90 lines
2.9 KiB
YAML
90 lines
2.9 KiB
YAML
- name: Apply DevSec hardening
|
|
hosts: all
|
|
become: yes
|
|
vars:
|
|
sysctl_overwrite:
|
|
# Enable IPv4 traffic forwarding. Needed for containers.
|
|
net.ipv4.ip_forward: 1
|
|
os_security_users_allow:
|
|
- "change_user" # Ensure this user is allowed to avoid modifying /bin/su (does not work on read-only filesystems)
|
|
os_family: "Suse"
|
|
os_release: "Tumbleweed" # Treat MicroOS as Tumbleweed
|
|
os_version: "{{ ansible_distribution_version }}"
|
|
os_vars:
|
|
packages:
|
|
- sudo
|
|
- openssh
|
|
ignore_fs_types:
|
|
- squashfs
|
|
- iso9660
|
|
- vfat
|
|
auth_pam:
|
|
- common-password
|
|
- common-auth
|
|
- common-account
|
|
- common-session
|
|
pam_passwords:
|
|
- password requisite pam_pwquality.so retry=3
|
|
- password required pam_unix.so use_authtok remember=5 sha512 shadow
|
|
securetty: [console, tty1, tty2, tty3, tty4, tty5, tty6]
|
|
sshd:
|
|
package: openssh
|
|
service: sshd
|
|
config: /etc/ssh/sshd_config
|
|
kernel_modules_disabled:
|
|
- cramfs
|
|
- freevxfs
|
|
- jffs2
|
|
- hfs
|
|
- hfsplus
|
|
- squashfs
|
|
- udf
|
|
- vfat
|
|
auditd_package: audit # This is the correct package name for auditd in openSUSE
|
|
os_env_umask: "027" # Setting a default umask value
|
|
os_auth_uid_min: "1000" # Setting the minimum user ID for non-system users
|
|
os_auth_uid_max: "60000" # Setting the maximum user ID for non-system users
|
|
os_auth_gid_min: 1000
|
|
os_auth_gid_max: 60000
|
|
os_auth_sys_uid_min: "100" # Setting the minimum user ID for system users
|
|
os_auth_sys_uid_max: "499" # Setting the maximum user ID for system users
|
|
os_auth_sys_gid_min: 100
|
|
os_auth_sys_gid_max: 499
|
|
os_auth_sub_uid_min: 100000
|
|
os_auth_sub_uid_max: 600100000
|
|
os_auth_sub_uid_count: 65536
|
|
os_auth_sub_gid_min: 100000
|
|
os_auth_sub_gid_max: 600100000
|
|
os_auth_sub_gid_count: 65536
|
|
os_shadow_perms:
|
|
owner: root
|
|
group: shadow
|
|
mode: "0640"
|
|
os_passwd_perms:
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
hidepid_option: "2" # allowed values: 0, 1, 2
|
|
os_mnt_boot_group: 'root'
|
|
os_mnt_boot_owner: 'root'
|
|
os_mnt_dev_group: 'root'
|
|
os_mnt_dev_owner: 'root'
|
|
os_mnt_dev_shm_group: 'root'
|
|
os_mnt_dev_shm_owner: 'root'
|
|
os_mnt_home_group: 'root'
|
|
os_mnt_home_owner: 'root'
|
|
os_mnt_run_group: 'root'
|
|
os_mnt_run_owner: 'root'
|
|
os_mnt_tmp_group: 'root'
|
|
os_mnt_tmp_owner: 'root'
|
|
os_mnt_var_group: 'root'
|
|
os_mnt_var_owner: 'root'
|
|
os_mnt_var_log_group: 'root'
|
|
os_mnt_var_log_owner: 'root'
|
|
os_mnt_var_log_audit_group: 'root'
|
|
os_mnt_var_log_audit_owner: 'root'
|
|
os_mnt_var_tmp_group: 'root'
|
|
os_mnt_var_tmp_owner: 'root'
|
|
roles:
|
|
- devsec.hardening.os_hardening
|