Merge pull request #1 from ansible-lockdown/devel

Initial release to main from devel
ansible-lockdown · Aug 23, 2023 · b2e41e9 · b2e41e9
2 parents 2007304 + a909ca6
commit b2e41e9
Show file tree

Hide file tree

Showing 18 changed files with 633 additions and 289 deletions.
diff --git a/.config/.gitleaks-report.json b/.config/.gitleaks-report.json
@@ -0,0 +1,22 @@
+[
+ {
+  "Description": "Generic API Key",
+  "StartLine": 115,
+  "EndLine": 115,
+  "StartColumn": 18,
+  "EndColumn": 68,
+  "Match": "secret\": \"2aaf9f2a51d8fe89e48cb9cc7d04a991ceb7f360\"",
+  "Secret": "2aaf9f2a51d8fe89e48cb9cc7d04a991ceb7f360",
+  "File": ".config/.secrets.baseline",
+  "SymlinkFile": "",
+  "Commit": "a5f558a34ac453f9581a1c37f71bd36383a9c3ed",
+  "Entropy": 3.8439426,
+  "Author": "Mark Bolwell",
+  "Email": "[email protected]",
+  "Date": "2023-08-23T09:28:17Z",
+  "Message": "initial\n\nSigned-off-by: Mark Bolwell \u003c[email protected]\u003e",
+  "Tags": [],
+  "RuleID": "generic-api-key",
+  "Fingerprint": "a5f558a34ac453f9581a1c37f71bd36383a9c3ed:.config/.secrets.baseline:generic-api-key:115"
+ }
+]
diff --git a/.config/.secrets.baseline b/.config/.secrets.baseline
@@ -118,5 +118,5 @@
       }
     ]
   },
-  "generated_at": "2023-08-23T09:27:45Z"
+  "generated_at": "2023-08-23T10:10:15Z"
 }
diff --git a/.github/workflows/devel_pipeline_validation.yml b/.github/workflows/devel_pipeline_validation.yml
@@ -0,0 +1,138 @@
+---
+
+    name: Devel pipeline
+
+    on: # yamllint disable-line rule:truthy
+      pull_request_target:
+          types: [opened, reopened, synchronize]
+          branches:
+              - devel
+          paths:
+              - '**.yml'
+              - '**.sh'
+              - '**.j2'
+              - '**.ps1'
+              - '**.cfg'
+
+    # A workflow run is made up of one or more jobs
+    # that can run sequentially or in parallel
+    jobs:
+      # This will create messages for first time contributers and direct them to the Discord server
+        welcome:
+          runs-on: ubuntu-latest
+
+          steps:
+              - uses: actions/first-interaction@main
+                with:
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}
+                  pr-message: |-
+                      Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
+                      Please join in the conversation happening on the [Discord Server](https://discord.io/ansible-lockdown) as well.
+
+        # This workflow contains a single job which tests the playbook
+        playbook-test:
+          # The type of runner that the job will run on
+          runs-on: ubuntu-latest
+          env:
+            ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
+            # Imported as a variable by terraform
+            TF_VAR_repository: ${{ github.event.repository.name }}
+          defaults:
+            run:
+              shell: bash
+              working-directory: .github/workflows/github_linux_IaC
+
+          steps:
+            - name: Clone ${{ github.event.repository.name }}
+              uses: actions/checkout@v3
+              with:
+                ref: ${{ github.event.pull_request.head.sha }}
+
+            # Pull in terraform code for linux servers
+            - name: Clone github IaC plan
+              uses: actions/checkout@v3
+              with:
+                repository: ansible-lockdown/github_linux_IaC
+                path: .github/workflows/github_linux_IaC
+
+            - name: Add_ssh_key
+              working-directory: .github/workflows
+              env:
+                  SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+                  PRIVATE_KEY: "${{ secrets.SSH_PRV_KEY }}"
+              run: |
+                mkdir .ssh
+                chmod 700 .ssh
+                echo $PRIVATE_KEY > .ssh/github_actions.pem
+                chmod 600 .ssh/github_actions.pem
+
+            - name: DEBUG - Show IaC files
+              if: env.ENABLE_DEBUG == 'true'
+              run: |
+                echo "OSVAR = $OSVAR"
+                echo "benchmark_type = $benchmark_type"
+                pwd
+                ls
+              env:
+                # Imported from github variables this is used to load the relvent OS.tfvars file
+                OSVAR: ${{ vars.OSVAR }}
+                benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+
+            - name: Terraform_Init
+              id: init
+              run: terraform init
+              env:
+                # Imported from github variables this is used to load the relvent OS.tfvars file
+                OSVAR: ${{ vars.OSVAR }}
+                TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+
+            - name: Terraform_Validate
+              id: validate
+              run: terraform validate
+              env:
+                # Imported from github variables this is used to load the relvent OS.tfvars file
+                OSVAR: ${{ vars.OSVAR }}
+                TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+
+            - name: Terraform_Apply
+              id: apply
+              env:
+                AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+                AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+                OSVAR: ${{ vars.OSVAR }}
+                TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+              run: terraform apply -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false
+
+  ## Debug Section
+            - name: DEBUG - Show Ansible hostfile
+              if: env.ENABLE_DEBUG == 'true'
+              run: cat hosts.yml
+
+      # Aws deployments taking a while to come up insert sleep or playbook fails
+
+            - name: Sleep for 60 seconds
+              run: sleep 60s
+
+          # Run the ansible playbook
+            - name: Run_Ansible_Playbook
+              uses: arillso/action.playbook@master
+              with:
+                playbook: site.yml
+                inventory: .github/workflows/github_linux_IaC/hosts.yml
+                galaxy_file: collections/requirements.yml
+                private_key: ${{ secrets.SSH_PRV_KEY }}
+        #          verbose: 3
+              env:
+                ANSIBLE_HOST_KEY_CHECKING: "false"
+                ANSIBLE_DEPRECATION_WARNINGS: "false"
+
+          # Remove test system - User secrets to keep if necessary
+
+            - name: Terraform_Destroy
+              if: always() && env.ENABLE_DEBUG == 'false'
+              env:
+                AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+                AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+                OSVAR: ${{ vars.OSVAR }}
+                TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+              run: terraform destroy -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false
diff --git a/.github/workflows/main_pipeline_validation.yml b/.github/workflows/main_pipeline_validation.yml
@@ -0,0 +1,127 @@
+---
+
+    name: Main pipeline
+
+    on: # yamllint disable-line rule:truthy
+      pull_request_target:
+          types: [opened, reopened, synchronize]
+          branches:
+              - main
+          paths:
+              - '**.yml'
+              - '**.sh'
+              - '**.j2'
+              - '**.ps1'
+              - '**.cfg'
+
+    # A workflow run is made up of one or more jobs
+    # that can run sequentially or in parallel
+    jobs:
+
+        # This workflow contains a single job which tests the playbook
+        playbook-test:
+          # The type of runner that the job will run on
+          runs-on: ubuntu-latest
+          env:
+            ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
+            # Imported as a variable by terraform
+            TF_VAR_repository: ${{ github.event.repository.name }}
+          defaults:
+            run:
+              shell: bash
+              working-directory: .github/workflows/github_linux_IaC
+
+          steps:
+            - name: Clone ${{ github.event.repository.name }}
+              uses: actions/checkout@v3
+              with:
+                ref: ${{ github.event.pull_request.head.sha }}
+
+            # Pull in terraform code for linux servers
+            - name: Clone github IaC plan
+              uses: actions/checkout@v3
+              with:
+                repository: ansible-lockdown/github_linux_IaC
+                path: .github/workflows/github_linux_IaC
+
+            - name: Add_ssh_key
+              working-directory: .github/workflows
+              env:
+                  SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+                  PRIVATE_KEY: "${{ secrets.SSH_PRV_KEY }}"
+              run: |
+                mkdir .ssh
+                chmod 700 .ssh
+                echo $PRIVATE_KEY > .ssh/github_actions.pem
+                chmod 600 .ssh/github_actions.pem
+
+            - name: DEBUG - Show IaC files
+              if: env.ENABLE_DEBUG == 'true'
+              run: |
+                echo "OSVAR = $OSVAR"
+                echo "benchmark_type = $benchmark_type"
+                pwd
+                ls
+              env:
+                # Imported from github variables this is used to load the relvent OS.tfvars file
+                OSVAR: ${{ vars.OSVAR }}
+                benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+
+            - name: Terraform_Init
+              id: init
+              run: terraform init
+              env:
+                # Imported from github variables this is used to load the relvent OS.tfvars file
+                OSVAR: ${{ vars.OSVAR }}
+                TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+
+            - name: Terraform_Validate
+              id: validate
+              run: terraform validate
+              env:
+                # Imported from github variables this is used to load the relvent OS.tfvars file
+                OSVAR: ${{ vars.OSVAR }}
+                TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+
+            - name: Terraform_Apply
+              id: apply
+              env:
+                AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+                AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+                OSVAR: ${{ vars.OSVAR }}
+                TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+              run: terraform apply -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false
+
+  ## Debug Section
+            - name: DEBUG - Show Ansible hostfile
+              if: env.ENABLE_DEBUG == 'true'
+              run: cat hosts.yml
+
+      # Aws deployments taking a while to come up insert sleep or playbook fails
+
+            - name: Sleep for 60 seconds
+              run: sleep 60s
+
+          # Run the ansible playbook
+            - name: Run_Ansible_Playbook
+              uses: arillso/action.playbook@master
+              with:
+                playbook: site.yml
+                inventory: .github/workflows/github_linux_IaC/hosts.yml
+                galaxy_file: collections/requirements.yml
+                private_key: ${{ secrets.SSH_PRV_KEY }}
+        #          verbose: 3
+              env:
+                ANSIBLE_HOST_KEY_CHECKING: "false"
+                ANSIBLE_DEPRECATION_WARNINGS: "false"
+
+          # Remove test system - User secrets to keep if necessary
+
+            - name: Terraform_Destroy
+              if: always() && env.ENABLE_DEBUG == 'false'
+              env:
+                AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+                AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+                OSVAR: ${{ vars.OSVAR }}
+                TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+              run: terraform destroy -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false
diff --git a/.github/workflows/update_galaxy.yml b/.github/workflows/update_galaxy.yml
@@ -0,0 +1,21 @@
+---
+
+# This is a basic workflow to help you get started with Actions
+
+name: update galaxy
+
+# Controls when the action will run.
+# Triggers the workflow on merge request events to the main branch
+on:
+    push:
+        branches:
+            - main
+jobs:
+    update_role:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v3
+            - uses: robertdebock/galaxy-action@master
+              with:
+                  galaxy_api_key: ${{ secrets.GALAXY_API_KEY }}
+                  git_branch: main
diff --git a/.gitignore b/.gitignore
@@ -46,3 +46,10 @@ benchparse/
 
 # GitHub Action/Workflow files
 .github/
+
+# key types
+*.pem
+*.ppk
+*.key
+*.rsa
+*.ecdsa
diff --git a/README.md b/README.md
@@ -1,4 +1,8 @@
-# AMAZON 2023 CIS
+# AMAZON 2023 CIS - Beta
+
+****************************
+NOTE AUDIT NOT YET AVAILABLE
+****************************
 
 ## Configure a Amazon 2023 machine to be [CIS](https://www.cisecurity.org/cis-benchmarks/) compliant
 
@@ -164,10 +168,12 @@ We encourage you (the community) to contribute to this role. Please read the rul
 
 ## Known Issues
 
-Variable used to unset.
-AMAZON2023cis_default_repo: true  # to be set to false if using repo that does have this ability
+Default builds dont have a root password set, so prelim will fail. Please set a root password using the correct encryption version
+
+CIS Documented controls
 
-CIS Documented rules 6.1.1 and 6.1.2 are identical. So section 6 only has 12 items compared to documentation
+- 1.2.2 and 1.2.4 affect default repos and will stop patching from occuring
+- 6.1.1 and 6.1.2 are identical. So section 6 only has 12 items compared to documentation.
 
 ## Pipeline Testing
-Original file line number
+Diff line change
@@ Expand Up / @@ -118,5 +118,5 @@ @@
           }
         ]
       },
-      "generated_at": "2023-08-23T09:27:45Z"
+      "generated_at": "2023-08-23T10:10:15Z"
     }