Skip to content

Commit eb47f4d

Browse files
schurzischurzi
committed
Merge branch 'master' into min_ansible_ver
2 parents a5a065f + 4a21ec0 commit eb47f4d

File tree

31 files changed

+144
-284
lines changed

31 files changed

+144
-284
lines changed

‎.github/workflows/mysql_hardening.yml‎

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ concurrency:
2727

2828
jobs:
2929
build:
30-
runs-on: ubuntu-18.04
30+
runs-on: ubuntu-latest
3131
env:
3232
PY_COLORS: 1
3333
ANSIBLE_FORCE_COLOR: 1
@@ -46,8 +46,8 @@ jobs:
4646
- debian10
4747
- debian11
4848
# - amazon # geerlingguy.mysql does not support fedora
49-
# - arch # needs to be fixed
50-
- opensuse_tumbleweed # needs to be fixed
49+
# - arch # geerlingguy.mysql does not support arch
50+
- opensuse_tumbleweed
5151
# - fedora # geerlingguy.mysql does not support fedora
5252
steps:
5353
- name: Checkout repo
@@ -56,10 +56,10 @@ jobs:
5656
path: ansible_collections/devsec/hardening
5757
submodules: true
5858

59-
- name: Set up Python 3.7
59+
- name: Set up Python 3.11
6060
uses: actions/setup-python@v4
6161
with:
62-
python-version: 3.7
62+
python-version: 3.11
6363

6464
- name: Install dependencies
6565
run: |
@@ -68,11 +68,6 @@ jobs:
6868
pip install -r requirements.txt
6969
working-directory: ansible_collections/devsec/hardening
7070

71-
- name: Create default collection path symlink
72-
run: |
73-
mkdir -p /home/runner/.ansible
74-
ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
75-
7671
# that was a hard one to fix. robert did it thankfully
7772
# https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212
7873
- name: disable apparmor on debian systems

‎.github/workflows/nginx_hardening.yml‎

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ concurrency:
2626

2727
jobs:
2828
build:
29-
runs-on: ubuntu-18.04
29+
runs-on: ubuntu-latest
3030
env:
3131
PY_COLORS: 1
3232
ANSIBLE_FORCE_COLOR: 1
@@ -44,7 +44,7 @@ jobs:
4444
- ubuntu2204
4545
- debian10
4646
- debian11
47-
- amazon
47+
- amazon2023
4848
# - arch # needs to be fixed
4949
# - opensuse_tumbleweed # needs to be fixed
5050
# - fedora # no support from geerlingguy role
@@ -55,10 +55,10 @@ jobs:
5555
path: ansible_collections/devsec/hardening
5656
submodules: true
5757

58-
- name: Set up Python 3.7
58+
- name: Set up Python 3.11
5959
uses: actions/setup-python@v4
6060
with:
61-
python-version: 3.7
61+
python-version: 3.11
6262

6363
- name: Install dependencies
6464
run: |
@@ -67,11 +67,6 @@ jobs:
6767
pip install -r requirements.txt
6868
working-directory: ansible_collections/devsec/hardening
6969

70-
- name: Create default collection path symlink
71-
run: |
72-
mkdir -p /home/runner/.ansible
73-
ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
74-
7570
- name: Test with molecule
7671
run: |
7772
molecule --version

‎.github/workflows/os_hardening.yml‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ concurrency:
2626

2727
jobs:
2828
build:
29-
runs-on: ubuntu-18.04
29+
runs-on: ubuntu-latest
3030
env:
3131
PY_COLORS: 1
3232
ANSIBLE_FORCE_COLOR: 1
@@ -39,25 +39,26 @@ jobs:
3939
- centosstream9
4040
- rocky8
4141
- rocky9
42+
- fedora
4243
- ubuntu1804
4344
- ubuntu2004
4445
- ubuntu2204
4546
- debian10
4647
- debian11
47-
- amazon
48+
- amazon2023
4849
- opensuse_tumbleweed
49-
# - arch # needs to be fixed
50+
- arch
5051
steps:
5152
- name: Checkout repo
5253
uses: actions/checkout@v3
5354
with:
5455
path: ansible_collections/devsec/hardening
5556
submodules: true
5657

57-
- name: Set up Python 3.7
58+
- name: Set up Python 3.11
5859
uses: actions/setup-python@v4
5960
with:
60-
python-version: 3.7
61+
python-version: 3.11
6162

6263
- name: Install dependencies
6364
run: |
@@ -66,11 +67,6 @@ jobs:
6667
pip install -r requirements.txt
6768
working-directory: ansible_collections/devsec/hardening
6869

69-
- name: Create default collection path symlink
70-
run: |
71-
mkdir -p /home/runner/.ansible
72-
ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
73-
7470
- name: Test with molecule
7571
run: |
7672
if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then

‎.github/workflows/os_hardening_vm.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,13 +39,15 @@ jobs:
3939
- centos9s
4040
- rocky8
4141
- rocky9
42+
- fedora36
43+
- fedora37
4244
- ubuntu1804
4345
- ubuntu2004
4446
- ubuntu2204
4547
- debian10
4648
- debian11
4749
- opensuse15
48-
# - arch # arch is currently not supported by cinc-auditor
50+
# - arch # needs fix for audit
4951
steps:
5052
- name: Checkout repo
5153
uses: actions/checkout@v3

‎.github/workflows/ssh_hardening.yml‎

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ concurrency:
2626

2727
jobs:
2828
build:
29-
runs-on: ubuntu-18.04
29+
runs-on: ubuntu-latest
3030
env:
3131
PY_COLORS: 1
3232
ANSIBLE_FORCE_COLOR: 1
@@ -45,20 +45,20 @@ jobs:
4545
- ubuntu2204
4646
- debian10
4747
- debian11
48-
- amazon
49-
# - arch # needs to be fixed
50-
# - opensuse_tumbleweed # baseline is not compatible with suse
48+
- amazon2023
49+
- arch
50+
# - opensuse_tumbleweed # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
5151
steps:
5252
- name: Checkout repo
5353
uses: actions/checkout@v3
5454
with:
5555
path: ansible_collections/devsec/hardening
5656
submodules: true
5757

58-
- name: Set up Python 3.7
58+
- name: Set up Python 3.11
5959
uses: actions/setup-python@v4
6060
with:
61-
python-version: 3.7
61+
python-version: 3.11
6262

6363
- name: Install dependencies
6464
run: |
@@ -67,11 +67,6 @@ jobs:
6767
pip install -r requirements.txt
6868
working-directory: ansible_collections/devsec/hardening
6969

70-
- name: Create default collection path symlink
71-
run: |
72-
mkdir -p /home/runner/.ansible
73-
ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
74-
7570
- name: Test with molecule
7671
run: |
7772
if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then

‎.github/workflows/ssh_hardening_custom_tests.yml‎

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ concurrency:
2626

2727
jobs:
2828
build:
29-
runs-on: ubuntu-18.04
29+
runs-on: ubuntu-latest
3030
env:
3131
PY_COLORS: 1
3232
ANSIBLE_FORCE_COLOR: 1
@@ -45,20 +45,20 @@ jobs:
4545
- ubuntu2204
4646
- debian10
4747
- debian11
48-
- amazon
49-
# - arch # needs to be fixed
50-
# - opensuse_tumbleweed # baseline is not compatible with suse
48+
- amazon2023
49+
- arch
50+
# - opensuse_tumbleweed # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
5151
steps:
5252
- name: Checkout repo
5353
uses: actions/checkout@v3
5454
with:
5555
path: ansible_collections/devsec/hardening
5656
submodules: true
5757

58-
- name: Set up Python 3.7
58+
- name: Set up Python 3.11
5959
uses: actions/setup-python@v4
6060
with:
61-
python-version: 3.7
61+
python-version: 3.11
6262

6363
- name: Install dependencies
6464
run: |
@@ -67,11 +67,6 @@ jobs:
6767
pip install -r requirements.txt
6868
working-directory: ansible_collections/devsec/hardening
6969

70-
- name: Create default collection path symlink
71-
run: |
72-
mkdir -p /home/runner/.ansible
73-
ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
74-
7570
- name: Test with molecule
7671
run: |
7772
if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then

‎molecule/mysql_hardening/molecule.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ provisioner:
2222
config_options:
2323
defaults:
2424
interpreter_python: auto_silent
25-
callback_whitelist: profile_tasks, timer, yaml
25+
callbacks_enabled: profile_tasks, timer, yaml
2626
verifier:
2727
name: ansible
2828

‎molecule/mysql_hardening/requirements.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
---
22
roles:
3-
- name: geerlingguy.git
4-
version: 3.0.1
53
- name: dev-sec.mysql
64
version: master
75

‎molecule/mysql_hardening/verify.yml‎

Lines changed: 19 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -6,26 +6,12 @@
66
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
77
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
88
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
9-
roles:
10-
- geerlingguy.git
119
tasks:
12-
- name: install fake SuSE-release for cinc compatibility
13-
copy:
14-
content: |
15-
openSUSE Faked Enterprise 2020 (x86_64)
16-
VERSION = 2020
17-
CODENAME = Faked Feature
18-
dest: /etc/SuSE-release
19-
owner: root
20-
group: root
21-
mode: '0444'
22-
when: ansible_facts.os_family == 'Suse'
23-
24-
- name: install git for SuSE since geerlinguy.git does not support it
25-
zypper:
26-
name: git
27-
state: present
28-
when: ansible_facts.os_family == 'Suse'
10+
- name: Use Python 3 on Suse
11+
set_fact:
12+
ansible_python_interpreter: /usr/bin/python3
13+
when:
14+
- ansible_os_family == 'Suse'
2915

3016
- name: install procps for debian systems
3117
apt:
@@ -34,29 +20,27 @@
3420
update_cache: true
3521
when: ansible_distribution == 'Debian'
3622

37-
- name: Use Python 3 on Suse
38-
set_fact:
39-
ansible_python_interpreter: /usr/bin/python3
40-
when:
41-
- ansible_os_family == 'Suse'
42-
4323
- name: include tests for the service
4424
include_tasks: verify_tasks/service.yml
4525

4626
- name: include tests for MySQL user
4727
include_tasks: verify_tasks/mysql_users.yml
4828

49-
- name: download cinc-auditor
50-
get_url:
51-
url: https://omnitruck.cinc.sh/install.sh
52-
dest: /tmp/install.sh
53-
mode: '0775'
54-
55-
- name: install cinc-auditor
56-
shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
57-
29+
- name: Verify
30+
hosts: localhost
31+
environment:
32+
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
33+
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
34+
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
35+
tasks:
5836
- name: Execute cinc-auditor tests
59-
command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/mysql-baseline/archive/refs/heads/master.zip"
37+
command: >
38+
docker run
39+
--volume /run/docker.sock:/run/docker.sock
40+
docker.io/cincproject/auditor exec
41+
-t docker://instance
42+
--no-show-progress --no-color
43+
--no-distinct-exit https://github.com/dev-sec/mysql-baseline/archive/refs/heads/master.zip
6044
register: test_results
6145
changed_when: false
6246
ignore_errors: true

‎molecule/nginx_hardening/converge.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
33
become: true
44
hosts: all
5+
collections:
6+
- devsec.hardening
57
environment:
68
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
79
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"

0 commit comments

Comments
 (0)