May 2017 - Release-announce - lists.openstack.org

openstack-ansible-security 13.3.16
by no-reply＠openstack.org 26 May '17

26 May '17

We enthusiastically announce the release of: openstack-ansible-security 13.3.16: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.14..13.3.16 ------------------------------------------------------ 65b28f9 Make all tests use upper-constraints 4664346 Use stable/mitaka branch when cloning plugins repo Diffstat (except docs and test files) ------------------------------------- tox.ini | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-)

1 0

openstack-ansible-security 13.3.18
by no-reply＠openstack.org 26 May '17

26 May '17

We are jazzed to announce the release of: openstack-ansible-security 13.3.18: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.14..13.3.18 ------------------------------------------------------ 65b28f9 Make all tests use upper-constraints 4664346 Use stable/mitaka branch when cloning plugins repo Diffstat (except docs and test files) ------------------------------------- tox.ini | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-)

1 0

openstack-ansible-security 14.0.3 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We are pumped to announce the release of: openstack-ansible-security 14.0.3: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.0.1..14.0.3 ---------------------------------------------------- 5e8714c Replace github with git.o.o Diffstat (except docs and test files) ------------------------------------- README.md | 2 +- bindep.txt | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)

1 0

openstack-ansible-security 14.0.4 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We joyfully announce the release of: openstack-ansible-security 14.0.4: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.0.3..14.0.4 ---------------------------------------------------- 4251bc5 Backport of package optimization Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 4 +- .../chrony-config-variable-7a1a7862c05c9675.yaml | 5 + tasks/aide.yml | 23 ---- tasks/apt.yml | 32 +++++ tasks/auditd.yml | 32 ----- tasks/auth.yml | 75 ----------- tasks/lsm.yml | 31 ----- tasks/mail.yml | 20 --- tasks/misc.yml | 48 +------ tasks/rpm.yml | 41 ++++-- tasks/services.yml | 145 --------------------- tox.ini | 2 +- vars/redhat.yml | 55 ++++++++ vars/ubuntu.yml | 56 ++++++++ 15 files changed, 196 insertions(+), 380 deletions(-)

1 0

openstack-ansible-security 14.0.7 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We are psyched to announce the release of: openstack-ansible-security 14.0.7: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.0.5..14.0.7 ---------------------------------------------------- bf463a0 Add libxslt headers to bindep 2d07959 Fix issues from new CentOS 7 release Diffstat (except docs and test files) ------------------------------------- bindep.txt | 2 ++ tasks/auditd.yml | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-)

1 0

openstack-ansible-security 13.3.9
by no-reply＠openstack.org 26 May '17

26 May '17

We are ecstatic to announce the release of: openstack-ansible-security 13.3.9: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.5..13.3.9 ---------------------------------------------------- d57be75 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

openstack-ansible-security 14.0.1 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We jubilantly announce the release of: openstack-ansible-security 14.0.1: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.0.0..14.0.1 ---------------------------------------------------- af2226f Use centralised Ansible test scripts Diffstat (except docs and test files) ------------------------------------- tasks/apt.yml | 1 + tox.ini | 67 ++++++++++------------------------------------------ 4 files changed, 29 insertions(+), 78 deletions(-)

1 0

openstack-ansible-security 13.3.4
by no-reply＠openstack.org 26 May '17

26 May '17

We are jazzed to announce the release of: openstack-ansible-security 13.3.4: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 13.3.4 ^^^^^^ New Features ************ * AIDE is configured to skip the entire "/var" directory when it does the database initialization and when it performs checks. This reduces disk I/O and allows these jobs to complete faster. This also allows the initialization to become a blocking process and Ansible will wait for the initialization to complete prior to running the next task. * Although the STIG requires martian packets to be logged, the logging is now disabled by default. The logs can quickly fill up a syslog server or make a physical console unusable. Deployers that need this logging enabled will need to set the following Ansible variable: security_sysctl_enable_martian_logging: yes Upgrade Notes ************* * All of the discretionary access control (DAC) auditing is now disabled by default. This reduces the amount of logs generated during deployments and minor upgrades. The following variables are now set to "no": security_audit_DAC_chmod: no security_audit_DAC_chown: no security_audit_DAC_lchown: no security_audit_DAC_fchmod: no security_audit_DAC_fchmodat: no security_audit_DAC_fchown: no security_audit_DAC_fchownat: no security_audit_DAC_fremovexattr: no security_audit_DAC_lremovexattr: no security_audit_DAC_fsetxattr: no security_audit_DAC_lsetxattr: no security_audit_DAC_setxattr: no Bug Fixes ********* * The "/run" directory is excluded from AIDE checks since the files and directories there are only temporary and often change when services start and stop. * AIDE initialization is now always run on subsequent playbook runs when "initialize_aide" is set to "yes". The initialization will be skipped if AIDE isn't installed or if the AIDE database already exists. See bug 1616281 (https://launchpad.net/bugs/1616281) for more details. * The auditd rules for auditing V-38568 (filesystem mounts) were incorrectly labeled in the auditd logs with the key of "export-V-38568". They are now correctly logged with the key "filesystem_mount-V-38568". Changes in openstack-ansible-security 13.3.3..13.3.4 ---------------------------------------------------- ca9b7de Disable DAC change auditing 775f641 Disable martian logging by default a329034 Exclude /run from AIDE checks c16d117 Ensure AIDE initializes on subsequent runs e0d0e36 Fix numbering on V-38583 Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 22 +++--- handlers/main.yml | 6 -- .../notes/aide-exclude-run-4d3c97a2d08eb373.yaml | 6 ++ .../aide-initialization-fix-16ab0223747d7719.yaml | 17 +++++ ...figurable-martian-logging-370ede40b036db0b.yaml | 13 ++++ .../reduce-auditd-logging-633677a74aee5481.yaml | 25 +++++++ tasks/aide.yml | 86 ++++++++++++++++++++++ tasks/boot.yml | 4 +- tasks/kernel.yml | 2 +- tasks/main.yml | 1 + tasks/misc.yml | 49 ------------ templates/osas-auditd.j2 | 8 +- 22 files changed, 293 insertions(+), 94 deletions(-)

1 0

openstack-ansible-security 13.1.3
by no-reply＠openstack.org 26 May '17

26 May '17

We are pumped to announce the release of: openstack-ansible-security 13.1.3: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 13.1.3 ^^^^^^ Bug Fixes * The security role previously set the permissions on all audit log files in "/var/log/audit" to "0400", but this prevents the audit daemon from writing to the active log file. This will prevent "auditd" from starting or restarting cleanly. The task now removes any permissions that are not allowed by the STIG. Any log files that meet or exceed the STIG requirements will not be modified.

1 0

openstack-ansible-security 13.3.6
by no-reply＠openstack.org 26 May '17

26 May '17

We are psyched to announce the release of: openstack-ansible-security 13.3.6: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.5..13.3.6 ---------------------------------------------------- d57be75 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0