Changelog

8.0.0 (2022-08-22)

Full Changelog

Breaking changes:

• change default to allow SFTP #564 [ssh_hardening] (schurzi)

Implemented enhancements:

• add possibility to keep .netrc files in users homedir #563 [os_hardening] (PhilippFunk)
• rework filesystem hardening #555 [os_hardening] (divialth)

Closed issues:

• Error in Task 'Create sshd_config and set permissions to root/600' #565 [ssh_hardening]
• [ssh_hardening] Debian 11 - Ansible cannot transfer files #557
• Add the old SFTP-Reminder to the stable ssh_hardening role for ansible #521

Changelog

7.16.0 (2022-08-16)

Full Changelog

Implemented enhancements:

• revert debian 9 change, only one tls variable now #562 [nginx_hardening] (rndmh3ro)
• add posibility to run ssh_hardening as unprivileged user #561 [ssh_hardening] (schurzi)
• add basic support for ubuntu22.04 #554 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (schurzi)
• Add full support for Debian 11 #538 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (addianto)

Fixed bugs:

• Replace default 2048 bits RSA keypair fails on Ubuntu 20.04 #459

Closed issues:

• os-hardening: yum gpg-check fails if gpg-check already set #556
• Ubuntu 22.04 LTS #553
• Revert nginx ssl-protocol after deprecation of debian9 #528
• Support for Debian 11 #527
• Support baseline-control os-14 #507

Changelog

7.15.1 (2022-07-26)

Full Changelog

Fixed bugs:

• Fix broken mode for /var/log/audit #552 [os_hardening] (hollow)

Merged pull requests:

• Only run hardening if /var/log/audit exists #550 [os_hardening] (mego22)

Changelog

7.15.0 (2022-07-11)

Full Changelog

Implemented enhancements:

• Harden mountpoints #531 [os_hardening] (lbayerlein)

Fixed bugs:

• os_hardening gpg-check enabled fails on success #549 [os_hardening]
• add VM tests for os_hardening #547 [os_hardening] (schurzi)
• Linting #546 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (rndmh3ro)

Changelog

7.14.3 (2022-06-29)

Full Changelog

Closed issues:

• Version 7.14.2 not released to Ansible Galaxy #544
• os_hardening role: os_ignore_users not described in the Readme's variable topic #542
• doc: incorrect description for ssh_client_alive_count #540
• 'legacy' branch is mentioned in README, but apparently doesn't exist #539
• ansible_role_name is undefined #532
• Can't sudo anymore after hardening #518
• Any planned official support for RHEL/CentOS Stream 9? #517

Merged pull requests:

• Improve documentation #541 [ssh_hardening] (schurzi)

Changelog

7.14.2 (2022-02-28)

Full Changelog

Fixed bugs:

• debian 9's nginx doesn't support tls1.3 #526 [nginx_hardening] (rndmh3ro)
• Change permissions of the tmout.sh file #520 [os_hardening] (abejotaR)

Closed issues:

• No such file directory error triggered by the kernel.unpriviliged_userns_clone configuration. #514

Merged pull requests:

• delete obsolete release drafts #530 (schurzi)
• add waivers to skip controls #529 [os_hardening] (rndmh3ro)
• remove centos8 tests #525 [mysql_hardening] [os_hardening] [ssh_hardening] [nginx_hardening] (rndmh3ro)

Changelog

7.14.1 (2022-02-18)

Full Changelog

Fixed bugs:

• move sysctls to debian specific vars #524 [os_hardening] (rndmh3ro)

Closed issues:

• Error when using the ssh_hardening role #519
• No such file directory error triggered by the kernel.unpriviliged_userns_clone configuration. #514

Changelog

7.14.0 (2021-12-16)

Full Changelog

Implemented enhancements:

• Add option to set timeout in seconds to logout users #516 [os_hardening] (lbayerlein)
• add feature to disable coredump to limit task #511 [os_hardening] (lbayerlein)
• Updated dh_params to 4096 #501 [nginx_hardening] (ksaadDE)

Fixed bugs:

• Fix duplicate sysctl config in fs #505 [os_hardening] (tekicat)

Closed issues:

• Roll back the changes #512
• Installing collection at tag 7.13.2 is defaulting to 7.12.0 each time #508
• Duplication of sysctl default parameter fs.protected_hardlinks and fs.protected_symlinks #502

Merged pull requests:

• Feature coredump #513 [os_hardening] (rndmh3ro)
• change hidepid mount task state to mounted #510 [os_hardening] (alegrey91)
• prettify nginx options #509 [nginx_hardening] (schurzi)
• Update nginx_add_header README to match default #506 [nginx_hardening] (duffn)

Changelog

Changelog

7.13.1 (2021-11-23)

Full Changelog

Closed issues:

• Unable to use 7.13.0 Release #503