add debian 12 support (#684)

* add debian 12 support Signed-off-by: Sebastian Gumprich <[email protected]> * temp disable pam-checks Signed-off-by: Sebastian Gumprich <[email protected]> * remove debian12 from vagrant tests as there's no box yet Signed-off-by: Sebastian Gumprich <[email protected]> * use new pam-tester from pip Signed-off-by: Sebastian Gumprich <[email protected]> * use new pam-tester from pip Signed-off-by: Sebastian Gumprich <[email protected]> * add setuptoolks to pam-tester install Signed-off-by: Sebastian Gumprich <[email protected]> * add setuptoolks to pam-tester install Signed-off-by: Sebastian Gumprich <[email protected]> * add setuptoolks to pam-tester install Signed-off-by: Sebastian Gumprich <[email protected]> * add setuptoolks to pam-tester install Signed-off-by: Sebastian Gumprich <[email protected]> * install pam-tester with python3 and use full path to it Signed-off-by: Sebastian Gumprich <[email protected]> * install python3-setupttools in verify-tests Signed-off-by: Sebastian Gumprich <[email protected]> * fix path for pam-tester in all tests Signed-off-by: Sebastian Gumprich <[email protected]> * set python interpreter to 3 for verify-tests Signed-off-by: Sebastian Gumprich <[email protected]> * Revert "set python interpreter to 3 for verify-tests" This reverts commit 00b6556. * add back accidentally deleted tasks Signed-off-by: Sebastian Gumprich <[email protected]> --------- Signed-off-by: Sebastian Gumprich <[email protected]> Co-authored-by: Sebastian Gumprich <[email protected]>
dev-sec · Aug 4, 2023 · ef5e880 · ef5e880
1 parent 9950f9b
commit ef5e880
Show file tree

Hide file tree

Showing 10 changed files with 41 additions and 17 deletions.
diff --git a/.github/workflows/mysql_hardening.yml b/.github/workflows/mysql_hardening.yml
@@ -45,6 +45,7 @@ jobs:
           - ubuntu2204
           - debian10
           - debian11
+          - debian12
           # - amazon  # geerlingguy.mysql does not support fedora
           # - arch  # geerlingguy.mysql does not support arch
           - opensuse_tumbleweed

diff --git a/.github/workflows/nginx_hardening.yml b/.github/workflows/nginx_hardening.yml
@@ -44,6 +44,7 @@ jobs:
           - ubuntu2204
           - debian10
           - debian11
+          - debian12
           - amazon2023
           # - arch  # needs to be fixed
           # - opensuse_tumbleweed  # needs to be fixed

diff --git a/.github/workflows/os_hardening.yml b/.github/workflows/os_hardening.yml
@@ -46,6 +46,7 @@ jobs:
           - ubuntu2204
           - debian10
           - debian11
+          - debian12
           - amazon2023
           - opensuse_tumbleweed
           - arch

diff --git a/.github/workflows/os_hardening_vm.yml b/.github/workflows/os_hardening_vm.yml
@@ -46,6 +46,7 @@ jobs:
           - ubuntu2204
           - debian10
           - debian11
+          # - debian12  # waiting for https://github.com/lavabit/robox/pull/274
           - opensuse15
           # - arch  # needs fix for audit
     steps:

diff --git a/.github/workflows/ssh_hardening.yml b/.github/workflows/ssh_hardening.yml
@@ -46,6 +46,7 @@ jobs:
           - ubuntu2204
           - debian10
           - debian11
+          - debian12
           - amazon2023
           - arch
           # - opensuse_tumbleweed  # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)

diff --git a/.github/workflows/ssh_hardening_custom_tests.yml b/.github/workflows/ssh_hardening_custom_tests.yml
@@ -46,6 +46,7 @@ jobs:
           - ubuntu2204
           - debian10
           - debian11
+          - debian12
           - amazon2023
           - arch
           # - opensuse_tumbleweed  # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)

diff --git a/README.md b/README.md
@@ -11,9 +11,9 @@
 This collection provides battle tested hardening for:
 
 - Linux operating systems:
-  - CentOS 7
-  - Rocky Linux 8
-  - Debian 10/11
+  - CentOS 7/8/9
+  - Rocky Linux 8/9
+  - Debian 10/11/12
   - Ubuntu 18.04/20.04/22.04
   - Amazon Linux (some roles supported)
   - Arch Linux (some roles supported)

diff --git a/molecule/os_hardening/verify.yml b/molecule/os_hardening/verify.yml
@@ -7,6 +7,10 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
+    - name: set ansible_python_interpreter to "/usr/bin/python3"
+      set_fact:
+        ansible_python_interpreter: "/usr/bin/python3"
+
     - name: include verification tasks
       ansible.builtin.include_tasks:
         file: "{{ item }}"

diff --git a/molecule/os_hardening/verify_tasks/pam.yml b/molecule/os_hardening/verify_tasks/pam.yml
@@ -1,9 +1,17 @@
 ---
-- name: download pam-tester
-  get_url:
-    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
-    dest: /bin/pam-tester
-    mode: 0555
+
+- name: install pip
+  package:
+    name:
+      - python3-pip
+      - python3-setuptools
+    state: present
+
+- name: install pam-tester
+  ansible.builtin.pip:
+    name: pam-tester
+    state: present
+    executable: /usr/bin/pip3
 
 - name: set password for test
   set_fact:
@@ -23,15 +31,15 @@
 
 - name: check successful login with correct password
   shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
     LANG: "{{ locale | default('C.UTF-8') }}"
 
 - name: check unsuccessful login with incorrect password
   shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -40,7 +48,7 @@
 
 - name: check unsuccessful login, with correct password (lockout)
   shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -52,7 +60,7 @@
 
 - name: check successful login
   shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"

diff --git a/molecule/os_hardening_vm/verify_tasks/pam.yml b/molecule/os_hardening_vm/verify_tasks/pam.yml
@@ -1,9 +1,15 @@
 ---
-- name: download pam-tester
-  get_url:
-    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
-    dest: /bin/pam-tester
-    mode: 0555
+- name: install pip
+  package:
+    name:
+      - python3-pip
+      - python3-setuptools
+    state: present
+
+- name: install pam-tester
+  ansible.builtin.pip:
+    name: pam-tester
+    state: present
 
 - name: set password for test
   set_fact: