openstack/ansible-hardening
Code Issues Proposed changes

Avoid skipped package-related tasks

Browse Source 
This patch splits up the tasks from packages.yml into the specific
package manager task files. This should avoid some skipped tasks
during playbook runs.

Change-Id: I7baab85abbcd91f72e1f104d45df53f540b756d0
This commit is contained in:
Major Hayden 2017-07-03 11:43:18 -05:00
parent f422da8599
commit 4dd5e3760c
No known key found for this signature in database
GPG Key ID: 737051E0C1011FB1
6 changed files with 213 additions and 188 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
tasks/rhel7stig/apt.yml
View File

@ -90,3 +90,30 @@
tags:
- high
- V-71979
- name: V-71987 - Clean requirements/dependencies when removing packages (dpkg)
lineinfile:
dest: /etc/apt/apt.conf.d/security-autoremove
regexp: "^(#)?APT::Get::AutomaticRemove"
line: "APT{{ '::' }}Get{{ '::' }}AutomaticRemove \"0\";"
state: present
create: yes
when:
- security_package_clean_on_remove | bool
- ansible_os_family | lower == 'debian'
tags:
- low
- packages
- V-71987
- name: Enable automatic package updates (apt)
copy:
src: 20auto-upgrades
dest: /etc/apt/apt.conf.d/20auto-upgrades
when:
- ansible_os_family | lower == 'debian'
- security_rhel7_automatic_package_updates | bool
tags:
- packages
- cat2
- V-71999

1
tasks/rhel7stig/dnf.yml
View File

@ -1 +0,0 @@
yum.yml

58
tasks/rhel7stig/dnf.yml Normal file
View File

@ -0,0 +1,58 @@
---
# Copyright 2017, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
- include: rpm.yml
- name: Check if /etc/dnf/automatic.conf exists
stat:
path: /etc/dnf/automatic.conf
check_mode: no
register: dnf_automatic_config_check
when:
- ansible_os_family | lower == 'redhat'
- ansible_pkg_mgr == 'dnf'
tags:
- always
- name: Enable automatic package updates (dnf)
lineinfile:
dest: /etc/dnf/automatic.conf
regexp: "^apply_updates"
line: "apply_updates = yes"
state: present
when:
- ansible_os_family | lower == 'redhat'
- ansible_pkg_mgr == 'dnf'
- dnf_automatic_config_check.stat.exists | bool
- security_rhel7_automatic_package_updates | bool
tags:
- packages
- medium
- V-71999
- name: Enable dnf-automatic timer for automatic package updates
systemd:
name: dnf-automatic.timer
enabled: yes
state: started
when:
- ansible_os_family | lower == 'redhat'
- ansible_pkg_mgr == 'dnf'
- dnf_automatic_config_check.stat.exists | bool
- security_rhel7_automatic_package_updates | bool
tags:
- packages
- medium
- V-71999

136
tasks/rhel7stig/packages.yml
View File

@ -33,139 +33,3 @@
- V-72233
- V-72301
- V-72307
- name: V-71987 - Clean requirements/dependencies when removing packages (RedHat)
lineinfile:
dest: "{{ pkg_mgr_config }}"
regexp: "^(#)?clean_requirements_on_remove"
line: "clean_requirements_on_remove=1"
state: present
when:
- security_package_clean_on_remove | bool
- ansible_os_family | lower == 'redhat'
tags:
- low
- packages
- V-71987
- name: V-71987 - Clean requirements/dependencies when removing packages (SUSE)
lineinfile:
dest: "{{ pkg_mgr_config }}"
regexp: '^(#)?\s*solver\.cleandepsOnRemove'
line: 'solver.cleandepsOnRemove = true'
state: present
when:
- security_package_clean_on_remove | bool
- ansible_pkg_mgr == 'zypper'
tags:
- low
- packages
- V-71987
- name: V-71987 - Clean requirements/dependencies when removing packages (dpkg)
lineinfile:
dest: /etc/apt/apt.conf.d/security-autoremove
regexp: "^(#)?APT::Get::AutomaticRemove"
line: "APT{{ '::' }}Get{{ '::' }}AutomaticRemove \"0\";"
state: present
create: yes
when:
- security_package_clean_on_remove | bool
- ansible_os_family | lower == 'debian'
tags:
- low
- packages
- V-71987
- name: Check if /etc/yum/yum-cron.conf exists
stat:
path: /etc/yum/yum-cron.conf
check_mode: no
register: yum_cron_config_check
when:
- ansible_os_family | lower == 'redhat'
- ansible_pkg_mgr == 'yum'
tags:
- always
- name: Enable automatic package updates (yum)
lineinfile:
dest: /etc/yum/yum-cron.conf
regexp: "^apply_updates"
line: "apply_updates = yes"
state: present
when:
- ansible_os_family | lower == 'redhat'
- ansible_pkg_mgr == 'yum'
- yum_cron_config_check.stat.exists | bool
- security_rhel7_automatic_package_updates | bool
tags:
- packages
- medium
- V-71999
- name: Check if /etc/dnf/automatic.conf exists
stat:
path: /etc/dnf/automatic.conf
check_mode: no
register: dnf_automatic_config_check
when:
- ansible_os_family | lower == 'redhat'
- ansible_pkg_mgr == 'dnf'
tags:
- always
- name: Enable automatic package updates (dnf)
lineinfile:
dest: /etc/dnf/automatic.conf
regexp: "^apply_updates"
line: "apply_updates = yes"
state: present
when:
- ansible_os_family | lower == 'redhat'
- ansible_pkg_mgr == 'dnf'
- dnf_automatic_config_check.stat.exists | bool
- security_rhel7_automatic_package_updates | bool
tags:
- packages
- medium
- V-71999
- name: Enable dnf-automatic timer for automatic package updates
systemd:
name: dnf-automatic.timer
enabled: yes
state: started
when:
- ansible_os_family | lower == 'redhat'
- ansible_pkg_mgr == 'dnf'
- dnf_automatic_config_check.stat.exists | bool
- security_rhel7_automatic_package_updates | bool
tags:
- packages
- medium
- V-71999
- name: Enable automatic package updates (apt)
copy:
src: 20auto-upgrades
dest: /etc/apt/apt.conf.d/20auto-upgrades
when:
- ansible_os_family | lower == 'debian'
- security_rhel7_automatic_package_updates | bool
tags:
- packages
- cat2
- V-71999
- name: Enable automatic package updates (SUSE)
copy:
src: zypper-autoupdates
dest: /etc/cron.daily/zypper-autoupdates
when:
- ansible_pkg_mgr == 'zypper'
- security_rhel7_automatic_package_updates | bool
tags:
- packages
- cat2
- V-71999

85
tasks/rhel7stig/rpm.yml Normal file
View File

@ -0,0 +1,85 @@
---
# Copyright 2016, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
- name: Ensure RPM verification task has finished
async_status:
jid: "{{ rpmverify_task.ansible_job_id }}"
failed_when: False
changed_when: False
register: job_result
until: job_result.finished
retries: 30
when:
- not rpmverify_task | skipped
- name: V-71855 - Get files with invalid checksums (rpm)
shell: "grep '^..5' {{ temp_dir }}/rpmverify.txt | awk '{ print $NF }'"
register: invalid_checksum_files
changed_when: False
when:
- not check_mode | bool
- ansible_os_family | lower == 'redhat'
tags:
- rpm
- high
- V-71855
- name: V-71855 - The cryptographic hash of system files and commands must match vendor values (rpm)
debug:
msg: |
The following files have checksums that differ from the checksum provided
with their package. Each of these should be verified manually to ensure
they have not been modified by an unauthorized user.
{% for filename in invalid_checksum_files.stdout_lines %}
{{ filename }}
{% endfor %}
when:
- not check_mode | bool
- ansible_os_family | lower == 'redhat'
- invalid_checksum_files is defined
- invalid_checksum_files.stdout is defined
tags:
- rpm
- high
- V-71855
- name: V-71977 - Require digital signatures for all packages
lineinfile:
dest: "{{ pkg_mgr_config }}"
regexp: "{{ item.regexp }}"
line: "{{ item.line }}"
state: present
with_items: "{{ rpm_gpgchecks | default([]) }}"
tags:
- rpm
- high
- V-71977
- V-71979
- V-71981
- name: V-71987 - Clean requirements/dependencies when removing packages (RedHat)
lineinfile:
dest: "{{ pkg_mgr_config }}"
regexp: "^(#)?clean_requirements_on_remove"
line: "clean_requirements_on_remove=1"
state: present
when:
- security_package_clean_on_remove | bool
- ansible_os_family | lower == 'redhat'
tags:
- low
- packages
- V-71987

68
tasks/rhel7stig/yum.yml
View File

@ -1,5 +1,5 @@
---
# Copyright 2016, Rackspace US, Inc.
# Copyright 2017, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@ -13,59 +13,29 @@
# See the License for the specific language governing permissions and
# limitations under the License.
- name: Ensure RPM verification task has finished
async_status:
jid: "{{ rpmverify_task.ansible_job_id }}"
failed_when: False
changed_when: False
register: job_result
until: job_result.finished
retries: 30
when:
- not rpmverify_task | skipped
- include: rpm.yml
- name: V-71855 - Get files with invalid checksums (rpm)
shell: "grep '^..5' {{ temp_dir }}/rpmverify.txt | awk '{ print $NF }'"
register: invalid_checksum_files
changed_when: False
- name: Check if /etc/yum/yum-cron.conf exists
stat:
path: /etc/yum/yum-cron.conf
check_mode: no
register: yum_cron_config_check
when:
- not check_mode | bool
- ansible_os_family | lower == 'redhat'
tags:
- rpm
- high
- V-71855
- always
- name: V-71855 - The cryptographic hash of system files and commands must match vendor values (rpm)
debug:
msg: |
The following files have checksums that differ from the checksum provided
with their package. Each of these should be verified manually to ensure
they have not been modified by an unauthorized user.
{% for filename in invalid_checksum_files.stdout_lines %}
{{ filename }}
{% endfor %}
when:
- not check_mode | bool
- ansible_os_family | lower == 'redhat'
- invalid_checksum_files is defined
- invalid_checksum_files.stdout is defined
tags:
- rpm
- high
- V-71855
- name: V-71977 - Require digital signatures for all packages
- name: Enable automatic package updates (yum)
lineinfile:
dest: "{{ pkg_mgr_config }}"
regexp: "{{ item.regexp }}"
line: "{{ item.line }}"
dest: /etc/yum/yum-cron.conf
regexp: "^apply_updates"
line: "apply_updates = yes"
state: present
with_items: "{{ rpm_gpgchecks | default([]) }}"
when:
- ansible_os_family | lower == 'redhat'
- yum_cron_config_check.stat.exists | bool
- security_rhel7_automatic_package_updates | bool
tags:
- rpm
- high
- V-71977
- V-71979
- V-71981
- packages
- medium
- V-71999

26
tasks/rhel7stig/zypper.yml
View File

@ -31,7 +31,6 @@
changed_when: False
when:
- not check_mode | bool
- ansible_pkg_mgr == 'zypper'
tags:
- rpm
- high
@ -49,7 +48,6 @@
{% endfor %}
when:
- not check_mode | bool
- ansible_pkg_mgr == 'zypper'
- invalid_checksum_files is defined
- invalid_checksum_files.stdout is defined
tags:
@ -77,3 +75,27 @@
- V-71977
- V-71979
- V-71981
- name: V-71987 - Clean requirements/dependencies when removing packages (SUSE)
lineinfile:
dest: "{{ pkg_mgr_config }}"
regexp: '^(#)?\s*solver\.cleandepsOnRemove'
line: 'solver.cleandepsOnRemove = true'
state: present
when:
- security_package_clean_on_remove | bool
tags:
- low
- packages
- V-71987
- name: Enable automatic package updates (SUSE)
copy:
src: zypper-autoupdates
dest: /etc/cron.daily/zypper-autoupdates
when:
- security_rhel7_automatic_package_updates | bool
tags:
- packages
- cat2
- V-71999