diff --git a/README.md b/README.md
index d05db0b..845e223 100644
--- a/README.md
+++ b/README.md
@@ -26,6 +26,14 @@ ansible-playbook playbooks/install_demo.yml -e @choose_demo.yml
| Video Walkthrough |
Workshop Types |
+
+ | SERVER / Hardening |
+ Will Tome |
+ demo: hardening |
+ hardening for Linux servers |
+ Not available |
+ |
+
| Windows IIS Server |
Colin McNaughton |
@@ -34,14 +42,6 @@ ansible-playbook playbooks/install_demo.yml -e @choose_demo.yml
Not available |
|
-
- | Create Developer Report |
- Sean Cavanaugh |
- demo: developer_report |
- Create HTML report using Ansible facts |
- Not available |
- |
-
| Deploy Application (survey) |
Sean Cavanaugh |
@@ -50,14 +50,6 @@ ansible-playbook playbooks/install_demo.yml -e @choose_demo.yml
Video Link |
|
-
- | Create Openscap Report |
- Sean Cavanaugh |
- demo: openscap |
- Create HTML report using SCAP Security Guide (SSG) |
- Not available |
- |
-
| SERVER / Patching |
Will Tome |
@@ -66,6 +58,22 @@ ansible-playbook playbooks/install_demo.yml -e @choose_demo.yml
Not available |
|
+
+ | Create Developer Report |
+ Sean Cavanaugh |
+ demo: developer_report |
+ Create HTML report using Ansible facts |
+ Not available |
+ |
+
+
+ | Create Openscap Report |
+ Sean Cavanaugh |
+ demo: openscap |
+ Create HTML report using SCAP Security Guide (SSG) |
+ Not available |
+ |
+
# Contribute
@@ -74,7 +82,7 @@ please refer to the [contribute.md](docs/contribute.md) documentation included i
# Notes
-This README.md was auto-generated by Ansible user **sean** on **2020-03-06** with Ansible version **2.9.5**
+This README.md was auto-generated by Ansible user **sean** on **2020-03-09** with Ansible version **2.9.5**
To generate a README.md, execute the following command
diff --git a/playbooks/03_hardening.yml b/playbooks/03_hardening.yml
new file mode 100644
index 0000000..381aea3
--- /dev/null
+++ b/playbooks/03_hardening.yml
@@ -0,0 +1,31 @@
+---
+- name: harden linux systems
+ hosts: "{{ HOSTS | default('all') }}"
+ become: yes
+ vars:
+ - harden_firewall: False
+ - harden_time: False
+ - harden_ssh: False
+ - harden_pci: False
+
+ tasks:
+ - name: Configure Firewall
+ when: harden_firewall | bool
+ include_role:
+ name: linux-system-roles.firewall
+
+ - name: Configure Timesync
+ when: harden_time | bool
+ include_role:
+ name: linux-system-roles.timesync
+
+ - name: SSH Hardening
+ when: harden_ssh | bool
+ include_role:
+ name: dev-sec.ssh-hardening
+
+ # run with --skip-tags accounts_passwords_pam_faillock_deny
+ - name: Apply PCI Baseline
+ when: harden_pci | bool
+ include_role:
+ name: redhatofficial.rhel7_pci_dss
diff --git a/playbooks/group_vars/all/03_hardening.yml b/playbooks/group_vars/all/03_hardening.yml
new file mode 100644
index 0000000..2ff63b3
--- /dev/null
+++ b/playbooks/group_vars/all/03_hardening.yml
@@ -0,0 +1,37 @@
+---
+survey_hardening:
+ name: ''
+ description: ''
+ spec:
+ - question_name: 'Enter host to configure'
+ type: text
+ variable: HOSTS
+ required: false
+ - question_name: Configure Firewall?
+ type: multiplechoice
+ variable: harden_firewall
+ required: false
+ choices:
+ - 'Yes'
+ - 'No'
+ - question_name: Configure Time?
+ type: multiplechoice
+ variable: harden_time
+ required: false
+ choices:
+ - 'Yes'
+ - 'No'
+ - question_name: Harden SSH?
+ type: multiplechoice
+ variable: harden_ssh
+ required: false
+ choices:
+ - 'Yes'
+ - 'No'
+ - question_name: PCI Baseline?
+ type: multiplechoice
+ variable: harden_pci
+ required: false
+ choices:
+ - 'Yes'
+ - 'No'
diff --git a/playbooks/group_vars/all/all.yml b/playbooks/group_vars/all/all.yml
index 2b17e4f..102c23c 100644
--- a/playbooks/group_vars/all/all.yml
+++ b/playbooks/group_vars/all/all.yml
@@ -38,6 +38,25 @@ demos:
workshop_type:
- f5
- rhel
+ hardening:
+ author: "Will Tome"
+ name: "SERVER / Hardening"
+ description: "hardening for Linux servers"
+ job_type: "run"
+ inventory: "Workshop Inventory"
+ playbook: "playbooks/03_hardening.yml"
+ credential: "Workshop Credential"
+ survey_enabled: yes
+ survey_spec: "{{survey_hardening}}"
+ project:
+ name: "Ansible official demo project"
+ description: "prescriptive demos from Red Hat Management Buisness Unit"
+ organization: "Default"
+ scm_type: git
+ scm_url: "https://github.com/ansible/product-demos"
+ workshop_type:
+ - f5
+ - rhel
windows_iis:
author: "Colin McNaughton"
name: "Windows IIS Server"
diff --git a/roles/requirements.yml b/roles/requirements.yml
new file mode 100644
index 0000000..df0002c
--- /dev/null
+++ b/roles/requirements.yml
@@ -0,0 +1,6 @@
+---
+- src: dev-sec.ssh-hardening
+- src: mindpointgroup.rhel7-cis
+- src: redhatofficial.rhel7_pci_dss
+- src: linux-system-roles.firewall
+- src: linux-system-roles.timesync