Skip to content

Commit 29f8a2f

Browse files
schurzischurzi
authored
add testing for OpenBSD and FreeBSD (#642)
* add testing for OpenBSD and FreeBSD Signed-off-by: Martin Schurz <[email protected]> * make python work Signed-off-by: Martin Schurz <[email protected]> * remove jinja template ... Signed-off-by: Martin Schurz <[email protected]> * make verify work Signed-off-by: Martin Schurz <[email protected]> * correct verify Signed-off-by: Martin Schurz <[email protected]> * correct verify Signed-off-by: Martin Schurz <[email protected]> * correct verify Signed-off-by: Martin Schurz <[email protected]> * correct verify Signed-off-by: Martin Schurz <[email protected]> * use right vm name for connect Signed-off-by: Martin Schurz <[email protected]> * add a bit of documentation Signed-off-by: Martin Schurz <[email protected]> * remove sudo Signed-off-by: Martin Schurz <[email protected]> * add weird OpenSBD workaround Signed-off-by: Martin Schurz <[email protected]> * make verify playbook more consistent Signed-off-by: Martin Schurz <[email protected]> * rename nonlinux to BSD Signed-off-by: Martin Schurz <[email protected]> * use openbsd7 for testing Signed-off-by: Martin Schurz <[email protected]> * correct use openbsd7 everywhere Signed-off-by: Martin Schurz <[email protected]> * add waivers Signed-off-by: Martin Schurz <[email protected]> * update waiver descriptions Signed-off-by: Martin Schurz <[email protected]> * use docker for inspec Signed-off-by: Martin Schurz <[email protected]> * keep looking right ;) Signed-off-by: Martin Schurz <[email protected]> * correct path to waivers Signed-off-by: Martin Schurz <[email protected]> * use ephemeral directory in docker Signed-off-by: Martin Schurz <[email protected]> * use bsd inspec profile Signed-off-by: Martin Schurz <[email protected]> * remove openbsd workaround Signed-off-by: Martin Schurz <[email protected]> * re-add openbsd workaround Signed-off-by: Martin Schurz <[email protected]> * commit suggestions Signed-off-by: Martin Schurz <[email protected]> * add supportet OS to metadata Signed-off-by: Martin Schurz <[email protected]> * use current python Signed-off-by: Martin Schurz <[email protected]> --------- Signed-off-by: Martin Schurz <[email protected]>
1 parent b01f22b commit 29f8a2f

File tree

10 files changed

+270
-0
lines changed

10 files changed

+270
-0
lines changed

‎.github/workflows/ssh_hardening_bsd.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
name: "devsec.ssh_hardening BSD"
3+
on: # yamllint disable-line rule:truthy
4+
workflow_dispatch:
5+
push:
6+
branches: [master]
7+
paths:
8+
- 'roles/ssh_hardening/**'
9+
- 'molecule/ssh_hardening_bsd/**'
10+
- '.github/workflows/ssh_hardening_bsd.yml'
11+
pull_request:
12+
branches: [master]
13+
paths:
14+
- 'roles/ssh_hardening/**'
15+
- 'molecule/ssh_hardening_bsd/**'
16+
- '.github/workflows/ssh_hardening_bsd.yml'
17+
schedule:
18+
- cron: '0 6 * * 5'
19+
20+
concurrency:
21+
group: >-
22+
${{ github.workflow }}-${{
23+
github.event.pull_request.number || github.sha
24+
}}
25+
cancel-in-progress: true
26+
27+
jobs:
28+
build:
29+
runs-on: self-hosted
30+
env:
31+
PY_COLORS: 1
32+
ANSIBLE_FORCE_COLOR: 1
33+
strategy:
34+
fail-fast: false
35+
matrix:
36+
molecule_distro:
37+
- openbsd7
38+
- freebsd12
39+
steps:
40+
- name: Checkout repo
41+
uses: actions/checkout@v3
42+
with:
43+
path: ansible_collections/devsec/hardening
44+
submodules: true
45+
46+
- name: Test with molecule
47+
run: |
48+
molecule --version
49+
molecule test -s ssh_hardening_bsd
50+
env:
51+
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
52+
working-directory: ansible_collections/devsec/hardening

‎molecule/ssh_hardening_bsd/INSTALL.rst‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
*******
2+
Docker driver installation guide
3+
*******
4+
5+
Requirements
6+
============
7+
8+
* Docker Engine
9+
10+
Install
11+
=======
12+
13+
Please refer to the `Virtual environment`_ documentation for installation best
14+
practices. If not using a virtual environment, please consider passing the
15+
widely recommended `'--user' flag`_ when invoking ``pip``.
16+
17+
.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
18+
.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
19+
20+
.. code-block:: bash
21+
22+
$ python3 -m pip install 'molecule[docker]'

‎molecule/ssh_hardening_bsd/converge.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
3+
hosts: all
4+
environment:
5+
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
6+
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
7+
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
8+
collections:
9+
- devsec.hardening
10+
tasks:
11+
- include_role:
12+
name: ssh_hardening
13+
vars:
14+
sftp_enabled: false

‎molecule/ssh_hardening_bsd/molecule.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
---
2+
dependency:
3+
name: galaxy
4+
options:
5+
role-file: molecule/ssh_hardening_bsd/requirements.yml
6+
driver:
7+
name: vagrant
8+
provider:
9+
name: libvirt
10+
platforms:
11+
# we need to name every instance differntly to start multiple VMs on the same host (parallelization)
12+
# since we also need to use different OS users to run the tests because of how molecule operates,
13+
# the VM names must be predictable by OS user (to clean up canceled runs)
14+
- name: "${USER}"
15+
box: "generic/${MOLECULE_DISTRO}"
16+
memory: 1024
17+
cpus: 2
18+
provisioner:
19+
name: ansible
20+
options:
21+
diff: true
22+
env:
23+
ANSIBLE_PIPELINING: "True"
24+
config_options:
25+
defaults:
26+
interpreter_python: auto_silent
27+
callback_whitelist: profile_tasks, timer, yaml
28+
verifier:
29+
name: ansible
30+
env:
31+
ANSIBLE_PIPELINING: "True"
32+
33+
scenario:
34+
create_sequence:
35+
- dependency
36+
- create
37+
- prepare
38+
check_sequence:
39+
- dependency
40+
- destroy
41+
- create
42+
- prepare
43+
- converge
44+
- check
45+
- destroy
46+
converge_sequence:
47+
- dependency
48+
- create
49+
- prepare
50+
- converge
51+
destroy_sequence:
52+
- destroy
53+
test_sequence:
54+
- dependency
55+
- destroy
56+
- syntax
57+
- create
58+
- prepare
59+
- converge
60+
- idempotence
61+
- verify
62+
- destroy

‎molecule/ssh_hardening_bsd/prepare.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
- name: prepare OpenBSD host
3+
hosts: all
4+
become: true
5+
gather_facts: false
6+
tasks:
7+
- name: install python
8+
# BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
9+
raw: "pkg_add python%3.10"
10+
when: "lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'"
11+
12+
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
13+
hosts: all
14+
become: true
15+
environment:
16+
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
17+
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
18+
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
19+
tasks:
20+
- name: created needed directory
21+
file:
22+
path: "/var/run/sshd"
23+
state: directory
24+
25+
- name: create ssh host keys # noqa ignore-errors
26+
command: "ssh-keygen -A"
27+
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
28+
ansible_facts.distribution == "Fedora" or
29+
ansible_facts.distribution == "Amazon" or
30+
ansible_facts.os_family == "Suse"
31+
changed_when: false
32+
ignore_errors: true

‎molecule/ssh_hardening_bsd/requirements.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
roles:
3+
- geerlingguy.git

‎molecule/ssh_hardening_bsd/verify.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
- name: OpenBSD workaround - inspec detects OpenSBD as unix and not linux compatible
3+
hosts: all
4+
become: true
5+
tasks:
6+
- name: use the type command instead of which to detect existing commands
7+
file:
8+
src: "/usr/bin/which"
9+
dest: "/usr/bin/type"
10+
state: hard
11+
when: "lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'"
12+
13+
- name: Verify
14+
hosts: localhost
15+
environment:
16+
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
17+
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
18+
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
19+
tasks:
20+
- name: get ssh-config
21+
command:
22+
cmd: "vagrant ssh-config"
23+
chdir: "{{ molecule_ephemeral_directory }}"
24+
register: ssh_config
25+
changed_when: false
26+
27+
- name: create ssh-config file
28+
copy:
29+
content: "{{ ssh_config.stdout_lines | join ('\n') }}"
30+
dest: "{{ molecule_ephemeral_directory }}/ssh-config"
31+
changed_when: false
32+
33+
- name: Execute cinc-auditor tests
34+
command: >
35+
docker run
36+
--volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
37+
--volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') }}.yaml:/waivers.yaml
38+
docker.io/cincproject/auditor exec
39+
--ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
40+
-t ssh://{{ lookup('env', 'USER') }}
41+
--sudo --no-show-progress --no-color
42+
--waiver-file /waivers.yaml
43+
--no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip
44+
register: test_results
45+
changed_when: false
46+
ignore_errors: true
47+
48+
- name: Display details about the cinc-auditor results
49+
debug:
50+
msg: "{{ test_results.stdout_lines }}"
51+
52+
- name: Fail when tests fail
53+
fail:
54+
msg: "Inspec failed to validate"
55+
when: test_results.rc != 0

‎molecule/ssh_hardening_bsd/waivers_freebsd12.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
sshd-45:
2+
run: false
3+
justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"

‎molecule/ssh_hardening_bsd/waivers_openbsd7.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
ssh-17:
2+
run: false
3+
justification: "GSSAPIAuthentication is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
4+
ssh-18:
5+
run: false
6+
justification: "GSSAPIDelegateCredentials is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
7+
sshd-30:
8+
run: false
9+
justification: "KerberosAuthentication is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
10+
sshd-31:
11+
run: false
12+
justification: "KerberosOrLocalPasswd is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
13+
sshd-32:
14+
run: false
15+
justification: "KerberosTicketCleanup is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
16+
sshd-33:
17+
run: false
18+
justification: "GSSAPIAuthentication is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
19+
sshd-34:
20+
run: false
21+
justification: "GSSAPICleanupCredentials is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"

‎roles/ssh_hardening/meta/main.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,12 @@ galaxy_info:
2424
- name: ArchLinux
2525
- name: SmartOS
2626
- name: opensuse
27+
- name: FreeBSD
28+
versions:
29+
- "12.2"
30+
- name: OpenBSD
31+
versions:
32+
- "7.0"
2733
galaxy_tags:
2834
- system
2935
- security

0 commit comments

Comments
 (0)