4 ms·
Ansible battle tested hardening for Linux, SSH, Nginx, MySQL
- yjftsjthsd-h 10mo ago"battle tested" how? Widely deployed? Red teamed and shown to actually help?
- observationist 10mo agoThey've got a red-team type process they apply repeatedly, you have to piece things together from the changelogs to get a grasp on what they're doing. They've built a positive feedback loop on which to iterate improvements in security, and bundled it in a way to be used effectively with Ansible. They're following CIS guidelines, so if you're in a situation where that matters, it's probably a solid starting point for building things you need to have compliant and predictable. Could probably save weeks of effort, depending on the size of the team.
- schurzi 10mo agoDeployed and actively used by some larger european companies, we also got feedback from some US companies that use parts of our work to harden their systems.
- mhb 10mo agoWhat does this mean?
- ggm 10mo agoIf you have compliance for contractual reasons (e/g you are the supply chain for an entity which has been declared to be a national-strategic service delivery) then this would probably help get you over the line to meet minimum proofs you have tried to comply with the obligations. So, "what does this mean" is "it means you can tender to sell services to people who put CIS obligations in the contract"
- mhb 10mo agoThanks.
- Spivak 10mo agoThese playbooks apply the CIS benchmarks, very very useful for compliance. I use them at $dayjob to build our base AMIs. As for whether they actually harden your servers, that's up for you to decide if you think that CIS actually helps. It certainly does reduce attack surface.
- wingmanjd 10mo agoAt my $DAYJOB, we have a bunch in-house saltstack states for applying the CIS benchmarks for Ubuntu, Debian, and CentOS. I never looked into it, but I always wondered if I'd be allowed to publish them publicly.
- bhattisatish 10mo agoWell there is one available for oscap at https://github.com/ComplianceAsCode/content https://github.com/ComplianceAsCode/content
- hackernudes 10mo agoContext: https://www.cisecurity.org/cis-benchmarks https://www.cisecurity.org/cis-benchmarks, https://www.cisecurity.org/about-us https://www.cisecurity.org/about-us """The CIS Benchmarks® are prescriptive configuration recommendations for more than 25+ vendor product families. They represent the consensus-based effort of cybersecurity experts globally to help you protect your systems against threats more confidently."""
- infocollector 10mo agohttps://learn.cisecurity.org/benchmarks https://learn.cisecurity.org/benchmarks - this seems broken at least right now. Are these benchmarks on github so that I can download and run it on a linux box?
- firesteelrain 10mo agoYou used to have to make an account to download them.
- TacticalCoder 10mo agoThe Linux hardening list lists quite some modifications but what hardening is made to SSH compared to a stock config? For Linux they summarize the list of hardened changes but for SSH I couldn't find it. For SSH it's basically a list of default values with a comment saying "change this if you must". Some summary as to what is hardened compared to a stock SSH install would be nice.
- observationist 10mo agohttps://github.com/dev-sec/ansible-collection-hardening/blob/master/roles/ssh_hardening/CHANGELOG.md https://github.com/dev-sec/ansible-collection-hardening/blob... The changelogs contain a summary of actions and changes, and full changelogs go into detail.
- imcritic 10mo agoThat's a poor answer. Changelogs are logs of changes between versions of a project.
- schurzi 10mo agoMaintainer here, we use a collection of baselines that are derived from internal guidelines and CIS benchmarks. The baselines have some more information as to what is done. For example SSH: https://github.com/dev-sec/ssh-baseline https://github.com/dev-sec/ssh-baseline
- ornornor 10mo agoAbout ansible: I really like the idea and popularity of ansible but find it so painful to use. YAML sucks, and testing is not straightforward (I use molecule in docker containers with geerlingguy’s spécial images) What’s your workflow for writing tested playbooks?
- tuananh 10mo agowait until you have to use puppet :D
- jdmoreira 10mo agoclaude code is really good at it from my experience
- JimBlackwood 10mo agoWhat do you want to do in a playbook that requires it to be tested? We keep our roles very simple and they will not do anything complicated. Ansible is for configuring a machine, that’s it. If we need to do anything more complicated, we’ll write it in a testable program (usually in Go).
- ornornor 9mo agoWhat do you do that doesn't need to be tested? I have a playbook for my dotfiles/rebuilding a personal machine from scratch. So I test that the files end up where they're supposed to be, the permissions, the packages, that whatever software I installed from source are indeed setup correctly and running, etc. Same for roles that need to provably configure a piece of software.
- tuananh 10mo agoI would much prefer to use RHEL/Fedora image mode for this. Use Dockerfile syntax. Immutable. Easy to update/rollback. CIS hardening baked in. ``` [customizations.openscap] datastream = "/usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml" profile_id = "xccdf_org.ssgproject.content_profile_cis" custom_remediate_script_path = "/your/custom/script.sh" ```