This patch adds initial support for CentOS 7 and Ubuntu 16.04 to the security role. Documentation and tests still need updates in subsequent patches. Release notes are included. Change-Id: Iae936bb307a5938651c55e703d68d39a7716d178changes/97/313697/17
Major Hayden
7 years ago
parent
fa2800419e
commit
22c4c21583
@ -0,0 +1,5 @@
|
||||
---
|
||||
features:
|
||||
- The openstack-ansible-security role supports the application of the Red
|
||||
Hat Enterprise Linux 6 STIG configurations to systems running CentOS 7 and
|
||||
Ubuntu 16.04 LTS.
|
||||
@ -0,0 +1,76 @@
|
||||
---
|
||||
# Copyright 2015, Rackspace US, Inc.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
- name: Check if CentOS 7 GPG keys are installed (for V-38476)
|
||||
command: rpm -qi gpg-pubkey-f4a80eb5-53a7ff4b
|
||||
register: v38476_result
|
||||
changed_when: "v38476_result.rc != 0"
|
||||
failed_when: False
|
||||
always_run: True
|
||||
tags:
|
||||
- package
|
||||
- cat1
|
||||
- V-38476
|
||||
|
||||
- name: V-38476 - Vendor-provided cryptographic certificates must be installed to verify the integrity of system software.
|
||||
fail:
|
||||
msg: "FAILED: Missing CentOS 7 GPG keys"
|
||||
when: "v38476_result.rc != 0"
|
||||
tags:
|
||||
- package
|
||||
- cat1
|
||||
- V-38476
|
||||
|
||||
- name: Search for yum repositories with GPG checks disabled
|
||||
command: grep -r "gpgcheck=0" /etc/yum.repos.d/
|
||||
register: v38462_result
|
||||
changed_when: False
|
||||
failed_when: False
|
||||
always_run: True
|
||||
tags:
|
||||
- package
|
||||
- cat1
|
||||
- V-38462
|
||||
|
||||
- name: V-38462 - Package management tool must verify authenticity of packages
|
||||
fail:
|
||||
msg: "FAILED: Ensure all repo files in /etc/yum.repos.d/ have 'gpgcheck=1' set."
|
||||
when: "v38462_result.rc == 0"
|
||||
tags:
|
||||
- package
|
||||
- cat1
|
||||
- V-38462
|
||||
|
||||
- name: V-38481 - Install yum-cron for automatic updates
|
||||
yum:
|
||||
name: yum-cron
|
||||
state: installed
|
||||
when: security_unattended_upgrades_enabled | bool
|
||||
tags:
|
||||
- package
|
||||
- cat2
|
||||
- V-38481
|
||||
|
||||
- name: V-38481 - System security patches and updates must be installed and up-to-date
|
||||
lineinfile:
|
||||
dest: /etc/yum/yum-cron.conf
|
||||
regexp: "^apply_updates"
|
||||
line: "apply_updates = yes"
|
||||
state: present
|
||||
when: security_unattended_upgrades_enabled | bool
|
||||
tags:
|
||||
- package
|
||||
- cat2
|
||||
- V-38481
|
||||
@ -0,0 +1,31 @@
|
||||
---
|
||||
# Copyright 2016, Rackspace US, Inc.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
# Configuration file paths
|
||||
pam_auth_file: /etc/pam.d/system-auth
|
||||
pam_password_file: /etc/pam.d/password-auth-ac
|
||||
vsftpd_conf_file: /etc/vsftpd/vsftpd.conf
|
||||
|
||||
# Package names
|
||||
auditd_pkg: audit
|
||||
ldap_server_pkg: openldap-servers
|
||||
telnet_server_pkg: telnet-server
|
||||
tftp_pkg: tftp-server
|
||||
xserver_pkg: xorg-x11-server-Xorg
|
||||
ypserv_pkg: ypserv
|
||||
|
||||
# Service names
|
||||
cron_service: crond
|
||||
ssh_service: sshd
|
||||
@ -0,0 +1,34 @@
|
||||
---
|
||||
# Copyright 2016, Rackspace US, Inc.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
# Maximum age of the apt cache before a refresh is required
|
||||
cache_timeout: 600
|
||||
|
||||
# Configuration file paths
|
||||
pam_auth_file: /etc/pam.d/common-auth
|
||||
pam_password_file: /etc/pam.d/common-password
|
||||
vsftpd_conf_file: /etc/vsftpd.conf
|
||||
|
||||
# Package names
|
||||
auditd_pkg: auditd
|
||||
ldap_server_pkg: slapd
|
||||
telnet_server_pkg: telnetd
|
||||
tftp_pkg: tftpd
|
||||
xserver_pkg: xorg-xserver
|
||||
ypserv_pkg: nis
|
||||
|
||||
# Service name
|
||||
cron_service: cron
|
||||
ssh_service: ssh
|
||||
Loading…
Reference in new issue