Skip to content

Commit 7661bc0

Browse files
uk-bollyuk-bolly
authored
Merge pull request #205 from ansible-lockdown/devel
Release to main
2 parents 00e6f19 + 79e36d8 commit 7661bc0

70 files changed

Lines changed: 1508 additions & 714 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.ansible-lint‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,10 @@ skip_list:
66
- 'schema'
77
- 'no-changed-when'
88
- 'var-spacing'
9-
- 'fqcn-builtins'
109
- 'experimental'
1110
- 'name[play]'
1211
- 'name[casing]'
1312
- 'name[template]'
14-
- 'fqcn[action]'
1513
- 'key-order[task]'
1614
- '204'
1715
- '305'

‎.config/.secrets.baseline‎

Lines changed: 4 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -75,10 +75,6 @@
7575
{
7676
"path": "detect_secrets.filters.allowlist.is_line_allowlisted"
7777
},
78-
{
79-
"path": "detect_secrets.filters.common.is_baseline_file",
80-
"filename": ".config/.secrets.baseline"
81-
},
8278
{
8379
"path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
8480
"min_level": 2
@@ -113,64 +109,11 @@
113109
{
114110
"path": "detect_secrets.filters.regex.should_exclude_file",
115111
"pattern": [
116-
".config/.gitleaks-report.json"
112+
".config/.gitleaks-report.json",
113+
"tasks/parse_etc_password.yml"
117114
]
118115
}
119116
],
120-
"results": {
121-
"defaults/main.yml": [
122-
{
123-
"type": "Secret Keyword",
124-
"filename": "defaults/main.yml",
125-
"hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
126-
"is_verified": false,
127-
"line_number": 364,
128-
"is_secret": false
129-
},
130-
{
131-
"type": "Secret Keyword",
132-
"filename": "defaults/main.yml",
133-
"hashed_secret": "fe96f7cfa2ab2224e7d015067a6f6cc713f7012e",
134-
"is_verified": false,
135-
"line_number": 375,
136-
"is_secret": false
137-
},
138-
{
139-
"type": "Secret Keyword",
140-
"filename": "defaults/main.yml",
141-
"hashed_secret": "a415ab5cc17c8c093c015ccdb7e552aee7911aa4",
142-
"is_verified": false,
143-
"line_number": 376,
144-
"is_secret": false
145-
}
146-
],
147-
"tasks/main.yml": [
148-
{
149-
"type": "Secret Keyword",
150-
"filename": "tasks/main.yml",
151-
"hashed_secret": "2478fefdceefe2847c3aa36dc731aaad5b3cc2fb",
152-
"is_verified": false,
153-
"line_number": 38,
154-
"is_secret": false
155-
},
156-
{
157-
"type": "Secret Keyword",
158-
"filename": "tasks/main.yml",
159-
"hashed_secret": "64411efd0f0561fe4852c6e414071345c9c6432a",
160-
"is_verified": false,
161-
"line_number": 110,
162-
"is_secret": false
163-
}
164-
],
165-
"tasks/parse_etc_password.yml": [
166-
{
167-
"type": "Secret Keyword",
168-
"filename": "tasks/parse_etc_password.yml",
169-
"hashed_secret": "2aaf9f2a51d8fe89e48cb9cc7d04a991ceb7f360",
170-
"is_verified": false,
171-
"line_number": 18
172-
}
173-
]
174-
},
175-
"generated_at": "2023-08-10T12:54:13Z"
117+
"results": {},
118+
"generated_at": "2023-09-21T14:11:05Z"
176119
}

‎.github/workflows/devel_pipeline_validation.yml‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,9 @@
2727
repo-token: ${{ secrets.GITHUB_TOKEN }}
2828
pr-message: |-
2929
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
30-
Please join in the conversation happening on the [Discord Server](https://discord.io/ansible-lockdown) as well.
30+
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
3131
32-
# This workflow contains a single job which tests the playbook
32+
# This workflow contains a single job that tests the playbook
3333
playbook-test:
3434
# The type of runner that the job will run on
3535
runs-on: ubuntu-latest
@@ -44,13 +44,13 @@
4444

4545
steps:
4646
- name: Clone ${{ github.event.repository.name }}
47-
uses: actions/checkout@v3
47+
uses: actions/checkout@v4
4848
with:
4949
ref: ${{ github.event.pull_request.head.sha }}
5050

5151
# Pull in terraform code for linux servers
52-
- name: Clone github IaC plan
53-
uses: actions/checkout@v3
52+
- name: Clone GitHub IaC plan
53+
uses: actions/checkout@v4
5454
with:
5555
repository: ansible-lockdown/github_linux_IaC
5656
path: .github/workflows/github_linux_IaC
@@ -74,23 +74,23 @@
7474
pwd
7575
ls
7676
env:
77-
# Imported from github variables this is used to load the relvent OS.tfvars file
77+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
7878
OSVAR: ${{ vars.OSVAR }}
7979
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
8080

8181
- name: Terraform_Init
8282
id: init
8383
run: terraform init
8484
env:
85-
# Imported from github variables this is used to load the relvent OS.tfvars file
85+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
8686
OSVAR: ${{ vars.OSVAR }}
8787
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
8888

8989
- name: Terraform_Validate
9090
id: validate
9191
run: terraform validate
9292
env:
93-
# Imported from github variables this is used to load the relvent OS.tfvars file
93+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
9494
OSVAR: ${{ vars.OSVAR }}
9595
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
9696

@@ -111,9 +111,9 @@
111111
# Aws deployments taking a while to come up insert sleep or playbook fails
112112

113113
- name: Sleep for 60 seconds
114-
run: sleep 60s
114+
run: sleep ${{ vars.BUILD_SLEEPTIME }}
115115

116-
# Run the ansible playbook
116+
# Run the Ansibleplaybook
117117
- name: Run_Ansible_Playbook
118118
uses: arillso/action.playbook@master
119119
with:
@@ -125,6 +125,7 @@
125125
env:
126126
ANSIBLE_HOST_KEY_CHECKING: "false"
127127
ANSIBLE_DEPRECATION_WARNINGS: "false"
128+
ANSIBLE_INJECT_FACT_VARS: "false"
128129

129130
# Remove test system - User secrets to keep if necessary
130131

‎.github/workflows/main_pipeline_validation.yml‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
# that can run sequentially or in parallel
1919
jobs:
2020

21-
# This workflow contains a single job which tests the playbook
21+
# This workflow contains a single job that tests the playbook
2222
playbook-test:
2323
# The type of runner that the job will run on
2424
runs-on: ubuntu-latest
@@ -33,13 +33,13 @@
3333

3434
steps:
3535
- name: Clone ${{ github.event.repository.name }}
36-
uses: actions/checkout@v3
36+
uses: actions/checkout@v4
3737
with:
3838
ref: ${{ github.event.pull_request.head.sha }}
3939

4040
# Pull in terraform code for linux servers
41-
- name: Clone github IaC plan
42-
uses: actions/checkout@v3
41+
- name: Clone GitHub IaC plan
42+
uses: actions/checkout@v4
4343
with:
4444
repository: ansible-lockdown/github_linux_IaC
4545
path: .github/workflows/github_linux_IaC
@@ -63,23 +63,23 @@
6363
pwd
6464
ls
6565
env:
66-
# Imported from github variables this is used to load the relvent OS.tfvars file
66+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
6767
OSVAR: ${{ vars.OSVAR }}
6868
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
6969

7070
- name: Terraform_Init
7171
id: init
7272
run: terraform init
7373
env:
74-
# Imported from github variables this is used to load the relvent OS.tfvars file
74+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
7575
OSVAR: ${{ vars.OSVAR }}
7676
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
7777

7878
- name: Terraform_Validate
7979
id: validate
8080
run: terraform validate
8181
env:
82-
# Imported from github variables this is used to load the relvent OS.tfvars file
82+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
8383
OSVAR: ${{ vars.OSVAR }}
8484
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
8585

@@ -100,9 +100,9 @@
100100
# Aws deployments taking a while to come up insert sleep or playbook fails
101101

102102
- name: Sleep for 60 seconds
103-
run: sleep 60s
103+
run: sleep ${{ vars.BUILD_SLEEPTIME }}
104104

105-
# Run the ansible playbook
105+
# Run the Ansibleplaybook
106106
- name: Run_Ansible_Playbook
107107
uses: arillso/action.playbook@master
108108
with:
@@ -114,6 +114,7 @@
114114
env:
115115
ANSIBLE_HOST_KEY_CHECKING: "false"
116116
ANSIBLE_DEPRECATION_WARNINGS: "false"
117+
ANSIBLE_INJECT_FACT_VARS: "false"
117118

118119
# Remove test system - User secrets to keep if necessary
119120

‎.github/workflows/update_galaxy.yml‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,7 @@
11
---
22

3-
# This is a basic workflow to help you get started with Actions
4-
53
name: update galaxy
64

7-
# Controls when the action will run.
8-
# Triggers the workflow on merge request events to the main branch
95
on:
106
push:
117
branches:
@@ -14,8 +10,10 @@ jobs:
1410
update_role:
1511
runs-on: ubuntu-latest
1612
steps:
17-
- uses: actions/checkout@v3
18-
- uses: robertdebock/galaxy-action@master
13+
- name: Checkout repo
14+
uses: actions/checkout@v4
15+
16+
- name: Action Ansible Galaxy Release ${{ github.ref_name }}
17+
uses: ansible-actions/ansible-galaxy-action@main
1918
with:
20-
galaxy_api_key: ${{ secrets.GALAXY_API_KEY }}
21-
git_branch: main
19+
galaxy_api_key: ${{ secrets.GALAXY_API_KEY }}

‎.pre-commit-config.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ci:
77

88
repos:
99
- repo: https://github.com/pre-commit/pre-commit-hooks
10-
rev: v3.2.0
10+
rev: v4.6.0
1111
hooks:
1212
# Safety
1313
- id: detect-aws-credentials
@@ -37,13 +37,13 @@ repos:
3737
exclude: .config/.gitleaks-report.json
3838

3939
- repo: https://github.com/gitleaks/gitleaks
40-
rev: v8.17.0
40+
rev: v8.18.2
4141
hooks:
4242
- id: gitleaks
4343
args: ['--baseline-path', '.config/.gitleaks-report.json']
4444

4545
- repo: https://github.com/ansible-community/ansible-lint
46-
rev: v6.17.2
46+
rev: v24.2.2
4747
hooks:
4848
- id: ansible-lint
4949
name: Ansible-lint
@@ -62,6 +62,6 @@ repos:
6262
- ansible-core>=2.10.1
6363

6464
- repo: https://github.com/adrienverge/yamllint.git
65-
rev: v1.32.0 # or higher tag
65+
rev: v1.35.1 # or higher tag
6666
hooks:
6767
- id: yamllint

‎.yamllint‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,4 @@ rules:
3030
trailing-spaces: enable
3131
truthy:
3232
allowed-values: ['true', 'false']
33-
check-keys: false
33+
check-keys: true

‎Changelog.md‎

Lines changed: 52 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,55 @@
11
# Changes to rhel9CIS
22

3+
## 1.1.5 - Based on CIS v1.0.0
4+
5+
- added new interactive user discoveries
6+
- updated controls 6.2.10-6.2.14
7+
- audit
8+
- steps moved to prelim
9+
- update to coipy and archive logic and variables
10+
- removed vars not used
11+
- updated quotes used in mode tasks
12+
- pre-commit update
13+
- issues addressed
14+
- #190 thanks to @ipruteanu-sie
15+
- aligned logic for user shadow suite params (aligned with other repos)
16+
- new variables to force changes to existing users added 5.6.1.1 - 5.6.1.2
17+
- #198 thanks to @brakkio86
18+
19+
## 1.1.4 - Based on CIS v1.0.0
20+
21+
- 1.2.1 new option for a new system to import gpg key for 1.2.1 to pass redhat only
22+
- thanks to @ipruteanu-sie
23+
- #156
24+
- #165
25+
- #180
26+
- #181
27+
- #183
28+
- #184
29+
30+
## 1.1.3 - Based on CIS v1.0.0
31+
32+
- updated goss binary to 0.4.4
33+
- moved majority of audit variables to vars/audit.yml
34+
- new function to enable audit_only using remediation
35+
- removed some dupes in audit config
36+
37+
## 1.1.2 - Based on CIS v1.0.0
38+
39+
- updated audit binary versions - aligned with rhel9-cis-audit
40+
- lint updates
41+
- .secrets updated
42+
- file mode quoted
43+
- updated 5.6.5 thansk to feedback from S!ghs on discord community
44+
45+
## 1.1.1 - Based on CIS v1.0.0
46+
47+
- thanks to @agbrowne
48+
- [#90](https://github.com/ansible-lockdown/RHEL9-CIS/issues/90)
49+
50+
- thanks to @mnasiadka
51+
- [#54](https://github.com/ansible-lockdown/RHEL9-CIS/pull/54)
52+
353
## 1.1.0
454

555
- new workflow configuration
@@ -81,8 +131,8 @@ Aligned benchmark audit version with remediate release
81131

82132
## 1.0.1
83133

84-
Control 6_2_16 new variable added thanks to @dulin_gnet on rhel8
85-
Will not follow ynlink in hoe directoris and amend permissions.
134+
Control 6_2_16 new variable added thanks to @dulin_gnet on rhel8
135+
Will not follow symlink in home directories and amend permissions.
86136

87137
- rhel_09_6_2_16_home_follow_symlink: false
88138

‎README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040

4141
### Community
4242

43-
Join us on our [Discord Server](https://discord.io/ansible-lockdown) to ask questions, discuss features, or just chat with other Ansible-Lockdown users.
43+
Join us on our [Discord Server](https://www.lockdownenterprise.com/discord) to ask questions, discuss features, or just chat with other Ansible-Lockdown users.
4444

4545
### Contributing
4646

@@ -132,8 +132,8 @@ os_check: false
132132
- python-def (should be included in RHEL 9)
133133
- libselinux-python
134134
- pip packages
135-
- jmespath ( complete list found in requirements.txt)
136-
- collections found in collections/requirememnts.yml
135+
- jmespath
136+
- collections found in collections/requirements.yml
137137

138138
pre-commit is available if installed on your host for pull request testing.
139139

0 commit comments

Comments
 (0)