ansible-os-hardening 4.0.0

4.0.0 (2017-03-14)

Full Changelog

Breaking Changes:

• remove support for ansible 1.9 #110 (rndmh3ro)
  • Ansible 1.9 is not supported anymore

Implemented enhancements:

• Description of the Ansible roles of dev-sec says "This Ansible playbook" #97
• install initramfs-tools #114 (rndmh3ro)
• omit empty variables #106 (rndmh3ro)

Fixed bugs:

• The role fails when conditionally included #105
• omit empty variables #106 (rndmh3ro)
• Could not find gem 'ruby (>= 2.1.0)' #116
• The task sysctl fails when /etc/initramfs-tools is not present #111
• Deprecation warning always_run #103

Closed issues:

• Error running on RHEL 7 due to syntax issues #112
• disable password age #109

Merged pull requests:

• change shadow owner in debian systems #117 (rndmh3ro)
• Rhel7 #113 (tyrken)
• use new Docker images #110 (rndmh3ro)
• Don’t refer to this role as "playbook" in the role description #104 (ypid)

ansible-os-hardening 3.2.0

3.2.0 (2016-10-24)

Full Changelog

Fixed bugs:

• CentOS 7 selinux dependencies #102
• ubuntu xenial warning during activate gpg-check for yum-repos #99
• rhel_system_auth.j2 is still using pam_passwdqc.so for CentOS 7 #98
• Enable pam_pwquality in rhel-family > 7 #73
• "irc" user always changed after reboot #53

Merged pull requests:

• update template #101 (rndmh3ro)
• fix deprecation warning for undefined error. #99 #100 (rndmh3ro)
• add rhel7 pam_pwquality. fix #73 #94 (rndmh3ro)

ansible-os-hardening 3.1.0

Full Changelog

Implemented enhancements:

• Supports --check mode #93 (conorsch)
• Adds support for CentOS 7 #91 (conorsch)
• Docker #90 (rndmh3ro)
• debian 8 support #88 (rndmh3ro)
• Ufw manage defaults #85 (fitz123)
• replace ignore_errors to failed_when to supress ugly error warnings #81 (fitz123)
• fix bare variables usage for loops #79 (fitz123)

Fixed bugs:

• Centos 7.1 fails at [Change various sysctl-settings on rhel-hosts...] #74
• Hardening fails on Centos 7.1 at task 'minimize access' #71

Closed issues:

• Permissions on /etc/shadow can lock out GUI users #86
• network related sysctl rewritten by ufw in ubuntu #82
• ansible >= 2.0 complains: Using bare variables is deprecated #78
• Norm-Audit-Hardening-Audit #76

Merged pull requests:

• Fix a formatting issue in readme. #92 (vivekagr)
• Permits overriding permissions on /etc/shadow #89 (conorsch)

ansible-os-hardening 3.0.0

Full Changelog

Implemented enhancements:

• update platforms in meta-file #69 (rndmh3ro)
• add webhook for ansible galaxy #68 (rndmh3ro)
• Move sysctl vars to defaults #67 (rndmh3ro)
• make sys_uid and sys_gid configurable #62 (rndmh3ro)
• Ansible 2.0 support #59 (rndmh3ro)
• use inspec as test framework #58 (chris-rock)
• Packages as attributes #57 (rndmh3ro)
• Change categories to tags for upcoming ansible 2.0 #56 (rndmh3ro)
• Add SINGLE and PROMPT parameters. #55 (rndmh3ro)
• add changelog generator #54 (chris-rock)

Fixed bugs:

• Updates "tags" parameters on includes in main.yml #66 (conorsch)
• Suid set def var, fix #64 #63 (rndmh3ro)
• ERROR! Include tasks should not specify tags in more than one way #60 (fitz123)

Closed issues:

• Hardening fails on Centos 7.1 at task 'remove suid/sgid bit from all binaries except in system and user whitelist' #72
• ansible 2.0 | "remove suid/sgid" task fails #64
• Custom sysctl #50

ansible-os-hardening 2.0.0

• Fix a bug in the passwdqc template (#51)
• Change directory layout so the role is easily installable from ansible-galaxy (#49)
• improved travis-tests to cover more cases (#42)

Thanks, @fitz123 for the following fixes!

• Fix passwdqc default options (#44)
• remove duplicate "update pam" task (#46)
• Fix stuck in case pam files was updated before by force update (#45)
• Fix nologin shell path (#44)

ansible-os-hardening 1.0.0

• Implement os-hardening to meet our tests
• Enable GPG-checking on all yum-repository files #5
• Disable system accounts #6
• Module-loading configuration #22
• Travis support #17
• Separate system-vars from editable vars. #34
• Add mode to su-binary task. #39
• Change oneliner if-statements to be more readable #36
• Create limits.d-directory if it does not exist. #33