Skip to content

Commit b87188c

Browse files
schurzijonathanspw
schurzi
and
jonathanspw
authored
Add support for current versions of Debian and EL (#893)
* Add support for current versions of Debian and EL Signed-off-by: Martin Schurz <[email protected]> * Add conditions for EL8 Signed-off-by: Martin Schurz <[email protected]> * Fix Audit in AlmaLinux Signed-off-by: Martin Schurz <[email protected]> * Fix broken SSH host key config in rhel/almalinux 10 Signed-off-by: Jonathan Wright <[email protected]> * Generate SSH Keys on EL10 Signed-off-by: Martin Schurz <[email protected]> * Generate SSH Keys for tests via Systemd Signed-off-by: Martin Schurz <[email protected]> * Fixup tests Signed-off-by: Martin Schurz <[email protected]> * Remove auditd conditions Signed-off-by: Martin Schurz <[email protected]> * Add path to audit handler Signed-off-by: Martin Schurz <[email protected]> * Install init scripts Signed-off-by: Martin Schurz <[email protected]> * Update main README --------- Signed-off-by: Martin Schurz <[email protected]> Signed-off-by: Jonathan Wright <[email protected]> Co-authored-by: Jonathan Wright <[email protected]>
1 parent f144605 commit b87188c

File tree

14 files changed

+57
-23
lines changed

14 files changed

+57
-23
lines changed

‎.github/workflows/mysql_hardening.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,14 +37,19 @@ jobs:
3737
fail-fast: false
3838
matrix:
3939
molecule_distro:
40+
- almalinux8
41+
- almalinux9
42+
# - almalinux10 # problem with baseline
4043
- centosstream9
4144
- rocky8
4245
- rocky9
46+
# - rocky10 # problem with baseline
4347
- ubuntu2004
4448
- ubuntu2204
4549
- ubuntu2404
4650
- debian11
4751
- debian12
52+
- debian13
4853
# - amazon # geerlingguy.mysql does not support fedora
4954
# - arch # geerlingguy.mysql does not support arch
5055
- opensuse_tumbleweed
@@ -71,7 +76,7 @@ jobs:
7176
pip install "ansible-core<2.17"
7277
ansible-galaxy collection install 'community.crypto:<3.0.0'
7378
working-directory: ansible_collections/devsec/hardening
74-
if: matrix.molecule_distro == 'rocky8'
79+
if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
7580

7681
# that was a hard one to fix. robert did it thankfully
7782
# https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212

‎.github/workflows/nginx_hardening.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,14 +36,19 @@ jobs:
3636
fail-fast: false
3737
matrix:
3838
molecule_distro:
39+
- almalinux8
40+
- almalinux9
41+
- almalinux10
3942
- centosstream9
4043
- rocky8
4144
- rocky9
45+
- rocky10
4246
- ubuntu2004
4347
- ubuntu2204
4448
- ubuntu2404
4549
- debian11
4650
- debian12
51+
- debian13
4752
- amazon2023
4853
# - arch # needs to be fixed
4954
# - opensuse_tumbleweed # needs to be fixed
@@ -70,7 +75,7 @@ jobs:
7075
pip install "ansible-core<2.17"
7176
ansible-galaxy collection install 'community.crypto:<3.0.0'
7277
working-directory: ansible_collections/devsec/hardening
73-
if: matrix.molecule_distro == 'rocky8'
78+
if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
7479

7580
# Molecule has problems detecting the proper location for installing roles
7681
# https://github.com/ansible/molecule/issues/3806

‎.github/workflows/os_hardening.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,16 +39,21 @@ jobs:
3939
- molecule_distro: opensuse_tumbleweed
4040
molecule_docker_command: "/usr/lib/systemd/systemd"
4141
molecule_distro:
42+
- almalinux8
43+
- almalinux9
44+
- almalinux10
4245
- centosstream9
4346
- rocky8
4447
- rocky9
48+
- rocky10
4549
- fedora39
4650
- fedora40
4751
- ubuntu2004
4852
- ubuntu2204
4953
- ubuntu2404
5054
- debian11
5155
- debian12
56+
- debian13
5257
- amazon2023
5358
- arch
5459
molecule_docker_command:
@@ -75,7 +80,7 @@ jobs:
7580
pip install "ansible-core<2.17"
7681
ansible-galaxy collection install 'community.crypto:<3.0.0'
7782
working-directory: ansible_collections/devsec/hardening
78-
if: matrix.molecule_distro == 'rocky8'
83+
if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
7984

8085
- name: Test with molecule
8186
run: molecule test -s os_hardening

‎.github/workflows/os_hardening_vm.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@ jobs:
3636
fail-fast: false
3737
matrix:
3838
molecule_distro:
39+
- almalinux/8
40+
- almalinux/9
41+
# - almalinux/10 # boot loop
3942
- generic/centos9s
4043
- generic/rocky8
4144
- generic/rocky9
@@ -69,7 +72,10 @@ jobs:
6972
pip install "ansible-core<2.17"
7073
ansible-galaxy collection install 'community.crypto:<3.0.0'
7174
working-directory: ansible_collections/devsec/hardening
72-
if: matrix.molecule_distro == 'generic/rocky8' || matrix.molecule_distro == 'generic/opensuse15'
75+
if: >
76+
matrix.molecule_distro == 'generic/rocky8' ||
77+
matrix.molecule_distro == 'almalinux/8' ||
78+
matrix.molecule_distro == 'generic/opensuse15'
7379
7480
- name: Update Vagrant Box
7581
run: |

‎.github/workflows/ssh_hardening.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,16 +42,21 @@ jobs:
4242
- molecule_distro: alpine
4343
molecule_docker_command: "/sbin/init"
4444
molecule_distro:
45+
- almalinux8
46+
- almalinux9
47+
- almalinux10
4548
- centosstream9
4649
- rocky8
4750
- rocky9
51+
- rocky10
4852
- fedora39
4953
- fedora40
5054
- ubuntu2004
5155
- ubuntu2204
5256
- ubuntu2404
5357
- debian11
5458
- debian12
59+
- debian13
5560
- amazon2023
5661
- arch
5762
molecule_docker_command:
@@ -78,7 +83,7 @@ jobs:
7883
pip install "ansible-core<2.17"
7984
ansible-galaxy collection install 'community.crypto:<3.0.0'
8085
working-directory: ansible_collections/devsec/hardening
81-
if: matrix.molecule_distro == 'rocky8'
86+
if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
8287

8388
- name: Test with molecule
8489
run: molecule test -s ssh_hardening

‎.github/workflows/ssh_hardening_custom_tests.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,16 +42,21 @@ jobs:
4242
- molecule_distro: alpine
4343
molecule_docker_command: "/sbin/init"
4444
molecule_distro:
45+
- almalinux8
46+
- almalinux9
47+
- almalinux10
4548
- centosstream9
4649
- rocky8
4750
- rocky9
51+
- rocky10
4852
- fedora39
4953
- fedora40
5054
- ubuntu2004
5155
- ubuntu2204
5256
- ubuntu2404
5357
- debian11
5458
- debian12
59+
- debian13
5560
- amazon2023
5661
- arch
5762
molecule_docker_command:
@@ -78,7 +83,7 @@ jobs:
7883
pip install "ansible-core<2.17"
7984
ansible-galaxy collection install 'community.crypto:<3.0.0'
8085
working-directory: ansible_collections/devsec/hardening
81-
if: matrix.molecule_distro == 'rocky8'
86+
if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
8287

8388
- name: Test with molecule
8489
run: molecule test -s ssh_hardening_custom_tests

‎README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,9 @@ This collection provides battle tested hardening for:
1414

1515
- Linux operating systems:
1616
- CentOS Stream 9
17-
- AlmaLinux 8/9
18-
- Rocky Linux 8/9
19-
- Debian 11/12
17+
- AlmaLinux 8/9/10
18+
- Rocky Linux 8/9/10
19+
- Debian 11/12/13
2020
- Ubuntu 20.04/22.04/24.04
2121
- Amazon Linux (some roles supported)
2222
- Arch Linux (some roles supported)

‎molecule/os_hardening_vm/prepare.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,12 @@
5959
- python3-libselinux
6060
when: ansible_facts.distribution == 'Fedora'
6161

62+
- name: Install required tools on AlmaLinux
63+
ansible.builtin.dnf:
64+
name:
65+
- initscripts
66+
when: ansible_facts.distribution == 'AlmaLinux'
67+
6268
- name: Install required tools on Arch
6369
community.general.pacman:
6470
name:
@@ -84,7 +90,6 @@
8490
ansible.posix.mount:
8591
path: /boot/efi
8692
state: unmounted
87-
when: ansible_facts.distribution == 'Fedora'
8893

8994
- name: Include YUM prepare tasks
9095
ansible.builtin.include_tasks: prepare_tasks/yum.yml

‎molecule/ssh_hardening/prepare.yml‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -75,11 +75,6 @@
7575
update_cache: true
7676
when: ansible_facts.os_family == 'Archlinux'
7777

78-
- name: Create ssh host keys # noqa ignore-errors
78+
- name: Create ssh host keys # noqa ignore-errors no-changed-when
7979
ansible.builtin.command: ssh-keygen -A
80-
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
81-
or ansible_facts.distribution == "Fedora"
82-
or ansible_facts.distribution == "Amazon"
83-
or ansible_facts.os_family == "Suse"
84-
changed_when: false
8580
ignore_errors: true

‎molecule/ssh_hardening_custom_tests/prepare.yml‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -75,11 +75,6 @@
7575
update_cache: true
7676
when: ansible_facts.os_family == 'Alpine'
7777

78-
- name: Create ssh host keys # noqa ignore-errors
78+
- name: Create ssh host keys # noqa ignore-errors no-changed-when
7979
ansible.builtin.command: ssh-keygen -A
80-
when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
81-
or ansible_facts.distribution == "Fedora"
82-
or ansible_facts.distribution == "Amazon"
83-
or ansible_facts.os_family == "Suse"
84-
changed_when: false
8580
ignore_errors: true

0 commit comments

Comments
 (0)