Release to main #205

uk-bolly · 2024-04-30T08:07:00Z

Overall Review of Changes:
Many issues, updates and improvements
audit capability
pre-commit

Issue Fixes:
#60
#54
#93
#95
#96
#97
#98
#99
#100
#103
#105
#108
#110
#112
#119
#120
#121
#127
#129
#131
#133
#136
#138
#140
#143
#145
#148
#150
#151
#152
#154
#159
#164
#167
#169
#173
#174
#175
#177
#178
#179
#185
#186
#188
#192
#201
#202
#204

Enhancements:
Updated to pre-commit plugins
Audit capability - audit_only
updates for audit copy and get url
audit moved to earlier in the playbook

How has this been tested?:
Manually
pipelines
community

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Sept23 to devel

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

updated discord link in readme

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

fix rule_1.8.1.1

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Goss version

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Sept lint

…ng 0600 #173 Signed-off-by: rjacobs1990 <ricardojacobs20@gmail.com>

Signed-off-by: rjacobs1990 <ricardojacobs20@gmail.com>

updates: - [github.com/gitleaks/gitleaks: v8.18.1 → v8.18.2](gitleaks/gitleaks@v8.18.1...v8.18.2) - [github.com/ansible-community/ansible-lint: v6.22.2 → v24.2.0](ansible/ansible-lint@v6.22.2...v24.2.0) - [github.com/adrienverge/yamllint.git: v1.33.0 → v1.34.0](https://github.com/adrienverge/yamllint.git/compare/v1.33.0...v1.34.0)

With an AD account there isn't an entry in the /etc/shadow file. This caused the password length check to treat it as a zero length password. Now local password check is skipped for AD account. Also added an additional check for a locked local account for the sudo user. Signed-off-by: John Foster <robopickle@proton.me>

Signed-off-by: Michael Hicks <nooneofconsequence@gmail.com>

Signed-off-by: John Foster <robopickle@proton.me>

findings in issue #168. Changed vars on line 233 to use dictionary. Signed-off-by: John Foster <robopickle@proton.me>

fixing some mismatched tags and tasks in 5.6.1.x

…ain_variables Using a patch to refactor doc-extension

Siemens/feat/bgrubby usage for params

…nfig [pre-commit.ci] pre-commit autoupdate

Update cis_6.1.x.yml

oscap scan found 2 issues in sshd configuration override files

…pyPath Replacing vars according to Audit needs

Signed-off-by: John Foster <robopickle@proton.me>

Bugfix 5 3 4 against issue #176

fix: idempotency molecule issue fixed for logfiles #173

@rjacobs1990

* change logic thanks to @rjacobs1990 see #175 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * thanks to @ipruteani-sie #134 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Thanks to @stwongst #125 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * thanks to @sgomez86 #146 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Added updates from #115 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * removed rp_filter in post added in error Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated yamllint precommit Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated fqcn fo json_query Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * fix typo for virt type query Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> --------- Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

updates: - [github.com/adrienverge/yamllint.git: v1.34.0 → v1.35.1](https://github.com/adrienverge/yamllint.git/compare/v1.34.0...v1.35.1) Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

@rjacobs1990

* change logic thanks to @rjacobs1990 see #175 * 1.2.1 force gpg import rhel * fix missing facts --------- Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

@ipruteanu-sie

* Issue #170, PR #181 thanks to @ipruteanu-sie * issue #182, PR #183 thansk to @ipruteanu-sie * PR #180 thanks to @ipruteanu-sie and @raabf * Addressed PR #165 thanks to @ipruteanu-sie * PT #184 addressed thansk to @ipruteanu-sie * updated credits * typo and ssh allow_deny comments * enable OS check --------- Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* Fixed issues with 4.1.1.2 and 4.1.1.3 Now handle multiple kernels and are idempotent Signed-off-by: John Foster <robopickle@proton.me> * Fixed issues with 4.1.1.2 and 4.1.1.3 Now handle multiple kernels and are idempotent Removed debug messages Signed-off-by: John Foster <robopickle@proton.me> --------- Signed-off-by: John Foster <robopickle@proton.me>

updates: - [github.com/ansible-community/ansible-lint: v24.2.0 → v24.2.1](ansible/ansible-lint@v24.2.0...v24.2.1) Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

@ipruteanu-sie

* Issue #170, PR #181 thanks to @ipruteanu-sie Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * issue #182, PR #183 thansk to @ipruteanu-sie Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * PR #180 thanks to @ipruteanu-sie and @raabf Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Addressed PR #165 thanks to @ipruteanu-sie Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * PT #184 addressed thansk to @ipruteanu-sie Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated credits Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * typo and ssh allow_deny comments Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * enable OS check Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * PR - #198 addressed thanks to @brakkio86 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Addressed issue #190 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Additional vars for issue #190 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated pre-commit version Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * consistent quotes around mode Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * moved audit added discoveries Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * removed unneeded vars Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * audit moved to prelim Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * tidy up Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * improved new variable usage Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * fixed logic 6.2.10 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * addressed #197 thanks to @mark-tomich Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updates for audit section Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * fixed naming Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * added prelim to includes Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> --------- Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

updates: - [github.com/pre-commit/pre-commit-hooks: v4.5.0 → v4.6.0](pre-commit/pre-commit-hooks@v4.5.0...v4.6.0) Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

updates: - [github.com/ansible-community/ansible-lint: v24.2.1 → v24.2.2](ansible/ansible-lint@v24.2.1...v24.2.2) Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

georgenalen

Looks good!

uk-bolly added 30 commits September 6, 2023 08:27

#60 addressed for ipb6

8f3150e

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

#54 merged into new layout

04cb2e0

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

updated

7c79027

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

more ansible_facst referenced #54

18e59d3

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

updated typos

3f32f9c

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

updated typos

8bd1767

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

updated due to changes

95140d3

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

new var rhel9cis_rhel_default_repo

43a339c

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Merge pull request #93 from ansible-lockdown/sept23

18a44fc

Sept23 to devel

updated

279023d

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Merge pull request #95 from ansible-lockdown/discord_link_update

7bb4040

updated discord link in readme

updated test and control

d64414c

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

updated discord link

64416d5

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Merge pull request #96 from ansible-lockdown/rule_1.8.1.1

a3b12b7

fix rule_1.8.1.1

git audit binary version updated

f6fd7e0

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

updated

9c84884

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Merge branch 'devel' into goss_version

f25110d

Merge pull request #97 from ansible-lockdown/goss_version

4072c54

Goss version

lint updates

e202d4b

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

import_tasks file added

a67a484

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

updated test

af20f70

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

import_tasks file added

c5ed197

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

import_tasks file added

e5d17f7

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

updated

061483f

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

fix filename

580ee76

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

added pragma allowed

11071a6

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

updated

35dfa87

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

quoted file mode

e82b2ce

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

updated

076c02e

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Merge pull request #98 from ansible-lockdown/sept_lint

60f756a

Sept lint

rjacobs1990 and others added 27 commits February 12, 2024 15:55

fix: idempotency molecule issue fixed for logfiles and prevent skippi…

8652390

…ng 0600 #173 Signed-off-by: rjacobs1990 <ricardojacobs20@gmail.com>

fix: more readable condition and prevent skipping 0600 #173

742165c

Signed-off-by: rjacobs1990 <ricardojacobs20@gmail.com>

fixing some mismatched tags and tasks in 5.6.1.x

1c7990c

Signed-off-by: Michael Hicks <nooneofconsequence@gmail.com>

Adjusted tasks/main.yml indentation after running precommit checks

0e89fed

Signed-off-by: John Foster <robopickle@proton.me>

Updated cis_6.1.x.yml to avoid deprecation warning as per Illibur's

e100b02

findings in issue #168. Changed vars on line 233 to use dictionary. Signed-off-by: John Foster <robopickle@proton.me>

Merge pull request #150 from numericillustration/devel

488a4d5

fixing some mismatched tags and tasks in 5.6.1.x

Merge pull request #164 from siemens/siemens/feat/Refactor_Document_m…

cc6522f

…ain_variables Using a patch to refactor doc-extension

Merge pull request #166 from siemens/siemens/feat/BgrubbyUsageForParams

e3f5522

Siemens/feat/bgrubby usage for params

Merge pull request #167 from ansible-lockdown/pre-commit-ci-update-co…

f9dbbee

…nfig [pre-commit.ci] pre-commit autoupdate

Merge pull request #169 from Illibur/patch-1

21f24b4

Update cis_6.1.x.yml

Merge pull request #174 from bbaassssiiee/bugfix/sshd

03e2a28

oscap scan found 2 issues in sshd configuration override files

Merge pull request #131 from siemens/siemens/feat/replacingVarAuditCo…

3313a1f

…pyPath Replacing vars according to Audit needs

Added blank line between each named task for consistency.

467434a

Signed-off-by: John Foster <robopickle@proton.me>

Merge pull request #177 from RoboPickle/bugfix_5_3_4

96536cc

Bugfix 5 3 4 against issue #176

Merge pull request #175 from rjacobs1990/bugfix/fix-permissions-logfiles

06ec3de

fix: idempotency molecule issue fixed for logfiles #173

[pre-commit.ci] pre-commit autoupdate (#178)

0215412

updates: - [github.com/adrienverge/yamllint.git: v1.34.0 → v1.35.1](https://github.com/adrienverge/yamllint.git/compare/v1.34.0...v1.35.1) Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Gpg import for rhel servers (#185)

0f58436

* change logic thanks to @rjacobs1990 see #175 * 1.2.1 force gpg import rhel * fix missing facts --------- Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

[pre-commit.ci] pre-commit autoupdate (#192)

e87d637

updates: - [github.com/ansible-community/ansible-lint: v24.2.0 → v24.2.1](ansible/ansible-lint@v24.2.0...v24.2.1) Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

[pre-commit.ci] pre-commit autoupdate (#200)

b5bea72

updates: - [github.com/pre-commit/pre-commit-hooks: v4.5.0 → v4.6.0](pre-commit/pre-commit-hooks@v4.5.0...v4.6.0) Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

[pre-commit.ci] pre-commit autoupdate (#202)

d8f9b30

updates: - [github.com/ansible-community/ansible-lint: v24.2.1 → v24.2.2](ansible/ansible-lint@v24.2.1...v24.2.2) Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

updated assert statement (#204)

79e36d8

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

uk-bolly requested a review from georgenalen April 30, 2024 08:07

georgenalen approved these changes May 1, 2024

View reviewed changes

uk-bolly merged commit 7661bc0 into main May 1, 2024
4 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Release to main #205

Release to main #205

uk-bolly commented Apr 30, 2024

georgenalen left a comment

Release to main #205

Release to main #205

Conversation

uk-bolly commented Apr 30, 2024

georgenalen left a comment

Choose a reason for hiding this comment