Skip to content

Commit e03e435

Browse files
schurzischurzi
authored
Merge pull request #547 from dev-sec/vm_tests
add VM tests for os_hardening
2 parents b00b38e + 27d091e commit e03e435

File tree

18 files changed

+380
-5
lines changed

18 files changed

+380
-5
lines changed

‎.github/workflows/os_hardening_vm.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
name: "devsec.os_hardening VM"
3+
on: # yamllint disable-line rule:truthy
4+
workflow_dispatch:
5+
push:
6+
paths:
7+
- 'roles/os_hardening/**'
8+
- 'molecule/os_hardening_vm/**'
9+
- '.github/workflows/os_hardening_vm.yml'
10+
pull_request:
11+
paths:
12+
- 'roles/os_hardening/**'
13+
- 'molecule/os_hardening_vm/**'
14+
- '.github/workflows/os_hardening_vm.yml'
15+
jobs:
16+
build:
17+
runs-on: self-hosted
18+
env:
19+
PY_COLORS: 1
20+
ANSIBLE_FORCE_COLOR: 1
21+
strategy:
22+
fail-fast: false
23+
matrix:
24+
molecule_distro:
25+
- centos7
26+
- rocky8
27+
- ubuntu1804
28+
- ubuntu2004
29+
- debian9
30+
- debian10
31+
# - opensuse42 # opensuse currently cannot get an ip address
32+
# - arch - arch is currently not supported by cinc-auditor
33+
steps:
34+
- name: Checkout repo
35+
uses: actions/checkout@v3
36+
with:
37+
path: ansible_collections/devsec/hardening
38+
submodules: true
39+
40+
- name: Create default collection path symlink
41+
run: |
42+
mkdir -p /home/runner/.ansible
43+
ln -fs /opt/actions-runner/_work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections /home/runner/.ansible/collections
44+
45+
- name: Test with molecule
46+
run: |
47+
molecule --version
48+
molecule test -s os_hardening_vm
49+
env:
50+
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
51+
working-directory: ansible_collections/devsec/hardening

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# Ansible Collection - devsec.hardening
22

33
![devsec.os_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening/badge.svg)
4+
![devsec.os_hardening VM](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening%20VM/badge.svg)
45
![devsec.ssh_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.ssh_hardening/badge.svg)
56
![devsec.nginx_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.nginx_hardening/badge.svg)
67
![devsec.mysql_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.mysql_hardening/badge.svg)

‎molecule/os_hardening/converge.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@
2626
os_security_suid_sgid_blacklist: ['/bin/umount']
2727
os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
2828
os_filesystem_whitelist: []
29-
os_ctrlaltdel_disabled: true
3029
os_yum_repo_file_whitelist: ['foo.repo']
3130
sysctl_config:
3231
net.ipv4.ip_forward: 0

‎molecule/os_hardening/verify.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@
5555
shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
5656

5757
- name: Execute cinc-auditor tests # noqa ignore-errors
58-
command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit --waiver-file waivers.yaml https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
58+
command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
5959
register: test_results
6060
changed_when: false
6161
ignore_errors: true

‎molecule/os_hardening_vm/INSTALL.rst‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
*******
2+
Docker driver installation guide
3+
*******
4+
5+
Requirements
6+
============
7+
8+
* Docker Engine
9+
10+
Install
11+
=======
12+
13+
Please refer to the `Virtual environment`_ documentation for installation best
14+
practices. If not using a virtual environment, please consider passing the
15+
widely recommended `'--user' flag`_ when invoking ``pip``.
16+
17+
.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
18+
.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
19+
20+
.. code-block:: bash
21+
22+
$ python3 -m pip install 'molecule[docker]'

‎molecule/os_hardening_vm/converge.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
3+
hosts: all
4+
become: true
5+
environment:
6+
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
7+
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
8+
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
9+
collections:
10+
- devsec.hardening
11+
tasks:
12+
- name: override for arch
13+
set_fact:
14+
os_mnt_boot_enabled: false
15+
when: ansible_facts.os_family == 'Archlinux'
16+
- include_role:
17+
name: os_hardening
18+
vars:
19+
os_auth_pam_passwdqc_enable: false
20+
os_auth_lockout_time: 15
21+
os_yum_repo_file_whitelist: ['foo.repo']
22+
os_mnt_boot_enabled: true
23+
os_mnt_boot_src: "/dev/vda1"

‎molecule/os_hardening_vm/molecule.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
dependency:
3+
name: galaxy
4+
options:
5+
role-file: molecule/os_hardening/requirements.yml
6+
driver:
7+
name: vagrant
8+
provider:
9+
name: libvirt
10+
platforms:
11+
- name: instance
12+
box: "generic/${MOLECULE_DISTRO}"
13+
memory: 1024
14+
cpus: 2
15+
provisioner:
16+
name: ansible
17+
env:
18+
ANSIBLE_PIPELINING: "True"
19+
config_options:
20+
defaults:
21+
interpreter_python: auto_silent
22+
callback_whitelist: profile_tasks, timer, yaml
23+
verifier:
24+
name: ansible
25+
env:
26+
ANSIBLE_PIPELINING: "True"
27+
28+
scenario:
29+
create_sequence:
30+
- dependency
31+
- create
32+
- prepare
33+
check_sequence:
34+
- dependency
35+
- destroy
36+
- create
37+
- prepare
38+
- converge
39+
- check
40+
- destroy
41+
converge_sequence:
42+
- dependency
43+
- create
44+
- prepare
45+
- converge
46+
destroy_sequence:
47+
- destroy
48+
test_sequence:
49+
- dependency
50+
- destroy
51+
- syntax
52+
- create
53+
- prepare
54+
- converge
55+
- idempotence
56+
- verify
57+
- destroy

‎molecule/os_hardening_vm/prepare.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
---
2+
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
3+
hosts: all
4+
become: true
5+
collections:
6+
- devsec.hardening
7+
environment:
8+
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
9+
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
10+
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
11+
tasks:
12+
- name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
13+
set_fact:
14+
ansible_python_interpreter: "/usr/bin/python3"
15+
when: ansible_facts.distribution == 'Fedora'
16+
17+
- name: Run the equivalent of "apt-get update && apt-get upgrade"
18+
apt:
19+
name: "*"
20+
state: latest
21+
update_cache: true
22+
when: ansible_os_family == 'Debian'
23+
24+
- name: install required tools on SuSE
25+
# cannot use zypper module, since it depends on python-xml
26+
shell: "zypper -n install python-xml"
27+
when: ansible_facts.os_family == 'Suse'
28+
29+
- name: install required tools on fedora
30+
dnf:
31+
name:
32+
- python
33+
- findutils
34+
- procps-ng
35+
when: ansible_facts.distribution == 'Fedora'
36+
37+
- name: install required tools on Arch
38+
community.general.pacman:
39+
name:
40+
- awk
41+
state: present
42+
update_cache: true
43+
when: ansible_facts.os_family == 'Archlinux'
44+
45+
- name: install required tools on RHEL # noqa ignore-errors
46+
yum:
47+
name:
48+
- openssh-clients
49+
- openssh
50+
state: present
51+
update_cache: true
52+
ignore_errors: true
53+
54+
- name: create recursing symlink to test minimize access
55+
shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
56+
changed_when: false
57+
58+
- name: include YUM prepare tasks
59+
include_tasks: prepare_tasks/yum.yml
60+
when: ansible_facts.os_family == 'RedHat'

‎molecule/os_hardening_vm/prepare_tasks/yum.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
- name: create 'foo' repository
3+
ansible.builtin.yum_repository:
4+
name: foo
5+
description: mandatory description
6+
baseurl: file:///mandatory-url
7+
enabled: false
8+
gpgcheck: false
9+
10+
- name: create 'bar' repository
11+
ansible.builtin.yum_repository:
12+
name: bar
13+
description: mandatory description
14+
baseurl: file:///mandatory-url
15+
enabled: false
16+
gpgcheck: false

‎molecule/os_hardening_vm/requirements.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
roles:
3+
- geerlingguy.git

0 commit comments

Comments
 (0)