dd52e48925
This will fix the follwing issues when using the centos/7 box for role testing:
* TASK [../../../openstack-ansible-security : V-38476 ...
fatal: [centos7]: FAILED! => {"changed": false, "failed": true, "msg": "Missing CentOS 7 GPG keys"}
The required gpg-pubkey packages are created after the import of the provided signing keys
in /etc/pki/rpm-gpg.
* TASK [../../../openstack-ansible-security : V-38574 ...
fatal: [centos7]: FAILED! => {"changed": false, "failed": true, "msg": "Must use SHA512 for password hashing (via PAM)"}
sha512 instead of md5 has to be used in /etc/pam.d/password-auth
* TASK [../../../openstack-ansible-security : Check password hashing algorithm used in login.defs (for V-38576)] ***
fatal: [centos7]: FAILED! => {"changed": true, "cmd": "grep '^ENCRYPT_METHOD.*SHA512' /etc/login.defs", ...
sha512 instead of md5 has to be used in /etc/login.defs
Change-Id: Ia40119dbf933b8102001cfe914312b17632bcf65
Co-authored-by: David Rabel <rabel@b1-systems.de>
29 lines
982 B
YAML
29 lines
982 B
YAML
---
|
|
# Copyright 2016, HPE, VMWare
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
- name: Prepare centos/7 box for role testing
|
|
hosts: centos
|
|
tasks:
|
|
- name: Import all archive signing keys from /etc/pki/rpm-gpg
|
|
shell: rpm --import /etc/pki/rpm-gpg/*
|
|
|
|
- name: Use sha512 instead of md5 as password hashing algorithm
|
|
shell: authconfig --passalgo=sha512 --update
|
|
|
|
- name: Playbook for role testing
|
|
hosts: all
|
|
roles:
|
|
- role: "../../../openstack-ansible-security"
|