- Release-announce - lists.openstack.org

openstack-ansible-security 13.1.2
by no-reply＠openstack.org 26 May '17

26 May '17

We are amped to announce the release of: openstack-ansible-security 13.1.2: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 13.1.2 ^^^^^^ Bug Fixes * The dictionary-based variables in "defaults/main.yml" are now individual variables. The dictionary-based variables could not be changed as the documentation instructed. Instead it was required to override the entire dictionary. Deployers must use the new variable names to enable or disable the security configuration changes applied by the security role. For more information, see Launchpad Bug 1577944 (https://bugs.launchpad.net/openstack- ansible/+bug/1577944). * The security role now handles "ssh_config" files that contain "Match" stanzas. A marker is added to the configuration file and any new configuration items will be added below that marker. In addition, the configuration file is validated for each change to the ssh configuration file.

1 0

openstack-ansible-security 13.1.1
by no-reply＠openstack.org 26 May '17

26 May '17

We are tickled pink to announce the release of: openstack-ansible-security 13.1.1: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 13.1.1 ^^^^^^ Bug Fixes * Failed access logging is now disabled by default and can be enabled by changing "auditd_rules['failed_access']" to "yes". The rsyslog daemon checks for the existence of log files regularly and this audit rule was triggered very frequently, which led to very large audit logs.

1 0

openstack-ansible-security 12.0.0 (liberty)
by no-reply＠openstack.org 26 May '17

26 May '17

We are thrilled to announce the release of: openstack-ansible-security 12.0.0: Security hardening role for openstack-ansible This release is part of the liberty release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 12.0.13
by no-reply＠openstack.org 26 May '17

26 May '17

We are psyched to announce the release of: openstack-ansible-security 12.0.13: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 12.1.0
by no-reply＠openstack.org 26 May '17

26 May '17

We exuberantly announce the release of: openstack-ansible-security 12.1.0: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 13.0.1
by no-reply＠openstack.org 26 May '17

26 May '17

We are glad to announce the release of: openstack-ansible-security 13.0.1: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 12.2.6
by no-reply＠openstack.org 26 May '17

26 May '17

We are overjoyed to announce the release of: openstack-ansible-security 12.2.6: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 12.2.5..12.2.6 ---------------------------------------------------- 44c1bc9 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

openstack-ansible-security 12.2.5
by no-reply＠openstack.org 26 May '17

26 May '17

We are tickled pink to announce the release of: openstack-ansible-security 12.2.5: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 12.2.5 ^^^^^^ New Features ************ * AIDE is configured to skip the entire "/var" directory when it does the database initialization and when it performs checks. This reduces disk I/O and allows these jobs to complete faster. This also allows the initialization to become a blocking process and Ansible will wait for the initialization to complete prior to running the next task. * Although the STIG requires martian packets to be logged, the logging is now disabled by default. The logs can quickly fill up a syslog server or make a physical console unusable. Deployers that need this logging enabled will need to set the following Ansible variable: security_sysctl_enable_martian_logging: yes Upgrade Notes ************* * All of the discretionary access control (DAC) auditing is now disabled by default. This reduces the amount of logs generated during deployments and minor upgrades. The following variables are now set to "no": security_audit_DAC_chmod: no security_audit_DAC_chown: no security_audit_DAC_lchown: no security_audit_DAC_fchmod: no security_audit_DAC_fchmodat: no security_audit_DAC_fchown: no security_audit_DAC_fchownat: no security_audit_DAC_fremovexattr: no security_audit_DAC_lremovexattr: no security_audit_DAC_fsetxattr: no security_audit_DAC_lsetxattr: no security_audit_DAC_setxattr: no Bug Fixes ********* * The "/run" directory is excluded from AIDE checks since the files and directories there are only temporary and often change when services start and stop. * AIDE initialization is now always run on subsequent playbook runs when "initialize_aide" is set to "yes". The initialization will be skipped if AIDE isn't installed or if the AIDE database already exists. See bug 1616281 (https://launchpad.net/bugs/1616281) for more details. * The auditd rules for auditing V-38568 (filesystem mounts) were incorrectly labeled in the auditd logs with the key of "export-V-38568". They are now correctly logged with the key "filesystem_mount-V-38568". Changes in openstack-ansible-security 12.2.3..12.2.5 ---------------------------------------------------- 77eaaf2 Disable DAC change auditing 31a8ff5 Disable martian logging by default e7373c4 Exclude /run from AIDE checks 6c9eb50 Ensure AIDE initializes on subsequent runs 23fe90b Fix numbering on V-38583 Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 22 +++--- handlers/main.yml | 6 -- .../notes/aide-exclude-run-4d3c97a2d08eb373.yaml | 6 ++ .../aide-initialization-fix-16ab0223747d7719.yaml | 17 +++++ ...figurable-martian-logging-370ede40b036db0b.yaml | 13 ++++ .../reduce-auditd-logging-633677a74aee5481.yaml | 25 +++++++ tasks/aide.yml | 86 ++++++++++++++++++++++ tasks/boot.yml | 4 +- tasks/kernel.yml | 2 +- tasks/main.yml | 1 + tasks/misc.yml | 49 ------------ templates/osas-auditd.j2 | 8 +- 22 files changed, 293 insertions(+), 94 deletions(-)

1 0

openstack-ansible-security 13.0.0
by no-reply＠openstack.org 26 May '17

26 May '17

We exuberantly announce the release of: openstack-ansible-security 13.0.0: Security hardening role for openstack-ansible This is the first release of openstack-ansible-security. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 12.0.16
by no-reply＠openstack.org 26 May '17

26 May '17

We exuberantly announce the release of: openstack-ansible-security 12.0.16: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 12.0.16 ^^^^^^^ New Features ************ * The audit rules added by the security role now have key fields that make it easier to link the audit log entry to the audit rule that caused it to appear. Bug Fixes ********* * The role previously did not restart the audit daemon after generating a new rules file. The bug (https://launchpad.net/bugs/1590916) has been fixed and the audit daemon will be restarted after any audit rule changes. * When the security role was run in Ansible's check mode and a tag was provided, the "check_mode" variable was not being set. Any tasks which depend on that variable would fail. This bug is fixed (https://bugs.launchpad.net/openstack-ansible/+bug/1590086) and the "check_mode" variable is now set properly on every playbook run.

1 0