Ansible role for security hardening
Go to file
Paul Belanger e399786343
Switch from debian-jessie to debian-stable (stretch)
Now that we have debian-stretch images online for openstack-infra,
we'd like to remove debian-jessie[1]. This updates zuul jobs to use the
debian-stable label, which happens to now be debian-stretch.

[1] http://lists.openstack.org/pipermail/openstack-dev/2018-April/129573.html

Change-Id: I7ea475bbdcde533dfde0a30bb516a5fe3a83cab7
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
2018-04-19 18:11:32 -04:00
defaults Replace Fedora 26 with 27 2018-03-07 13:30:45 +00:00
doc Updated from global requirements 2018-03-15 06:44:52 +00:00
files Add support for the openSUSE Leap distributions 2017-06-27 15:43:53 +01:00
handlers Always quote the filesystem permissions 2017-11-08 10:56:07 -06:00
library Verify password age limits [+Docs] 2016-12-08 09:44:23 -06:00
meta Add role maturity metadata to ansible-hardening 2017-11-03 13:50:50 +00:00
releasenotes Replace Fedora 26 with 27 2018-03-07 13:30:45 +00:00
tasks Merge "Simplify SELinux check" 2018-03-15 15:02:32 +00:00
templates Fix the path of chrony.keys 2017-12-22 10:01:58 +08:00
test_plugins Add equalto Jinja2 test for EL7 2017-06-30 09:13:16 -05:00
tests Remove tests-repo-clone.sh 2018-03-28 10:10:35 +01:00
vars Replace Fedora 26 with 27 2018-03-07 13:30:45 +00:00
zuul.d Switch from debian-jessie to debian-stable (stretch) 2018-04-19 18:11:32 -04:00
.gitignore Updated from OpenStack Ansible Tests 2018-03-27 15:59:31 +00:00
.gitreview Fix .gitreview 2017-05-30 18:27:52 +00:00
LICENSE Initial import of openstack-ansible-security role 2015-10-07 07:27:39 -05:00
README.md Replace Fedora 26 with 27 2018-03-07 13:30:45 +00:00
README.rst [Docs] Replace security role references 2017-06-12 18:59:28 +00:00
Vagrantfile Updated from OpenStack Ansible Tests 2018-01-22 16:58:12 +00:00
bindep.txt Updated from OpenStack Ansible Tests 2017-12-06 00:07:09 +00:00
manual-test.rc Use centralised test scripts 2016-09-28 12:16:50 +01:00
run_tests.sh Updated from OpenStack Ansible Tests 2018-03-27 15:59:31 +00:00
setup.cfg [Docs] Replace security role references 2017-06-12 18:59:28 +00:00
setup.py Updated from global requirements 2017-03-02 11:52:32 +00:00
test-requirements.txt Updated from global requirements 2018-03-15 06:44:52 +00:00
tox.ini Remove tests-repo-clone.sh 2018-03-28 10:10:35 +01:00

README.md

ansible-hardening

ansible-hardening-logo

The ansible-hardening role applies security hardening configurations from the Security Technical Implementation Guide (STIG) to systems running the following distributions:

  • CentOS 7
  • Debian Jessie
  • Fedora 27
  • openSUSE Leap 42.2 and 42.3
  • Red Hat Enterprise Linux 7
  • SUSE Linux Enterprise 12 (experimental)
  • Ubuntu 16.04

For more details, review the ansible-hardening documentation.

Requirements

This role can be used with or without OpenStack-Ansible. It requires Ansible 2.3 or later.

Role Variables

All of the variables for this role are in defaults/main.yml.

Dependencies

This role has no dependencies.

Example Playbook

Using the role is fairly straightforward:

- hosts: servers
  roles:
     - ansible-hardening

Running with Vagrant

This role can be tested easily on multiple platforms using Vagrant.

The Vagrantfile supports testing on:

  • Ubuntu 16.04
  • CentOS 7

To test on all platforms:

vagrant destroy --force && vagrant up

To test on Ubuntu 14.04 only:

vagrant destroy ubuntu1404 --force && vagrant up ubuntu1404

To test on Ubuntu 16.04 only:

vagrant destroy ubuntu1604 --force && vagrant up ubuntu1604

To test on CentOS 7 only:

vagrant destroy centos7 --force && vagrant up centos7

License

Apache 2.0

Author Information

For more information, join #openstack-ansible on Freenode.