openstack/ansible-hardening
Code Issues Proposed changes
Ansible role for security hardening
751 Commits 10 Branches 141 Tags 5.4 MiB
Jinja 44.5%
Python 41.2%
Shell 14.3%
1a02653708
Go to file
Markos Chandras 1a02653708 Sync test files with the openstack-ansible-tests repository 
This syncs most of the common files with the openstack-tests repository.
This effectively removes the Ubuntu 14.04 support from the Vagrantfile
as well as the RHEL6 STIG V-38496 workaround for it. This also removes
the now unused tests/vagrant.yml file and uses the tests/test.yml like
the upstream OpenStack CI does.

However, it doesn't sync the bindep.txt file since it doesn't quite
match what we have in the openstack-ansible-tests repository so the
shared one needs to be fixed first.

Finally, it adds a new doc/.gitignore file to exclude the generated
documentation file. This is necessary in order for the shared .gitignore
one to be used in the root of the repository.

Change-Id: Ia34979af9029ffb03fb525679356e6d9f3a039a6
2017-06-27 13:25:35 +01:00
defaults Actually set min/max password lifetime for account 2017-06-13 06:32:47 +00:00
doc Sync test files with the openstack-ansible-tests repository 2017-06-27 13:25:35 +01:00
files [Docs] Replace security role references 2017-06-12 18:59:28 +00:00
handlers Do not update grub if grub not used 2017-04-13 12:34:22 +00:00
library Verify password age limits [+Docs] 2016-12-08 09:44:23 -06:00
meta Adjust readme/meta for Ansible 2.3 2017-04-20 10:08:05 -05:00
releasenotes Add release note for password lifetime patches 2017-06-13 06:33:04 +00:00
tasks Trivial spelling fix 2017-06-23 07:51:32 -05:00
templates [Docs] Replace security role references 2017-06-12 18:59:28 +00:00
tests Sync test files with the openstack-ansible-tests repository 2017-06-27 13:25:35 +01:00
vars Get a list of all users + interactive users 2017-06-13 06:32:17 +00:00
.gitignore Sync test files with the openstack-ansible-tests repository 2017-06-27 13:25:35 +01:00
.gitreview Fix .gitreview 2017-05-30 18:27:52 +00:00
bindep.txt Initial Fedora 25 support 2017-05-31 13:33:34 +00:00
LICENSE Initial import of openstack-ansible-security role 2015-10-07 07:27:39 -05:00
manual-test.rc Use centralised test scripts 2016-09-28 12:16:50 +01:00
README.md Doc updates 2017-06-13 07:55:22 -05:00
README.rst [Docs] Replace security role references 2017-06-12 18:59:28 +00:00
run_tests.sh Sync test files with the openstack-ansible-tests repository 2017-06-27 13:25:35 +01:00
setup.cfg [Docs] Replace security role references 2017-06-12 18:59:28 +00:00
setup.py Updated from global requirements 2017-03-02 11:52:32 +00:00
test-requirements.txt Updated from global requirements 2017-05-17 03:55:45 +00:00
tox.ini Merge "Ensure that role tests pin pip/setuptools/wheel" 2017-06-13 06:55:30 +00:00
Vagrantfile Sync test files with the openstack-ansible-tests repository 2017-06-27 13:25:35 +01:00

README.md

ansible-hardening

ansible-hardening-logo

The ansible-hardening role applies security hardening configurations from the Security Technical Implementation Guide (STIG) to systems running the following distributions:

  • CentOS 7
  • Debian Jessie (experimental)
  • Fedora 25 (experimental)
  • Ubuntu 14.04 (deprecated)
  • Ubuntu 16.04
  • Red Hat Enterprise Linux 7

For more details, review the ansible-hardening documentation.

Requirements

This role can be used with or without OpenStack-Ansible. It requires Ansible 2.3 or later.

Role Variables

All of the variables for this role are in defaults/main.yml.

Dependencies

This role has no dependencies.

Example Playbook

Using the role is fairly straightforward:

- hosts: servers
  roles:
     - ansible-hardening

Running with Vagrant

This role can be tested easily on multiple platforms using Vagrant.

The Vagrantfile supports testing on:

  • Ubuntu 14.04
  • Ubuntu 16.04
  • CentOS 7

To test on all platforms:

vagrant destroy --force && vagrant up

To test on Ubuntu 14.04 only:

vagrant destroy ubuntu1404 --force && vagrant up ubuntu1404

To test on Ubuntu 16.04 only:

vagrant destroy ubuntu1604 --force && vagrant up ubuntu1604

To test on CentOS 7 only:

vagrant destroy centos7 --force && vagrant up centos7

License

Apache 2.0

Author Information

For more information, join #openstack-ansible on Freenode.