add modprobe template, control os-10 #138
Conversation
|
That's actually a CIS recommendation, see here: https://www.cisecurity.org/wp-content/uploads/2017/04/CIS_Oracle_Linux_6_Benchmark_v1.0.0.pdf, search for "1.1.1 Disable unused filesystems". I updated the readme. |
tasks/modprobe.yml
Outdated
| dest: "/etc/modprobe.d/dev-sec.conf" | ||
| owner: "root" | ||
| group: "root" | ||
| mode: "0640" |
There was a problem hiding this comment.
Seems your editor did not add a \n automatically. You can check with a hexeditor. Can you add one just to be safe :) ?
check for modprobe use apt and yum instead of package Revert "use apt and yum instead of package" This reverts commit 215a97b. use latest to install kmod run apt-get update
|
@ypid, I added some tasks to install modprobe and squashed the commits. Can you do one last review? :) |
tasks/modprobe.yml
Outdated
| command: 'modprobe -V' | ||
| register: modprobe_installed | ||
| ignore_errors: True | ||
| changed_when: False |
There was a problem hiding this comment.
I would drop this check task. The next task can just ensure that kmod is present.
There was a problem hiding this comment.
Yeah, I don't really know why I did this. There wa a problem with installing kmod on ubuntu 16.04 but I fixed this with the apt-task in default.yml.
Anyway, I removed it.
tasks/modprobe.yml
Outdated
| package: | ||
| name: 'kmod' | ||
| state: 'installed' | ||
| when: modprobe_installed and modprobe_installed.rc != 0 |
There was a problem hiding this comment.
I would change the state from installed to present. According to the docs installed should not work.
rndmh3ro
changed the title
rsync was erroneously added to `os_security_packages_list` variable, meaning it was uninstalled as a "package with known issues". Fixes #141
check for modprobe use apt and yum instead of package Revert "use apt and yum instead of package" This reverts commit 215a97b. use latest to install kmod run apt-get update
Issue #137: Indent sshd_config's "Match Group sftponly"
add modprobe template, control os-10
Issue dev-sec#137: Indent sshd_config's "Match Group sftponly"
I'm not sure if we should also run theses commands in addition to adding them to the
modprobe.d-directory.Currently I'd say yes so there's no restart required.
What do you think, @chris-rock @atomic111 @ypid ?