openstack
/
openstack-ansible-security
Code Issues Proposed changes
RETIRED, Security Role for OpenStack-Ansible
218 Commits 3 Branches 5 Tags 8.2 MiB
Go to file
Major Hayden 6c9eb50fd6 Ensure AIDE initializes on subsequent runs 
If a deployer installs AIDE the first time they apply the role
without initializing AIDE and they want to initialize it later,
the handler that does the initialization never fires.

This patch does a few things:

  - Ensures AIDE initialization if the initialize_aide bool is True
  - Doesn't intialize the AIDE db if it already exists
  - Moves the new db into place on Red Hat systems
  - Moves the AIDE tasks into its own file with tags
  - Prevents AIDE from trawling through /var

Manual backport of two reviews:
  * https://review.openstack.org/#/c/359554/
  * https://review.openstack.org/#/c/361460/

Closes-Bug: 1616281
Backport-of: I170eb3898b4336333b1fbe663ec4f069823898e0
Change-Id: Iaedcce1d6416f2224f44376336c23702e6152a00
 		2016-08-30 07:33:16 -05:00
defaults Ensure AIDE initializes on subsequent runs 2016-08-30 07:33:16 -05:00
doc Docs: Fix rendering of :orphan: 2016-06-27 20:38:03 +00:00
files V-38682: Disable bluetooth modules 2015-10-14 21:23:11 -05:00
handlers Ensure AIDE initializes on subsequent runs 2016-08-30 07:33:16 -05:00
meta Bump minimum required version of Ansible 2016-01-13 12:41:02 -08:00
releasenotes Ensure AIDE initializes on subsequent runs 2016-08-30 07:33:16 -05:00
tasks Ensure AIDE initializes on subsequent runs 2016-08-30 07:33:16 -05:00
templates Add key fields to audit rules 2016-06-13 18:54:19 +00:00
tests Add check/audit to gate testing 2016-06-14 12:13:08 +00:00
vars Enable role testing and make structure ansible-galaxy compatible 2015-10-09 11:47:23 +00:00
.gitignore Add dependencies for paramiko 2.0 2016-05-05 16:34:22 +01:00
.gitreview Update .gitreview for Liberty 2016-04-08 16:34:10 +01:00
LICENSE Initial import of openstack-ansible-security role 2015-10-07 07:27:39 -05:00
README.md Merge "Adding Vagrant setup for deploying security-ansible" 2016-02-05 16:12:33 +00:00
README.rst Add a note to the README file where to report bugs 2016-06-22 19:38:08 +00:00
Vagrantfile Adding Vagrant setup for deploying security-ansible 2016-01-25 08:04:26 -08:00
other-requirements.txt Add dependencies for paramiko 2.0 2016-05-05 16:34:22 +01:00
run_tests.sh Add dependencies for paramiko 2.0 2016-05-05 16:34:22 +01:00
setup.cfg Initial import of openstack-ansible-security role 2015-10-07 07:27:39 -05:00
setup.py Initial import of openstack-ansible-security role 2015-10-07 07:27:39 -05:00
test-requirements.txt Update tox configuration 2016-07-08 16:16:41 +00:00
tox.ini Update tox configuration 2016-07-08 16:16:41 +00:00

README.md

openstack-ansible-security

The goal of the openstack-ansible-security role is to improve security within openstack-ansible deployments. The role is based on the Security Technical Implementation Guide (STIG) for Red Hat Enterprise Linux 6.

Requirements

This role can be used with or without the openstack-ansible role. It requires Ansible 1.8.3 at a minimum.

Role Variables

All of the variables for this role are in defaults/main.yml.

Dependencies

This role has no dependencies.

Example Playbook

Using the role is fairly straightforward:

- hosts: servers
  roles:
     - openstack-ansible-security

Running with Vagrant

Security Ansible can be easily run for testing using Vagrant.

To do so run: vagrant destroy To destroy any previously created Vagrant setup vagrant up Spin up Ubuntu Trusty VM and run ansible-security against it

License

Apache 2.0

Author Information

For more information, join #openstack-ansible on Freenode.