Ansible role for security hardening

Go to file

Logan V 2a4875f2cd Re-adding the missing NTP default vars Some of the NTP defaults used to deploy chrony were shared between both the RHEL6 and RHEL7 STIG tasks, however the required defaults for these vars were removed in Iaae52c97a35d82dd807ef78a1a6593ce3aa33540. Since they are still needed by the RHEL7 STIG chrony deployment we will need to add them back. I also removed a reference to "security_disable_ipv6" in the chrony config file which was used to determine if Chrony should bind ::1 for its management socket. Since the "security_disable_ipv6" var no longer exists, we will unconditionally bind the ::1 management address. Change-Id: Ic80bda5fbf5cb4424e305ff9839121416b8bea19		2017-09-13 16:10:01 +00:00
defaults	Re-adding the missing NTP default vars	2017-09-13 16:10:01 +00:00
doc	Queens doc updates + removal of RHEL 6 STIG	2017-09-12 08:19:54 -06:00
files	Add support for the openSUSE Leap distributions	2017-06-27 15:43:53 +01:00
handlers	Do not update grub if grub not used	2017-04-13 12:34:22 +00:00
library	Verify password age limits [+Docs]	2016-12-08 09:44:23 -06:00
meta	Correct the list of supported OS versions	2017-06-28 15:51:05 -05:00
releasenotes	Make default NTP servers more global	2017-09-12 09:54:33 -06:00
tasks	Merge "Cast security_shadow_utils_fail_delay as int"	2017-09-12 15:20:30 +00:00
templates	Re-adding the missing NTP default vars	2017-09-13 16:10:01 +00:00
test_plugins	Add equalto Jinja2 test for EL7	2017-06-30 09:13:16 -05:00
tests	Queens doc updates + removal of RHEL 6 STIG	2017-09-12 08:19:54 -06:00
vars	Queens doc updates + removal of RHEL 6 STIG	2017-09-12 08:19:54 -06:00
.gitignore	Sync test files with the openstack-ansible-tests repository	2017-06-27 13:25:35 +01:00
.gitreview	Fix .gitreview	2017-05-30 18:27:52 +00:00
bindep.txt	Updated from OpenStack Ansible Tests	2017-09-01 16:47:38 +00:00
LICENSE	Initial import of openstack-ansible-security role	2015-10-07 07:27:39 -05:00
manual-test.rc	Use centralised test scripts	2016-09-28 12:16:50 +01:00
README.md	Queens doc updates + removal of RHEL 6 STIG	2017-09-12 08:19:54 -06:00
README.rst	[Docs] Replace security role references	2017-06-12 18:59:28 +00:00
run_tests.sh	Manually check apparmor_status	2017-08-16 09:02:42 -05:00
setup.cfg	[Docs] Replace security role references	2017-06-12 18:59:28 +00:00
setup.py	Updated from global requirements	2017-03-02 11:52:32 +00:00
test-requirements.txt	Updated from global requirements	2017-09-12 17:29:52 +00:00
tox.ini	Queens doc updates + removal of RHEL 6 STIG	2017-09-12 08:19:54 -06:00
Vagrantfile	Manually check apparmor_status	2017-08-16 09:02:42 -05:00

README.md

ansible-hardening

The ansible-hardening role applies security hardening configurations from the Security Technical Implementation Guide (STIG) to systems running the following distributions:

CentOS 7
Debian Jessie
Fedora 26
openSUSE Leap 42.2 and 42.3
Red Hat Enterprise Linux 7
SUSE Linux Enterprise 12 (experimental)
Ubuntu 16.04

For more details, review the ansible-hardening documentation.

Requirements

This role can be used with or without OpenStack-Ansible. It requires Ansible 2.3 or later.

Role Variables

All of the variables for this role are in defaults/main.yml.

Dependencies

This role has no dependencies.

Example Playbook

Using the role is fairly straightforward:

- hosts: servers
  roles:
     - ansible-hardening

Running with Vagrant

This role can be tested easily on multiple platforms using Vagrant.

The Vagrantfile supports testing on:

Ubuntu 16.04
CentOS 7

To test on all platforms:

vagrant destroy --force && vagrant up

To test on Ubuntu 14.04 only:

vagrant destroy ubuntu1404 --force && vagrant up ubuntu1404

To test on Ubuntu 16.04 only:

vagrant destroy ubuntu1604 --force && vagrant up ubuntu1604

To test on CentOS 7 only:

vagrant destroy centos7 --force && vagrant up centos7

License

Apache 2.0

Author Information

For more information, join #openstack-ansible on Freenode.