mirror/ansible-nginx-hardening
1
0
Fork 0
mirror of https://github.com/dev-sec/ansible-nginx-hardening.git synced 2024-11-22 15:32:01 +01:00
Code Issues Releases Activity

update testing and style

Browse Source
This commit is contained in:
Sebastian Gumprich 2018-08-15 18:16:50 +02:00
parent 2445b3dd9a
commit 11e43b9b02
11 changed files with 103 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.github_changelog_generator Normal file
View File

@ -0,0 +1 @@
unreleased=false

29
.kitchen.yml
View File

@ -21,7 +21,7 @@ provisioner:
roles_path: ../ansible-nginx-hardening/
http_proxy: <%= ENV['http_proxy'] || nil %>
https_proxy: <%= ENV['https_proxy'] || nil %>
playbook: default.yml
playbook: tests/test.yml
requirements_path: requirements.yml
platforms:
@ -33,6 +33,10 @@ platforms:
driver:
image: rndmh3ro/docker-centos7-ansible:latest
platform: centos
run_command: /sbin/init
provision_command:
- sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
- systemctl enable sshd.service
- name: oracle6-ansible-latest
driver:
image: rndmh3ro/docker-oracle6-ansible:latest
@ -40,11 +44,11 @@ platforms:
- name: oracle7-ansible-latest
driver:
image: rndmh3ro/docker-oracle7-ansible:latest
run_command: /sbin/init
platform: centos
- name: ubuntu1204-ansible-latest
driver:
image: rndmh3ro/docker-ubuntu1204-ansible:latest
platform: ubuntu
provision_command:
- sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
- systemctl enable sshd.service
- name: ubuntu1404-ansible-latest
driver:
image: rndmh3ro/docker-ubuntu1404-ansible:latest
@ -53,6 +57,9 @@ platforms:
driver:
image: rndmh3ro/docker-ubuntu1604-ansible:latest
platform: ubuntu
run_command: /sbin/init
provision_command:
- systemctl enable ssh.service
- name: debian7-ansible-latest
driver:
image: rndmh3ro/docker-debian7-ansible:latest
@ -65,6 +72,18 @@ platforms:
driver:
image: rndmh3ro/docker-debian9-ansible:latest
platform: debian
run_command: /sbin/init
provision_command:
- apt install -y systemd-sysv
- systemctl enable ssh.service
- name: amazon-ansible-latest
driver:
image: rndmh3ro/docker-amazon-ansible:latest
platform: centos
run_command: /sbin/init
provision_command:
- sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
- systemctl enable sshd.service
verifier:
name: inspec

17
.travis.yml
View File

@ -7,7 +7,7 @@ env:
init: /sbin/init
- distro: centos7
init: /usr/lib/systemd/systemd
init: /lib/systemd/systemd
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
version: latest
@ -29,20 +29,25 @@ env:
version: latest
init: /sbin/init
# - distro: debian7
# version: latest
# init: /sbin/init
- distro: debian7
version: latest
init: /sbin/init
- distro: debian8
version: latest
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
init: /sbin/init
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
- distro: debian9
version: latest
init: /lib/systemd/systemd
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
- distro: amazon
init: /lib/systemd/systemd
version: latest
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
before_install:
# Pull container
- 'docker pull rndmh3ro/docker-${distro}-ansible:${version}'
@ -56,7 +61,7 @@ script:
- 'docker exec "$(cat ${container_id})" ansible-galaxy install -r /etc/ansible/roles/ansible-nginx-hardening/requirements.yml -p /etc/ansible/roles/'
# Test role.
- 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-nginx-hardening/default.yml -vv'
- 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-nginx-hardening/tests/test.yml -vv'
# Verify role
- 'inspec exec https://github.com/dev-sec/nginx-baseline/ -t docker://$(cat ${container_id})'

4
Gemfile
View File

@ -16,3 +16,7 @@ end
group :tools do
gem 'github_changelog_generator', '~> 1'
end
gem 'kitchen-dokken'
gem 'rb-readline'

6
default.yml
View File

@ -1,6 +0,0 @@
---
- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
hosts: localhost
roles:
- geerlingguy.nginx
- ansible-nginx-hardening

11
defaults/main.yml
View File

@ -17,10 +17,15 @@ nginx_add_header: [
# disable content-type sniffing
"X-Content-Type-Options nosniff",
# XSS filter
"X-XSS-Protection \"1; mode=block\"" ]
"X-XSS-Protection \"1; mode=block\"",
"Strict-Transport-Security max-age=15768000",
"Content-Security-Policy \"script-src 'self'; object-src 'self'\"" ]
nginx_ssl_protocols: "TLSv1 TLSv1.1 TLSv1.2"
nginx_ssl_ciphers: "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"
nginx_set_cookie_flag: "* HttpOnly secure"
nginx_ssl_prefer_server_ciphers: "on"
nginx_ssl_protocols: "TLSv1.2"
nginx_ssl_ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
nginx_ssl_prefer_server_ciphers: "on"
nginx_ssl_session_tickets: "off"
nginx_dh_param: "{{nginx_root_dir}}/dh{{nginx_dh_size}}.pem"
nginx_dh_size: "2048"

2
requirements.yml
View File

@ -1 +1 @@
- src: geerlingguy.nginx
- src: nginxinc.nginx

4
spec/travis.yml
View File

@ -1,4 +0,0 @@
- hosts: localhost
roles:
- geerlingguy.nginx
- ansible-nginx-hardening

41
tasks/main.yml
View File

@ -3,14 +3,27 @@
include_vars: "{{ ansible_os_family }}.yml"
- name: config should not be worldwide read- or writeable
file: path="/etc/nginx" mode="o-rw" owner="root" group="root" recurse=yes
file:
path: "/etc/nginx"
mode: "o-rw"
owner: "root"
group: "root"
recurse: yes
- name: create additional configuration
template: src="hardening.conf.j2" dest="{{nginx_config_conf_dir}}/90.hardening.conf" owner="root" group="root"
template:
src: "hardening.conf.j2"
dest: "{{ nginx_config_conf_dir }}/90.hardening.conf"
owner: "root"
group: "root"
notify: reload nginx
- name: change configuration in main nginx.conf
lineinfile: dest="/etc/nginx/nginx.conf" regexp="^\s*server_tokens" line="server_tokens {{nginx_server_tokens}};" insertafter="http {"
lineinfile:
dest: "/etc/nginx/nginx.conf"
regexp: "^\\s*server_tokens"
line: "server_tokens {{ nginx_server_tokens }};"
insertafter: "http {"
notify: reload nginx
- name: change ssl_protocols in main nginx.conf
@ -22,19 +35,33 @@
notify: reload nginx
- name: change client_max_body_size in main nginx.conf
lineinfile: dest="/etc/nginx/nginx.conf" regexp="^\s*client_max_body_size" line="client_max_body_size {{nginx_client_max_body_size}};" insertafter="http {"
lineinfile:
dest: "/etc/nginx/nginx.conf"
regexp: "^\\s*client_max_body_size"
line: "client_max_body_size {{ nginx_client_max_body_size }};"
insertafter: "http {"
notify: reload nginx
- name: change client_body_buffer_size in main nginx.conf
lineinfile: dest="/etc/nginx/nginx.conf" regexp="^\s*client_body_buffer_size" line="client_body_buffer_size {{nginx_client_body_buffer_size}};" insertafter="http {"
lineinfile:
dest: "/etc/nginx/nginx.conf"
regexp: "^\\s*client_body_buffer_size"
line: "client_body_buffer_size {{ nginx_client_body_buffer_size }};"
insertafter: "http {"
notify: reload nginx
- name: change keepalive_timeout in main nginx.conf
lineinfile: dest="/etc/nginx/nginx.conf" regexp="^\s*keepalive_timeout" line="keepalive_timeout {{nginx_keepalive_timeout}};" insertafter="http {"
lineinfile:
dest: "/etc/nginx/nginx.conf"
regexp: "^\\s*keepalive_timeout"
line: "keepalive_timeout {{ nginx_keepalive_timeout }};"
insertafter: "http {"
notify: reload nginx
- name: remove default.conf
file: path="{{nginx_default_conf}}" state=absent
file:
path: "{{ nginx_default_conf }}"
state: absent
when: nginx_remove_default_site
notify: reload nginx

5
templates/hardening.conf.j2
View File

@ -8,7 +8,10 @@ client_header_timeout {{nginx_client_header_timeout}};
send_timeout {{nginx_send_timeout}};
limit_conn_zone {{nginx_limit_conn_zone}};
limit_conn {{nginx_limit_conn}};
ssl_ciphers {{nginx_ssl_ciphers}};
set_cookie_flag {{nginx_set_cookie_flag}};
ssl_ciphers '{{nginx_ssl_ciphers}}';
ssl_prefer_server_ciphers {{nginx_ssl_prefer_server_ciphers}};
ssl_session_tickets {{nginx_ssl_session_tickets}};
ssl_dhparam {{nginx_dh_param}};
{% for header in nginx_add_header %}
add_header {{header}};

15
tests/test.yml Normal file
View File

@ -0,0 +1,15 @@
---
- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
hosts: localhost
pre_tasks:
- package: name="{{item}}" state=installed
with_items:
- "systemd"
ignore_errors: true
- apt: name="{{item}}" state=installed update_cache=true
with_items:
- "systemd"
ignore_errors: true
roles:
- nginxinc.nginx
- ansible-nginx-hardening