9.0.1

Changelog

9.0.1 (2024-01-15)

Full Changelog

Implemented enhancements:

• Extend ansible-lint testing to cover our test cases #731
• Make value of kernel.unprivileged_userns_clone depending on kernel version #727
• Complete tests for OS hardening #660
• support restarts of audit service on Arch linux #722 [os_hardening] (schurzi)

Fixed bugs:

• Fails to install #735
• Amazon Linux gpg check fails #734
• ssh_hardening ipv6 #719
• boolean variable inconsistency? #330
• Restore idempotency for disabling unused filesystems with Ansible 2.16.0 #718 [os_hardening] (akikanellis)

Closed issues:

• 9.0.0 version number in galaxy.yml file is wrong #740
• Dependency Dashboard #655

Merged pull requests:

• restructure readme to move known limitations up top #739 [os_hardening] [ssh_hardening] (rndmh3ro)
• release only on releases, not pre-releases #738 (rndmh3ro)
• Update dependency ansible-core to v2.16.2 #737 (renovate[bot])
• fix linting for github config #736 (rndmh3ro)
• Update actions/setup-python action to v5 #733 (renovate[bot])
• Update ansible-lint action and revise configuration to scan all Ansible code #732 (schurzi)
• update labeler to new config format #730 [ssh_hardening] (schurzi)
• Update dependency ansible-core to v2.16.1 #728 [os_hardening] (renovate[bot])
• pin Ansible to always let Renovate update to the most current version in our tests #721 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (schurzi)

9.0.0

Changelog

9.0.0 (2023-11-16)

Full Changelog

Breaking changes:

• make it possible to configure more then yes and no for PermitTunnel #715 [ssh_hardening] (rndmh3ro)
• add role argument spec for os, ssh, mysql #687 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (rndmh3ro)

Implemented enhancements:

• Create role documentation with Automated-Ansible-Role-Documentation #694
• Minimize access user paths should be fully configurable #689
• Add support for Debian 12 #672
• add testing and support for current versions of Fedora and FreeBSD #709 [os_hardening] [ssh_hardening] (schurzi)
• feat: workflow for roles readme #705 [ssh_hardening] (Nemental)
• do not try to drop roles in mysql hardening #649 [mysql_hardening] (rndmh3ro)

Fixed bugs:

• nginx conf.d directory is missing on Rocky Linux 8 #707
• Default value of ssh_client_alive_interval is inconsistent with what documentation says #701
• [devsec.hardening.os_hardening : restart-auditd] fails #698
• sshd_hardening role cannot be used to build system images #697
• Error: No file was found when using first_found on Ubuntu 20.04 #676
• PUBLIC-role breaks mysql-hardening #648
• Error deploying the playbook #630
• boolean variable inconcistency ? #330
• Gather facts when os_hardening role is executed with tags #708 [os_hardening] (schurzi)

Closed issues:

• Dependency Dashboard #655
• Add send-to-mailinglist to github release action #434

Merged pull requests:

• update status badges in README #714 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (schurzi)
• fix CI test for os_hardening #711 [os_hardening] (schurzi)
• fix nginx CI tests #710 [nginx_hardening] (schurzi)
• fix: roles-readme action default value #706 [ssh_hardening] (Nemental)
• fix some wrong defaults and types in the readmes #703 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (rndmh3ro)
• update links to new Ansible Galaxy #702 [nginx_hardening] (schurzi)
• Fix typo in login.defs.j2 #700 [os_hardening] (nejch)
• chore(deps): update actions/checkout action to v4 #696 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (renovate[bot])
• test debian12 on VM #695 (rndmh3ro)
• fix descriptions in readme #693 [os_hardening] (rndmh3ro)
• feat: customize user paths default #692 [os_hardening] (S0obi)
• disable PAM tests #691 [os_hardening] (rndmh3ro)

8.8.0

Changelog

8.8.0 (2023-08-04)

Full Changelog

Implemented enhancements:

• Add support for Fedora 38 #671
• auditd: add possibility to override config template #685 [os_hardening] (Meecr0b)
• add debian 12 support #684 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (rndmh3ro)
• feat: explicitly support Fedora 37 and 38 #682 [os_hardening] [ssh_hardening] (nejch)
• Replace ssh_keys group with root, where applicable and use less permissive file mode #677 [ssh_hardening] (rndmh3ro)
• Add oddjob mkhomedir option rhel pam #675 [os_hardening] (imp1sh)

Fixed bugs:

• How does one set sshd_authenticationmethods to include password authentication? #686
• Error: No file was found when using first_found on Ubuntu 20.04 #676
• FreeIPA environment mkhomedir fails #664

Closed issues:

• What is the uscase of sysctl_overwrite over ansible.posix.sysctl? #683
• Ensure permissions on mysql-logfile are correct chokes when log_error is set to stderr #673
• TASK TASK FAILED: [devsec.hardening.os_hardening : Set password ageing for existing regular (non-system, non-root) accounts] #670
• After os_hardening ssh not working #663
• Unsupported parameters for (ansible.builtin.user) module #650

Merged pull requests:

• setting gets ignored #680 [os_hardening] (rndmh3ro)
• add var-naming[no-role-prefix] to skip-list #679 (rndmh3ro)
• expand on check conditions for non-file locations of logs #674 [mysql_hardening] (whysthatso)
• use new molecule-plugins #667 (schurzi)
• add spellchecking with codespell #662 [mysql_hardening] [os_hardening] [ssh_hardening] (schurzi)

8.7.0

Changelog

8.7.0 (2023-04-12)

Full Changelog

Implemented enhancements:

• Support BSD and other operating systems CI with VM based tests #599
• add check mode to molecule tests #644 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (schurzi)
• add testing for OpenBSD and FreeBSD #642 [ssh_hardening] (schurzi)
• Only skip audit restart handler in docker #637 [os_hardening] (nejch)
• Make action_mail_acct configurable in auditd #631 [os_hardening] (nejch)

Fixed bugs:

• getent task is skipped if user previously ran it with a key parameter #646
• Error running devsec.hardening.os_hardening role #645
• devsec.hardening.mysql_hardening - Get all users that have no authentication_string - Hello world #640
• fixes #646 - add another condition to getent task #647 [os_hardening] (gbolo)

Closed issues:

• Dependency Dashboard #655
• Invalid login.defs for RHEL6 #651
• Unsupported parameters for (ansible.builtin.user) module #650
• Deprecation warnings for os_hardening #638
• Write tests for MySQL user-deletion #445

Merged pull requests:

• Update minimum required Ansible version for os_hardening #657 [os_hardening] [ssh_hardening] (schurzi)
• Update test environment #656 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (schurzi)
• Update dependency geerlingguy.git to v3.0.1 #654 [mysql_hardening] (renovate[bot])
• Configure Renovate #653 (renovate[bot])
• simplify MySQL queries for user deletion #641 [mysql_hardening] (schurzi)
• Bump creyD/prettier_action from 4.2 to 4.3 #639 (dependabot[bot])
• Fix molecule tests for EL7 #636 [mysql_hardening] (rndmh3ro)
• run our CI tests periodically #634 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (schurzi)
• try to fix molecule local tests #632 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (rndmh3ro)
• remove unneccessary tasks for VM based test #629 [os_hardening] (schurzi)

8.6.0

Changelog

8.6.0 (2023-02-04)

Full Changelog

Implemented enhancements:

• make number of warning days before user password expires configurable #628 [os_hardening] (Normo)

Merged pull requests:

• Bump hugo19941994/delete-draft-releases from 1.0.0 to 1.0.1 #627 (dependabot[bot])

8.5.0

Changelog

8.5.0 (2023-01-31)

Full Changelog

Implemented enhancements:

• Add support for /etc/auditd.conf num_logs to go with max_log_file_action #616
• password ageing not enforced #570
• Rewrite system account detection and hardening and create tests #621 [os_hardening] [ssh_hardening] (rndmh3ro)
• Add support for /etc/auditd.conf num_logs to go with max_log_file_action #617 [os_hardening] (richardlock)
• Preserve default ownership and dir mode for /var/log on Ubuntu #615 [os_hardening] (stdtom)
• rewrite user home dir hardening #584 [os_hardening] (DonEstefan)
• apply password age settings to exisiting regular users #582 [os_hardening] (DonEstefan)
• Parametrize more auditd.conf options #535 [os_hardening] (kravietz)

Fixed bugs:

• os_hardening is setting wrong ownership for /var/log on Ubuntu #614
• [os_hardening] Task for setting initramfs modules does not match its condition #590 [os_hardening]
• Support for Amazon Linux 2 #624 [ssh_hardening] (mmitnyan)

Deprecated:

• deprecate rebuilding of initramfs #618 [os_hardening] (rndmh3ro)

Closed issues:

• Ubuntu 22.04 vars file missing? #619
• SSH KexAlgorithms causes SSH daemon to fail #500
• Playbook won't run for hardening #462

Merged pull requests:

• do not let dependabot label our prs #626 (rndmh3ro)
• run linting only when files inside roles change #625 (rndmh3ro)
• cancel running tests if new commit to branch is made #622 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (rndmh3ro)
• Fixed problems with running molecule locally with cgroup v2 #620 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (rndmh3ro)
• Bump actions/setup-python from 1 to 4 #611 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (dependabot[bot])
• Bump creyD/prettier_action from 3.1 to 4.2 #610 (dependabot[bot])
• linting #603 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (rndmh3ro)

8.4.0

Changelog

8.4.0 (2022-12-17)

Full Changelog

Implemented enhancements:

• Implement Test for MySQL systemd service #606
• Extended net hardening #607 [os_hardening] (DonEstefan)
• Add OpenSUSE support #605 [mysql_hardening] (rndmh3ro)
• Allow ssh_allow_tcp_forwarding to be a boolean #600 [ssh_hardening] (crisbal)
• OpenBSD does not support GSSAPI Authentication #598 [ssh_hardening] (dennisse)
• add Ansible specific templates for issues #596 (schurzi)
• use github templates for new issues #595 (schurzi)

Fixed bugs:

• os_auth_retries variable causes a comparison type error on pam tasks #593
• ssh_hardening: Install selinux dependencies fails on Oracle Linux (RHEL) 9 #585
• OpenBSD does not set distributiuon_major_version #597 [ssh_hardening] (dennisse)

Merged pull requests:

• Check for github action updates daily #609 (jlosito)
• add verify-task to check if mysql is running and enabled #608 [mysql_hardening] (rndmh3ro)
• Updates handlers for new ansible syntax and deprecated options for legacy commands #602 [os_hardening] (jsievertde)
• add notice to sign-off work to contributor guideline #601 (schurzi)

8.3.0

Changelog

8.3.0 (2022-10-27)

Full Changelog

Implemented enhancements:

• add hardening of root user account(s) #579 [os_hardening] (donestefan)

Fixed bugs:

• os_auth_retries variable causes a comparison type error on pam tasks #593
• cast expected int types in pam tasks #594 [os_hardening] (dlouzan)
• do not manage trusted user ca keys if none exist #580 [ssh_hardening] (hollow)

Closed issues:

• Trying to run the os_hardening on Debian 11, but fails on privilege escalation #587
• auditd increasing logfiles #586
• Path to nginx.conf should be configurable in a variable #577

Merged pull requests:

• adopt all current suggestions from ansible-lint #592 [mysql_hardening] [os_hardening] [ssh_hardening] (schurzi)
• Support more os #588 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (rndmh3ro)
• run tests only on pushes to master or to PRs #581 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (rndmh3ro)

8.2.0

Changelog

8.2.0 (2022-09-08)

Full Changelog

Implemented enhancements:

• Add nginx variables for config-path and owner/group #578 [nginx_hardening] (hagenbauer)
• add centos >8 Support #573 [ssh_hardening] (sbaerlocher)
• add always-tag to include so other tags can be used #569 [os_hardening] (rndmh3ro)

Closed issues:

• Bug using os_hardening "tags" #567

8.1.0

Changelog

8.1.0 (2022-08-26)

Full Changelog

Implemented enhancements:

• add always-tag to include so other tags can be used #569 [os_hardening] (rndmh3ro)

Closed issues:

• Bug using os_hardening "tags" #567
• dev-sec CI bot should not update CHANGELOG.md in fork repository #566

Merged pull requests:

• update supported OS in meta and fix linting #572 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (rndmh3ro)
• fix misleading comment #571 [os_hardening] (donestefan)
• only run release actions on upstream-repo #568 (rndmh3ro)