Skip to content

Latest commit

 

History

History
1079 lines (776 loc) · 125 KB

CHANGELOG.md

File metadata and controls

1079 lines (776 loc) · 125 KB
Raw

Changelog

9.0.2 (2024-03-25)

Full Changelog

Implemented enhancements:

  • Make Publickey authentication configurable #750
  • Ansible Linting #747
  • Make value of kernel.unprivileged_userns_clone depending on kernel version #727
  • Add ssh_pubkey_authentication variable to ssh hardening #749 [ssh_hardening] (debbabi)

Fixed bugs:

  • Error: Missing privilege separation directory: /run/sshd #752
  • harden permissions for directory mount /var/log fails for minimized Ubuntu 22.04 #741

Closed issues:

  • Dependency Dashboard #655

Merged pull requests:

9.0.1 (2024-01-15)

Full Changelog

Implemented enhancements:

  • Extend ansible-lint testing to cover our test cases #731
  • Complete tests for OS hardening #660
  • support restarts of audit service on Arch linux #722 [os_hardening] (schurzi)

Fixed bugs:

  • Fails to install #735
  • Amazon Linux gpg check fails #734
  • ssh_hardening ipv6 #719
  • boolean variable inconsistency? #330
  • Restore idempotency for disabling unused filesystems with Ansible 2.16.0 #718 [os_hardening] (akikanellis)

Closed issues:

  • 9.0.0 version number in galaxy.yml file is wrong #740

Merged pull requests:

9.0.0 (2023-11-16)

Full Changelog

Breaking changes:

Implemented enhancements:

Fixed bugs:

  • nginx conf.d directory is missing on Rocky Linux 8 #707
  • Default value of ssh_client_alive_interval is inconsistent with what documentation says #701
  • [devsec.hardening.os_hardening : restart-auditd] fails #698
  • sshd_hardening role cannot be used to build system images #697
  • Error: No file was found when using first_found on Ubuntu 20.04 #676
  • PUBLIC-role breaks mysql-hardening #648
  • Error deploying the playbook #630
  • Gather facts when os_hardening role is executed with tags #708 [os_hardening] (schurzi)

Closed issues:

  • Add send-to-mailinglist to github release action #434

Merged pull requests:

8.8.0 (2023-08-04)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • How does one set sshd_authenticationmethods to include password authentication? #686
  • FreeIPA environment mkhomedir fails #664

Closed issues:

  • What is the uscase of sysctl_overwrite over ansible.posix.sysctl? #683
  • Ensure permissions on mysql-logfile are correct chokes when log_error is set to stderr #673
  • TASK TASK FAILED: [devsec.hardening.os_hardening : Set password ageing for existing regular (non-system, non-root) accounts] #670
  • After os_hardening ssh not working #663
  • Unsupported parameters for (ansible.builtin.user) module #650

Merged pull requests:

8.7.0 (2023-04-12)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • getent task is skipped if user previously ran it with a key parameter #646
  • Error running devsec.hardening.os_hardening role #645
  • devsec.hardening.mysql_hardening - Get all users that have no authentication_string - Hello world #640
  • fixes #646 - add another condition to getent task #647 [os_hardening] (gbolo)

Closed issues:

  • Invalid login.defs for RHEL6 #651
  • Deprecation warnings for os_hardening #638
  • Write tests for MySQL user-deletion #445

Merged pull requests:

8.6.0 (2023-02-04)

Full Changelog

Implemented enhancements:

Merged pull requests:

8.5.0 (2023-01-30)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • os_hardening is setting wrong ownership for /var/log on Ubuntu #614
  • [os_hardening] Task for setting initramfs modules does not match its condition #590 [os_hardening]
  • Support for Amazon Linux 2 #624 [ssh_hardening] (mmitnyan)

Deprecated:

Closed issues:

  • Ubuntu 22.04 vars file missing? #619
  • SSH KexAlgorithms causes SSH daemon to fail #500
  • Playbook won't run for hardening #462

Merged pull requests:

8.4.0 (2022-12-17)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • os_auth_retries variable causes a comparison type error on pam tasks #593
  • ssh_hardening: Install selinux dependencies fails on Oracle Linux (RHEL) 9 #585
  • OpenBSD does not set distributiuon_major_version #597 [ssh_hardening] (dennisse)

Merged pull requests:

8.3.0 (2022-10-27)

Full Changelog

Implemented enhancements:

Fixed bugs:

Closed issues:

  • Trying to run the os_hardening on Debian 11, but fails on privilege escalation #587
  • auditd increasing logfiles #586
  • Path to nginx.conf should be configurable in a variable #577

Merged pull requests:

8.2.0 (2022-09-08)

Full Changelog

Implemented enhancements:

Closed issues:

  • Bug using os_hardening "tags" #567

8.1.0 (2022-08-26)

Full Changelog

Closed issues:

  • dev-sec CI bot should not update CHANGELOG.md in fork repository #566

Merged pull requests:

8.0.0 (2022-08-22)

Full Changelog

Breaking changes:

Implemented enhancements:

Closed issues:

  • Error in Task 'Create sshd_config and set permissions to root/600' #565 [ssh_hardening]
  • [ssh_hardening] Debian 11 - Ansible cannot transfer files #557
  • Add the old SFTP-Reminder to the stable ssh_hardening role for ansible #521

7.16.0 (2022-08-16)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • Replace default 2048 bits RSA keypair fails on Ubuntu 20.04 #459

Closed issues:

  • os-hardening: yum gpg-check fails if gpg-check already set #556
  • Ubuntu 22.04 LTS #553
  • Revert nginx ssl-protocol after deprecation of debian9 #528
  • Support for Debian 11 #527
  • Support baseline-control os-14 #507

7.15.1 (2022-07-26)

Full Changelog

Fixed bugs:

Merged pull requests:

7.15.0 (2022-07-11)

Full Changelog

Implemented enhancements:

Fixed bugs:

7.14.3 (2022-06-29)

Full Changelog

Closed issues:

  • Version 7.14.2 not released to Ansible Galaxy #544
  • os_hardening role: os_ignore_users not described in the Readme's variable topic #542
  • doc: incorrect description for ssh_client_alive_count #540
  • 'legacy' branch is mentioned in README, but apparently doesn't exist #539
  • ansible_role_name is undefined #532
  • Can't sudo anymore after hardening #518
  • Any planned official support for RHEL/CentOS Stream 9? #517

Merged pull requests:

7.14.2 (2022-02-28)

Full Changelog

Fixed bugs:

Closed issues:

  • No such file directory error triggered by the kernel.unprivileged_userns_clone configuration. #514

Merged pull requests:

7.14.1 (2022-02-18)

Full Changelog

Fixed bugs:

Closed issues:

  • Error when using the ssh_hardening role #519

7.14.0 (2021-12-16)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • Duplication of sysctl default parameter fs.protected_hardlinks and fs.protected_symlinks #502
  • Fix duplicate sysctl config in fs #505 [os_hardening] (tekicat)

Merged pull requests:

7.13.2 (2021-11-23)

Full Changelog

7.13.1 (2021-11-23)

Full Changelog

Closed issues:

  • Unable to use 7.13.0 Release #503

7.13.0 (2021-11-15)

Full Changelog

Implemented enhancements:

Closed issues:

  • Please create the collection in ansible-galaxy #407

Merged pull requests:

7.12.0 (2021-10-21)

Full Changelog

Implemented enhancements:

Fixed bugs:

Closed issues:

  • Extend os_hardening minimize_access task to cover additional passwd/group/shadow/gshadow paths #488
  • postgresql_hardening role #484
  • os_hardening fails on "Create a combined sysctl-dict if overwrites are defined" task #482
  • Improve changelog generation #381

7.11.0 (2021-08-30)

Full Changelog

Implemented enhancements:

Closed issues:

  • MariaDB hardening fails, because log_error file is missing [Debian 11] #476

Merged pull requests:

7.10.0 (2021-08-15)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • mysql_hardening cannot work with mysql on freebsd #472

Closed issues:

  • run ansible-lint only once in Github Actions #398

Merged pull requests:

7.9.0 (2021-07-22)

Full Changelog

Implemented enhancements:

Closed issues:

  • MySQL hardening fails because of missing attribute #464
  • add "when" statements for every import_tasks in hardening.yml #453

Merged pull requests:

  • update metadata to include community.mysql deps #465 (rndmh3ro)

7.8.0 (2021-07-01)

Full Changelog

Implemented enhancements:

Fixed bugs:

Closed issues:

  • Disable IPv6 | sysctl-18 net.ipv6.conf.all.disable_ipv6: 1 #406 [os_hardening]

Merged pull requests:

7.7.0 (2021-05-24)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • Warning: iptables-legacy tables present, Debian 10 #274
  • Check for MariaDB Version when selecting users without passwords #444 [mysql_hardening] (neubi4)
  • Adds dependency on ansible.posix and community.general #415 (irl)

Closed issues:

  • No dependency on ansible.posix collection #414
  • No dependency on community.general #413
  • in lxc/docker/openvz IPv6 is always disabled by ufw-configuration #402
  • Allow login_unix_socket to be specified #327

Merged pull requests:

7.6.0 (2021-04-27)

Full Changelog

Implemented enhancements:

Fixed bugs:

Closed issues:

  • Support HostKeyAlgorithms configuration for ssh_client file #441

Merged pull requests:

7.5.0 (2021-04-01)

Full Changelog

Implemented enhancements:

Fixed bugs:

Closed issues:

  • Harden user home directories #276

Merged pull requests:

7.4.0 (2021-03-23)

Full Changelog

Implemented enhancements:

Closed issues:

  • Errors in packer build for vagrant builder #244

Merged pull requests:

7.3.0 (2021-03-16)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • Not able to use sudo command for user authenticated via ActiveDirectory #278 [os_hardening]
  • You shouldn't touch /etc/pam.d/system-auth-ac in RedHat/CentOS #252 [os_hardening]

Closed issues:

  • Netdata monitoring of docker in docker no longer possible #412
  • Unable to connect with SSH (Permission denied (publickey)) #411
  • TASK [os_hardening : configure auditd | package-08] #410
  • Collection throws undefined ansible_role_name error in auditd task #409
  • Ensure permissions on /etc/crontab are configured #375 [os_hardening]
  • Documentation should be updated #361

Merged pull requests:

7.2.0 (2021-02-10)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • A reason why instance would go in rescue mode ? #267
  • fix galaxy action to update local galaxy.yml #395 (Normo)

Closed issues:

  • Updating version in galaxy.yml should be part of the release process #396
  • ssh_hardening fail on keypair generation #388
  • The system must display the date and time of the last successful account logon upon an SSH logon. #362
  • Error in "root password is present" step #326

Merged pull requests:

7.1.1 (2021-02-05)

Full Changelog

Fixed bugs:

Closed issues:

  • AnsibleUndefinedVariable: 'ansible_role_name' is undefined with 7.1.0 #387

7.1.0 (2021-02-02)

Full Changelog

Implemented enhancements:

Fixed bugs:

Closed issues:

  • initramfs-tools modules.j2 does not seem to be able to detect AMD CPUs #373
  • How do i install this on Centos 8? #367
  • hidepid=2 gives error when running systemctl on EL7 #364 [os_hardening]
  • Allow putting the ssh/sshd config in alternative files #348
  • os_env_umask has no effect #344
  • Don't modify /etc/sysctl.conf #343 [os_hardening]

Merged pull requests:

7.0.0 (2020-11-11)

Full Changelog

Breaking changes:

Implemented enhancements:

Fixed bugs:

  • Task "set 10.hardcore.conf perms to 0400 and root ownership" fails in check mode #313
  • Inconsistent use of role vars/role defaults #284
  • Is it safe to use on Debian 10? The build is failing. #281
  • /etc/login.defs alters centos 7/8 default values #265
  • Invalid Conditionals in user_accounts.yml #255
  • auth-system related files are created for non-RHEL systems (e.g. Debian) #247
  • NSA website links are stale #227
  • Running ansible on python3 throughs "TypeError: '<=' not supported between instances of 'str' and 'int'" #223
  • [lots of] deprecation warnings in Ansible 2.8 #221
  • squash_actions deprecation warning #218
  • login.defs.j2 template: ENV_PATH is missing ':' before variable substitution #202
  • auditd causing v5.0 to fail on unprivileged LXC's #191
  • Setting os_security_users_allow has no effect #175
  • minimize_access: maximum recursion depth exceeded on Ansible 2.5 #171
  • wrong permissions passwdqc #170
  • 'sysctl_rhel_config' is undefined #167
  • Update deprecated include statements #166
  • Strongly recommend against disabling vfat by default #162
  • bug in ufw.j2 template #151
  • Add a "don't fail on error" switch ? #148
  • System completely unresponsive after role execution #145
  • Why is rsync removed? #141
  • RHEL 7.4: Too many setuid bits removed #140
  • Change system accounts not on the user provided ignore-list items are not JSON serializable #125
  • playbook makes OS undetectable #124
  • Centos7/RHEL7: Exec shield is enabled by default and not manageable anymore by sysctl.conf #118
  • Could not find gem 'ruby (>= 2.1.0)' #116
  • os_security_kernel_enable_sysrq is not implemented #115
  • The task sysctl fails when /etc/initramfs-tools is not present #111
  • The role fails when conditionally included #105
  • Deprecation warning always_run #103
  • CentOS 7 selinux dependencies #102
  • ubuntu xenial warning during activate gpg-check for yum-repos #99
  • rhel_system_auth.j2 is still using pam_passwdqc.so for CentOS 7 #98
  • Centos 7.1 fails at [Change various sysctl-settings on rhel-hosts...] #74
  • Enable pam_pwquality in rhel-family > 7 #73
  • Hardening fails on Centos 7.1 at task 'minimize access' #71
  • "irc" user always changed after reboot #53
  • use touch for 10.hardcore.conf to avoid problems with dry-run #314 (schurzi)
  • use touch with no date changes #310 (rndmh3ro)
  • do not touch sysctl file to avoid idempotency problems #309 (rndmh3ro)
  • replace module parameter fixed #297 (danielkubat)
  • Addressing issue #255 #258 (ljkimmel)
  • Fix #247, cleanup conditions #248 (fernandezcuesta)
  • Fix error on applying the sysctl vars on containers #243 (ghost)
  • Update location of NSA RHEL 5 Guide #235 (jaredledvina)
  • Fix typo #212 (ruslo)
  • Update modprobe to 0644 #211 (joshuatalb)
  • Test Kitchen Vagrant Fixes #210 (joshuatalb)
  • [readme] Update documentation link #207 (pmav99)
  • fix ansible lint remarks #204 (rndmh3ro)
  • add colon to user env paths - fix #202 #203 (rndmh3ro)
  • add /usr/bin/su to suid_guid whitelist #199 (ccolic)
  • ensure that permissions to su-binary are not restricted to root user and group only, if os_security_users_allow contains the value change_user #197 (szEvEz)
  • do not install passwdqc on amazon linux #189 (rndmh3ro)
  • add back run opts for debian 8 in travis #184 (rndmh3ro)
  • Fix core dump config file creation when core dumps are disabled #182 (Normo)
  • change minimize access method #181 (rndmh3ro)
  • Fix errors produced by ansible-lint #159 (zbrojny120)
  • replace single ticks with double ticks. fix #151 #152 (rndmh3ro)
  • fixed tag #149 (martinbydefault)
  • Remove rsync from package blacklist #142 (duk3luk3)
  • Updates "tags" parameters on includes in main.yml #66 (conorsch)
  • Suid set def var, fix #64 #63 (rndmh3ro)

Closed issues:

  • Any planned support for RHEL/CentOS 8? #298
  • Consider using find module instead of shell #293
  • Optimize logical OR in when clause #292
  • vfat added to dev-sec.conf, but efi is used #288
  • The state of the galaxy release #269
  • OpenSUSE Support #249
  • ansible hardening fails on ubuntu 16.04 with msg": "ERROR! 'sysctl_rhel_config' is undefined #147
  • Enhancement: Test with TestInfra and Molecule #128
  • Enhancement: Pin python dependencies for development and testing #127
  • Update readme to include baselines #122
  • Error running on RHEL 7 due to syntax issues #112
  • disable password age #109
  • Permissions on /etc/shadow can lock out GUI users #86
  • network related sysctl rewritten by ufw in ubuntu #82
  • ansible >= 2.0 complains: Using bare variables is deprecated #78
  • Hardening fails on Centos 7.1 at task 'remove suid/sgid bit from all binaries except in system and user whitelist' #72
  • ansible 2.0 | "remove suid/sgid" task fails #64
  • Custom sysctl #50
  • Fix directory structure. #48
  • pam auth update error #47
  • ansible-os-hardening/tasks/minimize_access.yml #38
  • Role configuration. vars/main.yml? #34
  • Sysctl reloading #18
  • Add conditions for disabling of ip forwarding #15
  • Disable System Accounts #6

Merged pull requests:

* This Changelog was automatically generated by github_changelog_generator