Skip to content

Commit ef5e880

Browse files
rndmh3roSebastian Gumprich
rndmh3ro
and
Sebastian Gumprich
authored
add debian 12 support (#684)
* add debian 12 support Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * temp disable pam-checks Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * remove debian12 from vagrant tests as there's no box yet Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * use new pam-tester from pip Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * use new pam-tester from pip Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * add setuptoolks to pam-tester install Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * add setuptoolks to pam-tester install Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * add setuptoolks to pam-tester install Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * add setuptoolks to pam-tester install Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * install pam-tester with python3 and use full path to it Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * install python3-setupttools in verify-tests Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * fix path for pam-tester in all tests Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * set python interpreter to 3 for verify-tests Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * Revert "set python interpreter to 3 for verify-tests" This reverts commit 00b6556. * add back accidentally deleted tasks Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> --------- Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> Co-authored-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
1 parent 9950f9b commit ef5e880

File tree

10 files changed

+41
-17
lines changed

10 files changed

+41
-17
lines changed

‎.github/workflows/mysql_hardening.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ jobs:
4545
- ubuntu2204
4646
- debian10
4747
- debian11
48+
- debian12
4849
# - amazon # geerlingguy.mysql does not support fedora
4950
# - arch # geerlingguy.mysql does not support arch
5051
- opensuse_tumbleweed

‎.github/workflows/nginx_hardening.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ jobs:
4444
- ubuntu2204
4545
- debian10
4646
- debian11
47+
- debian12
4748
- amazon2023
4849
# - arch # needs to be fixed
4950
# - opensuse_tumbleweed # needs to be fixed

‎.github/workflows/os_hardening.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ jobs:
4646
- ubuntu2204
4747
- debian10
4848
- debian11
49+
- debian12
4950
- amazon2023
5051
- opensuse_tumbleweed
5152
- arch

‎.github/workflows/os_hardening_vm.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ jobs:
4646
- ubuntu2204
4747
- debian10
4848
- debian11
49+
# - debian12 # waiting for https://github.com/lavabit/robox/pull/274
4950
- opensuse15
5051
# - arch # needs fix for audit
5152
steps:

‎.github/workflows/ssh_hardening.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ jobs:
4646
- ubuntu2204
4747
- debian10
4848
- debian11
49+
- debian12
4950
- amazon2023
5051
- arch
5152
# - opensuse_tumbleweed # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)

‎.github/workflows/ssh_hardening_custom_tests.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ jobs:
4646
- ubuntu2204
4747
- debian10
4848
- debian11
49+
- debian12
4950
- amazon2023
5051
- arch
5152
# - opensuse_tumbleweed # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)

‎README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,9 @@
1111
This collection provides battle tested hardening for:
1212

1313
- Linux operating systems:
14-
- CentOS 7
15-
- Rocky Linux 8
16-
- Debian 10/11
14+
- CentOS 7/8/9
15+
- Rocky Linux 8/9
16+
- Debian 10/11/12
1717
- Ubuntu 18.04/20.04/22.04
1818
- Amazon Linux (some roles supported)
1919
- Arch Linux (some roles supported)

‎molecule/os_hardening/verify.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@
77
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
88
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
99
tasks:
10+
- name: set ansible_python_interpreter to "/usr/bin/python3"
11+
set_fact:
12+
ansible_python_interpreter: "/usr/bin/python3"
13+
1014
- name: include verification tasks
1115
ansible.builtin.include_tasks:
1216
file: "{{ item }}"

‎molecule/os_hardening/verify_tasks/pam.yml‎

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,17 @@
11
---
2-
- name: download pam-tester
3-
get_url:
4-
url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
5-
dest: /bin/pam-tester
6-
mode: 0555
2+
3+
- name: install pip
4+
package:
5+
name:
6+
- python3-pip
7+
- python3-setuptools
8+
state: present
9+
10+
- name: install pam-tester
11+
ansible.builtin.pip:
12+
name: pam-tester
13+
state: present
14+
executable: /usr/bin/pip3
715

816
- name: set password for test
917
set_fact:
@@ -23,15 +31,15 @@
2331

2432
- name: check successful login with correct password
2533
shell:
26-
cmd: "pam-tester --user testuser --password {{ test_pw }}"
34+
cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
2735
environment:
2836
TMPDIR: /var/tmp
2937
LC_ALL: "{{ locale | default('C.UTF-8') }}"
3038
LANG: "{{ locale | default('C.UTF-8') }}"
3139

3240
- name: check unsuccessful login with incorrect password
3341
shell:
34-
cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
42+
cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
3543
environment:
3644
TMPDIR: /var/tmp
3745
LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -40,7 +48,7 @@
4048

4149
- name: check unsuccessful login, with correct password (lockout)
4250
shell:
43-
cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
51+
cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail"
4452
environment:
4553
TMPDIR: /var/tmp
4654
LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -52,7 +60,7 @@
5260

5361
- name: check successful login
5462
shell:
55-
cmd: "pam-tester --user testuser --password {{ test_pw }}"
63+
cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
5664
environment:
5765
TMPDIR: /var/tmp
5866
LC_ALL: "{{ locale | default('C.UTF-8') }}"

‎molecule/os_hardening_vm/verify_tasks/pam.yml‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,15 @@
11
---
2-
- name: download pam-tester
3-
get_url:
4-
url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
5-
dest: /bin/pam-tester
6-
mode: 0555
2+
- name: install pip
3+
package:
4+
name:
5+
- python3-pip
6+
- python3-setuptools
7+
state: present
8+
9+
- name: install pam-tester
10+
ansible.builtin.pip:
11+
name: pam-tester
12+
state: present
713

814
- name: set password for test
915
set_fact:

0 commit comments

Comments
 (0)