare.key
Normal file
90
ansible/files/cloudflare.key
Normal file
|
|
@ -0,0 +1,90 @@
|
|||
$ANSIBLE_VAULT;1.1;AES256
|
||||
36383538613261333830346333313539383062333362643339656131393831326463623563636362
|
||||
3532393137343535313062636664626632303065343739610a633164383665623566353939373432
|
||||
38343937306164663238616439636331316630353764633963393233613663363330366539643535
|
||||
3661636364623732620a383561316265653264613234376539666265303232383263306633646663
|
||||
39343331636163623665316332326464613539376630633731643963376631333338316666343430
|
||||
32393436336565333463326138393132343336313034643061313265303930323361353163353334
|
||||
64626438656333336132653439383334376561333532313532633939323934623862363631373461
|
||||
63333862383265336638343563373836613633303330613735363935663539303535303065376339
|
||||
33306239373530353130353466353065366430666137626138666438616333623833326165656432
|
||||
65666137663833343333333566333132646164633135326237616164666663303634666231643039
|
||||
32373933396131343732376132336634373239343764326134303261353439393832336162643462
|
||||
37353435333434633233633634383139623733376636376233393830356164363032353437663938
|
||||
37393732383933323163386537346562633831353265363436393265306132303164646232326264
|
||||
64313330663131653530373662376464346639643533633961313063633362643132646330366430
|
||||
30316236316330633731636466323935376265633839373832663137336638346565613234363036
|
||||
33616131613761626231653236616332316330633330363039343634643732306138383830623430
|
||||
66323138306536613036623866326536303137666336626531313763396234613665636462333261
|
||||
34653039393839333031656634346630626335353665336430373437373537373533326135663662
|
||||
38656331633337613139633737393466666566303261666662626461323661636232303862386237
|
||||
39643161656561356630316439396331343538346234643562636137353463373266663634323839
|
||||
34356430313335306230333866366438623537633562373362316137363363396362343336386631
|
||||
32633939633339613338613834316365333932356561373334356563393061303635373733323764
|
||||
65633563363865633063343230316462646132623039353631386462383030303432643230616365
|
||||
61633437313739373865363362373737376365646461343733326366656165363463313466326530
|
||||
63613532303633663464623838363665313430323465323031343832363932626531613333376238
|
||||
39333235623635363565313935306164366237366433353437626237656133343630646238633633
|
||||
31656135356334356230613733346432643361333562373964303265333830643639373065383362
|
||||
36313765636362313431306238636431613566363863383737636638303833353032356332623239
|
||||
61363138383738333262383263326238366264313437653330323936646131623333336431333562
|
||||
34613938313036353935326433386535373338623165336663353566363132353961356539373962
|
||||
36653539656237306538626364343965313832323164346235313437666334353133313964656434
|
||||
32663037626537636266303337373234393431303639643036613166663631663465663664643239
|
||||
35376463656134616239353639356166363463306632666630666239376639336661323635313165
|
||||
62623166353365643832356461616330656638363333313262323430376139306161626433633434
|
||||
33653339363131313337646334373337313535366531626632636261346264326164643364653963
|
||||
37366233353866313530383662313537633639643336353266653733316662303365393861646462
|
||||
33346634303163663139373832623934626435323863353830336532313639343964623634393838
|
||||
65666436393731336366313864633761313335383838383437383666653665346266333562633035
|
||||
61333833373464663361383766326166333362383161636163326664636364383662333039386166
|
||||
37323765613233663934313264303438376131336266663331616564396233666666363937366433
|
||||
65663239343764616462363861633961333166636664343634613663663737363837353330636561
|
||||
64666266356466623436353464663830323262396663373330346635333433663733616132643761
|
||||
65326631613832353563303565613030316138666465646136323662363931633666306161626435
|
||||
34356666646262343330613435383563323333386366333937653835636363353934616332343765
|
||||
66386465393239653463653861353535633936636665643630366135613739336134353132373263
|
||||
62613932303239666439656238393932636330386439626133383761316233643834383031653061
|
||||
35386536393639376266383730323534633132633731643834306633613163383463323330393462
|
||||
65343233613966343863383561366133306666316233373463663538656336666237353739376466
|
||||
65663236346631333139386535333839663862386334356330373664616434363465643136343436
|
||||
30346636313936376362386163616332376333376333383865646661333465306562323533633035
|
||||
66353366326434363338373937333664663261343232366434656132363362343039353764653262
|
||||
65373739623863663837396137386539343661326433613439336265623561373466323466356330
|
||||
37326534383533663131613464633536373030346432633836636266393438316466613139663039
|
||||
32373736383364363066333766333839376131633539643561303466653438616539313338663032
|
||||
31666234343564343039656362633035326637306164656363393965336630623364653565343332
|
||||
62393431346139356136643430643637396565393862353236373235646138313435653965613939
|
||||
30653830656537303434363533383836656233663264643831643932376163343863656530666533
|
||||
38326230313839326263366433363332333238336162356130353937333561323530613565623861
|
||||
39653434356438623435316566323064313437353135333231373537343936326532623031393432
|
||||
35653334356464623565326336636239393133623730323035363436613033346630316264316631
|
||||
38383534313738393531643866366332336364623734306365323234323232396434303434633064
|
||||
31636333653335353931643763626135646663356366393763636664376565333861333430636236
|
||||
61303666326565396135386633316563356437313236343038363130636533396565656533663638
|
||||
38656631646231623062393030656334626564356566646666613036366336633865306337613862
|
||||
32356338393632636363373232373730316232353737333638636330386538613436333661613037
|
||||
61373764333337343733383861303532343563613433326461316330626234386331363039306563
|
||||
32613434636663313530326661333035363164636132316365323132633764306232333737356130
|
||||
61393139356362336131373730303734363965316431313839646639386336313663333562623432
|
||||
30636465343763663831333633643533376162336363346138616565633936343339643133653639
|
||||
65633332346437376431656566626565333031323764366165356439363137616166653737343536
|
||||
34326363663936333462386564343639386139613237626464623831393564616539386238643437
|
||||
61363433356238343033343031646230306139646332613061666638303538636635646666666237
|
||||
63343066663931616438396633376231313436313932306138376264616434353837656138666165
|
||||
63353464396364663338393634343234353232326666383064396363656438396435613334623634
|
||||
37666362636233656636376430636563303561356662376438663865653862326238323166656337
|
||||
32666534303863356138393462626266653461623636663534323739393630393635376263333332
|
||||
30306139313761393234336239326231376533353235633639363930393535616164316561613732
|
||||
37666565656363393061393162636366393866376136373534393138336665343266623933643932
|
||||
37343930626138633337396464373537373531326638316434353436393630633234633231356532
|
||||
64396334623066323862663033666565393966636430653364343438306633363136383634313132
|
||||
31366565356339386139333035366264616237303936383431653930636237383932633164616431
|
||||
64663035333833616631613363316230376461623730383537643237623765326132653437356530
|
||||
35323963353935363366323165343438616266353238336230666635336438666335383330636631
|
||||
33356433326432363263333530616238303738666161386636633165336436613239383138336234
|
||||
30376563396135303631653134313966316330383962376635313132666437313138313335333738
|
||||
31383932326338393164613535656362326236616161383432623563623861643566623335313464
|
||||
35363330663933613832313135356432393265616661346564396165373862363939316435386565
|
||||
61356538373061323264613166633165633537616564336161313064323164663366353963643634
|
||||
64613237396261356531306664663166356133663863313235306466656532376361
|
||||
95
ansible/files/cloudflare.pem
Normal file
95
ansible/files/cloudflare.pem
Normal file
|
|
@ -0,0 +1,95 @@
|
|||
$ANSIBLE_VAULT;1.1;AES256
|
||||
66656362343039396163383261626131396164623138383235326661396334323139343433373331
|
||||
6333616364656666396338313334633036343566386630390a373032303366666132376635376365
|
||||
35343932313764356433383664336461373132633066626163333930356634646532653465646164
|
||||
3637386264663834340a353937613135373531656134366635613430336434613062303262663136
|
||||
65323866636663333034356437613039313363663733316530613033383165303539646366346333
|
||||
39396532386333613738333335643738616630343932336565663762316232326662326439653537
|
||||
31663764346235613737306232336630623036623538343761343834363838323134623631633730
|
||||
31643434346231636337626639633830613534316663366637656630366532356134636161326462
|
||||
33383364376230303863663461633639383731376264313964313963393633646265623232323635
|
||||
63663361663565363738386337356166663031346533373731346463343739626262376236386464
|
||||
66363432316566363433393033613630626235333834386365663666323439316433643430663636
|
||||
61616236313038636165303330656466626135306431383934363564616663373761353437373165
|
||||
65393237363535336466646462343230623337646266303331363733356164623135643866626365
|
||||
39633663363261353432633938626161346433323636323866633534313434633935343339313763
|
||||
65653565343232643037396138663162616165613766363261663235323033346362323334343466
|
||||
36646538623730643364613236613038396664306461316434383533633734326565643265396637
|
||||
66636465316132333131656130326133336330633365373966303936633563613931343766663331
|
||||
32383366366564636665383962373764626566366233353931663833353161636661373630626532
|
||||
38376632636534646562663037313435373335343335336662313132333438343264393334343132
|
||||
32643732626138376662316339373330353632316131393763653030363638616239626135633131
|
||||
32646534633932313764633735666237326462363065663437393462313834316432616665643932
|
||||
39653764323438333239366363333038333963386535623965393430353035363363333366393737
|
||||
38633362643135356433383739333131313265333964313534323634306363346334363033396566
|
||||
37616463363430323730333233326134346666396361336237363730353962623337616362646436
|
||||
31626364353430666437373738343566663966366162633832333931336564356130663062363431
|
||||
62303161393963623262303738623739666263343939363438336361653632333635343765363536
|
||||
33373136386430356438636131323434626335326335363532626231373761353839633330373164
|
||||
66336337663766663333323032323166303036636532616633343863643938393663666164373237
|
||||
31316430643663343637373938336133383835313331623565393534333537633339343630396634
|
||||
36653963633030346365336165616430303237376262306539306339613839326566336436663134
|
||||
35303730356433663763393062623863323836646235376536323838366463643531613631316663
|
||||
33396161313464336639303865356166646532376563316564663231643536373464643861643063
|
||||
39353362376638643031343934303937313162343438623538663238333633323036366130356438
|
||||
38666463353832646666306134336136333066336636643466396530396532396632303632663738
|
||||
37323330613538353236623964613466316461313135363635633034306561333662343139366231
|
||||
37393764653533623533663935343537323930366639356365333132353562356537383439383839
|
||||
38373233363638366531353733323239393161653065326562636562613333383264656531306539
|
||||
39616166623234393539353430313439346662623335656530303264646539633466383031626633
|
||||
31343965633437353432343363333234623566613533316333363235646464626237363932303135
|
||||
63353034623761626433303865653732383764613939616236643665386165333633343237333261
|
||||
35316330663961323734653230393038303631363463666561613862653562356131616231346461
|
||||
39646462626365393163333735343733376363303635393136643935386664343930646135346162
|
||||
63383834653164336137356531383237653836356333613031653037373734663939376663656437
|
||||
31653865623830333663306538323264646632356533313862383334303237663033656532393733
|
||||
65356531373739353864656564623739653336653666333136396161366338333865663931656362
|
||||
64323135313736366330356665663966353633323239636339306566623236356237323837373266
|
||||
34336135646539666438663635653939323539346438356661333638666639353434643364303131
|
||||
36353433336161333562353239383239376335633263653966356333656230613134633638636338
|
||||
31303032393335323037396138303939353336363361393131323036653664346339363539646563
|
||||
37316238323231396233333665383630666561656631613163353763643938393462323332646562
|
||||
64303730663861623834616233316331316536336564323466633664633139363232363635326439
|
||||
62393536323032353033333038316166376632323936633834643337353036396532323338653466
|
||||
37376532356366393437303161636537636634326230616130383936663231626131393132663933
|
||||
38623639616262373930653262663232343333643039396531316466663862316164393233313663
|
||||
61643030396331643535353132373538366164393231653163333934636137646531346533316637
|
||||
64353136633934316434636432666339383933633366373638653261326532353733626238373365
|
||||
38396236323838363261366163626664303938343436356531396437326432353230643330616266
|
||||
62633639313435313637343464333633613932316634373262646565633463666532363230393536
|
||||
35363738326262343264383337316539336461623461366161363031623064353962366663623831
|
||||
35353061316334316137363966336565656662626339616465303661343766306332326562336432
|
||||
35343465356234613839613766326231643433383963663138313262333761303537303431306361
|
||||
64646538643565313838663430646634316239353739653839663966613339343633306131383431
|
||||
31383563353931303365633435393031356337376166613538383065353461386166653636643034
|
||||
39333330633234326438396161323864393936373563353134363838623165373064636239626533
|
||||
35333730616339363063306263663631626139666537353238623933643437656534386461366366
|
||||
66393038383035613030343830613061386636353962323764393762633936373935333734613361
|
||||
39623461343438343162306233316233376637626232353235393537613536383038373932663362
|
||||
64353133393631663662383537653039646663323838373061646531313263383339656265373039
|
||||
33336134656531333264313866373363633933363238376439633639346262373464356162333462
|
||||
30336535333161623837666664396331643535663130643332316561643663363339626161623333
|
||||
61343761393462623335306539376633373432366362373062613732613932616336336136643037
|
||||
34373833343262623262313630313536353663316665306332613237316562386332626237313063
|
||||
30323934373263323539653131623133313837666134303439626561306432653437656236633139
|
||||
33313464616565333238636337383363373932643939653061623363663938396633623162306662
|
||||
65333031383730356661313130643165653136326532386530313338396235653032396230383437
|
||||
61393335353561366562343838636231663236383733396564313536323833616335653966616330
|
||||
61616236656263373663616663656365643661383031323566336536346330396366353836633137
|
||||
36373762366130373233306438366566373632353065373434666132313162356239666630386137
|
||||
39616133303633633739646434353738356633363130373862643838333361386632653863613136
|
||||
66323837653231363466366461636563663233303432376530303361376339303861633439373135
|
||||
37396631333635393936386430643934386161326234333966653338663237323564666335656430
|
||||
38346661383336383538616161613865393731373666643037663364353932353861626234396562
|
||||
36326563633836306563633535636232373462643466333739343064336466333061653766623161
|
||||
39373762653739326130653031656566633337643337623531633761663534633139386438346132
|
||||
32326161376631356131333130326636353239663336666436346530306539363961393639666231
|
||||
35616435616130666563353031373362633834313031643866313538626338653435333064363366
|
||||
63316335616166353836393363333662356561363737393630663362373033643364346336376236
|
||||
33303961353437323739363436633762366664383939653061396266303635643437336465646461
|
||||
63303165336138663838656130376162616236373261626133346263623235643833303466333835
|
||||
32663534336336353532643963626130333938333530383062383061303439323339396261306532
|
||||
65383939613732333434386332386663653235366531336633386236383462646535323932636231
|
||||
39663837303164623864316133663039666263653537366365363462386336373535646266373363
|
||||
33343430373033363430346137623030363265373561613761663763653433383163303835653431
|
||||
6137653862376239353230323534353338356634306630333936
|
||||
|
|
@ -4,8 +4,12 @@
|
|||
vars:
|
||||
ssh_server_ports: "{{ vault_ssh_server_ports }}"
|
||||
nginx_add_header: []
|
||||
sysctl_overwrite:
|
||||
# Enable IPv4 traffic forwarding.
|
||||
net.ipv4.ip_forward: 1
|
||||
roles:
|
||||
- role: dev-sec.os-hardening
|
||||
- role: dev-sec.ssh-hardening
|
||||
become: yes
|
||||
- role: nginxinc.nginx
|
||||
- role: dev-sec.nginx-hardening
|
||||
- role: jnv.unattended-upgrades
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
---
|
||||
|
||||
django_project_name: publichealth
|
||||
|
||||
elasticsearch_heap_size: 1g
|
||||
|
||||
memcached_memory_allocation_mb: 256
|
||||
|
||||
nginx_worker_processes: 2
|
||||
nginx_worker_connections: 1024
|
||||
|
||||
email_admin: "{{ vault_email_admin }}"
|
||||
|
||||
domain: "{{ vault_domain }}"
|
||||
allowed_domains: "{{ vault_allowed_domains }}"
|
||||
|
||||
django_email_key: "{{ vault_django_email_key }}"
|
||||
django_email_domain: "{{ vault_django_email_domain }}"
|
||||
django_email_from: "{{ vault_django_email_from }}"
|
||||
|
||||
django_secret_key: "{{ vault_django_secret_key }}"
|
||||
|
||||
# Default: postgres://postgres:@postgres:5432/postgres
|
||||
django_postgres_url: "{{ vault_django_postgres_url }}"
|
||||
|
||||
# Default: http://elasticsearch:9200
|
||||
django_elasticsearch_url: "{{ vault_django_elasticsearch_url }}"
|
||||
|
||||
# Default: redis://redis:6379
|
||||
django_redis_url: "{{ vault_django_redis_url }}"
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
$ANSIBLE_VAULT;1.1;AES256
|
||||
35333039666131666639373965613132326263343464646535653261313834646664383638333438
|
||||
3066633663663765343734313962366362346232643161320a363333303363646236326536363131
|
||||
61393333313261346364366238383338626434373363326437346234363031376137313334383562
|
||||
6261326664363962360a353539376364346632663834653430363261633135343639326336666130
|
||||
32326337656136623364633930306363376134356562663061346131333336346262643465303064
|
||||
61383031366139336432633433613935333466643432306537353737353866386630336661623065
|
||||
37336339336463643335623039393134333032623362656139363537633139336636356232653835
|
||||
30356237343837306532616661396232363562396631653136626264666431366532353333353035
|
||||
66623733636330333435303432363739306263376336336364363032383866316230303662626439
|
||||
32376232366364613736326631633534386134343532303433653231363461343638366135333031
|
||||
35613730373338366539326564333235393465333465363536623664613430343364323466383532
|
||||
38383631376633356437623834663765623930656134613965643531653065393964373035306136
|
||||
63303461633164663938363733663963386537386534313534313937633861626665346333316435
|
||||
65393830383738663638623631353762643563636466336434356162336636343139633531373563
|
||||
62616466323831646238626530653238346161643533643235316333646436653739383936663666
|
||||
34383034343265353031356638643035383633623962616235633931643764306663646438333330
|
||||
64393033653266633165613934323739316134373239613734396237353934613761316138323162
|
||||
37396665303262316663643963313833353738343834616536613637623965666134316137626662
|
||||
31643463393833323863646661363030373938316636663936346562623932313263653062333434
|
||||
65323135613737646130633432626262373734633538633235303937663434663138303836323761
|
||||
64626462633438353762636135333165383862633364313931363461643033653232623835306366
|
||||
38343066623137343835326134343961323537393363363061353135366437356266306130393234
|
||||
37386539343336663933626232373162613964653034306335386339616165323963666164333163
|
||||
30366564323662656235653736626430613438333837653464373665613930376430336566303662
|
||||
32343062643031356265313965383536653362623438363335366666353137643062303137323332
|
||||
63663530363537393264643634303430616532373036623130383062353864376535656336663538
|
||||
62643436343436363335366633356463643561383733353462346162356435303137636232363435
|
||||
35663064623631373762633036393763303763613861343535343231633935313733643066316564
|
||||
35393737376564303566343035633365353138346632383436386134646637336239363736363265
|
||||
36373936333133346135386533373434396235616233343733666465313339653332393839646234
|
||||
66653732343239623464643934646637313934323566663238326135623432353463323366353263
|
||||
38353838306438643338383335656564313837346138636338343235613765323964393964623530
|
||||
37626138643365366466633561396336383433366233383762653530653733343839363930343632
|
||||
62656639306339393463396163653464386362363763313930633463643131636661616233323963
|
||||
39663163353133663761656132303435326566616532666636383463343735373937643637666565
|
||||
34326362626131616533646164333662303231383564616131366231323861646130353563393137
|
||||
66316434363366383939643634316637393832383065316636353663353231393264373939333463
|
||||
32666336383666333230363238633932323035656537666665363837343634633633316436623461
|
||||
33616663303063656432346265626638316636393635636331306139383034353637393836386365
|
||||
38356463316262326362663462313037393464303031373632343866633366393131306437373162
|
||||
31303231623866363835656233653562313439643535633261653834316339633930376237643830
|
||||
34313435336532656361346262323837643433663731663236626433343661623531626464303438
|
||||
63346637306535343436386437356464353439636536393336303539616366306138656636326632
|
||||
65363736656266643561343264306265333439663435343132633436653334343736386130643836
|
||||
34323165306438303363346137643061343438613739653665326439653332613261386138386465
|
||||
36323236633962383737636239343739386236333635333730363135383266643432633135633561
|
||||
33303133323530616232653362343637653865333130313036346333363763663633616661346432
|
||||
37326135376330353538333139336666653666636438383230313530366465336262666636323732
|
||||
62313537306666653234656639353535616237383964353961653332373065393634316130353336
|
||||
61663734383533613534323761393663333336616431616335383564323839316664316364633965
|
||||
36396430316430343832643135333334323037656537323361663465633765363038333432306530
|
||||
37313362393032336435386361373436336338636333623532663264383563396463363734656435
|
||||
61336534323736396135653361363331383232653166663637656664646264313666343935363362
|
||||
32626236653031306537623336316165343962316164633963306431323862666431663134306638
|
||||
31313938643238623232313261633366613632356637386262343861393333303538386166373962
|
||||
61383837336566386463303036373465363034343166316430663036316236303733303239383639
|
||||
33306463306164333363366664346464363164383139363434323930653038396363613838346638
|
||||
30623866326265383663326262326262356636343062626330336666623366656437306536393137
|
||||
37356265633265613534333639376432633730396239663466316532663733313664346138333930
|
||||
31663235643162623132
|
||||
13
ansible/inventories/evolution/webservers
Normal file
13
ansible/inventories/evolution/webservers
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
$ANSIBLE_VAULT;1.1;AES256
|
||||
61393361636537666237333561613438353833396362323665653635333365313632663138393464
|
||||
3235343235373336386135306436373332613033303034330a353536663964306266376662366263
|
||||
63346635333630656238366566666463373536323536396566363163393932613130623366323334
|
||||
3730333438326538380a623461333435376635373837346166303230383231623331363535623934
|
||||
38373834393464636633353132356136383363316134356334323737303762393063326532356135
|
||||
37643535386466656365663432376335666533653737323861393936353236343532663238663430
|
||||
30376161616161653539633934333366383061373134313866646262613430363930303866613837
|
||||
66643636393131393766653632386131613663363338376461623836613462643766376363626563
|
||||
37393938326465633661663938613935653838613063613937663837323435323765326461346261
|
||||
31616130336662326233623466353933343139666636313333303335306632663465666232373037
|
||||
33346235663765393337656336653866393233616561613738343337653038653665356535633631
|
||||
39366432343634303861
|
||||
|
|
@ -1,46 +1,46 @@
|
|||
$ANSIBLE_VAULT;1.1;AES256
|
||||
31623061306338643731643236656264313365323238383734373466653131336263653365396337
|
||||
3864346638623236343833646264393366666230396662300a623038333531393836356163623731
|
||||
38633239636431653935633763316639383562366332346531316632616666346532326239313933
|
||||
6135323639373465300a343438306338653633633465363938363865333530343663383838653738
|
||||
62663439333565343565666434646438346566633933333863303361373166616339626630623930
|
||||
66646162353034623439653262386130656564613962373234633234346138386132323362323839
|
||||
66656533333537303165336634346666306436626236343561343336343135346665666539643232
|
||||
65613166373464373035373666646533316365383931623966353939393765343062306230363963
|
||||
34306538383064336137313034633764316130653536353035323030326533633431633866646463
|
||||
39376234373437313334386465623837613362666337326562396364626332356463313165653661
|
||||
32333266396261306565333061323138646531376639666264353366633033646366396634623863
|
||||
61653030353061656666326561613736356461363032333937623362363734656466323032303661
|
||||
35633635353638613632653639643232313932353232386531353737663436396531396334313837
|
||||
63633333393632356166656266643165373238333237363930333132643962636263346466366130
|
||||
62343731353939336330316363613238363136366436343732353762626263663736383863356365
|
||||
61343361303933346239323165353365626431623938326464396438316332633563663465653337
|
||||
63323862393063633965383932393930326266323237643839366231666166636265623637346264
|
||||
66326662363735373638343561643239626265643630356239653536623930313564316636303130
|
||||
65383661633130323138323330633161386138646564306636643835666333316535636665626464
|
||||
37663531646130376564346261363064323434373864663939353835376262346130393338303833
|
||||
63626539633332383930373862316237363966363566383735383162396165363662363764366530
|
||||
34646135353534306237393233383764376330313234323364363834623438363537386331343934
|
||||
63343464353862616339326565626134353661353134306431326666643635383165633964353936
|
||||
30646437616436363539346433646463666535303530653533653062376633306332366237373434
|
||||
32303964633532336430343662373731356365326366383431616631373132636136653539323037
|
||||
64366334386637623436316161613535636130363162363264663033623531633932623462343331
|
||||
31343232333064623063326666323038663839643439353166346366663934353565653433366362
|
||||
33363432383533663263663761633762366633363563623237636636386337626338653238386533
|
||||
33326632646562386134343138663937346464643733616339316162653566323865643633376537
|
||||
36343636396263353037316631333933313739316135343766666432373633363166373866333632
|
||||
62623734653863303566643331303462363137346233636130333830323333323863356538356139
|
||||
37303231663966623034323138666664326236626439383638666664363531303433636662666561
|
||||
39626265323136313037383164646636653265373832663931356237343138396638376135346636
|
||||
66666536616135386666666464303539616135333064636135346430383431303037393036353435
|
||||
65306131333532663038306136303930636661373764343736383364303266356330333661386635
|
||||
34666539636239656637353131333330346563386334306535643230353439623762343932303361
|
||||
65353163346535396563383862653963326261386531363934356266653461313437633661313035
|
||||
33643766613366643065663637663733363563663633393238623633653664386630376637643464
|
||||
61316135633961636337303735656365356437653730373965343933333433386132633061363064
|
||||
37376337356262613136633431343461333237333063623834616165643637366362393137373339
|
||||
37363430393939663734303364343064666533653363656633303966613334356363316436326438
|
||||
30336236343731656566656631323737346630363538663361303734613738303462366238386563
|
||||
31623135633062666566346561386438663031383232376562623533656437333665376439653932
|
||||
66373134303762356238323962343339386161333038353038393936306434643739396464323532
|
||||
3236
|
||||
38616339396239313536353234393866336335626538653366333364333239623262656130323965
|
||||
6434363364333433376631373064353330363830633462660a363430303939646338343931393261
|
||||
30656361386363303731383364633736393864666466366430303737623034346362343963643163
|
||||
3463343437363230390a366437323666363364333632363165383865306637616133393932313834
|
||||
35343935373538356264633136343535373139393862363538386465623862373130353661306564
|
||||
33323036383165636666363466313237656330373866383536333561313037376234333761623139
|
||||
30373962373361636363653262323464343264303561396165336130353661613937356563663232
|
||||
30323432633534656532356362383663326432393533333931303463303036633730336131643165
|
||||
63343131663861393535663365376163616235633539393666363339333539613961626462343731
|
||||
32613062373061346262333239313837326333326235316564313361386438363363353836353736
|
||||
39343234363837333239363335613931663631376263613636386134353135386332376263386465
|
||||
37643035323039386330303230633965343466376336323730323066323462326565663066373534
|
||||
36633336636331633664323439336163346534383939306635613031303966373761383134373165
|
||||
31373137633430643932396461373466343939653337623065613961633966326263663939303562
|
||||
37303061646461363939343530386364636438386163383934386564353536323335323032306234
|
||||
38663934656530393962393666313833333930333333633032373435616461663433636631336665
|
||||
34623434303737633865393364306335396163343263636665633535613837343632343063373631
|
||||
31646464343732646136623638343166323533626331326133316339343530656237356434303264
|
||||
32353438633866653030353536386238373338663533363237363731396339323533623330396636
|
||||
39343333393066343637343466373662376263336638343230363936343862356465613762303431
|
||||
31613164623032646637383833396362333232663735643336666364363464666662646664663331
|
||||
39643635333038623439356632316433336535616466353566616163336134633037356239623534
|
||||
34656162366630373835633238333261333235666131303964366366396335653861373761623237
|
||||
34663161313465323736643763363533643664316537363266393337326365316336353533313436
|
||||
38353639313135346431633166643535356565653865306337636533313135663433386435653132
|
||||
66356264323235363063633061393966383939623564303666333831393663643437386437616638
|
||||
38633232666461633734363637666264613366353762393733643062643637363933613034316334
|
||||
33333538393832333231376366323862613537303662313063663637303064396431383031356662
|
||||
65363462616536636530313033343962303237383337316666643330333835316663393536373036
|
||||
65333366353366633062643639393961363061343237373065663839633936613737366238393934
|
||||
62616463623266343838306462353931383936646364666531346266383262616635353035613639
|
||||
31313266623439313732313039326533396639376431343935323636646433303561313235306363
|
||||
65306631336330613666613939353664346165323065323139643133306562303138346136613938
|
||||
35333331313831333232333136653664333136663533636338616235653230623431366334346462
|
||||
30333236326234313935386531626539626566656165353837623463366163366238616639343336
|
||||
62366165383464653665653237363234666136323365386263633437383535356436313037383964
|
||||
64656535333639343235343331376565326666386366633166343331656131333664663032363836
|
||||
34656261303638633363663162343166643931303332363639356533363533366261306439383339
|
||||
31303636386261346562613633393239333731303164663332343763396566666437633564313631
|
||||
35363338623335396333353836386137316662633539376337323866353763623863626164326439
|
||||
34616334333630383337376562326330363836356338643939333232323061356566663139373533
|
||||
34643131633763363430306336396163356430306566626162323332633230636264626236613961
|
||||
32376261663761666363646636636136663235656234306334613734383664303832623039323161
|
||||
34356238343965633466303631666130313762653533313562336432326662306136363834616237
|
||||
62633737656133653363386531396330656130633064343034653537306266393738
|
||||
|
|
|
|||
|
|
@ -1 +1,2 @@
|
|||
{install_date: 'Mon Dec 17 12:48:14 2018', version: 2.1.0}
|
||||
install_date: Fri May 15 20:29:19 2020
|
||||
version: 2.1.0
|
||||
|
|
|
|||
34
ansible/roles/dev-sec.os-hardening/.github/workflows/changelog.yml
vendored
Normal file
34
ansible/roles/dev-sec.os-hardening/.github/workflows/changelog.yml
vendored
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
name: Create Changelog
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
types: [closed]
|
||||
|
||||
release:
|
||||
types: [published]
|
||||
|
||||
issues:
|
||||
types: [closed, edited]
|
||||
|
||||
jobs:
|
||||
generate_changelog:
|
||||
runs-on: ubuntu-latest
|
||||
name: Generate changelog for master branch
|
||||
steps:
|
||||
- uses: actions/checkout@v1
|
||||
|
||||
- name: Generate changelog
|
||||
uses: charmixer/auto-changelog-action@v1
|
||||
with:
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: push
|
||||
uses: github-actions-x/commit@v2.6
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
push-branch: 'master'
|
||||
commit-message: 'update changelog'
|
||||
force-add: 'true'
|
||||
files: CHANGELOG.md
|
||||
name: dev-sec CI
|
||||
email: github@gumpri.ch
|
||||
50
ansible/roles/dev-sec.os-hardening/.github/workflows/release.yml
vendored
Normal file
50
ansible/roles/dev-sec.os-hardening/.github/workflows/release.yml
vendored
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
name: New release
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
|
||||
jobs:
|
||||
generate_changelog:
|
||||
runs-on: ubuntu-latest
|
||||
name: create release draft
|
||||
steps:
|
||||
- uses: actions/checkout@v1
|
||||
|
||||
- name: 'Get Previous tag'
|
||||
id: previoustag
|
||||
uses: "WyriHaximus/github-action-get-previous-tag@master"
|
||||
env:
|
||||
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
|
||||
|
||||
- name: calculate next version
|
||||
id: version
|
||||
uses: patrickjahns/version-drafter-action@v1
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Generate changelog
|
||||
uses: charmixer/auto-changelog-action@v1
|
||||
with:
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
since_tag: ${{ steps.previoustag.outputs.tag }}
|
||||
future_release: ${{ steps.version.outputs.next-version }}
|
||||
|
||||
- name: Read CHANGELOG.md
|
||||
id: package
|
||||
uses: juliangruber/read-file-action@v1
|
||||
with:
|
||||
path: ./CHANGELOG.md
|
||||
|
||||
- name: Create Release draft
|
||||
id: create_release
|
||||
uses: actions/create-release@v1
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
|
||||
with:
|
||||
release_name: ${{ steps.version.outputs.next-version }}
|
||||
tag_name: ${{ steps.version.outputs.next-version }}
|
||||
body: |
|
||||
${{ steps.package.outputs.content }}
|
||||
draft: true
|
||||
|
|
@ -16,47 +16,47 @@ provisioner:
|
|||
require_ruby_for_busser: false
|
||||
ansible_verbose: true
|
||||
roles_path: ../ansible-os-hardening/
|
||||
playbook: default.yml
|
||||
playbook: tests/test.yml
|
||||
http_proxy: <%= ENV['http_proxy'] || nil %>
|
||||
https_proxy: <%= ENV['https_proxy'] || nil %>
|
||||
|
||||
transport:
|
||||
max_ssh_sessions: 5
|
||||
max_ssh_sessions: 1
|
||||
|
||||
platforms:
|
||||
- name: ubuntu14.04
|
||||
- name: ubuntu-16.04
|
||||
driver_config:
|
||||
box: opscode-ubuntu-14.04
|
||||
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-14.04_chef-provisionerless.box
|
||||
- name: ubuntu16.04
|
||||
box: bento/ubuntu-16.04
|
||||
- name: ubuntu-18.04
|
||||
driver_config:
|
||||
box: opscode-ubuntu-16.04
|
||||
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-16.04_chef-provisionerless.box
|
||||
- name: ubuntu18.04
|
||||
box: bento/ubuntu-18.04
|
||||
- name: centos-6
|
||||
driver_config:
|
||||
box: ubuntu/bionic64
|
||||
- name: centos6
|
||||
box: bento/centos-6.7
|
||||
- name: centos-7
|
||||
driver_config:
|
||||
box: bento/centos-6.9
|
||||
- name: centos7
|
||||
box: bento/centos-7
|
||||
- name: centos-8
|
||||
driver_config:
|
||||
box: bento/centos-7.3
|
||||
- name: oracle6
|
||||
box: bento/centos-8
|
||||
- name: oracle-6
|
||||
driver_config:
|
||||
box: oracle-6.5
|
||||
box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel65-64.box
|
||||
- name: oracle7
|
||||
box: bento/oracle-6
|
||||
- name: oracle-7
|
||||
driver_config:
|
||||
box: boxcutter/ol72
|
||||
- name: debian7
|
||||
box: bento/oracle-7
|
||||
- name: debian-9
|
||||
driver_config:
|
||||
box: bento/debian-7.11
|
||||
- name: debian8
|
||||
box: bento/debian-9
|
||||
- name: debian-10
|
||||
driver_config:
|
||||
box: bento/debian-8.8
|
||||
- name: debian9
|
||||
box: bento/debian-10
|
||||
- name: amazon
|
||||
driver_config:
|
||||
box: bento/debian-9.0
|
||||
box: bento/amazonlinux-2
|
||||
- name: opensuse_tumbleweed
|
||||
driver_config:
|
||||
box: opensuse/Tumbleweed.x86_64
|
||||
|
||||
verifier:
|
||||
name: inspec
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@ driver:
|
|||
https_proxy: <%= ENV['https_proxy'] || nil %>
|
||||
|
||||
transport:
|
||||
max_ssh_sessions: 5
|
||||
max_ssh_sessions: 1
|
||||
|
||||
provisioner:
|
||||
name: ansible_playbook
|
||||
|
|
@ -17,7 +17,7 @@ provisioner:
|
|||
require_ruby_for_busser: false
|
||||
ansible_verbose: true
|
||||
ansible_diff: true
|
||||
hosts: all
|
||||
|
||||
roles_path: ../ansible-os-hardening/
|
||||
http_proxy: <%= ENV['http_proxy'] || nil %>
|
||||
https_proxy: <%= ENV['https_proxy'] || nil %>
|
||||
|
|
@ -36,6 +36,14 @@ platforms:
|
|||
provision_command:
|
||||
- sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
|
||||
- systemctl enable sshd.service
|
||||
- name: centos8-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-centos8-ansible:latest
|
||||
platform: centos
|
||||
run_command: /sbin/init
|
||||
provision_command:
|
||||
- sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
|
||||
- systemctl enable sshd.service
|
||||
- name: oracle6-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-oracle6-ansible:latest
|
||||
|
|
@ -48,10 +56,6 @@ platforms:
|
|||
provision_command:
|
||||
- sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
|
||||
- systemctl enable sshd.service
|
||||
- name: ubuntu1404-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-ubuntu1404-ansible:latest
|
||||
platform: ubuntu
|
||||
- name: ubuntu1604-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-ubuntu1604-ansible:latest
|
||||
|
|
@ -66,14 +70,6 @@ platforms:
|
|||
run_command: /sbin/init
|
||||
provision_command:
|
||||
- systemctl enable ssh.service
|
||||
- name: debian7-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-debian7-ansible:latest
|
||||
platform: debian
|
||||
- name: debian8-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-debian8-ansible:latest
|
||||
platform: debian
|
||||
- name: debian9-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-debian9-ansible:latest
|
||||
|
|
@ -82,6 +78,14 @@ platforms:
|
|||
provision_command:
|
||||
- apt install -y systemd-sysv
|
||||
- systemctl enable ssh.service
|
||||
- name: debian10-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-debian10-ansible:latest
|
||||
platform: debian
|
||||
run_command: /sbin/init
|
||||
provision_command:
|
||||
- apt install -y systemd-sysv
|
||||
- systemctl enable ssh.service
|
||||
- name: amazon-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-amazon-ansible:latest
|
||||
|
|
@ -90,6 +94,23 @@ platforms:
|
|||
provision_command:
|
||||
- sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
|
||||
- systemctl enable sshd.service
|
||||
- name: fedora-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-fedora-ansible:latest
|
||||
platform: centos
|
||||
run_command: /sbin/init
|
||||
provision_command:
|
||||
- dnf install -y python
|
||||
- sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
|
||||
- systemctl enable sshd.service
|
||||
- name: opensuse_tumbleweed-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-opensuse_tumbleweed-ansible
|
||||
platform: opensuse
|
||||
provision_command:
|
||||
- zypper -n install python-xml rpm-python
|
||||
- sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
|
||||
- systemctl enable sshd.service
|
||||
|
||||
verifier:
|
||||
name: inspec
|
||||
|
|
|
|||
|
|
@ -11,6 +11,16 @@ env:
|
|||
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||||
version: latest
|
||||
|
||||
- distro: centos8
|
||||
init: /lib/systemd/systemd
|
||||
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||||
version: latest
|
||||
|
||||
- distro: fedora
|
||||
init: /lib/systemd/systemd
|
||||
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||||
version: latest
|
||||
|
||||
- distro: oracle6
|
||||
version: latest
|
||||
init: /sbin/init
|
||||
|
|
@ -20,10 +30,6 @@ env:
|
|||
# run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||||
# version: latest
|
||||
|
||||
- distro: ubuntu1404
|
||||
version: latest
|
||||
init: /sbin/init
|
||||
|
||||
- distro: ubuntu1604
|
||||
version: latest
|
||||
init: /lib/systemd/systemd
|
||||
|
|
@ -34,16 +40,12 @@ env:
|
|||
init: /lib/systemd/systemd
|
||||
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||||
|
||||
- distro: debian7
|
||||
- distro: debian9
|
||||
version: latest
|
||||
init: /sbin/init
|
||||
|
||||
- distro: debian8
|
||||
version: latest
|
||||
init: /sbin/init
|
||||
init: /lib/systemd/systemd
|
||||
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||||
|
||||
- distro: debian9
|
||||
- distro: debian10
|
||||
version: latest
|
||||
init: /lib/systemd/systemd
|
||||
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||||
|
|
@ -53,17 +55,28 @@ env:
|
|||
version: latest
|
||||
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||||
|
||||
# - distro: opensuse_tumbleweed
|
||||
# init: /usr/lib/systemd/systemd
|
||||
# version: latest
|
||||
# run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro --volume=/run:/run:ro"
|
||||
|
||||
before_install:
|
||||
# Pull container
|
||||
- 'docker pull rndmh3ro/docker-${distro}-ansible:${version}'
|
||||
|
||||
script:
|
||||
- pip install --user ansible-lint
|
||||
- ansible-lint ./
|
||||
|
||||
- container_id=$(mktemp)
|
||||
# Run container in detached state.
|
||||
- 'docker run --detach --volume="${PWD}":/etc/ansible/roles/ansible-os-hardening:ro ${run_opts} rndmh3ro/docker-${distro}-ansible:${version} "${init}" > "${container_id}"'
|
||||
|
||||
# Output Ansible version from docker image
|
||||
- 'docker exec "$(cat ${container_id})" ansible-playbook --version'
|
||||
|
||||
# Test role.
|
||||
- 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-os-hardening/tests/test.yml --diff --skip-tags "sysctl"'
|
||||
- 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-os-hardening/tests/test.yml --diff'
|
||||
|
||||
# Verify role
|
||||
- 'inspec exec https://github.com/dev-sec/linux-baseline/ -t docker://$(cat ${container_id}) --controls=os-01 os-02 os-03 os-04 os-05 os-05b os-06 os-07 os-09 os-10 os-11 package-01 package-02 package-03 package-05 package-06 package-08 package-09 --no-distinct-exit'
|
||||
|
|
|
|||
|
|
@ -1,6 +1,113 @@
|
|||
# Change Log
|
||||
# Changelog
|
||||
|
||||
## [Unreleased](https://github.com/dev-sec/ansible-os-hardening/tree/HEAD)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/6.0.0...HEAD)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- add changelog and release workflow [\#271](https://github.com/dev-sec/ansible-os-hardening/pull/271) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- github action for changelog generation [\#270](https://github.com/dev-sec/ansible-os-hardening/pull/270) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [6.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/6.0.0) (2020-05-05)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/5.2.1...6.0.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Configure audit=1 for more accurate auid auditing [\#253](https://github.com/dev-sec/ansible-os-hardening/issues/253)
|
||||
- Add Debian Buster support for ansible-os-hardening [\#233](https://github.com/dev-sec/ansible-os-hardening/issues/233)
|
||||
- Add CentOS 8 support for ansible-os-hardening [\#232](https://github.com/dev-sec/ansible-os-hardening/issues/232)
|
||||
- Add selinux configuration [\#154](https://github.com/dev-sec/ansible-os-hardening/issues/154)
|
||||
- Make useradd defaults in login.defs dependent on OS [\#266](https://github.com/dev-sec/ansible-os-hardening/pull/266) ([Aisbergg](https://github.com/Aisbergg))
|
||||
- Add kernel hardening parameters from Tails and CIS Benchmark [\#263](https://github.com/dev-sec/ansible-os-hardening/pull/263) ([kravietz](https://github.com/kravietz))
|
||||
- add ansible-lint [\#262](https://github.com/dev-sec/ansible-os-hardening/pull/262) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Remove trailing space [\#261](https://github.com/dev-sec/ansible-os-hardening/pull/261) ([kravietz](https://github.com/kravietz))
|
||||
- Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-os-hardening/pull/259) ([jaredledvina](https://github.com/jaredledvina))
|
||||
- Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-os-hardening/pull/254) ([kravietz](https://github.com/kravietz))
|
||||
- Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-os-hardening/pull/251) ([dustinmiller1337](https://github.com/dustinmiller1337))
|
||||
- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) ([dustinmiller1337](https://github.com/dustinmiller1337))
|
||||
- Make max\_log\_file\_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-os-hardening/pull/246) ([jandd](https://github.com/jandd))
|
||||
- Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-os-hardening/pull/240) ([okupriyanov](https://github.com/okupriyanov))
|
||||
- Fedora - Use new auto ansible\_python\_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-os-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
|
||||
- add test support for CentOS8 [\#237](https://github.com/dev-sec/ansible-os-hardening/pull/237) ([yeoldegrove](https://github.com/yeoldegrove))
|
||||
- Support configuring SELinux and default to enforcing [\#236](https://github.com/dev-sec/ansible-os-hardening/pull/236) ([jaredledvina](https://github.com/jaredledvina))
|
||||
- Add test support for debian buster [\#234](https://github.com/dev-sec/ansible-os-hardening/pull/234) ([123Haynes](https://github.com/123Haynes))
|
||||
- Changed local var name to a less common one [\#231](https://github.com/dev-sec/ansible-os-hardening/pull/231) ([rgarrigue](https://github.com/rgarrigue))
|
||||
- Use ansible facts for vars [\#226](https://github.com/dev-sec/ansible-os-hardening/pull/226) ([joshuatalb](https://github.com/joshuatalb))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- /etc/login.defs alters centos 7/8 default values [\#265](https://github.com/dev-sec/ansible-os-hardening/issues/265)
|
||||
- Invalid Conditionals in user\_accounts.yml [\#255](https://github.com/dev-sec/ansible-os-hardening/issues/255)
|
||||
- `auth-system` related files are created for non-RHEL systems \(e.g. Debian\) [\#247](https://github.com/dev-sec/ansible-os-hardening/issues/247)
|
||||
- NSA website links are stale [\#227](https://github.com/dev-sec/ansible-os-hardening/issues/227)
|
||||
- Running ansible on python3 throughs "TypeError: '\<=' not supported between instances of 'str' and 'int'" [\#223](https://github.com/dev-sec/ansible-os-hardening/issues/223)
|
||||
- \[lots of\] deprecation warnings in Ansible 2.8 [\#221](https://github.com/dev-sec/ansible-os-hardening/issues/221)
|
||||
- Add a "don't fail on error" switch ? [\#148](https://github.com/dev-sec/ansible-os-hardening/issues/148)
|
||||
- Addressing issue \#255 [\#258](https://github.com/dev-sec/ansible-os-hardening/pull/258) ([ljkimmel](https://github.com/ljkimmel))
|
||||
- Fix \#247, cleanup conditions [\#248](https://github.com/dev-sec/ansible-os-hardening/pull/248) ([fernandezcuesta](https://github.com/fernandezcuesta))
|
||||
- Fix error on applying the sysctl vars on containers [\#243](https://github.com/dev-sec/ansible-os-hardening/pull/243) ([okupriyanov](https://github.com/okupriyanov))
|
||||
- Update location of NSA RHEL 5 Guide [\#235](https://github.com/dev-sec/ansible-os-hardening/pull/235) ([jaredledvina](https://github.com/jaredledvina))
|
||||
|
||||
## [5.2.1](https://github.com/dev-sec/ansible-os-hardening/tree/5.2.1) (2019-06-09)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/5.2.0...5.2.1)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Fix deprecation warnings in Ansible 2.8 [\#224](https://github.com/dev-sec/ansible-os-hardening/pull/224) ([Normo](https://github.com/Normo))
|
||||
- add docs to find-task in minimize access. fix \#219 [\#220](https://github.com/dev-sec/ansible-os-hardening/pull/220) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- `squash\_actions` deprecation warning [\#218](https://github.com/dev-sec/ansible-os-hardening/issues/218)
|
||||
|
||||
## [5.2.0](https://github.com/dev-sec/ansible-os-hardening/tree/5.2.0) (2019-05-04)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/5.1.0...5.2.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Speed up "minimize access on found files" task [\#208](https://github.com/dev-sec/ansible-os-hardening/issues/208)
|
||||
- Fedora support? [\#163](https://github.com/dev-sec/ansible-os-hardening/issues/163)
|
||||
- remove eol'd OS and add new [\#217](https://github.com/dev-sec/ansible-os-hardening/pull/217) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Add note about docker under warning [\#214](https://github.com/dev-sec/ansible-os-hardening/pull/214) ([ChrisMcKee](https://github.com/ChrisMcKee))
|
||||
- change minimize access tasks to speed them up [\#209](https://github.com/dev-sec/ansible-os-hardening/pull/209) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Added fedora support [\#206](https://github.com/dev-sec/ansible-os-hardening/pull/206) ([jonaswre](https://github.com/jonaswre))
|
||||
- Pass package list directly to apt and yum modules without using with\_items loop [\#200](https://github.com/dev-sec/ansible-os-hardening/pull/200) ([Normo](https://github.com/Normo))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- login.defs.j2 template: ENV\_PATH is missing ':' before variable substitution [\#202](https://github.com/dev-sec/ansible-os-hardening/issues/202)
|
||||
- 'sysctl\_rhel\_config' is undefined [\#167](https://github.com/dev-sec/ansible-os-hardening/issues/167)
|
||||
- RHEL 7.4: Too many setuid bits removed [\#140](https://github.com/dev-sec/ansible-os-hardening/issues/140)
|
||||
- Fix typo [\#212](https://github.com/dev-sec/ansible-os-hardening/pull/212) ([ruslo](https://github.com/ruslo))
|
||||
- Update modprobe to 0644 [\#211](https://github.com/dev-sec/ansible-os-hardening/pull/211) ([joshuatalb](https://github.com/joshuatalb))
|
||||
- Test Kitchen Vagrant Fixes [\#210](https://github.com/dev-sec/ansible-os-hardening/pull/210) ([joshuatalb](https://github.com/joshuatalb))
|
||||
- \[readme\] Update documentation link [\#207](https://github.com/dev-sec/ansible-os-hardening/pull/207) ([pmav99](https://github.com/pmav99))
|
||||
- fix ansible lint remarks [\#204](https://github.com/dev-sec/ansible-os-hardening/pull/204) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- add colon to user env paths - fix \#202 [\#203](https://github.com/dev-sec/ansible-os-hardening/pull/203) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Fix errors produced by ansible-lint [\#159](https://github.com/dev-sec/ansible-os-hardening/pull/159) ([zbrojny120](https://github.com/zbrojny120))
|
||||
|
||||
## [5.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/5.1.0) (2018-10-17)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/5.0.0...5.1.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- add ubuntu 1804 support [\#196](https://github.com/dev-sec/ansible-os-hardening/pull/196) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- add option to disable auditd [\#192](https://github.com/dev-sec/ansible-os-hardening/pull/192) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191)
|
||||
- Setting os\_security\_users\_allow has no effect [\#175](https://github.com/dev-sec/ansible-os-hardening/issues/175)
|
||||
- add /usr/bin/su to suid\_guid whitelist [\#199](https://github.com/dev-sec/ansible-os-hardening/pull/199) ([ccolic](https://github.com/ccolic))
|
||||
- ensure that permissions to su-binary are not restricted to root user and group only, if os\_security\_users\_allow contains the value change\_user [\#197](https://github.com/dev-sec/ansible-os-hardening/pull/197) ([szEvEz](https://github.com/szEvEz))
|
||||
|
||||
## [5.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/5.0.0) (2018-09-02)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.3.0...5.0.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
|
@ -34,6 +141,7 @@
|
|||
- change minimize access method [\#181](https://github.com/dev-sec/ansible-os-hardening/pull/181) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [4.3.0](https://github.com/dev-sec/ansible-os-hardening/tree/4.3.0) (2018-01-03)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.3.1...4.3.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
|
@ -63,6 +171,7 @@
|
|||
- move defaults to os-specific vars [\#157](https://github.com/dev-sec/ansible-os-hardening/pull/157) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [4.3.1](https://github.com/dev-sec/ansible-os-hardening/tree/4.3.1) (2017-09-13)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.2.0...4.3.1)
|
||||
|
||||
**Fixed bugs:**
|
||||
|
|
@ -70,6 +179,7 @@
|
|||
- os\_security\_kernel\_enable\_sysrq is not implemented [\#115](https://github.com/dev-sec/ansible-os-hardening/issues/115)
|
||||
|
||||
## [4.2.0](https://github.com/dev-sec/ansible-os-hardening/tree/4.2.0) (2017-08-08)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.1.0...4.2.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
|
@ -93,6 +203,7 @@
|
|||
- remove execshield sysctl-parameter on rhel7 [\#119](https://github.com/dev-sec/ansible-os-hardening/pull/119) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [4.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/4.1.0) (2017-06-27)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.0.0...4.1.0)
|
||||
|
||||
**Fixed bugs:**
|
||||
|
|
@ -113,6 +224,7 @@
|
|||
- add more sysctl settings, allow overwriting [\#120](https://github.com/dev-sec/ansible-os-hardening/pull/120) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [4.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/4.0.0) (2017-03-14)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.2.0...4.0.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
|
@ -124,7 +236,6 @@
|
|||
**Fixed bugs:**
|
||||
|
||||
- The role fails when conditionally included [\#105](https://github.com/dev-sec/ansible-os-hardening/issues/105)
|
||||
- omit empty variables [\#106](https://github.com/dev-sec/ansible-os-hardening/pull/106) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
|
|
@ -139,6 +250,7 @@
|
|||
- Don’t refer to this role as "playbook" in the role description [\#104](https://github.com/dev-sec/ansible-os-hardening/pull/104) ([ypid](https://github.com/ypid))
|
||||
|
||||
## [3.2.0](https://github.com/dev-sec/ansible-os-hardening/tree/3.2.0) (2016-10-24)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.1.0...3.2.0)
|
||||
|
||||
**Fixed bugs:**
|
||||
|
|
@ -156,9 +268,11 @@
|
|||
- add rhel7 pam\_pwquality. fix \#73 [\#94](https://github.com/dev-sec/ansible-os-hardening/pull/94) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [3.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/3.1.0) (2016-08-03)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.1...3.1.0)
|
||||
|
||||
## [3.1](https://github.com/dev-sec/ansible-os-hardening/tree/3.1) (2016-07-27)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.0.0...3.1)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
|
@ -181,7 +295,6 @@
|
|||
- Permissions on /etc/shadow can lock out GUI users [\#86](https://github.com/dev-sec/ansible-os-hardening/issues/86)
|
||||
- network related sysctl rewritten by ufw in ubuntu [\#82](https://github.com/dev-sec/ansible-os-hardening/issues/82)
|
||||
- ansible \>= 2.0 complains: Using bare variables is deprecated [\#78](https://github.com/dev-sec/ansible-os-hardening/issues/78)
|
||||
- Norm-Audit-Hardening-Audit [\#76](https://github.com/dev-sec/ansible-os-hardening/issues/76)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
|
|
@ -189,6 +302,7 @@
|
|||
- Permits overriding permissions on /etc/shadow [\#89](https://github.com/dev-sec/ansible-os-hardening/pull/89) ([conorsch](https://github.com/conorsch))
|
||||
|
||||
## [3.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/3.0.0) (2016-03-13)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/2.0.0...3.0.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
|
@ -208,7 +322,6 @@
|
|||
|
||||
- Updates "tags" parameters on includes in main.yml [\#66](https://github.com/dev-sec/ansible-os-hardening/pull/66) ([conorsch](https://github.com/conorsch))
|
||||
- Suid set def var, fix \#64 [\#63](https://github.com/dev-sec/ansible-os-hardening/pull/63) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- ERROR! Include tasks should not specify tags in more than one way [\#60](https://github.com/dev-sec/ansible-os-hardening/pull/60) ([fitz123](https://github.com/fitz123))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
|
|
@ -221,6 +334,7 @@
|
|||
- Release 3.0.0 [\#75](https://github.com/dev-sec/ansible-os-hardening/pull/75) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [2.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/2.0.0) (2015-11-28)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/1.0.0...2.0.0)
|
||||
|
||||
**Closed issues:**
|
||||
|
|
@ -239,6 +353,9 @@
|
|||
- improved travis-tests to cover more cases [\#42](https://github.com/dev-sec/ansible-os-hardening/pull/42) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [1.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/1.0.0) (2015-09-01)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/06d1464e95cad7ccc24734b934a158b16dfc5014...1.0.0)
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- ansible-os-hardening/tasks/minimize\_access.yml [\#38](https://github.com/dev-sec/ansible-os-hardening/issues/38)
|
||||
|
|
@ -285,4 +402,4 @@
|
|||
|
||||
|
||||
|
||||
\* *This Change Log was automatically generated by [github_changelog_generator](https://github.com/skywinder/Github-Changelog-Generator)*
|
||||
\* *This Changelog was automatically generated by [github_changelog_generator](https://github.com/github-changelog-generator/github-changelog-generator)*
|
||||
|
|
|
|||
|
|
@ -11,6 +11,7 @@ group :integration do
|
|||
gem 'kitchen-sync'
|
||||
gem 'kitchen-transport-rsync'
|
||||
gem 'kitchen-docker'
|
||||
gem 'inspec', '~> 3'
|
||||
end
|
||||
|
||||
group :tools do
|
||||
|
|
|
|||
|
|
@ -35,6 +35,20 @@ It will not:
|
|||
If you're using inspec to test your machines after applying this role, please make sure to add the connecting user to the `os_ignore_users`-variable.
|
||||
Otherwise inspec will fail. For more information, see [issue #124](https://github.com/dev-sec/ansible-os-hardening/issues/124).
|
||||
|
||||
If you're using Docker / Kubernetes+Docker you'll need to override the ipv4 ip forward sysctl setting.
|
||||
|
||||
```yaml
|
||||
- hosts: localhost
|
||||
roles:
|
||||
- dev-sec.os-hardening
|
||||
vars:
|
||||
sysctl_overwrite:
|
||||
# Enable IPv4 traffic forwarding.
|
||||
net.ipv4.ip_forward: 1
|
||||
```
|
||||
|
||||
|
||||
|
||||
## Variables
|
||||
|
||||
| Name | Default Value | Description |
|
||||
|
|
@ -57,24 +71,27 @@ Otherwise inspec will fail. For more information, see [issue #124](https://githu
|
|||
| `os_security_suid_sgid_blacklist`| [] | a list of paths which should have their SUID/SGID bits removed|
|
||||
| `os_security_suid_sgid_whitelist`| [] | a list of paths which should not have their SUID/SGID bits altered|
|
||||
| `os_security_suid_sgid_remove_from_unknown`| false | true if you want to remove SUID/SGID bits from any file, that is not explicitly configured in a `blacklist`. This will make every Ansible-run search through the mounted filesystems looking for SUID/SGID bits that are not configured in the default and user blacklist. If it finds an SUID/SGID bit, it will be removed, unless this file is in your `whitelist`.|
|
||||
| `os_security_packages_clean'`| true | removes packages with known issues. See section packages.|
|
||||
| `os_security_packages_clean`| true | removes packages with known issues. See section packages.|
|
||||
| `os_selinux_state` | enforcing | Set the SELinux state, can be either disabled, permissive, or enforcing. |
|
||||
| `os_selinux_policy` | targeted | Set the SELinux polixy. |
|
||||
| `ufw_manage_defaults` | true | true means apply all settings with `ufw_` prefix|
|
||||
| `ufw_ipt_sysctl` | '' | by default it disables IPT_SYSCTL in /etc/default/ufw. If you want to overwrite /etc/sysctl.conf values using ufw - set it to your sysctl dictionary, for example `/etc/ufw/sysctl.conf`
|
||||
| `ufw_default_input_policy` | DROP | set default input policy of ufw to `DROP` |
|
||||
| `ufw_default_output_policy` | ACCEPT | set default output policy of ufw to `ACCEPT` |
|
||||
| `ufw_default_forward_policy` | DROP | set default forward policy of ufw to `DROP` |
|
||||
| `os_auditd_enabled` | true | Set to false to disable installing and configuring auditd. |
|
||||
| `os_auditd_max_log_file_action` | `keep_logs` | Defines the behaviour of auditd when its log file is filled up. Possible other values are described in the auditd.conf man page. The most common alternative to the default may be `rotate`. |
|
||||
|
||||
## Packages
|
||||
|
||||
We remove the following packages:
|
||||
|
||||
* xinetd ([NSA](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf), Chapter 3.2.1)
|
||||
* inetd ([NSA](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf), Chapter 3.2.1)
|
||||
* tftp-server ([NSA](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf), Chapter 3.2.5)
|
||||
* ypserv ([NSA](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf), Chapter 3.2.4)
|
||||
* telnet-server ([NSA](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf), Chapter 3.2.2)
|
||||
* rsh-server ([NSA](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf), Chapter 3.2.3)
|
||||
* xinetd ([NSA](https://apps.nsa.gov/iaarchive/library/ia-guidance/security-configuration/operating-systems/guide-to-the-secure-configuration-of-red-hat-enterprise.cfm), Chapter 3.2.1)
|
||||
* inetd ([NSA](https://apps.nsa.gov/iaarchive/library/ia-guidance/security-configuration/operating-systems/guide-to-the-secure-configuration-of-red-hat-enterprise.cfm), Chapter 3.2.1)
|
||||
* tftp-server ([NSA](https://apps.nsa.gov/iaarchive/library/ia-guidance/security-configuration/operating-systems/guide-to-the-secure-configuration-of-red-hat-enterprise.cfm), Chapter 3.2.5)
|
||||
* ypserv ([NSA](https://apps.nsa.gov/iaarchive/library/ia-guidance/security-configuration/operating-systems/guide-to-the-secure-configuration-of-red-hat-enterprise.cfm), Chapter 3.2.4)
|
||||
* telnet-server ([NSA](https://apps.nsa.gov/iaarchive/library/ia-guidance/security-configuration/operating-systems/guide-to-the-secure-configuration-of-red-hat-enterprise.cfm), Chapter 3.2.2)
|
||||
* rsh-server ([NSA](https://apps.nsa.gov/iaarchive/library/ia-guidance/security-configuration/operating-systems/guide-to-the-secure-configuration-of-red-hat-enterprise.cfm), Chapter 3.2.3)
|
||||
* prelink ([open-scap](https://static.open-scap.org/ssg-guides/ssg-sl7-guide-ospp-rhel7-server.html#xccdf_org.ssgproject.content_rule_disable_prelink))
|
||||
|
||||
## Disabled filesystems
|
||||
|
|
@ -92,6 +109,14 @@ We disable the following filesystems, because they're most likely not used:
|
|||
|
||||
To prevent some of the filesystems from being disabled, add them to the `os_filesystem_whitelist` variable.
|
||||
|
||||
## Installation
|
||||
|
||||
Install the role with ansible-galaxy:
|
||||
|
||||
```
|
||||
ansible-galaxy install dev-sec.os-hardening
|
||||
```
|
||||
|
||||
## Example Playbook
|
||||
|
||||
```yaml
|
||||
|
|
@ -115,7 +140,13 @@ So for example if you want to change the IPv4 traffic forwarding variable to `1`
|
|||
net.ipv4.ip_forward: 1
|
||||
```
|
||||
|
||||
Alternatively you can change Ansible's [hash-behaviour](https://docs.ansible.com/ansible/intro_configuration.html#hash-behaviour) to `merge`, then you only have to overwrite the single hash you need to. But please be aware that changing the hash-behaviour changes it for all your playbooks and is not recommended by Ansible.
|
||||
Alternatively you can change Ansible's [hash-behaviour](https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-hash-behaviour) to `merge`, then you only have to overwrite the single hash you need to. But please be aware that changing the hash-behaviour changes it for all your playbooks and is not recommended by Ansible.
|
||||
|
||||
## Improving Kernel Audit logging
|
||||
|
||||
By default, any process that starts before the `auditd` daemon will have an AUID of `4294967295`. To improve this and provide more accurate logging, it's recommended to add the kernel boot parameter `audit=1` to you configuration. Without doing this, you will find that your `auditd` logs fail to properly audit all processes.
|
||||
|
||||
For more information, please see this [upstream documentation](https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html) and your system's boot loader documentation for how to configure additional kernel parameters.
|
||||
|
||||
## Local Testing
|
||||
|
||||
|
|
|
|||
|
|
@ -1,74 +0,0 @@
|
|||
---
|
||||
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
||||
hosts: localhost
|
||||
roles:
|
||||
- ansible-os-hardening
|
||||
pre_tasks:
|
||||
- name: Run the equivalent of "apt-get update" as a separate step
|
||||
apt:
|
||||
update_cache: yes
|
||||
when: ansible_os_family == 'Debian'
|
||||
- name: Install firefox to get Xorg
|
||||
package:
|
||||
name: firefox
|
||||
state: present
|
||||
vars:
|
||||
os_security_users_allow: change_user
|
||||
os_security_kernel_enable_core_dump: false
|
||||
os_security_suid_sgid_remove_from_unknown: true
|
||||
os_auth_pam_passwdqc_enable: false
|
||||
os_desktop_enable: true
|
||||
os_env_extra_user_paths: ['/home']
|
||||
os_auth_allow_homeless: true
|
||||
os_security_suid_sgid_blacklist: ['/bin/umount']
|
||||
os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
|
||||
os_filesystem_whitelist: ['vfat']
|
||||
sysctl_config:
|
||||
net.ipv4.ip_forward: 0
|
||||
net.ipv6.conf.all.forwarding: 0
|
||||
net.ipv6.conf.all.accept_ra: 0
|
||||
net.ipv6.conf.default.accept_ra: 0
|
||||
net.ipv4.conf.all.rp_filter: 1
|
||||
net.ipv4.conf.default.rp_filter: 1
|
||||
net.ipv4.icmp_echo_ignore_broadcasts: 1
|
||||
net.ipv4.icmp_ignore_bogus_error_responses: 1
|
||||
net.ipv4.icmp_ratelimit: 100
|
||||
net.ipv4.icmp_ratemask: 88089
|
||||
net.ipv6.conf.all.disable_ipv6: 1
|
||||
net.ipv4.conf.all.arp_ignore: 1
|
||||
net.ipv4.conf.all.arp_announce: 2
|
||||
net.ipv4.conf.all.shared_media: 1
|
||||
net.ipv4.conf.default.shared_media: 1
|
||||
net.ipv4.conf.all.accept_source_route: 0
|
||||
net.ipv4.conf.default.accept_source_route: 0
|
||||
net.ipv4.conf.default.accept_redirects: 0
|
||||
net.ipv4.conf.all.accept_redirects: 0
|
||||
net.ipv4.conf.all.secure_redirects: 0
|
||||
net.ipv4.conf.default.secure_redirects: 0
|
||||
net.ipv6.conf.default.accept_redirects: 0
|
||||
net.ipv6.conf.all.accept_redirects: 0
|
||||
net.ipv4.conf.all.send_redirects: 0
|
||||
net.ipv4.conf.default.send_redirects: 0
|
||||
net.ipv4.conf.all.log_martians: 1
|
||||
net.ipv6.conf.default.router_solicitations: 0
|
||||
net.ipv6.conf.default.accept_ra_rtr_pref: 0
|
||||
net.ipv6.conf.default.accept_ra_pinfo: 0
|
||||
net.ipv6.conf.default.accept_ra_defrtr: 0
|
||||
net.ipv6.conf.default.autoconf: 0
|
||||
net.ipv6.conf.default.dad_transmits: 0
|
||||
net.ipv6.conf.default.max_addresses: 1
|
||||
kernel.sysrq: 0
|
||||
fs.suid_dumpable: 0
|
||||
kernel.randomize_va_space: 2
|
||||
|
||||
|
||||
- name: wrapper playbook for kitchen testing "ansible-os-hardening"
|
||||
hosts: localhost
|
||||
pre_tasks:
|
||||
- name: Run the equivalent of "apt-get update" as a separate step
|
||||
apt:
|
||||
update_cache: yes
|
||||
when: ansible_os_family == 'Debian'
|
||||
roles:
|
||||
- ansible-os-hardening
|
||||
|
||||
|
|
@ -27,7 +27,7 @@ os_security_suid_sgid_remove_from_unknown: false
|
|||
|
||||
# remove packages with known issues
|
||||
os_security_packages_clean: true
|
||||
os_security_packages_list: ['xinetd','inetd','ypserv','telnet-server','rsh-server', 'prelink']
|
||||
os_security_packages_list: ['xinetd', 'inetd', 'ypserv', 'telnet-server', 'rsh-server', 'prelink']
|
||||
|
||||
# Allow interactive startup (rhel, centos)
|
||||
os_security_init_prompt: true
|
||||
|
|
@ -175,17 +175,6 @@ sysctl_config:
|
|||
|
||||
kernel.core_uses_pid: 1
|
||||
|
||||
# When an attacker is trying to exploit the local kernel, it is often
|
||||
# helpful to be able to examine where in memory the kernel, modules,
|
||||
# and data structures live. As such, kernel addresses should be treated
|
||||
# as sensitive information.
|
||||
#
|
||||
# Many files and interfaces contain these addresses (e.g. /proc/kallsyms,
|
||||
# /proc/modules, etc), and this setting can censor the addresses. A value
|
||||
# of "0" allows all users to see the kernel addresses. A value of "1"
|
||||
# limits visibility to the root user, and "2" blocks even the root user.
|
||||
kernel.kptr_restrict: 1
|
||||
|
||||
# The PTRACE system is used for debugging. With it, a single user process
|
||||
# can attach to any other dumpable process owned by the same user. In the
|
||||
# case of malicious software, it is possible to use PTRACE to access
|
||||
|
|
@ -226,6 +215,33 @@ sysctl_config:
|
|||
fs.protected_hardlinks: 1
|
||||
fs.protected_symlinks: 1
|
||||
|
||||
# These settings are set to the maximum supported value in order to
|
||||
# improve ASLR effectiveness for mmap, at the cost of increased
|
||||
# address-space fragmentation. | Tail-1
|
||||
vm.mmap_rnd_bits: 32
|
||||
vm.mmap_rnd_compat_bits: 16
|
||||
|
||||
# When an attacker is trying to exploit the local kernel, it is often
|
||||
# helpful to be able to examine where in memory the kernel, modules,
|
||||
# and data structures live. As such, kernel addresses should be treated
|
||||
# as sensitive information.
|
||||
#
|
||||
# Many files and interfaces contain these addresses (e.g. /proc/kallsyms,
|
||||
# /proc/modules, etc), and this setting can censor the addresses. A value
|
||||
# of "0" allows all users to see the kernel addresses. A value of "1"
|
||||
# limits visibility to the root user, and "2" blocks even the root user.
|
||||
#
|
||||
# Some off-the-shelf malware exploit kernel addresses exposed
|
||||
# via /proc/kallsyms so by not making these addresses easily available
|
||||
# we increase the cost of such attack some what; now such malware has
|
||||
# to check which kernel Tails is running and then fetch the corresponding
|
||||
# kernel address map from some external source. This is not hard,
|
||||
# but certainly not all malware has such functionality. | Tails-2
|
||||
kernel.kptr_restrict: 2
|
||||
|
||||
# kexec is dangerous: it enables replacement of the running kernel. | Tails-3
|
||||
kernel.kexec_load_disabled: 1
|
||||
|
||||
# Do not delete the following line or otherwise the playbook will fail
|
||||
# at task 'create a combined sysctl-dict if overwrites are defined'
|
||||
sysctl_overwrite:
|
||||
|
|
@ -240,6 +256,12 @@ os_unused_filesystems:
|
|||
- "squashfs"
|
||||
- "udf"
|
||||
- "vfat"
|
||||
# Obsolete network protocols that should be disabled
|
||||
# per CIS Oracle Linux 6 Benchmark (2016)
|
||||
- "tipc" # CIS 3.5.4
|
||||
- "sctp" # CIS 3.5.2
|
||||
- "dccp" # CIS 3.5.1
|
||||
- "rds" # CIS 3.5.3
|
||||
|
||||
# whitelist for used filesystems
|
||||
os_filesystem_whitelist: []
|
||||
|
|
@ -250,3 +272,9 @@ os_hardening_enabled: true
|
|||
|
||||
# Set to false to disable installing and configuring auditd.
|
||||
os_auditd_enabled: true
|
||||
os_auditd_max_log_file_action: keep_logs
|
||||
|
||||
# Set the SELinux state, can be either disabled, permissive, or enforcing.
|
||||
os_selinux_state: enforcing
|
||||
# Set the SELinux polixy.
|
||||
os_selinux_policy: targeted
|
||||
|
|
|
|||
3
ansible/roles/dev-sec.os-hardening/handlers/main.yml
Normal file
3
ansible/roles/dev-sec.os-hardening/handlers/main.yml
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
---
|
||||
- name: update-initramfs
|
||||
command: 'update-initramfs -u'
|
||||
|
|
@ -1 +1,2 @@
|
|||
{install_date: 'Mon Dec 17 12:48:33 2018', version: 5.1.0}
|
||||
install_date: Fri May 15 20:29:23 2020
|
||||
version: 6.0.1
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
---
|
||||
galaxy_info:
|
||||
author: "Sebastian Gumprich"
|
||||
description: 'This Ansible role provides numerous security-related configurations, providing all-round base protection.'
|
||||
description: 'This role provides numerous security-related configurations, providing all-round base protection.'
|
||||
company: Hardening Framework Team
|
||||
license: Apache License 2.0
|
||||
min_ansible_version: '2.5'
|
||||
|
|
@ -10,17 +10,18 @@ galaxy_info:
|
|||
versions:
|
||||
- 6
|
||||
- 7
|
||||
- 8
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- precise
|
||||
- trusty
|
||||
- xenial
|
||||
- bionic
|
||||
- name: Debian
|
||||
versions:
|
||||
- wheezy
|
||||
- jessie
|
||||
- stretch
|
||||
- buster
|
||||
- name: Amazon
|
||||
- name: Fedora
|
||||
- name: openSUSE
|
||||
galaxy_tags:
|
||||
- system
|
||||
- security
|
||||
|
|
|
|||
|
|
@ -1,8 +1,6 @@
|
|||
---
|
||||
- name: remove deprecated or insecure packages | package-01 - package-09
|
||||
apt:
|
||||
name: '{{ item }}'
|
||||
name: '{{ os_security_packages_list }}'
|
||||
state: 'absent'
|
||||
with_items:
|
||||
- '{{ os_security_packages_list }}'
|
||||
when: 'os_security_packages_clean'
|
||||
when: os_security_packages_clean | bool
|
||||
|
|
|
|||
|
|
@ -1,12 +0,0 @@
|
|||
- name: find directories for minimizing access
|
||||
find:
|
||||
paths: '{{ outer_item }}'
|
||||
recurse: yes
|
||||
register: minimize_access_directories
|
||||
|
||||
- name: minimize access on found files
|
||||
file:
|
||||
path: '{{ item.path }}'
|
||||
mode: 'go-w'
|
||||
state: file
|
||||
with_items: '{{ minimize_access_directories.files }}'
|
||||
|
|
@ -1,21 +1,21 @@
|
|||
---
|
||||
- name: Set OS family dependent variables
|
||||
include_vars: '{{ ansible_os_family }}.yml'
|
||||
include_vars: '{{ ansible_facts.os_family }}.yml'
|
||||
tags: always
|
||||
|
||||
- name: Set OS dependent variables
|
||||
include_vars: '{{ item }}'
|
||||
with_first_found:
|
||||
- files:
|
||||
- '{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml'
|
||||
- '{{ ansible_distribution }}.yml'
|
||||
- '{{ ansible_os_family }}-{{ ansible_distribution_major_version }}.yml'
|
||||
- '{{ ansible_facts.distribution }}-{{ ansible_facts.distribution_major_version }}.yml'
|
||||
- '{{ ansible_facts.distribution }}.yml'
|
||||
- '{{ ansible_facts.os_family }}-{{ ansible_facts.distribution_major_version }}.yml'
|
||||
skip: true
|
||||
tags: always
|
||||
|
||||
- import_tasks: auditd.yml
|
||||
tags: auditd
|
||||
when: os_auditd_enabled
|
||||
when: os_auditd_enabled | bool
|
||||
|
||||
- import_tasks: limits.yml
|
||||
tags: limits
|
||||
|
|
@ -39,7 +39,7 @@
|
|||
tags: securetty
|
||||
|
||||
- import_tasks: suid_sgid.yml
|
||||
when: os_security_suid_sgid_enforce
|
||||
when: os_security_suid_sgid_enforce | bool
|
||||
tags: suid_sgid
|
||||
|
||||
- import_tasks: sysctl.yml
|
||||
|
|
@ -52,9 +52,14 @@
|
|||
tags: rhosts
|
||||
|
||||
- import_tasks: yum.yml
|
||||
when: ansible_os_family == 'RedHat'
|
||||
when: ansible_facts.os_family == 'RedHat'
|
||||
tags: yum
|
||||
|
||||
- import_tasks: apt.yml
|
||||
when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
|
||||
when: ansible_facts.distribution == 'Debian' or ansible_facts.distribution == 'Ubuntu'
|
||||
tags: apt
|
||||
|
||||
- import_tasks: selinux.yml
|
||||
tags: selinux
|
||||
when:
|
||||
- ansible_facts.selinux.status == 'enabled'
|
||||
|
|
|
|||
|
|
@ -9,14 +9,14 @@
|
|||
mode: '0755'
|
||||
state: 'directory'
|
||||
|
||||
- name: create aditional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
|
||||
- name: create additional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
|
||||
pam_limits:
|
||||
dest: '/etc/security/limits.d/10.hardcore.conf'
|
||||
domain: '*'
|
||||
limit_type: hard
|
||||
limit_item: core
|
||||
value: 0
|
||||
comment: Prevent core dumps for all users. These are usually only needed by developers and may contain sensitive information
|
||||
value: '0'
|
||||
comment: Prevent core dumps for all users. These are usually not needed and may contain sensitive information
|
||||
|
||||
- name: set 10.hardcore.conf perms to 0400 and root ownership
|
||||
file:
|
||||
|
|
@ -25,10 +25,10 @@
|
|||
group: 'root'
|
||||
mode: '0440'
|
||||
|
||||
when: 'not os_security_kernel_enable_core_dump'
|
||||
when: not os_security_kernel_enable_core_dump | bool
|
||||
|
||||
- name: remove 10.hardcore.conf config file
|
||||
file:
|
||||
path: /etc/security/limits.d/10.hardcore.conf
|
||||
state: absent
|
||||
when: 'os_security_kernel_enable_core_dump'
|
||||
when: os_security_kernel_enable_core_dump | bool
|
||||
|
|
|
|||
|
|
@ -6,4 +6,3 @@
|
|||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: '0444'
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
---
|
||||
|
||||
- include_tasks: hardening.yml
|
||||
when: os_hardening_enabled
|
||||
- import_tasks: hardening.yml
|
||||
when: os_hardening_enabled | bool
|
||||
|
|
|
|||
|
|
@ -1,16 +1,31 @@
|
|||
---
|
||||
# Using a two-pass approach for checking directories in order to support symlinks.
|
||||
- include_tasks: find_files.yml
|
||||
loop_control:
|
||||
loop_var: outer_item
|
||||
loop:
|
||||
# If the find-task throws an error on /usr/bin/X11 like "File system loop detected"
|
||||
# the other files inside /usr/bin (and all other directories) are
|
||||
# still getting found and the permissions minimized in the next task.
|
||||
# This is also the reason why there's ignore_errors: true on the task.
|
||||
# also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
|
||||
- name: find files with write-permissions for group
|
||||
shell: "find -L {{ item }} -perm /go+w -type f" # noqa 305
|
||||
with_flattened:
|
||||
- '/usr/local/sbin'
|
||||
- '/usr/local/bin'
|
||||
- '/usr/sbin'
|
||||
- '/usr/bin'
|
||||
- '/sbin'
|
||||
- '/bin'
|
||||
- '{{ os_env_extra_user_paths }}'
|
||||
- "{{ os_env_extra_user_paths }}" # noqa 104
|
||||
register: minimize_access_directories
|
||||
ignore_errors: true
|
||||
changed_when: false
|
||||
|
||||
- name: minimize access on found files
|
||||
file:
|
||||
path: '{{ item.1 }}'
|
||||
mode: 'go-w'
|
||||
state: file
|
||||
with_subelements:
|
||||
- "{{ minimize_access_directories.results }}"
|
||||
- stdout_lines
|
||||
|
||||
- name: change shadow ownership to root and mode to 0600 | os-02
|
||||
file:
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
---
|
||||
- name: install modprobe to disable filesystems | os-10
|
||||
package:
|
||||
name: '{{modprobe_package}}'
|
||||
name: '{{ modprobe_package }}'
|
||||
state: 'present'
|
||||
|
||||
- name: check if efi is installed
|
||||
|
|
@ -20,5 +20,4 @@
|
|||
dest: '/etc/modprobe.d/dev-sec.conf'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: '0640'
|
||||
|
||||
mode: '0644'
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
---
|
||||
- name: update pam on Debian systems
|
||||
command: 'pam-auth-update --package'
|
||||
when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
|
||||
when: ansible_facts.distribution in ['Debian', 'Ubuntu']
|
||||
changed_when: False
|
||||
environment:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
|
|
@ -19,14 +19,18 @@
|
|||
apt:
|
||||
name: '{{ os_packages_pam_cracklib }}'
|
||||
state: 'absent'
|
||||
when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and os_auth_pam_passwdqc_enable
|
||||
when:
|
||||
- ansible_facts.distribution in ['Debian', 'Ubuntu']
|
||||
- os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: install the package for strong password checking
|
||||
apt:
|
||||
name: '{{ os_packages_pam_passwdqc }}'
|
||||
state: 'present'
|
||||
update_cache: 'yes'
|
||||
when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and os_auth_pam_passwdqc_enable
|
||||
when:
|
||||
- ansible_facts.distribution in ['Debian', 'Ubuntu']
|
||||
- os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: configure passwdqc
|
||||
template:
|
||||
|
|
@ -35,19 +39,26 @@
|
|||
mode: '0644'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and os_auth_pam_passwdqc_enable
|
||||
when:
|
||||
- ansible_facts.distribution in ['Debian', 'Ubuntu']
|
||||
- os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: remove passwdqc
|
||||
apt:
|
||||
name: '{{ os_packages_pam_passwdqc }}'
|
||||
state: 'absent'
|
||||
when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable
|
||||
when:
|
||||
- ansible_facts.distribution in ['Debian', 'Ubuntu']
|
||||
- not os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: install tally2
|
||||
apt:
|
||||
name: 'libpam-modules'
|
||||
state: 'present'
|
||||
when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable and os_auth_retries > 0
|
||||
when:
|
||||
- ansible_facts.distribution in ['Debian', 'Ubuntu']
|
||||
- not os_auth_pam_passwdqc_enable
|
||||
- os_auth_retries > 0
|
||||
|
||||
- name: configure tally2
|
||||
template:
|
||||
|
|
@ -56,31 +67,47 @@
|
|||
mode: '0644'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable and os_auth_retries > 0
|
||||
when:
|
||||
- ansible_facts.distribution in ['Debian', 'Ubuntu']
|
||||
- not os_auth_pam_passwdqc_enable
|
||||
- os_auth_retries > 0
|
||||
|
||||
- name: delete tally2 when retries is 0
|
||||
file:
|
||||
path: '{{ tally2_path }}'
|
||||
state: 'absent'
|
||||
when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable and os_auth_retries == 0
|
||||
when:
|
||||
- ansible_facts.distribution in ['Debian', 'Ubuntu']
|
||||
- not os_auth_pam_passwdqc_enable
|
||||
- os_auth_retries == 0
|
||||
|
||||
- name: remove pam_cracklib, because it does not play nice with passwdqc
|
||||
yum:
|
||||
name: '{{ os_packages_pam_cracklib }}'
|
||||
state: 'absent'
|
||||
when: (ansible_os_family == 'RedHat' and ansible_distribution_version < '7' and not ansible_distribution == 'Amazon') and os_auth_pam_passwdqc_enable
|
||||
when:
|
||||
- ansible_facts.os_family == 'RedHat'
|
||||
- ansible_facts.distribution_major_version|int is version('7', '<')
|
||||
- ansible_facts.distribution != 'Amazon'
|
||||
- os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: install the package for strong password checking
|
||||
yum:
|
||||
name: '{{ os_packages_pam_passwdqc }}'
|
||||
state: 'present'
|
||||
when: (ansible_os_family == 'RedHat' and ansible_distribution_version < '7' and not ansible_distribution == 'Amazon') and os_auth_pam_passwdqc_enable
|
||||
when:
|
||||
- ansible_facts.os_family == 'RedHat'
|
||||
- ansible_facts.distribution_major_version|int is version('7', '<')
|
||||
- ansible_facts.distribution != 'Amazon'
|
||||
- os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: remove passwdqc
|
||||
yum:
|
||||
name: '{{ os_packages_pam_passwdqc }}'
|
||||
state: 'absent'
|
||||
when: ansible_os_family == 'RedHat' and not os_auth_pam_passwdqc_enable
|
||||
when:
|
||||
- ansible_facts.os_family == 'RedHat'
|
||||
- not os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: configure passwdqc and tally via central system-auth confic
|
||||
template:
|
||||
|
|
@ -89,11 +116,17 @@
|
|||
mode: '0640'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
when: ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: Gather package facts
|
||||
package_facts:
|
||||
manager: auto
|
||||
|
||||
- name: NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
|
||||
template:
|
||||
src: 'etc/rhel_libuser.conf.j2'
|
||||
src: 'etc/libuser.conf.j2'
|
||||
dest: '/etc/libuser.conf'
|
||||
mode: '0640'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
when: "'libuser' in ansible_facts.packages"
|
||||
|
|
|
|||
|
|
@ -6,10 +6,10 @@
|
|||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: '0750'
|
||||
when: not os_security_kernel_enable_core_dump
|
||||
when: not os_security_kernel_enable_core_dump | bool
|
||||
|
||||
- name: remove pinerolo_profile.sh from profile.d
|
||||
file:
|
||||
path: /etc/profile.d/pinerolo_profile.sh
|
||||
state: absent
|
||||
when: os_security_kernel_enable_core_dump
|
||||
when: os_security_kernel_enable_core_dump | bool
|
||||
|
|
|
|||
|
|
@ -3,13 +3,13 @@
|
|||
command: "awk -F: '{print $1}' /etc/passwd"
|
||||
changed_when: False
|
||||
check_mode: False
|
||||
register: users
|
||||
register: users_accounts
|
||||
|
||||
- name: delete rhosts-files from system | os-09
|
||||
file:
|
||||
dest: '~{{ item }}/.rhosts'
|
||||
state: 'absent'
|
||||
with_flattened: '{{ users.stdout_lines | default([]) }}'
|
||||
with_flattened: '{{ users_accounts.stdout_lines | default([]) }}'
|
||||
|
||||
- name: delete hosts.equiv from system | os-01
|
||||
file:
|
||||
|
|
@ -20,4 +20,4 @@
|
|||
file:
|
||||
dest: '~{{ item }}/.netrc'
|
||||
state: 'absent'
|
||||
with_flattened: '{{ users.stdout_lines | default([]) }}'
|
||||
with_flattened: '{{ users_accounts.stdout_lines | default([]) }}'
|
||||
|
|
|
|||
5
ansible/roles/dev-sec.os-hardening/tasks/selinux.yml
Normal file
5
ansible/roles/dev-sec.os-hardening/tasks/selinux.yml
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
---
|
||||
- name: configure selinux | selinux-01
|
||||
selinux:
|
||||
policy: "{{ os_selinux_policy }}"
|
||||
state: "{{ os_selinux_state }}"
|
||||
|
|
@ -13,13 +13,13 @@
|
|||
- name: find binaries with suid/sgid set | os-06
|
||||
shell: find / -xdev \( -perm -4000 -o -perm -2000 \) -type f ! -path '/proc/*' -print 2>/dev/null
|
||||
register: sbit_binaries
|
||||
when: os_security_suid_sgid_remove_from_unknown
|
||||
when: os_security_suid_sgid_remove_from_unknown | bool
|
||||
changed_when: False
|
||||
|
||||
- name: gather files from which to remove suids/sgids and remove system white-listed files | os-06
|
||||
set_fact:
|
||||
suid: '{{ sbit_binaries.stdout_lines | difference(os_security_suid_sgid_system_whitelist) }}'
|
||||
when: os_security_suid_sgid_remove_from_unknown
|
||||
when: os_security_suid_sgid_remove_from_unknown | bool
|
||||
|
||||
- name: remove suid/sgid bit from all binaries except in system and user whitelist | os-06
|
||||
file:
|
||||
|
|
@ -29,4 +29,4 @@
|
|||
follow: 'yes'
|
||||
with_flattened:
|
||||
- '{{ suid | default([]) | difference(os_security_suid_sgid_whitelist) }}'
|
||||
when: os_security_suid_sgid_remove_from_unknown
|
||||
when: os_security_suid_sgid_remove_from_unknown | bool
|
||||
|
|
|
|||
|
|
@ -13,14 +13,15 @@
|
|||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: '0544'
|
||||
when: ansible_distribution == 'RedHat' or ansible_distribution == 'Fedora' or ansible_distribution == 'CentOS' or ansible_distribution == 'Amazon'
|
||||
when: ansible_facts.distribution == 'RedHat' or ansible_facts.distribution == 'Fedora' or
|
||||
ansible_facts.distribution == 'CentOS' or ansible_facts.distribution == 'Amazon'
|
||||
|
||||
- name: install initramfs-tools
|
||||
apt:
|
||||
name: 'initramfs-tools'
|
||||
state: 'present'
|
||||
update_cache: true
|
||||
when: ansible_os_family == 'Debian' and os_security_kernel_enable_module_loading
|
||||
when: ansible_facts.os_family == 'Debian' and os_security_kernel_enable_module_loading
|
||||
|
||||
- name: rebuild initramfs with starting pack of modules, if module loading at runtime is disabled
|
||||
template:
|
||||
|
|
@ -29,41 +30,44 @@
|
|||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: '0440'
|
||||
when: ansible_os_family == 'Debian' and os_security_kernel_enable_module_loading
|
||||
notify:
|
||||
- update-initramfs
|
||||
when: ansible_facts.os_family == 'Debian' and os_security_kernel_enable_module_loading
|
||||
register: initramfs
|
||||
|
||||
- name: update-initramfs
|
||||
command: 'update-initramfs -u'
|
||||
when: initramfs.changed
|
||||
- name: change sysctls
|
||||
block:
|
||||
- name: create a combined sysctl-dict if overwrites are defined
|
||||
set_fact:
|
||||
sysctl_config: '{{ sysctl_config | combine(sysctl_overwrite) }}'
|
||||
when: sysctl_overwrite | default()
|
||||
|
||||
- name: create a combined sysctl-dict if overwrites are defined
|
||||
set_fact:
|
||||
sysctl_config: '{{ sysctl_config | combine(sysctl_overwrite) }}'
|
||||
when: sysctl_overwrite | default()
|
||||
- name: Change various sysctl-settings, look at the sysctl-vars file for documentation
|
||||
sysctl:
|
||||
name: '{{ item.key }}'
|
||||
value: '{{ item.value }}'
|
||||
sysctl_set: yes
|
||||
state: present
|
||||
reload: yes
|
||||
ignoreerrors: yes
|
||||
with_dict: '{{ sysctl_config }}'
|
||||
|
||||
- name: Change various sysctl-settings, look at the sysctl-vars file for documentation
|
||||
sysctl:
|
||||
name: '{{ item.key }}'
|
||||
value: '{{ item.value }}'
|
||||
sysctl_set: yes
|
||||
state: present
|
||||
reload: yes
|
||||
ignoreerrors: yes
|
||||
with_dict: '{{ sysctl_config }}'
|
||||
- name: Change various sysctl-settings on rhel6-hosts or older, look at the sysctl-vars file for documentation
|
||||
sysctl:
|
||||
name: '{{ item.key }}'
|
||||
value: '{{ item.value }}'
|
||||
state: present
|
||||
reload: yes
|
||||
ignoreerrors: yes
|
||||
with_dict: '{{ sysctl_rhel_config }}'
|
||||
when: ((ansible_facts.distribution == 'RedHat' or ansible_facts.distribution == 'Fedora' or ansible_facts.distribution == 'CentOS') and
|
||||
ansible_distribution_version|int is version('7', '<')) or ansible_facts.distribution == 'Amazon'
|
||||
|
||||
- name: Change various sysctl-settings on rhel6-hosts or older, look at the sysctl-vars file for documentation
|
||||
sysctl:
|
||||
name: '{{ item.key }}'
|
||||
value: '{{ item.value }}'
|
||||
state: present
|
||||
reload: yes
|
||||
ignoreerrors: yes
|
||||
with_dict: '{{ sysctl_rhel_config }}'
|
||||
when: ((ansible_distribution == 'RedHat' or ansible_distribution == 'Fedora' or ansible_distribution == 'CentOS') and ansible_distribution_major_version < '7') or ansible_distribution == 'Amazon'
|
||||
when: ansible_virtualization_type not in ['docker', 'openvz', 'lxc']
|
||||
|
||||
- name: Apply ufw defaults
|
||||
template:
|
||||
src: 'etc/default/ufw.j2'
|
||||
dest: '/etc/default/ufw'
|
||||
when: ufw_manage_defaults and (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu')
|
||||
when: ufw_manage_defaults and (ansible_facts.distribution == 'Debian' or ansible_facts.distribution == 'Ubuntu')
|
||||
tags: ufw
|
||||
|
|
|
|||
|
|
@ -10,17 +10,19 @@
|
|||
- name: calculate UID_MAX from UID_MIN by substracting 1
|
||||
set_fact:
|
||||
uid_max: '{{ uid_min.stdout | int - 1 }}'
|
||||
when: uid_min is defined
|
||||
when: uid_min.stdout|int > 0
|
||||
|
||||
- name: set UID_MAX on Debian-systems if no login.defs exist
|
||||
set_fact:
|
||||
uid_max: '999'
|
||||
when: ansible_os_family == 'Debian' and not uid_min
|
||||
when:
|
||||
- ansible_facts.os_family == 'Debian'
|
||||
- uid_max is not defined
|
||||
|
||||
- name: set UID_MAX on other systems if no login.defs exist
|
||||
set_fact:
|
||||
uid_max: '499'
|
||||
when: not uid_min
|
||||
when: uid_max is not defined
|
||||
|
||||
- name: get all system accounts
|
||||
command: awk -F'':'' '{ if ( $3 <= {{ uid_max|quote }} ) print $1}' /etc/passwd
|
||||
|
|
|
|||
|
|
@ -7,41 +7,35 @@
|
|||
- 'CentOS-Debuginfo'
|
||||
- 'CentOS-Media'
|
||||
- 'CentOS-Vault'
|
||||
when: os_security_packages_clean
|
||||
when: os_security_packages_clean | bool
|
||||
|
||||
- name: get yum-repository-files
|
||||
shell: 'find /etc/yum.repos.d/ -type f -name *.repo'
|
||||
changed_when: False
|
||||
register: yum_repos
|
||||
|
||||
- name: check if rhnplugin.conf exists
|
||||
stat:
|
||||
path: '/etc/yum/pluginconf.d/rhnplugin.conf'
|
||||
register: rhnplugin_file
|
||||
|
||||
# for the 'default([])' see here:
|
||||
# https://github.com/dev-sec/ansible-os-hardening/issues/99 and
|
||||
# https://stackoverflow.com/questions/37067827/ansible-deprecation-warning-for-undefined-variable-despite-when-clause
|
||||
- name: activate gpg-check for yum-repos
|
||||
#
|
||||
# failed_when is needed because by default replace module will fail if the file doesn't exists.
|
||||
# status.rc is only defined if an error accrued and only error code (rc) 257 will be ignored.
|
||||
# All other errors will still be raised.
|
||||
- name: activate gpg-check for config files
|
||||
replace:
|
||||
dest: '{{ item }}'
|
||||
regexp: '^\s*gpgcheck: 0'
|
||||
replace: 'gpgcheck: 1'
|
||||
register: status
|
||||
failed_when: status.rc is defined and status.rc != 257
|
||||
with_flattened:
|
||||
- '/etc/yum.conf'
|
||||
- '{{ yum_repos.stdout_lines| default([]) }}'
|
||||
|
||||
- name: activate gpg-check for yum rhn if it exists
|
||||
replace:
|
||||
dest: '/etc/yum/pluginconf.d/rhnplugin.conf'
|
||||
regexp: '^\s*gpgcheck: 0'
|
||||
replace: 'gpgcheck: 1'
|
||||
when: rhnplugin_file.stat.exists
|
||||
- '/etc/dnf/dnf.conf'
|
||||
- '{{ yum_repos.stdout_lines| default([]) }}' # noqa 104
|
||||
- '/etc/yum/pluginconf.d/rhnplugin.conf'
|
||||
|
||||
- name: remove deprecated or insecure packages | package-01 - package-09
|
||||
yum:
|
||||
name: '{{ item }}'
|
||||
name: '{{ os_security_packages_list }}'
|
||||
state: 'absent'
|
||||
with_items:
|
||||
- '{{ os_security_packages_list }}'
|
||||
when: os_security_packages_clean
|
||||
when: os_security_packages_clean | bool
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
{{ ansible_managed | comment }}
|
||||
|
||||
log_file = /var/log/audit/audit.log
|
||||
log_format = RAW
|
||||
log_group = root
|
||||
|
|
@ -10,7 +12,7 @@ dispatcher = /sbin/audispd
|
|||
name_format = NONE
|
||||
##name = mydomain
|
||||
max_log_file = 6
|
||||
max_log_file_action = keep_logs
|
||||
max_log_file_action = {{ os_auditd_max_log_file_action }}
|
||||
space_left = 75
|
||||
space_left_action = SYSLOG
|
||||
action_mail_acct = root
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
# {{ ansible_managed | comment }}
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
# /etc/default/ufw
|
||||
#
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
# {{ ansible_managed | comment }}
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
# This file contains the names of kernel modules that should be loaded at boot time, one per line. Lines beginning with "#" are ignored.
|
||||
#
|
||||
# A list of all available kernel modules kann be found with `find /lib/modules/$(uname -r)/kernel/`
|
||||
|
|
@ -10,7 +11,7 @@
|
|||
#
|
||||
# Modules for certains builds, contains support modules and some CPU-specific optimizations.
|
||||
|
||||
{% if ansible_architecture == 'x86_64' %}
|
||||
{% if ansible_facts.architecture == 'x86_64' %}
|
||||
# Optimize for x86_64 cryptographic features
|
||||
twofish-x86_64-3way
|
||||
twofish-x86_64
|
||||
|
|
@ -19,7 +20,7 @@ salsa20-x86_64
|
|||
blowfish-x86_64
|
||||
{% endif %}
|
||||
|
||||
{% if 'amd' in ansible_processor %}
|
||||
{% if 'amd' in ansible_facts.processor %}
|
||||
# AMD-specific optimizations
|
||||
kvm-amd
|
||||
{% else %}
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# See libuser.conf(5) for more information.
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
# {{ ansible_managed | comment }}
|
||||
# See libuser.conf(5) for more information.
|
||||
|
||||
# Do not modify the default module list if you care about unattended calls
|
||||
# to programs (i.e., scripts) working!
|
||||
|
|
@ -1,4 +1,5 @@
|
|||
# {{ ansible_managed | comment }}
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
# Configuration control definitions for the login package.
|
||||
#
|
||||
# Three items must be defined: `MAIL_DIR`, `ENV_SUPATH`, and `ENV_PATH`. If unspecified, some arbitrary (and possibly incorrect) value will be assumed. All other items are optional - if not specified then the described action or option will be inhibited.
|
||||
|
|
@ -7,6 +8,7 @@
|
|||
#
|
||||
#-- Modified for Linux. --marekm
|
||||
|
||||
{% if os_useradd_mail_dir is defined %}
|
||||
# *REQUIRED for useradd/userdel/usermod*
|
||||
#
|
||||
# Directory where mailboxes reside, _or_ name of file, relative to the home directory. If you _do_ define `MAIL_DIR` and `MAIL_FILE`, `MAIL_DIR` takes precedence.
|
||||
|
|
@ -19,136 +21,141 @@
|
|||
#
|
||||
# See default PAM configuration files provided for login, su, etc.
|
||||
# This is a temporary situation: setting these variables will soon move to `/etc/default/useradd` and the variables will then be no more supported
|
||||
MAIL_DIR /var/mail
|
||||
#MAIL_FILE .mail
|
||||
MAIL_DIR {{ os_useradd_mail_dir }}
|
||||
{% endif %}
|
||||
|
||||
{% if os_useradd_create_home is defined %}
|
||||
# If useradd should create home directories for users by default
|
||||
CREATE_HOME {{ 'yes' if os_useradd_create_home else 'no' }}
|
||||
|
||||
{% endif %}
|
||||
# Enable logging and display of `/var/log/faillog` login failure info. This option conflicts with the `pam_tally` PAM module.
|
||||
FAILLOG_ENAB yes
|
||||
FAILLOG_ENAB yes
|
||||
|
||||
# Enable display of unknown usernames when login failures are recorded.
|
||||
#
|
||||
# *WARNING*: Unknown usernames may become world readable. See #290803 and #298773 for details about how this could become a security concern
|
||||
LOG_UNKFAIL_ENAB no
|
||||
LOG_UNKFAIL_ENAB no
|
||||
|
||||
# Enable logging of successful logins
|
||||
LOG_OK_LOGINS yes
|
||||
LOG_OK_LOGINS yes
|
||||
|
||||
# Enable "syslog" logging of su activity - in addition to sulog file logging.
|
||||
SYSLOG_SU_ENAB yes
|
||||
SYSLOG_SU_ENAB yes
|
||||
|
||||
# Enable "syslog" logging of newgrp and sg.
|
||||
SYSLOG_SG_ENAB yes
|
||||
SYSLOG_SG_ENAB yes
|
||||
|
||||
# If defined, all su activity is logged to this file.
|
||||
#SULOG_FILE /var/log/sulog
|
||||
#SULOG_FILE /var/log/sulog
|
||||
|
||||
# If defined, file which maps tty line to `TERM` environment parameter. Each line of the file is in a format something like "vt100 tty01".
|
||||
#TTYTYPE_FILE /etc/ttytype
|
||||
#TTYTYPE_FILE /etc/ttytype
|
||||
|
||||
# If defined, login failures will be logged here in a utmp format last, when invoked as lastb, will read `/var/log/btmp`, so...
|
||||
FTMP_FILE /var/log/btmp
|
||||
FTMP_FILE /var/log/btmp
|
||||
|
||||
# If defined, the command name to display when running "su -". For # example, if this is defined as "su" then a "ps" will display the command is "-su". If not defined, then "ps" would display the name of the shell actually being run, e.g. something like "-sh".
|
||||
SU_NAME su
|
||||
SU_NAME su
|
||||
|
||||
# If defined, file which inhibits all the usual chatter during the login sequence. If a full pathname, then hushed mode will be enabled if the user's name or shell are found in the file. If not a full pathname, then hushed mode will be enabled if the file exists in the user's home directory.
|
||||
#HUSHLOGIN_FILE /etc/hushlogins
|
||||
HUSHLOGIN_FILE .hushlogin
|
||||
#HUSHLOGIN_FILE /etc/hushlogins
|
||||
HUSHLOGIN_FILE .hushlogin
|
||||
|
||||
# *REQUIRED*: The default PATH settings, for superuser and normal users. (they are minimal, add the rest in the shell startup files)
|
||||
ENV_SUPATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
ENV_PATH PATH=/usr/local/bin:/usr/bin:/bin{{ os_env_extra_user_paths| join (':') }}
|
||||
ENV_SUPATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
ENV_PATH PATH=/usr/local/bin:/usr/bin:/bin:{{ os_env_extra_user_paths | join (':') }}
|
||||
|
||||
# Terminal permissions
|
||||
# --------------------
|
||||
|
||||
# Login tty will be assigned this group ownership.
|
||||
# If you have a "write" program which is "setgid" to a special group which owns the terminals, define `TTYGROUP` to the group number and `TTYPERM` to `0620`. Otherwise leave `TTYGROUP` commented out and assign `TTYPERM` to either `622` or `600`.
|
||||
TTYGROUP tty
|
||||
TTYGROUP tty
|
||||
|
||||
# Login tty will be set to this permission.
|
||||
# In Debian `/usr/bin/bsd-write` or similar programs are setgid tty. However, the default and recommended value for `TTYPERM` is still `0600` to not allow anyone to write to anyone else console or terminal
|
||||
# Users can still allow other people to write them by issuing the `mesg y` command.
|
||||
TTYPERM 0600
|
||||
TTYPERM 0600
|
||||
|
||||
# Login conf initializations
|
||||
# --------------------------
|
||||
|
||||
# Terminal ERASE character ('\010' = backspace). Only used on System V.
|
||||
ERASECHAR 0177
|
||||
ERASECHAR 0177
|
||||
|
||||
# Terminal KILL character ('\025' = CTRL/U). Only used on System V.
|
||||
KILLCHAR 025
|
||||
KILLCHAR 025
|
||||
|
||||
# The default umask value for `pam_umask` and is used by useradd and newusers to set the mode of the new home directories.
|
||||
# If `USERGROUPS_ENAB` is set to `yes`, that will modify this `UMASK` default value for private user groups, i. e. the uid is the same as gid, and username is the same as the primary group name: for these, the user permissions will be used as group permissions, e. g. `022` will become `002`.
|
||||
# Prefix these values with `0` to get octal, `0x` to get hexadecimal.
|
||||
# `022` is the "historical" value in Debian for UMASK
|
||||
# `027`, or even `077`, could be considered better for privacy.
|
||||
UMASK {{ os_env_umask }}
|
||||
UMASK {{ os_env_umask }}
|
||||
|
||||
# Enable setting of the umask group bits to be the same as owner bits (examples: `022` -> `002`, `077` -> `007`) for non-root users, if the uid is the same as gid, and username is the same as the primary group name.
|
||||
# If set to yes, userdel will remove the user´s group if it contains no more members, and useradd will create by default a group with the name of the user.
|
||||
USERGROUPS_ENAB yes
|
||||
USERGROUPS_ENAB yes
|
||||
|
||||
|
||||
# Password aging controls
|
||||
# -----------------------
|
||||
|
||||
# Maximum number of days a password may be used.
|
||||
PASS_MAX_DAYS {{ os_auth_pw_max_age }}
|
||||
PASS_MAX_DAYS {{ os_auth_pw_max_age }}
|
||||
|
||||
# Minimum number of days allowed between password changes.
|
||||
PASS_MIN_DAYS {{ os_auth_pw_min_age }}
|
||||
PASS_MIN_DAYS {{ os_auth_pw_min_age }}
|
||||
|
||||
# Number of days warning given before a password expires.
|
||||
PASS_WARN_AGE 7
|
||||
PASS_WARN_AGE 7
|
||||
|
||||
# Min/max values for automatic uid selection in useradd
|
||||
UID_MIN {{ os_auth_uid_min }}
|
||||
UID_MAX 60000
|
||||
UID_MIN {{ os_auth_uid_min }}
|
||||
UID_MAX 60000
|
||||
# System accounts
|
||||
SYS_UID_MIN {{ os_auth_sys_uid_min }}
|
||||
SYS_UID_MAX {{ os_auth_sys_uid_max }}
|
||||
SYS_UID_MIN {{ os_auth_sys_uid_min }}
|
||||
SYS_UID_MAX {{ os_auth_sys_uid_max }}
|
||||
|
||||
# Min/max values for automatic gid selection in groupadd
|
||||
GID_MIN {{ os_auth_gid_min }}
|
||||
GID_MAX 60000
|
||||
GID_MIN {{ os_auth_gid_min }}
|
||||
GID_MAX 60000
|
||||
# System accounts
|
||||
SYS_GID_MIN {{ os_auth_sys_gid_min }}
|
||||
SYS_GID_MAX {{ os_auth_sys_gid_max }}
|
||||
SYS_GID_MIN {{ os_auth_sys_gid_min }}
|
||||
SYS_GID_MAX {{ os_auth_sys_gid_max }}
|
||||
|
||||
# Max number of login retries if password is bad. This will most likely be overriden by PAM, since the default pam_unix module has it's own built in of 3 retries. However, this is a safe fallback in case you are using an authentication module that does not enforce PAM_MAXTRIES.
|
||||
LOGIN_RETRIES {{ os_auth_retries }}
|
||||
LOGIN_RETRIES {{ os_auth_retries }}
|
||||
|
||||
# Max time in seconds for login
|
||||
LOGIN_TIMEOUT {{ os_auth_timeout }}
|
||||
LOGIN_TIMEOUT {{ os_auth_timeout }}
|
||||
|
||||
# Which fields may be changed by regular users using chfn - use any combination of letters "frwh" (full name, room number, work phone, home phone). If not defined, no changes are allowed.
|
||||
# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
|
||||
{% if os_chfn_restrict %}
|
||||
CHFN_RESTRICT {{ os_chfn_restrict }}
|
||||
CHFN_RESTRICT {{ os_chfn_restrict }}
|
||||
{% endif %}
|
||||
# Should login be allowed if we can't cd to the home directory?
|
||||
DEFAULT_HOME {{ 'yes' if os_auth_allow_homeless else 'no' }}
|
||||
DEFAULT_HOME {{ 'yes' if os_auth_allow_homeless else 'no' }}
|
||||
|
||||
# If defined, this command is run when removing a user.
|
||||
# It should remove any at/cron/print jobs etc. owned by
|
||||
# the user to be removed (passed as the first argument).
|
||||
#USERDEL_CMD /usr/sbin/userdel_local
|
||||
#USERDEL_CMD /usr/sbin/userdel_local
|
||||
|
||||
# Instead of the real user shell, the program specified by this parameter will be launched, although its visible name (`argv[0]`) will be the shell's. The program may do whatever it wants (logging, additional authentification, banner, ...) before running the actual shell.
|
||||
#FAKE_SHELL /bin/fakeshell
|
||||
#FAKE_SHELL /bin/fakeshell
|
||||
|
||||
# If defined, either full pathname of a file containing device names or a ":" delimited list of device names. Root logins will be allowed only upon these devices.
|
||||
# This variable is used by login and su.
|
||||
#CONSOLE /etc/consoles
|
||||
#CONSOLE console:tty01:tty02:tty03:tty04
|
||||
#CONSOLE /etc/consoles
|
||||
#CONSOLE console:tty01:tty02:tty03:tty04
|
||||
|
||||
# List of groups to add to the user's supplementary group set when logging in on the console (as determined by the `CONSOLE` setting). Default is none.
|
||||
# Use with caution - it is possible for users to gain permanent access to these groups, even when not logged in on the console. How to do it is left as an exercise for the reader...
|
||||
# This variable is used by login and su.
|
||||
#CONSOLE_GROUPS floppy:audio:cdrom
|
||||
#CONSOLE_GROUPS floppy:audio:cdrom
|
||||
|
||||
# If set to `MD5`, MD5-based algorithm will be used for encrypting password
|
||||
# If set to `SHA256`, SHA256-based algorithm will be used for encrypting password
|
||||
|
|
@ -158,15 +165,15 @@ DEFAULT_HOME {{ 'yes' if os_auth_allow_homeless else 'no' }}
|
|||
#
|
||||
# Note: It is recommended to use a value consistent with
|
||||
# the PAM modules configuration.
|
||||
MD5_CRYPT_ENAB no
|
||||
ENCRYPT_METHOD SHA512
|
||||
MD5_CRYPT_ENAB no
|
||||
ENCRYPT_METHOD SHA512
|
||||
|
||||
# Only used if `ENCRYPT_METHOD` is set to `SHA256` or `SHA512`: Define the number of SHA rounds.
|
||||
# With a lot of rounds, it is more difficult to brute forcing the password. But note also that it more CPU resources will be needed to authenticate users.
|
||||
# If not specified, the libc will choose the default number of rounds (5000). The values must be inside the 1000-999999999 range. If only one of the MIN or MAX values is set, then this value will be used.
|
||||
# If MIN > MAX, the highest value will be used.
|
||||
#SHA_CRYPT_MIN_ROUNDS 5000
|
||||
#SHA_CRYPT_MAX_ROUNDS 5000
|
||||
#SHA_CRYPT_MIN_ROUNDS 5000
|
||||
#SHA_CRYPT_MAX_ROUNDS 5000
|
||||
|
||||
|
||||
# Obsoleted by PAM
|
||||
|
|
@ -207,5 +214,3 @@ ENCRYPT_METHOD SHA512
|
|||
# This variable is deprecated. You should use ENCRYPT_METHOD.
|
||||
#
|
||||
#MD5_CRYPT_ENAB no
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# {{ ansible_managed | comment }}
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
#%PAM-1.0
|
||||
{% if os_auth_retries > 0 %}
|
||||
|
|
@ -18,7 +18,7 @@ account sufficient pam_succeed_if.so uid < 500 quiet
|
|||
account required pam_permit.so
|
||||
|
||||
{% if (os_auth_pam_passwdqc_enable|bool) %}
|
||||
{%- if ((ansible_os_family == 'RedHat' and ansible_distribution_version >= '7') or ansible_distribution == 'Amazon') %}
|
||||
{%- if ((ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_version|int is version('7', '>=')) or ansible_facts.distribution == 'Amazon') %}
|
||||
password required pam_pwquality.so {{ os_auth_pam_pwquality_options }}
|
||||
{%- else %}
|
||||
password requisite pam_passwdqc.so {{ os_auth_pam_passwdqc_options }}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# {{ ansible_managed | comment }}
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
# Disable core dumps via soft limits for all users. Compliance to this setting is voluntary and can be modified by users up to a hard limit. This setting is a sane default.
|
||||
ulimit -S -c 0 > /dev/null 2>&1
|
||||
|
|
|
|||
|
|
@ -1,5 +1,4 @@
|
|||
# {{ ansible_managed | comment }}
|
||||
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
# A list of TTYs, from which root can log in
|
||||
# see `man securetty` for reference
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# {{ ansible_managed | comment }}
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
# color => new RH6.0 bootup
|
||||
# verbose => old-style bootup
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
{{ ansible_managed | comment }}
|
||||
|
||||
Name: passwdqc password strength enforcement
|
||||
Default: yes
|
||||
Priority: 1024
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
{{ ansible_managed | comment }}
|
||||
|
||||
Name: tally2 lockout after failed attempts enforcement
|
||||
Default: yes
|
||||
Priority: 1024
|
||||
|
|
|
|||
|
|
@ -4,10 +4,22 @@
|
|||
roles:
|
||||
- ansible-os-hardening
|
||||
pre_tasks:
|
||||
- name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
|
||||
set_fact:
|
||||
ansible_python_interpreter: "/usr/bin/python3"
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Run the equivalent of "apt-get update" as a separate step
|
||||
apt:
|
||||
update_cache: yes
|
||||
when: ansible_os_family == 'Debian'
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
- name: install required tools on fedora
|
||||
dnf:
|
||||
name:
|
||||
- python
|
||||
- findutils
|
||||
- procps-ng
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
- name: create recursing symlink to test minimize access
|
||||
shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
|
||||
vars:
|
||||
|
|
@ -20,7 +32,7 @@
|
|||
os_auth_allow_homeless: true
|
||||
os_security_suid_sgid_blacklist: ['/bin/umount']
|
||||
os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
|
||||
os_filesystem_whitelist: ['vfat']
|
||||
os_filesystem_whitelist: []
|
||||
sysctl_config:
|
||||
net.ipv4.ip_forward: 0
|
||||
net.ipv6.conf.all.forwarding: 0
|
||||
|
|
@ -52,23 +64,26 @@
|
|||
net.ipv6.conf.default.accept_ra_rtr_pref: 0
|
||||
net.ipv6.conf.default.accept_ra_pinfo: 0
|
||||
net.ipv6.conf.default.accept_ra_defrtr: 0
|
||||
net.ipv6.conf.default.autoconf: 0
|
||||
net.ipv6.conf.default.conf: 0
|
||||
net.ipv6.conf.default.dad_transmits: 0
|
||||
net.ipv6.conf.default.max_addresses: 1
|
||||
kernel.sysrq: 0
|
||||
fs.suid_dumpable: 0
|
||||
kernel.randomize_va_space: 2
|
||||
|
||||
|
||||
- name: wrapper playbook for kitchen testing "ansible-os-hardening"
|
||||
hosts: localhost
|
||||
vars:
|
||||
- os_auditd_enabled: false
|
||||
os_auditd_enabled: false
|
||||
pre_tasks:
|
||||
- name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
|
||||
set_fact:
|
||||
ansible_python_interpreter: "/usr/bin/python3"
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- name: Run the equivalent of "apt-get update" as a separate step
|
||||
apt:
|
||||
update_cache: yes
|
||||
when: ansible_os_family == 'Debian'
|
||||
when: ansible_facts.os_family == 'Debian'
|
||||
roles:
|
||||
- ansible-os-hardening
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
# system accounts that do not get their login disabled and pasword changed
|
||||
os_always_ignore_users: ['root','sync','shutdown','halt', 'ec2-user']
|
||||
os_always_ignore_users: ['root', 'sync', 'shutdown', 'halt', 'ec2-user']
|
||||
|
||||
sysctl_rhel_config:
|
||||
# ExecShield protection against buffer overflows
|
||||
|
|
|
|||
|
|
@ -1,13 +1,10 @@
|
|||
---
|
||||
|
||||
os_packages_pam_ccreds: 'libpam-ccreds'
|
||||
os_packages_pam_passwdqc: 'libpam-passwdqc'
|
||||
os_packages_pam_cracklib: 'libpam-cracklib'
|
||||
passwdqc_path: '/usr/share/pam-configs/passwdqc'
|
||||
tally2_path: '/usr/share/pam-configs/tally2'
|
||||
os_nologin_shell_path: '/usr/sbin/nologin'
|
||||
|
||||
auditd_package: 'auditd'
|
||||
modprobe_package: 'kmod'
|
||||
|
||||
# Different distros use different standards for /etc/shadow perms, e.g.
|
||||
# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
|
||||
# You must provide key/value pairs for owner, group, and mode if overriding.
|
||||
|
|
@ -29,3 +26,12 @@ os_auth_sys_uid_min: 100
|
|||
os_auth_sys_uid_max: 999
|
||||
os_auth_sys_gid_min: 100
|
||||
os_auth_sys_gid_max: 999
|
||||
|
||||
# defaults for useradd
|
||||
os_useradd_mail_dir: /var/mail
|
||||
|
||||
modprobe_package: 'kmod'
|
||||
auditd_package: 'auditd'
|
||||
|
||||
tally2_path: '/usr/share/pam-configs/tally2'
|
||||
passwdqc_path: '/usr/share/pam-configs/passwdqc'
|
||||
|
|
|
|||
31
ansible/roles/dev-sec.os-hardening/vars/Fedora.yml
Normal file
31
ansible/roles/dev-sec.os-hardening/vars/Fedora.yml
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
---
|
||||
|
||||
os_packages_pam_ccreds: 'pam_ccreds'
|
||||
os_packages_pam_passwdqc: 'pam_passwdqc'
|
||||
os_packages_pam_cracklib: 'pam_cracklib'
|
||||
os_nologin_shell_path: '/sbin/nologin'
|
||||
|
||||
# Different distros use different standards for /etc/shadow perms, e.g.
|
||||
# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
|
||||
# You must provide key/value pairs for owner, group, and mode if overriding.
|
||||
os_shadow_perms:
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0000'
|
||||
|
||||
os_passwd_perms:
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
os_env_umask: '027'
|
||||
|
||||
os_auth_uid_min: 1000
|
||||
os_auth_gid_min: 1000
|
||||
os_auth_sys_uid_min: 201
|
||||
os_auth_sys_uid_max: 999
|
||||
os_auth_sys_gid_min: 201
|
||||
os_auth_sys_gid_max: 999
|
||||
|
||||
modprobe_package: 'module-init-tools'
|
||||
auditd_package: 'audit'
|
||||
|
|
@ -1,6 +1,8 @@
|
|||
os_packages_pam_ccreds: 'pam_ccreds'
|
||||
os_packages_pam_passwdqc: 'pam_passwdqc'
|
||||
os_packages_pam_cracklib: 'pam_cracklib'
|
||||
---
|
||||
|
||||
os_packages_pam_ccreds: 'pam_ccreds'
|
||||
os_packages_pam_passwdqc: 'pam_passwdqc'
|
||||
os_packages_pam_cracklib: 'pam_cracklib'
|
||||
os_nologin_shell_path: '/sbin/nologin'
|
||||
|
||||
# Different distros use different standards for /etc/shadow perms, e.g.
|
||||
|
|
|
|||
|
|
@ -1,8 +1,5 @@
|
|||
---
|
||||
|
||||
modprobe_package: 'module-init-tools'
|
||||
auditd_package: 'audit'
|
||||
|
||||
os_packages_pam_ccreds: 'pam_ccreds'
|
||||
os_packages_pam_passwdqc: 'pam_passwdqc'
|
||||
os_packages_pam_cracklib: 'pam_cracklib'
|
||||
|
|
@ -29,3 +26,10 @@ os_auth_sys_uid_min: 201
|
|||
os_auth_sys_uid_max: 999
|
||||
os_auth_sys_gid_min: 201
|
||||
os_auth_sys_gid_max: 999
|
||||
|
||||
# defaults for useradd
|
||||
os_useradd_mail_dir: /var/spool/mail
|
||||
os_useradd_create_home: true
|
||||
|
||||
modprobe_package: 'module-init-tools'
|
||||
auditd_package: 'audit'
|
||||
|
|
|
|||
34
ansible/roles/dev-sec.os-hardening/vars/Suse.yml
Normal file
34
ansible/roles/dev-sec.os-hardening/vars/Suse.yml
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
---
|
||||
|
||||
os_packages_pam_ccreds: 'pam_ccreds'
|
||||
os_packages_pam_passwdqc: 'pam_passwdqc'
|
||||
os_packages_pam_cracklib: 'cracklib'
|
||||
os_nologin_shell_path: '/sbin/nologin'
|
||||
|
||||
# Different distros use different standards for /etc/shadow perms, e.g.
|
||||
# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
|
||||
# You must provide key/value pairs for owner, group, and mode if overriding.
|
||||
os_shadow_perms:
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
os_passwd_perms:
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
os_env_umask: '027'
|
||||
|
||||
os_auth_uid_min: 1000
|
||||
os_auth_gid_min: 1000
|
||||
os_auth_sys_uid_min: 100
|
||||
os_auth_sys_uid_max: 499
|
||||
os_auth_sys_gid_min: 100
|
||||
os_auth_sys_gid_max: 499
|
||||
|
||||
# defaults for useradd
|
||||
os_useradd_create_home: false
|
||||
|
||||
modprobe_package: 'kmod-compat'
|
||||
auditd_package: 'audit'
|
||||
|
|
@ -108,4 +108,4 @@ os_security_suid_sgid_system_whitelist:
|
|||
- '/usr/lib/libvte-2.90-9/gnome-pty-helper' # gnome
|
||||
|
||||
# system accounts that do not get their login disabled and pasword changed
|
||||
os_always_ignore_users: ['root','sync','shutdown','halt']
|
||||
os_always_ignore_users: ['root', 'sync', 'shutdown', 'halt']
|
||||
|
|
|
|||
40
ansible/roles/dev-sec.ssh-hardening/.github/ISSUE_TEMPLATE/bug_report.md
vendored
Normal file
40
ansible/roles/dev-sec.ssh-hardening/.github/ISSUE_TEMPLATE/bug_report.md
vendored
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
---
|
||||
name: Bug report
|
||||
about: Create a report to help us improve
|
||||
|
||||
---
|
||||
|
||||
**Describe the bug**
|
||||
A clear and concise description of what the bug is.
|
||||
|
||||
**Expected behavior**
|
||||
A clear and concise description of what you expected to happen.
|
||||
|
||||
**Actual behavior**
|
||||
<!--- Paste verbatim command output between quotes -->
|
||||
```paste below
|
||||
|
||||
```
|
||||
**Example Playbook**
|
||||
<!--- Paste an example playbook that can be used to reproduce the problem between quotes -->
|
||||
```paste below
|
||||
|
||||
```
|
||||
|
||||
**OS / Environment**
|
||||
<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
|
||||
|
||||
**Ansible Version**
|
||||
<!--- Paste verbatim output from "ansible --version" between quotes -->
|
||||
```paste below
|
||||
|
||||
```
|
||||
|
||||
**Role Version**
|
||||
<!--- Paste version of the role between quotes -->
|
||||
```paste below
|
||||
|
||||
```
|
||||
|
||||
**Additional context**
|
||||
Add any other context about the problem here.
|
||||
17
ansible/roles/dev-sec.ssh-hardening/.github/ISSUE_TEMPLATE/feature_request.md
vendored
Normal file
17
ansible/roles/dev-sec.ssh-hardening/.github/ISSUE_TEMPLATE/feature_request.md
vendored
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
---
|
||||
name: Feature request
|
||||
about: Suggest an idea for this project
|
||||
|
||||
---
|
||||
|
||||
**Is your feature request related to a problem? Please describe.**
|
||||
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
|
||||
|
||||
**Describe the solution you'd like**
|
||||
A clear and concise description of what you want to happen.
|
||||
|
||||
**Describe alternatives you've considered**
|
||||
A clear and concise description of any alternative solutions or features you've considered.
|
||||
|
||||
**Additional context**
|
||||
Add any other context or screenshots about the feature request here.
|
||||
34
ansible/roles/dev-sec.ssh-hardening/.github/workflows/changelog.yml
vendored
Normal file
34
ansible/roles/dev-sec.ssh-hardening/.github/workflows/changelog.yml
vendored
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
name: Create Changelog
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
types: [closed]
|
||||
|
||||
release:
|
||||
types: [published]
|
||||
|
||||
issues:
|
||||
types: [closed, edited]
|
||||
|
||||
jobs:
|
||||
generate_changelog:
|
||||
runs-on: ubuntu-latest
|
||||
name: Generate changelog for master branch
|
||||
steps:
|
||||
- uses: actions/checkout@v1
|
||||
|
||||
- name: Generate changelog
|
||||
uses: charmixer/auto-changelog-action@v1
|
||||
with:
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: push
|
||||
uses: github-actions-x/commit@v2.6
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
push-branch: 'master'
|
||||
commit-message: 'update changelog'
|
||||
force-add: 'true'
|
||||
files: CHANGELOG.md
|
||||
name: dev-sec CI
|
||||
email: github@gumpri.ch
|
||||
51
ansible/roles/dev-sec.ssh-hardening/.github/workflows/release.yml
vendored
Normal file
51
ansible/roles/dev-sec.ssh-hardening/.github/workflows/release.yml
vendored
Normal file
|
|
@ -0,0 +1,51 @@
|
|||
name: New release
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
|
||||
jobs:
|
||||
generate_changelog:
|
||||
runs-on: ubuntu-latest
|
||||
name: create release draft
|
||||
steps:
|
||||
- uses: actions/checkout@v1
|
||||
|
||||
- name: 'Get Previous tag'
|
||||
id: previoustag
|
||||
uses: "WyriHaximus/github-action-get-previous-tag@master"
|
||||
env:
|
||||
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
|
||||
|
||||
- name: calculate next version
|
||||
id: version
|
||||
uses: patrickjahns/version-drafter-action@v1
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Generate changelog
|
||||
uses: charmixer/auto-changelog-action@v1
|
||||
with:
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
since_tag: ${{ steps.previoustag.outputs.tag }}
|
||||
# wait for https://github.com/CharMixer/auto-changelog-action/pull/3
|
||||
#future_release: ${{ steps.version.outputs.next-version }}
|
||||
|
||||
- name: Read CHANGELOG.md
|
||||
id: package
|
||||
uses: juliangruber/read-file-action@v1
|
||||
with:
|
||||
path: ./CHANGELOG.md
|
||||
|
||||
- name: Create Release draft
|
||||
id: create_release
|
||||
uses: actions/create-release@v1
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
|
||||
with:
|
||||
release_name: ${{ steps.version.outputs.next-version }}
|
||||
tag_name: ${{ steps.version.outputs.next-version }}
|
||||
body: |
|
||||
${{ steps.package.outputs.content }}
|
||||
draft: true
|
||||
|
|
@ -17,7 +17,7 @@ provisioner:
|
|||
require_ansible_omnibus: true
|
||||
ansible_verbose: true
|
||||
ansible_diff: true
|
||||
hosts: all
|
||||
|
||||
roles_path: ../ansible-ssh-hardening/
|
||||
http_proxy: <%= ENV['http_proxy'] || nil %>
|
||||
https_proxy: <%= ENV['https_proxy'] || nil %>
|
||||
|
|
|
|||
|
|
@ -20,56 +20,34 @@ provisioner:
|
|||
http_proxy: <%= ENV['http_proxy'] || nil %>
|
||||
https_proxy: <%= ENV['https_proxy'] || nil %>
|
||||
|
||||
transport:
|
||||
max_ssh_sessions: 5
|
||||
|
||||
platforms:
|
||||
- name: ubuntu-12.04
|
||||
driver_config:
|
||||
box: opscode-ubuntu-12.04
|
||||
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-12.04_chef-provisionerless.box
|
||||
- name: ubuntu-14.04
|
||||
driver_config:
|
||||
box: opscode-ubuntu-14.04
|
||||
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-14.04_chef-provisionerless.box
|
||||
- name: ubuntu-16.04
|
||||
driver_config:
|
||||
box: opscode-ubuntu-16.04
|
||||
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-16.04_chef-provisionerless.box
|
||||
- name: centos-6.4
|
||||
- name: centos-7.2
|
||||
box: bento/ubuntu-16.04
|
||||
- name: ubuntu-18.04
|
||||
driver_config:
|
||||
box: opscode-centos-7.2
|
||||
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-7.2_chef-provisionerless.box
|
||||
- name: centos-6.5
|
||||
box: bento/ubuntu-18.04
|
||||
- name: centos-6
|
||||
driver_config:
|
||||
box: opscode-centos-6.5
|
||||
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-6.5_chef-provisionerless.box
|
||||
- name: centos-6.8
|
||||
driver_config:
|
||||
box: bento/centos-6.8
|
||||
box: bento/centos-6
|
||||
- name: centos-7
|
||||
driver_config:
|
||||
box: bento/centos-7.2
|
||||
- name: oracle-6.4
|
||||
box: bento/centos-7
|
||||
- name: oracle-6
|
||||
driver_config:
|
||||
box: oracle-6.4
|
||||
box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel64-64.box
|
||||
- name: oracle-6.5
|
||||
driver_config:
|
||||
box: oracle-6.5
|
||||
box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel65-64.box
|
||||
box: bento/oracle-6
|
||||
- name: oracle-7
|
||||
driver_config:
|
||||
box: boxcutter/ol72
|
||||
- name: debian-7
|
||||
box: bento/oracle-7
|
||||
- name: debian-9
|
||||
driver_config:
|
||||
box: debian-7
|
||||
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-7.8_chef-provisionerless.box
|
||||
- name: debian-8
|
||||
box: bento/debian-9
|
||||
- name: debian-10
|
||||
driver_config:
|
||||
box: debian-8
|
||||
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-8.1_chef-provisionerless.box
|
||||
box: bento/debian-10
|
||||
- name: amazon
|
||||
driver_config:
|
||||
box: bento/amazonlinux-2
|
||||
|
||||
verifier:
|
||||
name: inspec
|
||||
|
|
|
|||
|
|
@ -6,9 +6,6 @@ driver:
|
|||
http_proxy: <%= ENV['http_proxy'] || nil %>
|
||||
https_proxy: <%= ENV['https_proxy'] || nil %>
|
||||
|
||||
transport:
|
||||
max_ssh_sessions: 5
|
||||
|
||||
provisioner:
|
||||
name: ansible_playbook
|
||||
hosts: all
|
||||
|
|
@ -17,12 +14,12 @@ provisioner:
|
|||
require_ruby_for_busser: false
|
||||
ansible_verbose: true
|
||||
ansible_diff: true
|
||||
hosts: all
|
||||
|
||||
roles_path: ../ansible-ssh-hardening/
|
||||
http_proxy: <%= ENV['http_proxy'] || nil %>
|
||||
https_proxy: <%= ENV['https_proxy'] || nil %>
|
||||
playbook: tests/default.yml
|
||||
ansible_diff: true
|
||||
|
||||
ansible_extra_flags:
|
||||
- "--skip-tags=sysctl"
|
||||
|
||||
|
|
@ -51,10 +48,6 @@ platforms:
|
|||
provision_command:
|
||||
- sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
|
||||
- systemctl enable sshd.service
|
||||
- name: ubuntu1404-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-ubuntu1404-ansible:latest
|
||||
platform: ubuntu
|
||||
- name: ubuntu1604-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-ubuntu1604-ansible:latest
|
||||
|
|
@ -62,14 +55,13 @@ platforms:
|
|||
run_command: /sbin/init
|
||||
provision_command:
|
||||
- systemctl enable ssh.service
|
||||
- name: debian7-ansible-latest
|
||||
- name: ubuntu1804-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-debian7-ansible:latest
|
||||
platform: debian
|
||||
- name: debian8-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-debian8-ansible:latest
|
||||
platform: debian
|
||||
image: rndmh3ro/docker-ubuntu1804-ansible:latest
|
||||
platform: ubuntu
|
||||
run_command: /sbin/init
|
||||
provision_command:
|
||||
- systemctl enable ssh.service
|
||||
- name: debian9-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-debian9-ansible:latest
|
||||
|
|
@ -78,6 +70,14 @@ platforms:
|
|||
provision_command:
|
||||
- apt install -y systemd-sysv
|
||||
- systemctl enable ssh.service
|
||||
- name: debian10-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-debian10-ansible
|
||||
platform: debian
|
||||
run_command: /sbin/init
|
||||
provision_command:
|
||||
- apt install -y systemd-sysv
|
||||
- systemctl enable ssh.service
|
||||
- name: amazon-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-amazon-ansible:latest
|
||||
|
|
@ -86,6 +86,15 @@ platforms:
|
|||
provision_command:
|
||||
- sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
|
||||
- systemctl enable sshd.service
|
||||
- name: fedora-ansible-latest
|
||||
driver:
|
||||
image: rndmh3ro/docker-fedora-ansible:latest
|
||||
platform: centos
|
||||
run_command: /sbin/init
|
||||
provision_command:
|
||||
- dnf install -y python
|
||||
- sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
|
||||
- systemctl enable sshd.service
|
||||
|
||||
verifier:
|
||||
name: inspec
|
||||
|
|
|
|||
|
|
@ -25,17 +25,9 @@ env:
|
|||
init: /lib/systemd/systemd
|
||||
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||||
|
||||
- distro: ubuntu1404
|
||||
- distro: ubuntu1804
|
||||
version: latest
|
||||
init: /sbin/init
|
||||
|
||||
- distro: debian7
|
||||
version: latest
|
||||
init: /sbin/init
|
||||
|
||||
- distro: debian8
|
||||
version: latest
|
||||
init: /sbin/init
|
||||
init: /lib/systemd/systemd
|
||||
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||||
|
||||
- distro: debian9
|
||||
|
|
@ -43,29 +35,42 @@ env:
|
|||
init: /lib/systemd/systemd
|
||||
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||||
|
||||
- distro: debian10
|
||||
version: latest
|
||||
init: /lib/systemd/systemd
|
||||
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||||
|
||||
- distro: amazon
|
||||
init: /lib/systemd/systemd
|
||||
version: latest
|
||||
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||||
|
||||
- distro: fedora
|
||||
init: /lib/systemd/systemd
|
||||
version: latest
|
||||
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||||
|
||||
before_install:
|
||||
# Pull container
|
||||
- 'docker pull rndmh3ro/docker-${distro}-ansible:${version}'
|
||||
|
||||
script:
|
||||
- pip install --user ansible-lint
|
||||
- ansible-lint ./
|
||||
|
||||
- container_id=$(mktemp)
|
||||
# Run container in detached state.
|
||||
- 'docker run --detach --volume="${PWD}":/etc/ansible/roles/ansible-ssh-hardening:ro ${run_opts} rndmh3ro/docker-${distro}-ansible:${version} "${init}" > "${container_id}"'
|
||||
|
||||
# Test role.
|
||||
- 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-ssh-hardening/tests/default_custom.yml'
|
||||
- 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-ssh-hardening/tests/default.yml'
|
||||
- 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-ssh-hardening/tests/default_custom.yml --diff'
|
||||
- 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-ssh-hardening/tests/default.yml --diff'
|
||||
|
||||
# Verify role
|
||||
# remove the UseLogin-check, see here for reasons: https://github.com/dev-sec/ansible-ssh-hardening/pull/141
|
||||
- 'inspec exec https://github.com/dev-sec/ssh-baseline/ -t docker://$(cat ${container_id}) --controls=sshd-01 sshd-02 sshd-03 sshd-04 sshd-05 sshd-06 sshd-07 sshd-08 sshd-09 sshd-10 sshd-11 sshd-12 sshd-13 sshd-14 sshd-16 sshd-17 sshd-18 sshd-19 sshd-20 sshd-21 sshd-22 sshd-23 sshd-24 sshd-25 sshd-26 sshd-27 sshd-28 sshd-29 sshd-30 sshd-31 sshd-32 sshd-33 sshd-34 sshd-35 sshd-36 sshd-37 sshd-38 sshd-39 sshd-40 sshd-41 sshd-42 sshd-43 sshd-44 sshd-45 sshd-46 sshd-47 sshd-48 --no-distinct-exit'
|
||||
- 'inspec exec https://github.com/dev-sec/ssh-baseline/ -t docker://$(cat ${container_id}) --controls=sshd-01 sshd-02 sshd-03 sshd-04 sshd-05 sshd-06 sshd-07 sshd-08 sshd-09 sshd-10 sshd-11 sshd-12 sshd-13 sshd-14 sshd-15 sshd-16 sshd-17 sshd-18 sshd-19 sshd-20 sshd-21 sshd-22 sshd-23 sshd-24 sshd-25 sshd-26 sshd-27 sshd-28 sshd-29 sshd-30 sshd-31 sshd-32 sshd-33 sshd-34 sshd-35 sshd-36 sshd-37 sshd-38 sshd-39 sshd-40 sshd-41 sshd-42 sshd-43 sshd-44 sshd-45 sshd-46 sshd-47 sshd-48 --no-distinct-exit'
|
||||
# remove UseRoaming and RhostsRSAAuthentication because these options are deprecated - ssh-14, ssh-15, ssh-21
|
||||
- 'inspec exec https://github.com/dev-sec/ssh-baseline/ -t docker://$(cat ${container_id}) --controls=ssh-01 ssh-02 ssh-03 ssh-04 ssh-05 ssh-06 ssh-07 ssh-08 ssh-09 ssh-10 ssh-11 ssh-12 ssh-13 ssh-16 ssh-17 ssh-18 ssh-19 ssh-20 --no-distinct-exit'
|
||||
- 'inspec exec https://github.com/dev-sec/ssh-baseline/ -t docker://$(cat ${container_id}) --controls=ssh-01 ssh-02 ssh-03 ssh-04 ssh-05 ssh-06 ssh-07 ssh-08 ssh-09 ssh-10 ssh-11 ssh-12 ssh-13 ssh-14 ssh-15 ssh-16 ssh-17 ssh-18 ssh-19 ssh-20 --no-distinct-exit'
|
||||
|
||||
notifications:
|
||||
webhooks: https://galaxy.ansible.com/api/v1/notifications/
|
||||
|
|
|
|||
|
|
@ -1,6 +1,217 @@
|
|||
# Change Log
|
||||
# Changelog
|
||||
|
||||
## [Unreleased](https://github.com/dev-sec/ansible-ssh-hardening/tree/HEAD)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/8.0.0...HEAD)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- add changelog and release workflow [\#282](https://github.com/dev-sec/ansible-ssh-hardening/pull/282) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- fix: Ansible part of Fedora build [\#281](https://github.com/dev-sec/ansible-ssh-hardening/pull/281) ([kostasns](https://github.com/kostasns))
|
||||
- Add changelog action [\#280](https://github.com/dev-sec/ansible-ssh-hardening/pull/280) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- fix: Amazon linux build [\#279](https://github.com/dev-sec/ansible-ssh-hardening/pull/279) ([kostasns](https://github.com/kostasns))
|
||||
- feat: Allow to set custom list of HostKeyAlgorithms [\#278](https://github.com/dev-sec/ansible-ssh-hardening/pull/278) ([kostasns](https://github.com/kostasns))
|
||||
- fix\(ansible\_facts\): replace few remaining facts from 'ansible\_' to using 'ansible\_facts' dictionary [\#277](https://github.com/dev-sec/ansible-ssh-hardening/pull/277) ([kostasns](https://github.com/kostasns))
|
||||
|
||||
## [8.0.0](https://github.com/dev-sec/ansible-ssh-hardening/tree/8.0.0) (2020-04-21)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/7.0.0...8.0.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Remove dependency on bash [\#265](https://github.com/dev-sec/ansible-ssh-hardening/issues/265)
|
||||
- Possibility to use other value than yes/no for AllowTCPforwarding [\#255](https://github.com/dev-sec/ansible-ssh-hardening/issues/255)
|
||||
- Add support for Debian Buster in ansible-ssh-hardening [\#248](https://github.com/dev-sec/ansible-ssh-hardening/issues/248)
|
||||
- Some options not configurable via the role [\#239](https://github.com/dev-sec/ansible-ssh-hardening/issues/239)
|
||||
- PermitUserEnvironment should not be conflated with AcceptEnv [\#232](https://github.com/dev-sec/ansible-ssh-hardening/issues/232)
|
||||
- Disable also dynamic MOTD via PAM if enabled - refs \#271 [\#273](https://github.com/dev-sec/ansible-ssh-hardening/pull/273) ([ancoron](https://github.com/ancoron))
|
||||
- Use sha2 HMACs on RHEL 6 / CentOS 6. [\#270](https://github.com/dev-sec/ansible-ssh-hardening/pull/270) ([foonix](https://github.com/foonix))
|
||||
- Removing 2fa [\#269](https://github.com/dev-sec/ansible-ssh-hardening/pull/269) ([dennisse](https://github.com/dennisse))
|
||||
- Renaming Ansible variables discovered from systems [\#268](https://github.com/dev-sec/ansible-ssh-hardening/pull/268) ([PovilasGT](https://github.com/PovilasGT))
|
||||
- Do not use bash to get ssh version [\#266](https://github.com/dev-sec/ansible-ssh-hardening/pull/266) ([kljensen](https://github.com/kljensen))
|
||||
- Add 'all', 'local', 'yes', 'no' options support for AllowTcpForwarding variable [\#257](https://github.com/dev-sec/ansible-ssh-hardening/pull/257) ([brnck](https://github.com/brnck))
|
||||
- Support KEX for OpenSSH 8.0+ & quantum resistant KEX [\#254](https://github.com/dev-sec/ansible-ssh-hardening/pull/254) ([lunarthegrey](https://github.com/lunarthegrey))
|
||||
- SFTP: set default umask to 0027 [\#252](https://github.com/dev-sec/ansible-ssh-hardening/pull/252) ([Slamdunk](https://github.com/Slamdunk))
|
||||
- Separate PermitUserEnviroment from AcceptEnv [\#251](https://github.com/dev-sec/ansible-ssh-hardening/pull/251) ([szEvEz](https://github.com/szEvEz))
|
||||
- Feature: Debian 10 \(Buster\) support [\#249](https://github.com/dev-sec/ansible-ssh-hardening/pull/249) ([jaredledvina](https://github.com/jaredledvina))
|
||||
- fix broken packages, extend README with furhter development instructions [\#246](https://github.com/dev-sec/ansible-ssh-hardening/pull/246) ([szEvEz](https://github.com/szEvEz))
|
||||
- refactor authenticationmethod settings, allow user to set authenticat… [\#245](https://github.com/dev-sec/ansible-ssh-hardening/pull/245) ([szEvEz](https://github.com/szEvEz))
|
||||
- RHEL/OL/CentOS 8 support [\#242](https://github.com/dev-sec/ansible-ssh-hardening/pull/242) ([Furragen](https://github.com/Furragen))
|
||||
- Added ssh\_syslog\_facility, ssh\_log\_level and ssh\_strict\_modes parameters [\#240](https://github.com/dev-sec/ansible-ssh-hardening/pull/240) ([bschonec](https://github.com/bschonec))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- HostKey comment "\# Req 20" breaks key based auth [\#262](https://github.com/dev-sec/ansible-ssh-hardening/issues/262)
|
||||
- SSH fails to start/connect if custom server ports is set on CentOS 7.6 [\#212](https://github.com/dev-sec/ansible-ssh-hardening/issues/212)
|
||||
- Google 2fa authentication problem [\#170](https://github.com/dev-sec/ansible-ssh-hardening/issues/170)
|
||||
- vars: remove empty main.yml file [\#274](https://github.com/dev-sec/ansible-ssh-hardening/pull/274) ([paulfantom](https://github.com/paulfantom))
|
||||
- Only manage moduli when hardening server [\#267](https://github.com/dev-sec/ansible-ssh-hardening/pull/267) ([jbronn](https://github.com/jbronn))
|
||||
- Remove comment from sshd config HostKey param [\#263](https://github.com/dev-sec/ansible-ssh-hardening/pull/263) ([abtreece](https://github.com/abtreece))
|
||||
|
||||
## [7.0.0](https://github.com/dev-sec/ansible-ssh-hardening/tree/7.0.0) (2019-09-15)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/6.2.0...7.0.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Add new option ssh\_server\_match\_address [\#230](https://github.com/dev-sec/ansible-ssh-hardening/issues/230)
|
||||
- set UsePAM to yes by default [\#233](https://github.com/dev-sec/ansible-ssh-hardening/pull/233) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- Unable to connect after applying the role \(Ubuntu 18.04, AWS EC2\) [\#229](https://github.com/dev-sec/ansible-ssh-hardening/issues/229)
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- Can't connect to new instance created from hardened image [\#189](https://github.com/dev-sec/ansible-ssh-hardening/issues/189)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- changed string comparison to version comparison [\#234](https://github.com/dev-sec/ansible-ssh-hardening/pull/234) ([gobind-singh](https://github.com/gobind-singh))
|
||||
|
||||
## [6.2.0](https://github.com/dev-sec/ansible-ssh-hardening/tree/6.2.0) (2019-08-05)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/6.1.3...6.2.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- added support for `ssh\_server\_match\_address` \(\#230\) [\#231](https://github.com/dev-sec/ansible-ssh-hardening/pull/231) ([MatthiasLohr](https://github.com/MatthiasLohr))
|
||||
|
||||
## [6.1.3](https://github.com/dev-sec/ansible-ssh-hardening/tree/6.1.3) (2019-06-09)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/6.1.2...6.1.3)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Fix squash\_actions deprecation in test playbooks [\#228](https://github.com/dev-sec/ansible-ssh-hardening/pull/228) ([Normo](https://github.com/Normo))
|
||||
- Fix deprecation warnings in Ansible 2.8 [\#227](https://github.com/dev-sec/ansible-ssh-hardening/pull/227) ([Normo](https://github.com/Normo))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- deprecation warnings in Ansible 2.8 [\#226](https://github.com/dev-sec/ansible-ssh-hardening/issues/226)
|
||||
|
||||
## [6.1.2](https://github.com/dev-sec/ansible-ssh-hardening/tree/6.1.2) (2019-05-17)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/6.1.1...6.1.2)
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- sshd\_custom\_options used in ssh\_config generation [\#224](https://github.com/dev-sec/ansible-ssh-hardening/issues/224)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- use correct variable ssh\_custom\_options in ssh\_config template [\#225](https://github.com/dev-sec/ansible-ssh-hardening/pull/225) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [6.1.1](https://github.com/dev-sec/ansible-ssh-hardening/tree/6.1.1) (2019-05-07)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/6.1.0...6.1.1)
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- Missing indent for `ChrootDirectory` in `Match Group sftponly` [\#221](https://github.com/dev-sec/ansible-ssh-hardening/issues/221)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- fix indentation for matches [\#222](https://github.com/dev-sec/ansible-ssh-hardening/pull/222) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [6.1.0](https://github.com/dev-sec/ansible-ssh-hardening/tree/6.1.0) (2019-05-04)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/6.0.0...6.1.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- PermitRootLogin yes [\#190](https://github.com/dev-sec/ansible-ssh-hardening/issues/190)
|
||||
- Match Group' in configuration but 'user' not in connection test specification [\#188](https://github.com/dev-sec/ansible-ssh-hardening/issues/188)
|
||||
- Allow custom values [\#175](https://github.com/dev-sec/ansible-ssh-hardening/issues/175)
|
||||
- use selinux fact to check if selinux is used [\#220](https://github.com/dev-sec/ansible-ssh-hardening/pull/220) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Remove eol os and add fedora [\#218](https://github.com/dev-sec/ansible-ssh-hardening/pull/218) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- document and move custom variables [\#217](https://github.com/dev-sec/ansible-ssh-hardening/pull/217) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- fix: allow other ssh ports using selinux [\#214](https://github.com/dev-sec/ansible-ssh-hardening/pull/214) ([guilieb](https://github.com/guilieb))
|
||||
- Make ansible-lint happy [\#204](https://github.com/dev-sec/ansible-ssh-hardening/pull/204) ([alexclear](https://github.com/alexclear))
|
||||
- Fix ssh and sshd config files to satisfy inspec reqs on all Testkitchen setups [\#203](https://github.com/dev-sec/ansible-ssh-hardening/pull/203) ([alexclear](https://github.com/alexclear))
|
||||
- enable ssh 7.7p1 support [\#202](https://github.com/dev-sec/ansible-ssh-hardening/pull/202) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Removed DEPRECATION WARNING for apt, using list instead of with\_items [\#201](https://github.com/dev-sec/ansible-ssh-hardening/pull/201) ([jonaswre](https://github.com/jonaswre))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- Using more than one rule in a Group or User Match block? [\#207](https://github.com/dev-sec/ansible-ssh-hardening/issues/207)
|
||||
- fix multiple match rules not working \#207 [\#208](https://github.com/dev-sec/ansible-ssh-hardening/pull/208) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [6.0.0](https://github.com/dev-sec/ansible-ssh-hardening/tree/6.0.0) (2018-11-18)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/5.0.0...6.0.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Ubuntu 18.04 support [\#182](https://github.com/dev-sec/ansible-ssh-hardening/issues/182)
|
||||
- Update opensshd.conf.js [\#196](https://github.com/dev-sec/ansible-ssh-hardening/pull/196) ([ikr0m](https://github.com/ikr0m))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- GSSAPI support broken. Can't be enabled. [\#192](https://github.com/dev-sec/ansible-ssh-hardening/issues/192)
|
||||
- Unsupported option "rhostsrsaauthentication" "rsaauthentication" [\#184](https://github.com/dev-sec/ansible-ssh-hardening/issues/184)
|
||||
- Weak kex are controlled by wrong variable ? [\#174](https://github.com/dev-sec/ansible-ssh-hardening/issues/174)
|
||||
- Can't connect to server by SSH after applying this role [\#115](https://github.com/dev-sec/ansible-ssh-hardening/issues/115)
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- Support StreamLocalBindUnlink [\#197](https://github.com/dev-sec/ansible-ssh-hardening/issues/197)
|
||||
- Add molecule testing [\#183](https://github.com/dev-sec/ansible-ssh-hardening/issues/183)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Support for custom configuration [\#199](https://github.com/dev-sec/ansible-ssh-hardening/pull/199) ([MatthiasLohr](https://github.com/MatthiasLohr))
|
||||
- parameterize PermitRootLogin [\#195](https://github.com/dev-sec/ansible-ssh-hardening/pull/195) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- set 'GSSAPIAuthentication yes' if variable 'ssh\_gssapi\_support' is set to 'true' [\#194](https://github.com/dev-sec/ansible-ssh-hardening/pull/194) ([szEvEz](https://github.com/szEvEz))
|
||||
- Use ansible version compare module [\#187](https://github.com/dev-sec/ansible-ssh-hardening/pull/187) ([BentoumiTech](https://github.com/BentoumiTech))
|
||||
- add ubuntu 18.04 support [\#186](https://github.com/dev-sec/ansible-ssh-hardening/pull/186) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [5.0.0](https://github.com/dev-sec/ansible-ssh-hardening/tree/5.0.0) (2018-09-16)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/4.4.0...5.0.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Fixing the broken Ansible dependency mechanism [\#176](https://github.com/dev-sec/ansible-ssh-hardening/issues/176)
|
||||
- Include new baseline-tests [\#161](https://github.com/dev-sec/ansible-ssh-hardening/issues/161)
|
||||
- GlobalKnownHostsFile missing from ssh\_config [\#155](https://github.com/dev-sec/ansible-ssh-hardening/issues/155)
|
||||
- Options not compatible with OpenSSH server 7.6 [\#151](https://github.com/dev-sec/ansible-ssh-hardening/issues/151)
|
||||
- Kitchen travis [\#180](https://github.com/dev-sec/ansible-ssh-hardening/pull/180) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- update config of kex, macs, ciphers [\#179](https://github.com/dev-sec/ansible-ssh-hardening/pull/179) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- add debian 9 and a comment [\#178](https://github.com/dev-sec/ansible-ssh-hardening/pull/178) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Dependency flag [\#177](https://github.com/dev-sec/ansible-ssh-hardening/pull/177) ([jcheroske](https://github.com/jcheroske))
|
||||
- Travis [\#173](https://github.com/dev-sec/ansible-ssh-hardening/pull/173) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- OpenBSD Support [\#171](https://github.com/dev-sec/ansible-ssh-hardening/pull/171) ([jbronn](https://github.com/jbronn))
|
||||
- Implement disabling chroot for sftp [\#166](https://github.com/dev-sec/ansible-ssh-hardening/pull/166) ([towo](https://github.com/towo))
|
||||
- New tests [\#163](https://github.com/dev-sec/ansible-ssh-hardening/pull/163) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- yaml-lint update, refactor tasks [\#162](https://github.com/dev-sec/ansible-ssh-hardening/pull/162) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Handle a few deprecated OpenSSH options [\#160](https://github.com/dev-sec/ansible-ssh-hardening/pull/160) ([ageis](https://github.com/ageis))
|
||||
- Added support for TrustedUserCAKeys and AuthorizedPrincipalsFile. [\#157](https://github.com/dev-sec/ansible-ssh-hardening/pull/157) ([gdelafond](https://github.com/gdelafond))
|
||||
- Adds sshd config for keyboard-interactive pam device [\#156](https://github.com/dev-sec/ansible-ssh-hardening/pull/156) ([rcII](https://github.com/rcII))
|
||||
- Use package state 'present' since 'installed' is deprecated [\#154](https://github.com/dev-sec/ansible-ssh-hardening/pull/154) ([Normo](https://github.com/Normo))
|
||||
- conform to current dev-sec/ssh-baseline [\#150](https://github.com/dev-sec/ansible-ssh-hardening/pull/150) ([alval5280](https://github.com/alval5280))
|
||||
- new parameter: ssh\_max\_startups [\#149](https://github.com/dev-sec/ansible-ssh-hardening/pull/149) ([aeschbacher](https://github.com/aeschbacher))
|
||||
- Update syntax to 2.4 [\#148](https://github.com/dev-sec/ansible-ssh-hardening/pull/148) ([thomasjpfan](https://github.com/thomasjpfan))
|
||||
- Amazonlinux-Testing [\#147](https://github.com/dev-sec/ansible-ssh-hardening/pull/147) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Fixed trailing whitespace [\#146](https://github.com/dev-sec/ansible-ssh-hardening/pull/146) ([zbrojny120](https://github.com/zbrojny120))
|
||||
- Add support for Amazon Linux [\#145](https://github.com/dev-sec/ansible-ssh-hardening/pull/145) ([woneill](https://github.com/woneill))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- ssh\_server\_weak\_kex variable is not used any where [\#167](https://github.com/dev-sec/ansible-ssh-hardening/issues/167)
|
||||
- opensshd.conf.j2 template type error [\#159](https://github.com/dev-sec/ansible-ssh-hardening/issues/159)
|
||||
- line 56: Bad SSH2 mac spec [\#135](https://github.com/dev-sec/ansible-ssh-hardening/issues/135)
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- Travis & Debian 9 "Stretch" [\#158](https://github.com/dev-sec/ansible-ssh-hardening/issues/158)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- remove oracle7 from travis tests for the time being [\#181](https://github.com/dev-sec/ansible-ssh-hardening/pull/181) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [4.4.0](https://github.com/dev-sec/ansible-ssh-hardening/tree/4.4.0) (2017-12-29)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/4.3.1...4.4.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
|
@ -10,12 +221,11 @@
|
|||
- allow configuration of GatewayPorts [\#136](https://github.com/dev-sec/ansible-ssh-hardening/pull/136) ([pwyliu](https://github.com/pwyliu))
|
||||
- Added support for AuthorizedKeysFile config setting [\#132](https://github.com/dev-sec/ansible-ssh-hardening/pull/132) ([hyrsky](https://github.com/hyrsky))
|
||||
- corrected comments explaining the task's behaviour [\#131](https://github.com/dev-sec/ansible-ssh-hardening/pull/131) ([martinbydefault](https://github.com/martinbydefault))
|
||||
- Add Two-Factor Authentication [\#123](https://github.com/dev-sec/ansible-ssh-hardening/pull/123) ([lazzurs](https://github.com/lazzurs))
|
||||
- Feature/2fa auth [\#123](https://github.com/dev-sec/ansible-ssh-hardening/pull/123) ([lazzurs](https://github.com/lazzurs))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- ssh\_use\_dns used twice in defaults/main.yml [\#129](https://github.com/dev-sec/ansible-ssh-hardening/issues/129)
|
||||
- line 56: Bad SSH2 mac spec [\#135](https://github.com/dev-sec/ansible-ssh-hardening/issues/135)
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
|
|
@ -31,6 +241,7 @@
|
|||
- force /bin/sh when getting openssh-version [\#134](https://github.com/dev-sec/ansible-ssh-hardening/pull/134) ([gtz42](https://github.com/gtz42))
|
||||
|
||||
## [4.3.1](https://github.com/dev-sec/ansible-ssh-hardening/tree/4.3.1) (2017-08-14)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/4.3.0...4.3.1)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
|
@ -46,7 +257,8 @@
|
|||
- role creates duplicate parameter/values after run [\#124](https://github.com/dev-sec/ansible-ssh-hardening/issues/124)
|
||||
|
||||
## [4.3.0](https://github.com/dev-sec/ansible-ssh-hardening/tree/4.3.0) (2017-08-03)
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/4.1.3...4.3.0)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/4.2.0...4.3.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
|
|
@ -58,11 +270,13 @@
|
|||
- Don't overwrite ssh\_host\_key\_files if set manually [\#125](https://github.com/dev-sec/ansible-ssh-hardening/pull/125) ([oakey-b1](https://github.com/oakey-b1))
|
||||
- Add comment filter to {{ansible\_managed}} string [\#121](https://github.com/dev-sec/ansible-ssh-hardening/pull/121) ([fazlearefin](https://github.com/fazlearefin))
|
||||
|
||||
## [4.1.3](https://github.com/dev-sec/ansible-ssh-hardening/tree/4.1.3) (2017-06-30)
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/4.2.0...4.1.3)
|
||||
|
||||
## [4.2.0](https://github.com/dev-sec/ansible-ssh-hardening/tree/4.2.0) (2017-06-30)
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/4.1.2...4.2.0)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/4.1.3...4.2.0)
|
||||
|
||||
## [4.1.3](https://github.com/dev-sec/ansible-ssh-hardening/tree/4.1.3) (2017-06-30)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/4.1.2...4.1.3)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
|
|
@ -78,6 +292,7 @@
|
|||
- Do not use shell when not needed + Lint whitespaces [\#118](https://github.com/dev-sec/ansible-ssh-hardening/pull/118) ([krhubert](https://github.com/krhubert))
|
||||
|
||||
## [4.1.2](https://github.com/dev-sec/ansible-ssh-hardening/tree/4.1.2) (2017-05-31)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/4.1.1...4.1.2)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
|
@ -93,17 +308,15 @@
|
|||
- Update readme to include baselines [\#110](https://github.com/dev-sec/ansible-ssh-hardening/issues/110)
|
||||
|
||||
## [4.1.1](https://github.com/dev-sec/ansible-ssh-hardening/tree/4.1.1) (2017-05-18)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/4.1.0...4.1.1)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- fix validation error [\#113](https://github.com/dev-sec/ansible-ssh-hardening/pull/113) ([pwyliu](https://github.com/pwyliu))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- fix validation error [\#113](https://github.com/dev-sec/ansible-ssh-hardening/pull/113) ([pwyliu](https://github.com/pwyliu))
|
||||
|
||||
## [4.1.0](https://github.com/dev-sec/ansible-ssh-hardening/tree/4.1.0) (2017-05-09)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/4.0.0...4.1.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
|
@ -123,6 +336,7 @@
|
|||
- Adds option to enable password based authentication on the server [\#107](https://github.com/dev-sec/ansible-ssh-hardening/pull/107) ([colin-nolan](https://github.com/colin-nolan))
|
||||
|
||||
## [4.0.0](https://github.com/dev-sec/ansible-ssh-hardening/tree/4.0.0) (2017-04-22)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/3.2.0...4.0.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
|
@ -145,8 +359,6 @@
|
|||
**Fixed bugs:**
|
||||
|
||||
- SELinux-specific task still runs on SELinux-disabled systems [\#74](https://github.com/dev-sec/ansible-ssh-hardening/issues/74)
|
||||
- List only one Port in ssh config [\#84](https://github.com/dev-sec/ansible-ssh-hardening/pull/84) ([fullyint](https://github.com/fullyint))
|
||||
- Fix ssh config to handle custom options per Host [\#83](https://github.com/dev-sec/ansible-ssh-hardening/pull/83) ([fullyint](https://github.com/fullyint))
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
|
|
@ -159,6 +371,7 @@
|
|||
- Fix ssh\_server\_ports and ssh\_client\_ports documentation bug [\#80](https://github.com/dev-sec/ansible-ssh-hardening/pull/80) ([kivilahtio](https://github.com/kivilahtio))
|
||||
|
||||
## [3.2.0](https://github.com/dev-sec/ansible-ssh-hardening/tree/3.2.0) (2016-10-24)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/3.1.0...3.2.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
|
@ -173,11 +386,8 @@
|
|||
- Selinux issue [\#75](https://github.com/dev-sec/ansible-ssh-hardening/issues/75)
|
||||
- Running the tests locally [\#61](https://github.com/dev-sec/ansible-ssh-hardening/issues/61)
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- Applied-Crypto-Hardening project and new cyphers. [\#28](https://github.com/dev-sec/ansible-ssh-hardening/issues/28)
|
||||
|
||||
## [3.1.0](https://github.com/dev-sec/ansible-ssh-hardening/tree/3.1.0) (2016-08-03)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/3.1...3.1.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
|
@ -185,6 +395,7 @@
|
|||
- use new ciphers, kex, macs and privilege separation for redhat family 7 or later [\#72](https://github.com/dev-sec/ansible-ssh-hardening/issues/72)
|
||||
|
||||
## [3.1](https://github.com/dev-sec/ansible-ssh-hardening/tree/3.1) (2016-08-03)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/3.0.0...3.1)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
|
@ -212,11 +423,12 @@
|
|||
- Add SCP/SFTP to FAQ [\#58](https://github.com/dev-sec/ansible-ssh-hardening/pull/58) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [3.0.0](https://github.com/dev-sec/ansible-ssh-hardening/tree/3.0.0) (2016-03-13)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/2.0.0...3.0.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Added sftp\_enabled, sftp\_chroot\_dir, and ssh\_client\_roaming from the … [\#57](https://github.com/dev-sec/ansible-ssh-hardening/pull/57) ([shirokatze](https://github.com/shirokatze))
|
||||
- Added sftp\_enabled, sftp\_chroot\_dir, and ssh\_client\_roaming from the … [\#57](https://github.com/dev-sec/ansible-ssh-hardening/pull/57) ([ghost](https://github.com/ghost))
|
||||
- add test support for ansible 1.9 and 2.0 [\#56](https://github.com/dev-sec/ansible-ssh-hardening/pull/56) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- update platforms in meta-file [\#52](https://github.com/dev-sec/ansible-ssh-hardening/pull/52) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- add webhook for ansible galaxy [\#51](https://github.com/dev-sec/ansible-ssh-hardening/pull/51) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
|
@ -235,6 +447,7 @@
|
|||
- New release 3.0.0 [\#59](https://github.com/dev-sec/ansible-ssh-hardening/pull/59) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [2.0.0](https://github.com/dev-sec/ansible-ssh-hardening/tree/2.0.0) (2015-11-28)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/1.2.1...2.0.0)
|
||||
|
||||
**Closed issues:**
|
||||
|
|
@ -248,6 +461,7 @@
|
|||
- sftp\_enable option [\#41](https://github.com/dev-sec/ansible-ssh-hardening/pull/41) ([fitz123](https://github.com/fitz123))
|
||||
|
||||
## [1.2.1](https://github.com/dev-sec/ansible-ssh-hardening/tree/1.2.1) (2015-10-16)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/1.2...1.2.1)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
|
@ -255,10 +469,12 @@
|
|||
- Allow whitelisted groups on ssh [\#40](https://github.com/dev-sec/ansible-ssh-hardening/pull/40) ([fheinle](https://github.com/fheinle))
|
||||
|
||||
## [1.2](https://github.com/dev-sec/ansible-ssh-hardening/tree/1.2) (2015-09-28)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/1.2.0...1.2)
|
||||
|
||||
## [1.2.0](https://github.com/dev-sec/ansible-ssh-hardening/tree/1.2.0) (2015-09-28)
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/1.1...1.2.0)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/1.1.0...1.2.0)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
|
|
@ -266,16 +482,20 @@
|
|||
- Add more travis-tests [\#38](https://github.com/dev-sec/ansible-ssh-hardening/pull/38) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Support for selinux and pam. fix \#23 [\#35](https://github.com/dev-sec/ansible-ssh-hardening/pull/35) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [1.1](https://github.com/dev-sec/ansible-ssh-hardening/tree/1.1) (2015-09-01)
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/1.1.0...1.1)
|
||||
|
||||
## [1.1.0](https://github.com/dev-sec/ansible-ssh-hardening/tree/1.1.0) (2015-09-01)
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/1.0.0...1.1.0)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/1.1...1.1.0)
|
||||
|
||||
## [1.1](https://github.com/dev-sec/ansible-ssh-hardening/tree/1.1) (2015-09-01)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/1.0.0...1.1)
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- ssh\_ports - individual client/server config [\#33](https://github.com/dev-sec/ansible-ssh-hardening/issues/33)
|
||||
- Applied-Crypto-Hardening project and new cyphers. [\#28](https://github.com/dev-sec/ansible-ssh-hardening/issues/28)
|
||||
- UsePAM should probably default to yes on Red Hat Linux 7 [\#23](https://github.com/dev-sec/ansible-ssh-hardening/issues/23)
|
||||
- Running test-kitchen fails [\#2](https://github.com/dev-sec/ansible-ssh-hardening/issues/2)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
|
|
@ -296,6 +516,9 @@
|
|||
- Debian install script [\#19](https://github.com/dev-sec/ansible-ssh-hardening/pull/19) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [1.0.0](https://github.com/dev-sec/ansible-ssh-hardening/tree/1.0.0) (2015-04-30)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-ssh-hardening/compare/a9591764206b79a4ed324bb8576151ebac0127b1...1.0.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Update variable-documentation [\#12](https://github.com/dev-sec/ansible-ssh-hardening/pull/12) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
|
@ -304,7 +527,6 @@
|
|||
|
||||
- add travis test for ubuntu 12.04 [\#7](https://github.com/dev-sec/ansible-ssh-hardening/issues/7)
|
||||
- Use handler for sshd restart [\#6](https://github.com/dev-sec/ansible-ssh-hardening/issues/6)
|
||||
- Running test-kitchen fails [\#2](https://github.com/dev-sec/ansible-ssh-hardening/issues/2)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
|
|
@ -325,4 +547,4 @@
|
|||
|
||||
|
||||
|
||||
\* *This Change Log was automatically generated by [github_changelog_generator](https://github.com/skywinder/Github-Changelog-Generator)*
|
||||
\* *This Changelog was automatically generated by [github_changelog_generator](https://github.com/github-changelog-generator/github-changelog-generator)*
|
||||
|
|
|
|||
|
|
@ -11,6 +11,7 @@ group :integration do
|
|||
gem 'kitchen-sync'
|
||||
gem 'kitchen-transport-rsync'
|
||||
gem 'kitchen-docker'
|
||||
gem 'inspec', '~> 3'
|
||||
end
|
||||
|
||||
group :tools do
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
|
|||
|
||||
## Requirements
|
||||
|
||||
* Ansible > 2.4
|
||||
* Ansible > 2.5
|
||||
|
||||
## Role Variables
|
||||
| Name | Default Value | Description |
|
||||
|
|
@ -22,17 +22,18 @@ Warning: This role disables root-login on the target server! Please make sure yo
|
|||
|`ssh_client_port` | '22' |port to which ssh-client should connect|
|
||||
|`ssh_listen_to` | ['0.0.0.0'] |one or more ip addresses, to which ssh-server should listen to. Default is all adresseses, but should be configured to specific addresses for security reasons!|
|
||||
|`ssh_host_key_files` | [] |Host keys for sshd. If empty ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key', '/etc/ssh/ssh_host_ed25519_key'] will be used, as far as supported by the installed sshd version|
|
||||
|`ssh_host_key_algorithms` | [] | Host key algorithms that the server offers. If empty the [default list](https://man.openbsd.org/sshd_config#HostKeyAlgorithms) will be used, otherwise overrides the setting with specified list of algorithms|
|
||||
|`ssh_client_alive_interval` | 600 | specifies an interval for sending keepalive messages |
|
||||
|`ssh_client_alive_count` | 3 | defines how often keep-alive messages are sent |
|
||||
|`ssh_permit_tunnel` | false | true if SSH Port Tunneling is required |
|
||||
|`ssh_remote_hosts` | [] | one or more hosts and their custom options for the ssh-client. Default is empty. See examples in `defaults/main.yml`.|
|
||||
|`ssh_allow_root_with_key` | false | false to disable root login altogether. Set to true to allow root to login via key-based mechanism.|
|
||||
|`ssh_allow_tcp_forwarding` | false | false to disable TCP Forwarding. Set to true to allow TCP Forwarding.|
|
||||
|`ssh_permit_root_login` | no | Disable root-login. Set to `without-password` or `yes` to enable root-login |
|
||||
|`ssh_allow_tcp_forwarding` | no | `no` to disable TCP Forwarding. Set to `yes` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `yes`, `no`, `all` or `local`|
|
||||
|`ssh_gateway_ports` | `false` | `false` to disable binding forwarded ports to non-loopback addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified` to allow the client to specify which address to bind to.|
|
||||
|`ssh_allow_agent_forwarding` | false | false to disable Agent Forwarding. Set to true to allow Agent Forwarding.|
|
||||
|`ssh_pam_support` | true | true if SSH has PAM support.|
|
||||
|`ssh_use_pam` | false | false to disable pam authentication.|
|
||||
|`ssh_gssapi_support` | true | true if SSH has GSSAPI support.|
|
||||
|`ssh_use_pam` | true | false to disable pam authentication.|
|
||||
|`ssh_gssapi_support` | false | true if SSH has GSSAPI support.|
|
||||
|`ssh_kerberos_support` | true | true if SSH has Kerberos support.|
|
||||
|`ssh_deny_users` | '' | if specified, login is disallowed for user names that match one of the patterns.|
|
||||
|`ssh_allow_users` | '' | if specified, login is allowed only for user names that match one of the patterns.|
|
||||
|
|
@ -46,6 +47,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
|
|||
|`ssh_print_motd` | false | false to disable printing of the MOTD|
|
||||
|`ssh_print_last_log` | false | false to disable display of last login information|
|
||||
|`sftp_enabled` | false | true to enable sftp configuration|
|
||||
|`sftp_umask` | 0027 | Specifies the umask for sftp|
|
||||
|`sftp_chroot` | true | false to disable chroot for sftp|
|
||||
|`sftp_chroot_dir` | /home/%u | change default sftp chroot location|
|
||||
|`ssh_client_roaming` | false | enable experimental client roaming|
|
||||
|
|
@ -54,8 +56,6 @@ Warning: This role disables root-login on the target server! Please make sure yo
|
|||
|`ssh_challengeresponseauthentication` | false | Specifies whether challenge-response authentication is allowed (e.g. via PAM) |
|
||||
|`ssh_client_password_login` | false | `true` to allow password-based authentication with the ssh client |
|
||||
|`ssh_server_password_login` | false | `true` to allow password-based authentication with the ssh server |
|
||||
|`ssh_google_auth` | false | `true` to enable google authenticator based TOTP 2FA |
|
||||
|`ssh_pam_device` | false | `true` to enable public key auth with pam device 2FA |
|
||||
|`ssh_banner` | `false` | `true` to print a banner on login |
|
||||
|`ssh_client_hardening` | `true` | `false` to stop harden the client |
|
||||
|`ssh_client_port` | `'22'` | Specifies the port number to connect on the remote host. |
|
||||
|
|
@ -64,15 +64,40 @@ Warning: This role disables root-login on the target server! Please make sure yo
|
|||
|`ssh_print_debian_banner` | `false` | `true` to print debian specific banner |
|
||||
|`ssh_server_enabled` | `true` | `false` to disable the opensshd server |
|
||||
|`ssh_server_hardening` | `true` | `false` to stop harden the server |
|
||||
|`ssh_server_match_address` | '' | Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file. |
|
||||
|`ssh_server_match_group` | '' | Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file. |
|
||||
|`ssh_server_match_user` | '' | Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file. |
|
||||
|`ssh_server_permit_environment_vars` | `false` | `true` to specify that ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys are processed by sshd |
|
||||
|`ssh_server_permit_environment_vars` | `no` | `yes` to specify that ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys are processed by sshd. With openssh version 7.8 it is possible to specify a whitelist of environment variable names in addition to global "yes" or "no" settings |
|
||||
|`ssh_server_accept_env_vars`| '' | Specifies what environment variables sent by the client will be copied into the session's enviroment, multiple environment variables may be separated by whitespace |
|
||||
|`ssh_use_dns` | `false` | Specifies whether sshd should look up the remote host name, and to check that the resolved host name for the remote IP address maps back to the very same IP address. |
|
||||
|`ssh_server_revoked_keys` | [] | a list of revoked public keys that the ssh server will always reject, useful to revoke known weak or compromised keys.|
|
||||
|`ssh_max_startups` | '10:30:100' | Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon.|
|
||||
|`ssh_macs` | [] | Change this list to overwrite macs. Defaults found in `defaults/main.yml` |
|
||||
|`ssh_kex` | [] | Change this list to overwrite kexs. Defaults found in `defaults/main.yml` |
|
||||
|`ssh_ciphers` | [] | Change this list to overwrite ciphers. Defaults found in `defaults/main.yml` |
|
||||
|`ssh_custom_options` | [] | Custom lines for SSH client configuration |
|
||||
|`sshd_custom_options` | [] | Custom lines for SSH daemon configuration |
|
||||
|`sshd_syslog_facility` | 'AUTH' | The facility code that is used when logging messages from sshd |
|
||||
|`sshd_log_level` | 'VERBOSE' | the verbosity level that is used when logging messages from sshd |
|
||||
|`sshd_strict_modes` | 'yes' | Check file modes and ownership of the user's files and home directory before accepting login |
|
||||
|`sshd_authenticationmethods` | `publickey` | Specifies the authentication methods that must be successfully completed for a user to be granted access. Make sure to set all required variables for your selected authentication method. Defaults found in `defaults/main.yml`
|
||||
|
||||
## Configuring settings not listed in role-variables
|
||||
|
||||
If you want to configure ssh options that are not listed above, you can use `ssh_custom_options` (for `/etc/ssh/ssh_config`) or `sshd_custom_options` (for `/etc/ssh/sshd_config`) to set them. These options will be set on the **beginning** of the file so you can override options further down in the file.
|
||||
|
||||
Example playbook:
|
||||
|
||||
```
|
||||
- hosts: localhost
|
||||
roles:
|
||||
- dev-sec.ssh-hardening
|
||||
vars:
|
||||
ssh_custom_options:
|
||||
- "Include /etc/ssh/ssh_config.d/*"
|
||||
sshd_custom_options:
|
||||
- "AcceptEnv LANG"
|
||||
```
|
||||
|
||||
## Example Playbook
|
||||
|
||||
|
|
@ -97,27 +122,31 @@ bundle install
|
|||
### Testing with Docker
|
||||
```
|
||||
# fast test on one machine
|
||||
bundle exec kitchen test default-ubuntu-1204
|
||||
bundle exec kitchen test ssh-ubuntu1804-ansible-latest
|
||||
|
||||
# test on all machines
|
||||
bundle exec kitchen test
|
||||
|
||||
# for development
|
||||
bundle exec kitchen create default-ubuntu-1204
|
||||
bundle exec kitchen converge default-ubuntu-1204
|
||||
bundle exec kitchen create ssh-ubuntu1804-ansible-latest
|
||||
bundle exec kitchen converge ssh-ubuntu1804-ansible-latest
|
||||
bundle exec kitchen verify ssh-ubuntu1804-ansible-latest
|
||||
|
||||
# cleanup
|
||||
bundle exec kitchen destroy ssh-ubuntu1804-ansible-latest
|
||||
```
|
||||
|
||||
### Testing with Virtualbox
|
||||
```
|
||||
# fast test on one machine
|
||||
KITCHEN_YAML=".kitchen.vagrant.yml" bundle exec kitchen test default-ubuntu-1204
|
||||
KITCHEN_YAML=".kitchen.vagrant.yml" bundle exec kitchen test ssh-ubuntu-1804
|
||||
|
||||
# test on all machines
|
||||
KITCHEN_YAML=".kitchen.vagrant.yml" bundle exec kitchen test
|
||||
|
||||
# for development
|
||||
KITCHEN_YAML=".kitchen.vagrant.yml" bundle exec kitchen create default-ubuntu-1204
|
||||
KITCHEN_YAML=".kitchen.vagrant.yml" bundle exec kitchen converge default-ubuntu-1204
|
||||
KITCHEN_YAML=".kitchen.vagrant.yml" bundle exec kitchen create ssh-ubuntu-1804
|
||||
KITCHEN_YAML=".kitchen.vagrant.yml" bundle exec kitchen converge ssh-ubuntu-1804
|
||||
```
|
||||
For more information see [test-kitchen](http://kitchen.ci/docs/getting-started)
|
||||
|
||||
|
|
|
|||
|
|
@ -30,6 +30,9 @@ ssh_listen_to: ['0.0.0.0'] # sshd
|
|||
# Host keys to look for when starting sshd.
|
||||
ssh_host_key_files: [] # sshd
|
||||
|
||||
# Specifies the host key algorithms that the server offers
|
||||
ssh_host_key_algorithms: [] # sshd
|
||||
|
||||
# Specifies the maximum number of authentication attempts permitted per connection. Once the number of failures reaches half this value, additional failures are logged.
|
||||
ssh_max_auth_retries: 2
|
||||
|
||||
|
|
@ -48,11 +51,11 @@ ssh_permit_tunnel: false
|
|||
# options: ['StrictHostKeyChecking no']
|
||||
ssh_remote_hosts: []
|
||||
|
||||
# false to disable root login altogether. Set to true to allow root to login via key-based mechanism.
|
||||
ssh_allow_root_with_key: false # sshd
|
||||
# Set this to "without-password" or "yes" to allow root to login
|
||||
ssh_permit_root_login: 'no' # sshd
|
||||
|
||||
# false to disable TCP Forwarding. Set to true to allow TCP Forwarding.
|
||||
ssh_allow_tcp_forwarding: false # sshd
|
||||
ssh_allow_tcp_forwarding: 'no' # sshd
|
||||
|
||||
# false to disable binding forwarded ports to non-loopback addresses. Set to true to force binding on wildcard address.
|
||||
# Set to 'clientspecified' to allow the client to specify which address to bind to.
|
||||
|
|
@ -65,16 +68,13 @@ ssh_allow_agent_forwarding: false # sshd
|
|||
ssh_pam_support: true
|
||||
|
||||
# false to disable pam authentication.
|
||||
ssh_use_pam: false # sshd
|
||||
ssh_use_pam: true # sshd
|
||||
|
||||
# false to disable google 2fa authentication
|
||||
ssh_google_auth: false # sshd
|
||||
|
||||
# false to disable pam device 2FA input
|
||||
ssh_pam_device: false # sshd
|
||||
# specify AuthenticationMethods
|
||||
sshd_authenticationmethods: 'publickey'
|
||||
|
||||
# true if SSH support GSSAPI
|
||||
ssh_gssapi_support: true
|
||||
ssh_gssapi_support: false
|
||||
|
||||
# true if SSH support Kerberos
|
||||
ssh_kerberos_support: true
|
||||
|
|
@ -139,6 +139,9 @@ sftp_enabled: false
|
|||
# false to disable sftp chroot
|
||||
sftp_chroot: true
|
||||
|
||||
# sftp default umask
|
||||
sftp_umask: 0027
|
||||
|
||||
# change default sftp chroot location
|
||||
sftp_chroot_dir: /home/%u
|
||||
|
||||
|
|
@ -151,7 +154,11 @@ ssh_server_match_user: false # sshd
|
|||
# list of hashes (containing group and rules) to generate Match Group blocks for.
|
||||
ssh_server_match_group: false # sshd
|
||||
|
||||
ssh_server_permit_environment_vars: false
|
||||
# list of hashes (containing addresses/subnets and rules) to generate Match Address blocks for.
|
||||
ssh_server_match_address: false # sshd
|
||||
|
||||
ssh_server_permit_environment_vars: 'no'
|
||||
ssh_server_accept_env_vars : ''
|
||||
|
||||
# maximum number of concurrent unauthenticated connections to the SSH daemon
|
||||
ssh_max_startups: '10:30:100' # sshd
|
||||
|
|
@ -167,6 +174,10 @@ ssh_macs_53_default:
|
|||
- hmac-ripemd160
|
||||
- hmac-sha1
|
||||
|
||||
ssh_macs_53_el_6_5_default:
|
||||
- hmac-sha2-512
|
||||
- hmac-sha2-256
|
||||
|
||||
ssh_macs_59_default:
|
||||
- hmac-sha2-512
|
||||
- hmac-sha2-256
|
||||
|
|
@ -205,6 +216,11 @@ ssh_kex_59_default:
|
|||
ssh_kex_66_default:
|
||||
- curve25519-sha256@libssh.org
|
||||
- diffie-hellman-group-exchange-sha256
|
||||
|
||||
ssh_kex_80_default:
|
||||
- sntrup4591761x25519-sha512@tinyssh.org
|
||||
- curve25519-sha256@libssh.org
|
||||
- diffie-hellman-group-exchange-sha256
|
||||
|
||||
# directory where to store ssh_password policy
|
||||
ssh_custom_selinux_dir: '/etc/selinux/local-policies'
|
||||
|
|
@ -220,4 +236,16 @@ ssh_server_revoked_keys: []
|
|||
|
||||
# Set to false to turn the role into a no-op. Useful when using
|
||||
# the Ansible role dependency mechanism.
|
||||
ssh_hardening_enabled: true
|
||||
ssh_hardening_enabled: true
|
||||
|
||||
# Custom options for SSH client configuration file
|
||||
ssh_custom_options: []
|
||||
|
||||
# Custom options for SSH daemon configuration file
|
||||
sshd_custom_options: []
|
||||
|
||||
# Logging
|
||||
sshd_syslog_facility: 'AUTH'
|
||||
sshd_log_level: 'VERBOSE'
|
||||
|
||||
sshd_strict_modes: yes
|
||||
|
|
|
|||
|
|
@ -1 +1,2 @@
|
|||
{install_date: 'Mon Dec 17 12:48:22 2018', version: 5.0.0}
|
||||
install_date: Fri May 15 20:29:21 2020
|
||||
version: 8.1.0
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ galaxy_info:
|
|||
description: 'This Ansible role provides numerous security-related ssh configurations, providing all-round base protection.'
|
||||
company: Hardening Framework Team
|
||||
license: Apache License 2.0
|
||||
min_ansible_version: '2.4'
|
||||
min_ansible_version: '2.5'
|
||||
platforms:
|
||||
- name: EL
|
||||
versions:
|
||||
|
|
@ -12,14 +12,14 @@ galaxy_info:
|
|||
- 7
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- precise
|
||||
- trusty
|
||||
- xenial
|
||||
- bionic
|
||||
- name: Debian
|
||||
versions:
|
||||
- wheezy
|
||||
- jessie
|
||||
- stretch
|
||||
- buster
|
||||
- name: Amazon
|
||||
- name: Fedora
|
||||
galaxy_tags:
|
||||
- system
|
||||
- security
|
||||
|
|
|
|||
|
|
@ -1,36 +0,0 @@
|
|||
---
|
||||
# Install the 2FA packages and setup the config in PAM and SSH
|
||||
- name: Install google authenticator PAM module
|
||||
apt:
|
||||
name: 'libpam-google-authenticator'
|
||||
state: present
|
||||
when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
|
||||
|
||||
- name: Install google authenticator PAM module
|
||||
yum:
|
||||
name: 'google-authenticator'
|
||||
state: present
|
||||
when: ansible_os_family == 'RedHat' or ansible_os_family == 'Oracle Linux'
|
||||
|
||||
- name: Add google auth module to PAM
|
||||
pamd:
|
||||
name: 'sshd'
|
||||
type: 'auth'
|
||||
control: 'required'
|
||||
module_path: 'pam_google_authenticator.so'
|
||||
|
||||
- name: Remove password auth from PAM
|
||||
pamd:
|
||||
name: 'sshd'
|
||||
type: 'auth'
|
||||
control: 'substack'
|
||||
module_path: 'password-auth'
|
||||
state: absent
|
||||
when: ansible_distribution == 'RedHat' or ansible_distribution == 'Oracle Linux' or ansible_distribution == 'Amazon'
|
||||
|
||||
- name: Remove password auth from PAM
|
||||
replace:
|
||||
dest: '/etc/pam.d/sshd'
|
||||
regexp: '^@include common-auth'
|
||||
replace: '#@include common-auth'
|
||||
when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
|
||||
|
|
@ -3,61 +3,73 @@
|
|||
- name: set hostkeys according to openssh-version
|
||||
set_fact:
|
||||
ssh_host_key_files: ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key', '/etc/ssh/ssh_host_ed25519_key']
|
||||
when: sshd_version.stdout >= '6.3' and not ssh_host_key_files
|
||||
when: sshd_version is version('6.3', '>=') and not ssh_host_key_files
|
||||
|
||||
- name: set hostkeys according to openssh-version
|
||||
set_fact:
|
||||
ssh_host_key_files: ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key']
|
||||
when: sshd_version.stdout >= '6.0' and not ssh_host_key_files
|
||||
when: sshd_version is version('6.0', '>=') and not ssh_host_key_files
|
||||
|
||||
- name: set hostkeys according to openssh-version
|
||||
set_fact:
|
||||
ssh_host_key_files: ['/etc/ssh/ssh_host_rsa_key']
|
||||
when: sshd_version.stdout >= '5.3' and not ssh_host_key_files
|
||||
when: sshd_version is version('5.3', '>=') and not ssh_host_key_files
|
||||
|
||||
###
|
||||
|
||||
- name: set macs according to openssh-version if openssh >= 7.6
|
||||
set_fact:
|
||||
ssh_macs: '{{ ssh_macs_76_default }}'
|
||||
when: sshd_version.stdout >= '7.6' and not ssh_macs
|
||||
when: sshd_version is version('7.6', '>=') and not ssh_macs
|
||||
|
||||
- name: set macs according to openssh-version if openssh >= 6.6
|
||||
set_fact:
|
||||
ssh_macs: '{{ ssh_macs_66_default }}'
|
||||
when: sshd_version.stdout >= '6.6' and not ssh_macs
|
||||
when: sshd_version is version('6.6', '>=') and not ssh_macs
|
||||
|
||||
- name: set macs according to openssh-version
|
||||
set_fact:
|
||||
ssh_macs: '{{ ssh_macs_59_default }}'
|
||||
when: sshd_version.stdout >= '5.9' and not ssh_macs
|
||||
when: sshd_version is version('5.9', '>=') and not ssh_macs
|
||||
|
||||
- name: set macs for Enterprise Linux >= 6.5 (openssh 5.3 with backports)
|
||||
set_fact:
|
||||
ssh_macs: '{{ ssh_macs_53_el_6_5_default }}'
|
||||
when:
|
||||
- ansible_facts.distribution in ['CentOS', 'OracleLinux', 'RedHat']
|
||||
- ansible_facts.distribution_version is version('6.5', '>=')
|
||||
- not ssh_macs
|
||||
|
||||
- name: set macs according to openssh-version
|
||||
set_fact:
|
||||
ssh_macs: '{{ ssh_macs_53_default }}'
|
||||
when: sshd_version.stdout >= '5.3' and not ssh_macs
|
||||
when: sshd_version is version('5.3', '>=') and not ssh_macs
|
||||
|
||||
###
|
||||
|
||||
- name: set ciphers according to openssh-version if openssh >= 6.6
|
||||
set_fact:
|
||||
ssh_ciphers: '{{ ssh_ciphers_66_default }}'
|
||||
when: sshd_version.stdout >= '6.6' and not ssh_ciphers
|
||||
when: sshd_version is version('6.6', '>=') and not ssh_ciphers
|
||||
|
||||
- name: set ciphers according to openssh-version
|
||||
set_fact:
|
||||
ssh_ciphers: '{{ ssh_ciphers_53_default }}'
|
||||
when: sshd_version.stdout >= '5.3' and not ssh_ciphers
|
||||
when: sshd_version is version('5.3', '>=') and not ssh_ciphers
|
||||
|
||||
###
|
||||
|
||||
- name: set kex according to openssh-version if openssh >= 8.0
|
||||
set_fact:
|
||||
ssh_kex: '{{ ssh_kex_80_default }}'
|
||||
when: sshd_version is version('8.0', '>=') and not ssh_kex
|
||||
|
||||
- name: set kex according to openssh-version if openssh >= 6.6
|
||||
set_fact:
|
||||
ssh_kex: '{{ ssh_kex_66_default }}'
|
||||
when: sshd_version.stdout >= '6.6' and not ssh_kex
|
||||
when: sshd_version is version('6.6', '>=') and not ssh_kex
|
||||
|
||||
- name: set kex according to openssh-version
|
||||
set_fact:
|
||||
ssh_kex: '{{ ssh_kex_59_default }}'
|
||||
when: sshd_version.stdout >= '5.9' and not ssh_kex
|
||||
|
||||
when: sshd_version is version('5.9', '>=') and not ssh_kex
|
||||
|
|
|
|||
|
|
@ -2,19 +2,21 @@
|
|||
- name: Set OS dependent variables
|
||||
include_vars: '{{ item }}'
|
||||
with_first_found:
|
||||
- '{{ ansible_distribution }}_{{ ansible_distribution_major_version }}.yml'
|
||||
- '{{ ansible_distribution }}.yml'
|
||||
- '{{ ansible_os_family }}_{{ ansible_distribution_major_version }}.yml'
|
||||
- '{{ ansible_os_family }}.yml'
|
||||
- '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
|
||||
- '{{ ansible_facts.distribution }}.yml'
|
||||
- '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
|
||||
- '{{ ansible_facts.os_family }}.yml'
|
||||
|
||||
- name: get openssh-version
|
||||
shell: ssh -V 2>&1 | sed -r 's/.*_([0-9]*\.[0-9]).*/\1/g'
|
||||
args:
|
||||
executable: /bin/sh
|
||||
command: ssh -V
|
||||
register: sshd_version_raw
|
||||
changed_when: false
|
||||
register: sshd_version
|
||||
check_mode: no
|
||||
|
||||
- name: parse openssh-version
|
||||
set_fact:
|
||||
sshd_version: "{{ sshd_version_raw.stderr | regex_replace('.*_([0-9]*.[0-9]).*', '\\1') }}"
|
||||
|
||||
- name: include tasks to create crypo-vars
|
||||
include_tasks: crypto.yml
|
||||
|
||||
|
|
@ -26,7 +28,7 @@
|
|||
owner: '{{ ssh_owner }}'
|
||||
group: '{{ ssh_group }}'
|
||||
notify: restart sshd
|
||||
when: ssh_server_hardening
|
||||
when: ssh_server_hardening | bool
|
||||
|
||||
- name: create sshd_config and set permissions to root/600
|
||||
template:
|
||||
|
|
@ -35,9 +37,21 @@
|
|||
mode: '0600'
|
||||
owner: '{{ ssh_owner }}'
|
||||
group: '{{ ssh_group }}'
|
||||
validate: '/usr/sbin/sshd -T -f %s'
|
||||
validate: '/usr/sbin/sshd -T -C user=root -C host=localhost -C addr=localhost -f %s'
|
||||
notify: restart sshd
|
||||
when: ssh_server_hardening
|
||||
when: ssh_server_hardening | bool
|
||||
|
||||
- name: disable dynamic MOTD
|
||||
pamd:
|
||||
name: sshd
|
||||
type: session
|
||||
control: optional
|
||||
module_path: pam_motd.so
|
||||
state: absent
|
||||
when:
|
||||
- ssh_server_hardening | bool
|
||||
- ssh_pam_support | bool
|
||||
- not (ssh_print_motd | bool)
|
||||
|
||||
- name: create ssh_config and set permissions to root/644
|
||||
template:
|
||||
|
|
@ -46,38 +60,27 @@
|
|||
mode: '0644'
|
||||
owner: '{{ ssh_owner }}'
|
||||
group: '{{ ssh_group }}'
|
||||
when: ssh_client_hardening
|
||||
when: ssh_client_hardening | bool
|
||||
|
||||
- name: Check if {{ sshd_moduli_file }} contains weak DH parameters
|
||||
shell: awk '$5 < {{ sshd_moduli_minimum }}' {{ sshd_moduli_file }}
|
||||
register: sshd_register_moduli
|
||||
changed_when: false
|
||||
check_mode: no
|
||||
when: ssh_server_hardening | bool
|
||||
|
||||
- name: remove all small primes
|
||||
shell: awk '$5 >= {{ sshd_moduli_minimum }}' {{ sshd_moduli_file }} > {{ sshd_moduli_file }}.new ;
|
||||
[ -r {{ sshd_moduli_file }}.new -a -s {{ sshd_moduli_file }}.new ] && mv {{ sshd_moduli_file }}.new {{ sshd_moduli_file }} || true
|
||||
notify: restart sshd
|
||||
when: sshd_register_moduli.stdout
|
||||
when:
|
||||
- ssh_server_hardening | bool
|
||||
- sshd_register_moduli.stdout
|
||||
|
||||
- name: include tasks to setup ca keys and principals
|
||||
include_tasks: ca_keys_and_principals.yml
|
||||
when: ssh_trusted_user_ca_keys_file != ''
|
||||
|
||||
- name: include tasks to setup 2FA
|
||||
include_tasks: 2fa.yml
|
||||
when:
|
||||
- ssh_use_pam
|
||||
- ssh_challengeresponseauthentication
|
||||
- ssh_google_auth
|
||||
|
||||
- name: test to see if selinux is installed and running
|
||||
command: getenforce
|
||||
register: sestatus
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
check_mode: no
|
||||
when: ssh_trusted_user_ca_keys_file | length > 0
|
||||
|
||||
- name: include selinux specific tasks
|
||||
include_tasks: selinux.yml
|
||||
when: sestatus.rc == 0
|
||||
when: ansible_facts.selinux and ansible_facts.selinux.status == "enabled"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
---
|
||||
|
||||
- include_tasks: hardening.yml
|
||||
when: ssh_hardening_enabled
|
||||
when: ssh_hardening_enabled | bool
|
||||
|
|
|
|||
|
|
@ -1,24 +1,22 @@
|
|||
---
|
||||
- name: install selinux dependencies when selinux is installed on RHEL or Oracle Linux
|
||||
- name: install selinux dependencies when selinux is installed
|
||||
package:
|
||||
name: '{{ item }}'
|
||||
name: '{{ ssh_selinux_packages }}'
|
||||
state: present
|
||||
with_items:
|
||||
- 'policycoreutils-python'
|
||||
- 'checkpolicy'
|
||||
when: ansible_os_family == 'RedHat' or ansible_os_family == 'Oracle Linux'
|
||||
|
||||
- name: install selinux dependencies when selinux is installed on Debian or Ubuntu
|
||||
apt:
|
||||
name: '{{ item }}'
|
||||
- name: "authorize {{ ssh_server_ports }} ports for selinux"
|
||||
seport:
|
||||
ports: '{{ item }}'
|
||||
proto: tcp
|
||||
setype: ssh_port_t
|
||||
state: present
|
||||
with_items:
|
||||
- 'policycoreutils'
|
||||
- 'checkpolicy'
|
||||
when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
|
||||
- "{{ ssh_server_ports }}"
|
||||
|
||||
- name: check if ssh_password module is already installed
|
||||
shell: 'semodule -l | grep ssh_password'
|
||||
shell: 'set -o pipefail && semodule -l | grep ssh_password'
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: ssh_password_module
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
|
|
@ -41,17 +39,18 @@
|
|||
dest: '{{ ssh_custom_selinux_dir }}'
|
||||
|
||||
- name: check and compile policy
|
||||
shell: checkmodule -M -m -o {{ ssh_custom_selinux_dir }}/ssh_password.mod {{ ssh_custom_selinux_dir }}/ssh_password
|
||||
command: checkmodule -M -m -o {{ ssh_custom_selinux_dir }}/ssh_password.mod {{ ssh_custom_selinux_dir }}/ssh_password
|
||||
|
||||
- name: create selinux policy module package
|
||||
shell: semodule_package -o {{ ssh_custom_selinux_dir }}/ssh_password.pp -m {{ ssh_custom_selinux_dir }}/ssh_password.mod
|
||||
command: semodule_package -o {{ ssh_custom_selinux_dir }}/ssh_password.pp -m {{ ssh_custom_selinux_dir }}/ssh_password.mod
|
||||
|
||||
- name: install selinux policy
|
||||
shell: semodule -i {{ ssh_custom_selinux_dir }}/ssh_password.pp
|
||||
command: semodule -i {{ ssh_custom_selinux_dir }}/ssh_password.pp
|
||||
|
||||
when: not ssh_use_pam and sestatus.stdout != 'Disabled' and ssh_password_module.stdout.find('ssh_password') != 0
|
||||
when: not ssh_use_pam | bool and ssh_password_module.stdout.find('ssh_password') != 0
|
||||
|
||||
# The following tasks only get executed when selinux is installed, UsePam is 'yes' and the ssh_password module is installed.
|
||||
- name: remove selinux-policy when Pam is used, because Allowing sshd to read the shadow file directly is considered a potential security risk (http://danwalsh.livejournal.com/12333.html)
|
||||
# See http://danwalsh.livejournal.com/12333.html for more info
|
||||
- name: remove selinux-policy when Pam is used, because Allowing sshd to read the shadow file directly is considered a potential security risk
|
||||
command: semodule -r ssh_password
|
||||
when: ssh_use_pam and ssh_password_module.stdout.find('ssh_password') == 0
|
||||
when: ssh_use_pam | bool and ssh_password_module.stdout.find('ssh_password') == 0
|
||||
|
|
|
|||
|
|
@ -2,7 +2,15 @@
|
|||
|
||||
# This is the ssh client system-wide configuration file.
|
||||
# See ssh_config(5) for more information on any settings used. Comments will be added only to clarify why a configuration was chosen.
|
||||
#
|
||||
|
||||
{% if ssh_custom_options -%}
|
||||
# Custom configuration that overwrites default configuration
|
||||
# ==========================================================
|
||||
{% for line in ssh_custom_options %}
|
||||
{{ line }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
# Basic configuration
|
||||
# ===================
|
||||
|
||||
|
|
@ -82,7 +90,7 @@ ForwardX11 no
|
|||
|
||||
# Never use host-based authentication. It can be exploited.
|
||||
HostbasedAuthentication no
|
||||
{% if sshd_version.stdout | float < 7.4 -%}
|
||||
{% if sshd_version is version('7.6', '<') %}
|
||||
RhostsRSAAuthentication no
|
||||
# Enable RSA authentication via identity files.
|
||||
RSAAuthentication yes
|
||||
|
|
@ -111,7 +119,7 @@ Compression yes
|
|||
#EscapeChar ~
|
||||
#VisualHostKey yes
|
||||
|
||||
{% if sshd_version.stdout | float <= 7.1 -%}
|
||||
{% if sshd_version is version('7.1', '<=') %}
|
||||
# Disable experimental client roaming. This is known to cause potential issues with secrets being disclosed to malicious servers and defaults to being disabled.
|
||||
UseRoaming {{ 'yes' if ssh_client_roaming else 'no' }}
|
||||
{% endif %}
|
||||
|
|
|
|||
|
|
@ -3,11 +3,19 @@
|
|||
# This is the ssh client system-wide configuration file.
|
||||
# See sshd_config(5) for more information on any settings used. Comments will be added only to clarify why a configuration was chosen.
|
||||
|
||||
{% if sshd_custom_options -%}
|
||||
# Custom configuration that overwrites default configuration
|
||||
# ==========================================================
|
||||
{% for line in sshd_custom_options -%}
|
||||
{{ line }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
# Basic configuration
|
||||
# ===================
|
||||
|
||||
# Either disable or only allowssh root login via certificates.
|
||||
PermitRootLogin {{ 'without-password' if (ssh_allow_root_with_key|bool) else 'no' }}
|
||||
# Either disable or only allow root login via certificates.
|
||||
PermitRootLogin {{ ssh_permit_root_login }}
|
||||
|
||||
# Define which port sshd should listen to. Default to `22`.
|
||||
{% for port in ssh_server_ports -%}
|
||||
|
|
@ -24,9 +32,14 @@ ListenAddress {{address}}
|
|||
|
||||
# List HostKeys here.
|
||||
{% for key in ssh_host_key_files -%}
|
||||
HostKey {{key}} # Req 20
|
||||
HostKey {{key}}
|
||||
{% endfor %}
|
||||
|
||||
# Specifies the host key algorithms that the server offers.
|
||||
{% if sshd_version is version('5.8', '>=') %}
|
||||
{{ "HostKeyAlgorithms "+ssh_host_key_algorithms| join(',') if ssh_host_key_algorithms else "HostKeyAlgorithms"|comment }}
|
||||
{% endif %}
|
||||
|
||||
# Security configuration
|
||||
# ======================
|
||||
|
||||
|
|
@ -34,11 +47,11 @@ HostKey {{key}} # Req 20
|
|||
Protocol 2
|
||||
|
||||
# Make sure sshd checks file modes and ownership before accepting logins. This prevents accidental misconfiguration.
|
||||
StrictModes yes
|
||||
StrictModes {{ 'yes' if (sshd_strict_modes|bool) else 'no' }}
|
||||
|
||||
# Logging, obsoletes QuietMode and FascistLogging
|
||||
SyslogFacility AUTH
|
||||
LogLevel VERBOSE
|
||||
SyslogFacility {{ sshd_syslog_facility }}
|
||||
LogLevel {{ sshd_log_level }}
|
||||
|
||||
# Cryptography
|
||||
# ------------
|
||||
|
|
@ -75,8 +88,11 @@ LogLevel VERBOSE
|
|||
# --------------
|
||||
|
||||
# Secure Login directives.
|
||||
{% if sshd_version.stdout | float < 7.5 -%}
|
||||
UsePrivilegeSeparation {% if (ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6') or (ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version <= '6') -%}{{ssh_ps53}}{% else %}{{ssh_ps59}}{% endif %}
|
||||
{% if sshd_version is version('7.4', '<') %}
|
||||
UseLogin no
|
||||
{% endif %}
|
||||
{% if sshd_version is version('7.5', '<') %}
|
||||
UsePrivilegeSeparation {% if (ansible_facts.distribution == 'Debian' and ansible_facts.distribution_major_version <= '6') or (ansible_facts.os_family in ['Oracle Linux', 'RedHat'] and ansible_facts.distribution_major_version <= '6' and not ansible_facts.distribution == 'Amazon') -%}{{ssh_ps53}}{% else %}{{ssh_ps59}}{% endif %}
|
||||
{% endif %}
|
||||
|
||||
LoginGraceTime 30s
|
||||
|
|
@ -96,14 +112,11 @@ HostbasedAuthentication no
|
|||
{% if ssh_pam_support -%}
|
||||
UsePAM {{ 'yes' if (ssh_use_pam|bool) else 'no' }}
|
||||
{% endif %}
|
||||
{% if ssh_google_auth %}
|
||||
# Force public key auth then ask for google auth code
|
||||
AuthenticationMethods publickey,keyboard-interactive
|
||||
{% endif %}
|
||||
|
||||
# Force public key auth then ask for pam device input
|
||||
{% if ssh_pam_device %}
|
||||
AuthenticationMethods publickey,keyboard-interactive:pam
|
||||
# Set AuthenticationMethods per default to publickey
|
||||
# AuthenticationMethods was introduced in OpenSSH 6.2 - https://www.openssh.com/txt/release-6.2
|
||||
{% if sshd_version is version('6.2', '>=') %}
|
||||
AuthenticationMethods {{ sshd_authenticationmethods }}
|
||||
{% endif %}
|
||||
|
||||
# Disable password-based authentication, it can allow for potentially easier brute-force attacks.
|
||||
|
|
@ -119,11 +132,9 @@ KerberosTicketCleanup yes
|
|||
#KerberosGetAFSToken no
|
||||
{% endif %}
|
||||
|
||||
{% if ssh_gssapi_support -%}
|
||||
# Only enable GSSAPI authentication if it is configured.
|
||||
GSSAPIAuthentication no
|
||||
GSSAPIAuthentication {{ 'yes' if ssh_gssapi_support else 'no' }}
|
||||
GSSAPICleanupCredentials yes
|
||||
{% endif %}
|
||||
|
||||
# In case you don't use PAM (`UsePAM no`), you can alternatively restrict users and groups here. For key-based authentication this is not necessary, since all keys must be explicitely enabled.
|
||||
{% if ssh_deny_users -%}
|
||||
|
|
@ -142,15 +153,15 @@ DenyGroups {{ssh_deny_groups}}
|
|||
AllowGroups {{ssh_allow_groups}}
|
||||
{% endif %}
|
||||
|
||||
{% if ssh_authorized_keys_file %}
|
||||
{% if ssh_authorized_keys_file -%}
|
||||
AuthorizedKeysFile {{ ssh_authorized_keys_file }}
|
||||
{% endif %}
|
||||
|
||||
{% if ssh_trusted_user_ca_keys_file %}
|
||||
{% if ssh_trusted_user_ca_keys_file -%}
|
||||
TrustedUserCAKeys {{ ssh_trusted_user_ca_keys_file }}
|
||||
{% if ssh_authorized_principals_file %}
|
||||
{% if ssh_authorized_principals_file -%}
|
||||
AuthorizedPrincipalsFile {{ ssh_authorized_principals_file }}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
|
||||
# Network
|
||||
|
|
@ -168,19 +179,23 @@ PermitTunnel {{ 'yes' if (ssh_permit_tunnel|bool) else 'no' }}
|
|||
|
||||
# Disable forwarding tcp connections.
|
||||
# no real advantage without denied shell access
|
||||
AllowTcpForwarding {{ 'yes' if (ssh_allow_tcp_forwarding|bool) else 'no' }}
|
||||
{% if sshd_version is version('6.2', '>=') %}
|
||||
AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no', 'local', 'all')) else 'no' }}
|
||||
{% else %}
|
||||
AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no')) else 'no' }}
|
||||
{% endif %}
|
||||
|
||||
# Disable agent formwarding, since local agent could be accessed through forwarded connection.
|
||||
# Disable agent forwarding, since local agent could be accessed through forwarded connection.
|
||||
# no real advantage without denied shell access
|
||||
AllowAgentForwarding {{ 'yes' if (ssh_allow_agent_forwarding|bool) else 'no' }}
|
||||
|
||||
{% if ssh_gateway_ports|bool %}
|
||||
{% if ssh_gateway_ports|bool -%}
|
||||
# Port forwardings are forced to bind to the wildcard address
|
||||
GatewayPorts yes
|
||||
{% elif ssh_gateway_ports == 'clientspecified' %}
|
||||
{% elif ssh_gateway_ports == 'clientspecified' -%}
|
||||
# Clients allowed to specify which address to bind port forwardings to
|
||||
GatewayPorts clientspecified
|
||||
{% else %}
|
||||
{% else -%}
|
||||
# Do not allow remote port forwardings to bind to non-loopback addresses.
|
||||
GatewayPorts no
|
||||
{% endif %}
|
||||
|
|
@ -192,13 +207,10 @@ X11UseLocalhost yes
|
|||
# User environment configuration
|
||||
# ==============================
|
||||
|
||||
{% if ssh_server_permit_environment_vars %}
|
||||
PermitUserEnvironment yes
|
||||
{% for item in ssh_server_permit_environment_vars %}
|
||||
AcceptEnv {{ item }}
|
||||
{% endfor %}
|
||||
{% else %}
|
||||
PermitUserEnvironment no
|
||||
PermitUserEnvironment {{ ssh_server_permit_environment_vars }}
|
||||
|
||||
{% if ssh_server_accept_env_vars -%}
|
||||
AcceptEnv {{ ssh_server_accept_env_vars }}
|
||||
{% endif %}
|
||||
|
||||
# Misc. configuration
|
||||
|
|
@ -210,31 +222,31 @@ UseDNS {{ 'yes' if (ssh_use_dns|bool) else 'no' }}
|
|||
|
||||
PrintMotd {{ 'yes' if (ssh_print_motd|bool) else 'no' }}
|
||||
|
||||
{% if ansible_os_family != 'FreeBSD' %}
|
||||
{% if ansible_facts.os_family != 'FreeBSD' %}
|
||||
PrintLastLog {{ 'yes' if (ssh_print_last_log|bool) else 'no' }}
|
||||
{% endif %}
|
||||
|
||||
Banner {{ '/etc/ssh/banner.txt' if (ssh_banner|bool) else 'none' }}
|
||||
|
||||
{% if ansible_os_family == 'Debian' %}
|
||||
{% if ansible_facts.os_family == 'Debian' -%}
|
||||
DebianBanner {{ 'yes' if (ssh_print_debian_banner|bool) else 'no' }}
|
||||
{% endif %}
|
||||
|
||||
# Reject keys that are explicitly blacklisted
|
||||
RevokedKeys /etc/ssh/revoked_keys
|
||||
|
||||
{% if sftp_enabled %}
|
||||
{% if sftp_enabled -%}
|
||||
# SFTP matching configuration
|
||||
# ===========================
|
||||
# Configuration, in case SFTP is used
|
||||
# override default of no subsystems
|
||||
# Subsystem sftp /opt/app/openssh5/libexec/sftp-server
|
||||
|
||||
Subsystem sftp internal-sftp -l INFO -f LOCAL6
|
||||
Subsystem sftp internal-sftp -l INFO -f LOCAL6 -u {{ sftp_umask }}
|
||||
|
||||
# These lines must appear at the *end* of sshd_config
|
||||
Match Group sftponly
|
||||
ForceCommand internal-sftp -l INFO -f LOCAL6
|
||||
ForceCommand internal-sftp -l INFO -f LOCAL6 -u {{ sftp_umask }}
|
||||
{% if sftp_chroot %}
|
||||
ChrootDirectory {{ sftp_chroot_dir }}
|
||||
{% endif %}
|
||||
|
|
@ -245,23 +257,38 @@ Match Group sftponly
|
|||
X11Forwarding no
|
||||
{% endif %}
|
||||
|
||||
{% if ssh_server_match_group %}
|
||||
{% if ssh_server_match_address -%}
|
||||
# Address matching configuration
|
||||
# ============================
|
||||
|
||||
{% for item in ssh_server_match_address -%}
|
||||
Match Address {{ item.address }}
|
||||
{% for rule in item.rules %}
|
||||
{{ rule | indent(4) }}
|
||||
{% endfor %}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
{% if ssh_server_match_group -%}
|
||||
# Group matching configuration
|
||||
# ============================
|
||||
|
||||
{% for item in ssh_server_match_group %}
|
||||
{% for item in ssh_server_match_group -%}
|
||||
Match Group {{ item.group }}
|
||||
{{ item.rules | indent(4) }}
|
||||
{% for rule in item.rules %}
|
||||
{{ rule | indent(4) }}
|
||||
{% endfor %}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
|
||||
{% if ssh_server_match_user %}
|
||||
{% if ssh_server_match_user -%}
|
||||
# User matching configuration
|
||||
# ===========================
|
||||
|
||||
{% for item in ssh_server_match_user %}
|
||||
{% for item in ssh_server_match_user -%}
|
||||
Match User {{ item.user }}
|
||||
{{ item.rules | indent(4) }}
|
||||
{% for rule in item.rules %}
|
||||
{{ rule | indent(4) }}
|
||||
{% endfor %}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
|
|
|||
|
|
@ -2,20 +2,30 @@
|
|||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
||||
hosts: localhost
|
||||
pre_tasks:
|
||||
- package: name="{{item}}" state=present
|
||||
with_items:
|
||||
- "openssh-clients"
|
||||
- "openssh-server"
|
||||
- name: use python3
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- package: name="{{ packages }}" state=present
|
||||
vars:
|
||||
packages:
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
- libselinux-python
|
||||
ignore_errors: true
|
||||
- apt: name="{{item}}" state=present update_cache=true
|
||||
with_items:
|
||||
- "openssh-client"
|
||||
- "openssh-server"
|
||||
- apt: name="{{packages}}" state=present update_cache=true
|
||||
vars:
|
||||
packages:
|
||||
- "openssh-client"
|
||||
- "openssh-server"
|
||||
ignore_errors: true
|
||||
- file: path="/var/run/sshd" state=directory
|
||||
- name: create ssh host keys
|
||||
command: "ssh-keygen -A"
|
||||
when: not ((ansible_os_family in ['Oracle Linux', 'RedHat']) and ansible_distribution_major_version < '7')
|
||||
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
|
||||
ansible_facts.distribution == "Fedora" or
|
||||
ansible_facts.distribution == "Amazon"
|
||||
|
||||
roles:
|
||||
- ansible-ssh-hardening
|
||||
|
|
|
|||
|
|
@ -2,30 +2,40 @@
|
|||
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
|
||||
hosts: localhost
|
||||
pre_tasks:
|
||||
- package: name="{{item}}" state=present
|
||||
with_items:
|
||||
- "openssh-clients"
|
||||
- "openssh-server"
|
||||
- name: use python3
|
||||
set_fact:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
when: ansible_facts.distribution == 'Fedora'
|
||||
|
||||
- package: name="{{ packages }}" state=present
|
||||
vars:
|
||||
packages:
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
- libselinux-python
|
||||
ignore_errors: true
|
||||
- apt: name="{{item}}" state=present update_cache=true
|
||||
with_items:
|
||||
- "openssh-client"
|
||||
- "openssh-server"
|
||||
- apt: name="{{packages}}" state=present update_cache=true
|
||||
vars:
|
||||
packages:
|
||||
- "openssh-client"
|
||||
- "openssh-server"
|
||||
ignore_errors: true
|
||||
- file: path="/var/run/sshd" state=directory
|
||||
- name: create ssh host keys
|
||||
command: "ssh-keygen -A"
|
||||
when: not ((ansible_os_family in ['Oracle Linux', 'RedHat']) and ansible_distribution_major_version < '7')
|
||||
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
|
||||
ansible_facts.distribution == "Fedora" or
|
||||
ansible_facts.distribution == "Amazon"
|
||||
|
||||
roles:
|
||||
- ansible-ssh-hardening
|
||||
vars:
|
||||
network_ipv6_enable: true
|
||||
ssh_allow_root_with_key: true
|
||||
ssh_allow_tcp_forwarding: true
|
||||
ssh_allow_tcp_forwarding: 'yes'
|
||||
ssh_gateway_ports: true
|
||||
ssh_allow_agent_forwarding: true
|
||||
ssh_server_permit_environment_vars: ['PWD','HTTP_PROXY']
|
||||
ssh_server_permit_environment_vars: 'yes'
|
||||
ssh_server_accept_env_vars: 'PWD HTTP_PROXY'
|
||||
ssh_client_alive_interval: 100
|
||||
ssh_client_alive_count: 10
|
||||
ssh_client_password_login: true
|
||||
|
|
@ -37,6 +47,7 @@
|
|||
ssh_deny_groups: 'foo bar'
|
||||
ssh_authorized_keys_file: '/etc/ssh/authorized_keys/%u'
|
||||
ssh_max_auth_retries: 10
|
||||
ssh_permit_root_login: "without-password"
|
||||
ssh_permit_tunnel: true
|
||||
ssh_print_motd: true
|
||||
ssh_print_last_log: true
|
||||
|
|
@ -45,12 +56,21 @@
|
|||
sftp_enabled: true
|
||||
sftp_chroot: true
|
||||
#ssh_server_enabled: false
|
||||
ssh_server_match_address:
|
||||
- address: '192.168.1.1/24'
|
||||
rules:
|
||||
- 'AllowTcpForwarding yes'
|
||||
- 'AllowAgentForwarding no'
|
||||
ssh_server_match_group:
|
||||
- group: 'root'
|
||||
rules: 'AllowTcpForwarding yes'
|
||||
rules:
|
||||
- 'AllowTcpForwarding yes'
|
||||
- 'AllowAgentForwarding no'
|
||||
ssh_server_match_user:
|
||||
- user: 'root'
|
||||
rules: 'AllowTcpForwarding yes'
|
||||
rules:
|
||||
- 'AllowTcpForwarding yes'
|
||||
- 'AllowAgentForwarding no'
|
||||
ssh_remote_hosts:
|
||||
- names: ['example.com', 'example2.com']
|
||||
options: ['Port 2222', 'ForwardAgent yes']
|
||||
|
|
@ -63,8 +83,13 @@
|
|||
ssh_trusted_user_ca_keys:
|
||||
- '# ssh-rsa ...'
|
||||
ssh_authorized_principals_file: '/etc/ssh/auth_principals/%u'
|
||||
ssh_authorized_principals :
|
||||
ssh_authorized_principals:
|
||||
- { path: '/etc/ssh/auth_principals/root', principals: [ 'root' ], owner: "{{ ssh_owner }}", group: "{{ ssh_group }}", directoryowner: "{{ ssh_owner }}", directorygroup: "{{ ssh_group}}" }
|
||||
ssh_host_key_algorithms:
|
||||
- ssh-ed25519
|
||||
- rsa-sha2-512
|
||||
- rsa-sha2-256
|
||||
- ssh-rsa
|
||||
ssh_macs:
|
||||
- hmac-sha2-512
|
||||
- hmac-sha2-256
|
||||
|
|
@ -76,3 +101,7 @@
|
|||
ssh_kex:
|
||||
- diffie-hellman-group-exchange-sha256
|
||||
- diffie-hellman-group-exchange-sha1
|
||||
ssh_custom_options:
|
||||
- "Include /etc/ssh/ssh_config.d/*"
|
||||
sshd_custom_options:
|
||||
- "AcceptEnv LANG"
|
||||
|
|
|
|||
|
|
@ -1,3 +1,6 @@
|
|||
sshd_service_name: ssh
|
||||
ssh_owner: root
|
||||
ssh_group: root
|
||||
ssh_selinux_packages:
|
||||
- policycoreutils-python
|
||||
- checkpolicy
|
||||
|
|
|
|||
6
ansible/roles/dev-sec.ssh-hardening/vars/Fedora.yml
Normal file
6
ansible/roles/dev-sec.ssh-hardening/vars/Fedora.yml
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
sshd_service_name: sshd
|
||||
ssh_owner: root
|
||||
ssh_group: root
|
||||
ssh_selinux_packages:
|
||||
- python3-policycoreutils
|
||||
- checkpolicy
|
||||
|
|
@ -1,3 +1,6 @@
|
|||
sshd_service_name: sshd
|
||||
ssh_owner: root
|
||||
ssh_group: root
|
||||
ssh_selinux_packages:
|
||||
- policycoreutils-python
|
||||
- checkpolicy
|
||||
|
|
|
|||
|
|
@ -1,3 +1,6 @@
|
|||
sshd_service_name: sshd
|
||||
ssh_owner: root
|
||||
ssh_group: root
|
||||
ssh_selinux_packages:
|
||||
- policycoreutils-python
|
||||
- checkpolicy
|
||||
|
|
|
|||
6
ansible/roles/dev-sec.ssh-hardening/vars/RedHat_8.yml
Normal file
6
ansible/roles/dev-sec.ssh-hardening/vars/RedHat_8.yml
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
sshd_service_name: sshd
|
||||
ssh_owner: root
|
||||
ssh_group: root
|
||||
ssh_selinux_packages:
|
||||
- python3-policycoreutils
|
||||
- checkpolicy
|
||||
5
ansible/roles/docker-compose/.gitignore
vendored
5
ansible/roles/docker-compose/.gitignore
vendored
|
|
@ -1,5 +0,0 @@
|
|||
*.retry
|
||||
.vagrant
|
||||
tests/_roles
|
||||
!tests/_roles/.gitkeep
|
||||
.DS_Store
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
---
|
||||
language: python
|
||||
python: "2.7"
|
||||
|
||||
sudo: required
|
||||
dist: trusty
|
||||
|
||||
addons:
|
||||
apt:
|
||||
sources:
|
||||
- sourceline: ppa:ansible/ansible
|
||||
packages:
|
||||
- ansible
|
||||
|
||||
before_install: cd tests
|
||||
|
||||
install:
|
||||
- ansible-galaxy install -r roles.yml
|
||||
|
||||
script:
|
||||
- ansible-playbook -i localhost test.yml
|
||||
|
||||
notifications:
|
||||
webhooks: https://galaxy.ansible.com/api/v1/notifications/
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
MIT License
|
||||
|
||||
Copyright (c) 2016 Suzuki Shunsuke
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
|
|
@ -1,39 +0,0 @@
|
|||
docker-compose
|
||||
===============
|
||||
|
||||
[](https://travis-ci.org/suzuki-shunsuke/ansible-docker-compose)
|
||||
|
||||
Install Docker Compose.
|
||||
|
||||
https://galaxy.ansible.com/suzuki-shunsuke/docker-compose/
|
||||
|
||||
Requirements
|
||||
------------
|
||||
|
||||
* Docker Engine
|
||||
|
||||
Role Variables
|
||||
--------------
|
||||
|
||||
* docker_compose_path: the path where docker-compose is installed. The default is /usr/local/bin
|
||||
* docker_compose_mode: the permission of the docker-compose. The default is 0755
|
||||
* docker_compose_version: docker-compose version. The default is `1.11.2`
|
||||
|
||||
Dependencies
|
||||
------------
|
||||
|
||||
Nothing.
|
||||
|
||||
Example Playbook
|
||||
----------------
|
||||
|
||||
```yaml
|
||||
- hosts: servers
|
||||
roles:
|
||||
- role: suzuki-shunsuke.docker-compose
|
||||
```
|
||||
|
||||
License
|
||||
-------
|
||||
|
||||
MIT
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
---
|
||||
# defaults file for docker-compose
|
||||
docker_compose_path: /usr/local/bin
|
||||
docker_compose_mode: 0755
|
||||
docker_compose_version: 1.11.2
|
||||
|
|
@ -1 +0,0 @@
|
|||
{install_date: 'Mon Apr 24 12:06:46 2017', version: 1.2.0}
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
galaxy_info:
|
||||
author: Suzuki Shunsuke
|
||||
description: Install Docker Compose
|
||||
license: MIT
|
||||
min_ansible_version: 1.2
|
||||
github_branch: master
|
||||
platforms:
|
||||
- name: GenericUnix
|
||||
versions:
|
||||
- all
|
||||
galaxy_tags:
|
||||
- docker
|
||||
- docker compose
|
||||
|
||||
dependencies: []
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
---
|
||||
# tasks file for docker-compose
|
||||
- name: Install docker-compose
|
||||
get_url:
|
||||
url: https://github.com/docker/compose/releases/download/{{docker_compose_version}}/docker-compose-{{ansible_system}}-{{ansible_architecture}}
|
||||
dest: "{{'{}/docker-compose'.format(docker_compose_path)}}"
|
||||
mode: "{{docker_compose_mode}}"
|
||||
12
ansible/roles/docker-compose/tests/Vagrantfile
vendored
12
ansible/roles/docker-compose/tests/Vagrantfile
vendored
|
|
@ -1,12 +0,0 @@
|
|||
# -*- mode: ruby -*-
|
||||
# vi: set ft=ruby :
|
||||
|
||||
Vagrant.configure(2) do |config|
|
||||
config.vm.box = "bento/ubuntu-16.04"
|
||||
config.vm.provider "virtualbox" do |vb|
|
||||
vb.memory = "2048"
|
||||
end
|
||||
config.vm.provision "ansible" do |ansible|
|
||||
ansible.playbook = "./test.yml"
|
||||
end
|
||||
end
|
||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue