ungleich-public
/
public-health-ch
6
1
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity
public-health-ch/ansible/roles/dev-sec.os-hardening/CHANGELOG.md

36 KiB
Raw Blame History

Changelog

6.2.0 (2020-08-16)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • Inconsistent use of role vars/role defaults #284

Closed issues:

  • Consider using find module instead of shell #293
  • Optimize logical OR in when clause #292
  • vfat added to dev-sec.conf, but efi is used #288
  • OpenSUSE Support #249

Merged pull requests:

6.1.0 (2020-07-21)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • Is it safe to use on Debian 10? The build is failing. #281

Closed issues:

  • The state of the galaxy release #269

Merged pull requests:

6.0.3 (2020-06-06)

Full Changelog

Implemented enhancements:

6.0.2 (2020-06-02)

Full Changelog

Implemented enhancements:

6.0.1 (2020-05-09)

Full Changelog

Implemented enhancements:

6.0.0 (2020-05-05)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • /etc/login.defs alters centos 7/8 default values #265
  • Invalid Conditionals in user_accounts.yml #255
  • auth-system related files are created for non-RHEL systems e.g. Debian #247
  • NSA website links are stale #227
  • Running ansible on python3 throughs "TypeError: '<=' not supported between instances of 'str' and 'int'" #223
  • lots of
  • Add a "don't fail on error" switch ? #148
  • Addressing issue #255 #258 (ljkimmel)
  • Fix #247, cleanup conditions #248 (fernandezcuesta)
  • Fix error on applying the sysctl vars on containers #243 (ghost)
  • Update location of NSA RHEL 5 Guide #235 (jaredledvina)

5.2.1 (2019-06-09)

Full Changelog

Implemented enhancements:

  • Fix deprecation warnings in Ansible 2.8 #224 (Normo)
  • add docs to find-task in minimize access. fix #219 #220 (rndmh3ro)

Fixed bugs:

  • squash\_actions deprecation warning #218

5.2.0 (2019-05-04)

Full Changelog

Implemented enhancements:

  • Speed up "minimize access on found files" task #208
  • Fedora support? #163
  • remove eol'd OS and add new #217 (rndmh3ro)
  • Add note about docker under warning #214 (ChrisMcKee)
  • change minimize access tasks to speed them up #209 (rndmh3ro)
  • Added fedora support #206 (jonaswre)
  • Pass package list directly to apt and yum modules without using with_items loop #200 (Normo)

Fixed bugs:

5.1.0 (2018-10-17)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • auditd causing v5.0 to fail on unpriviledged LXC's #191
  • Setting os_security_users_allow has no effect #175
  • add /usr/bin/su to suid_guid whitelist #199 (ccolic)
  • ensure that permissions to su-binary are not restricted to root user and group only, if os_security_users_allow contains the value change_user #197 (szEvEz)

5.0.0 (2018-09-02)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • minimize_access: maximum recursion depth exceeded on Ansible 2.5 #171
  • wrong permissions passwdqc #170
  • Update deprecated include statements #166
  • Strongly recommend against disabling vfat by default #162
  • System completely unresponsive after role execution #145
  • do not install passwdqc on amazon linux #189 (rndmh3ro)
  • add back run opts for debian 8 in travis #184 (rndmh3ro)
  • Fix core dump config file creation when core dumps are disabled #182 (Normo)
  • change minimize access method #181 (rndmh3ro)

4.3.0 (2018-01-03)

Full Changelog

Implemented enhancements:

  • Update some RH settings in this role #155
  • Removal of core dump hardening configuration if core dumps are allowed #129
  • add amazon linux testing #160 (rndmh3ro)
  • Don't create home for system accounts #156 (oakey-b1)
  • Prevent disabling of filesystems via whitelist #153 (manuelprinz)
  • Add kernel hardening settings from Ubuntu /etc/sysctl.d #150 (kravietz)
  • Removal of core dump hardening configuration if core dumps are allowed #146 (martinbydefault)
  • add missing sysctl parameter #143 (rndmh3ro)
  • update readme #139 (rndmh3ro)
  • add modprobe template, control os-10 #138 (rndmh3ro)

Fixed bugs:

Closed issues:

  • ansible hardening fails on ubuntu 16.04 with msg": "ERROR! 'sysctl_rhel_config' is undefined #147
  • Enhancement: Test with TestInfra and Molecule #128

Merged pull requests:

4.3.1 (2017-09-13)

Full Changelog

Fixed bugs:

  • os_security_kernel_enable_sysrq is not implemented #115

4.2.0 (2017-08-08)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • Why is rsync removed? #141
  • playbook makes OS undetectable #124
  • Centos7/RHEL7: Exec shield is enabled by default and not manageable anymore by sysctl.conf #118
  • Remove rsync from package blacklist #142 (duk3luk3)

Merged pull requests:

  • remove execshield sysctl-parameter on rhel7 #119 (rndmh3ro)

4.1.0 (2017-06-27)

Full Changelog

Fixed bugs:

  • Change system accounts not on the user provided ignore-list items are not JSON serializable #125
  • Could not find gem 'ruby \>= 2.1.0' #116
  • The task sysctl fails when /etc/initramfs-tools is not present #111
  • Deprecation warning always_run #103

Closed issues:

  • Enhancement: Pin python dependencies for development and testing #127
  • Update readme to include baselines #122

Merged pull requests:

  • Converts set to JSON-serializable list #126 (pestaa)
  • add more sysctl settings, allow overwriting #120 (rndmh3ro)

4.0.0 (2017-03-14)

Full Changelog

Implemented enhancements:

  • Description of the Ansible roles of dev-sec says "This Ansible playbook" #97
  • install initramfs-tools #114 (rndmh3ro)
  • omit empty variables #106 (rndmh3ro)

Fixed bugs:

  • The role fails when conditionally included #105

Closed issues:

  • Error running on RHEL 7 due to syntax issues #112
  • disable password age #109

Merged pull requests:

3.2.0 (2016-10-24)

Full Changelog

Fixed bugs:

  • CentOS 7 selinux dependencies #102
  • ubuntu xenial warning during activate gpg-check for yum-repos #99
  • rhel_system_auth.j2 is still using pam_passwdqc.so for CentOS 7 #98
  • Enable pam_pwquality in rhel-family > 7 #73
  • "irc" user always changed after reboot #53

Merged pull requests:

3.1.0 (2016-08-03)

Full Changelog

3.1 (2016-07-27)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • Centos 7.1 fails at [Change various sysctl-settings on rhel-hosts...] #74
  • Hardening fails on Centos 7.1 at task 'minimize access' #71

Closed issues:

  • Permissions on /etc/shadow can lock out GUI users #86
  • network related sysctl rewritten by ufw in ubuntu #82
  • ansible >= 2.0 complains: Using bare variables is deprecated #78

Merged pull requests:

  • Fix a formatting issue in readme. #92 (vivekagr)
  • Permits overriding permissions on /etc/shadow #89 (conorsch)

3.0.0 (2016-03-13)

Full Changelog

Implemented enhancements:

Fixed bugs:

Closed issues:

  • Hardening fails on Centos 7.1 at task 'remove suid/sgid bit from all binaries except in system and user whitelist' #72
  • ansible 2.0 | "remove suid/sgid" task fails #64
  • Custom sysctl #50

Merged pull requests:

2.0.0 (2015-11-28)

Full Changelog

Closed issues:

  • Fix directory structure. #48
  • pam auth update error #47

Merged pull requests:

1.0.0 (2015-09-01)

Full Changelog

Closed issues:

  • ansible-os-hardening/tasks/minimize_access.yml #38
  • Role configuration. vars/main.yml? #34
  • Sysctl reloading #18
  • Add conditions for disabling of ip forwarding #15
  • Disable System Accounts #6

Merged pull requests:

* This Changelog was automatically generated by github_changelog_generator