- Release-announce - lists.openstack.org

openstack-ansible-security 13.3.4
by no-reply＠openstack.org 26 May '17

26 May '17

We are jazzed to announce the release of: openstack-ansible-security 13.3.4: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 13.3.4 ^^^^^^ New Features ************ * AIDE is configured to skip the entire "/var" directory when it does the database initialization and when it performs checks. This reduces disk I/O and allows these jobs to complete faster. This also allows the initialization to become a blocking process and Ansible will wait for the initialization to complete prior to running the next task. * Although the STIG requires martian packets to be logged, the logging is now disabled by default. The logs can quickly fill up a syslog server or make a physical console unusable. Deployers that need this logging enabled will need to set the following Ansible variable: security_sysctl_enable_martian_logging: yes Upgrade Notes ************* * All of the discretionary access control (DAC) auditing is now disabled by default. This reduces the amount of logs generated during deployments and minor upgrades. The following variables are now set to "no": security_audit_DAC_chmod: no security_audit_DAC_chown: no security_audit_DAC_lchown: no security_audit_DAC_fchmod: no security_audit_DAC_fchmodat: no security_audit_DAC_fchown: no security_audit_DAC_fchownat: no security_audit_DAC_fremovexattr: no security_audit_DAC_lremovexattr: no security_audit_DAC_fsetxattr: no security_audit_DAC_lsetxattr: no security_audit_DAC_setxattr: no Bug Fixes ********* * The "/run" directory is excluded from AIDE checks since the files and directories there are only temporary and often change when services start and stop. * AIDE initialization is now always run on subsequent playbook runs when "initialize_aide" is set to "yes". The initialization will be skipped if AIDE isn't installed or if the AIDE database already exists. See bug 1616281 (https://launchpad.net/bugs/1616281) for more details. * The auditd rules for auditing V-38568 (filesystem mounts) were incorrectly labeled in the auditd logs with the key of "export-V-38568". They are now correctly logged with the key "filesystem_mount-V-38568". Changes in openstack-ansible-security 13.3.3..13.3.4 ---------------------------------------------------- ca9b7de Disable DAC change auditing 775f641 Disable martian logging by default a329034 Exclude /run from AIDE checks c16d117 Ensure AIDE initializes on subsequent runs e0d0e36 Fix numbering on V-38583 Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 22 +++--- handlers/main.yml | 6 -- .../notes/aide-exclude-run-4d3c97a2d08eb373.yaml | 6 ++ .../aide-initialization-fix-16ab0223747d7719.yaml | 17 +++++ ...figurable-martian-logging-370ede40b036db0b.yaml | 13 ++++ .../reduce-auditd-logging-633677a74aee5481.yaml | 25 +++++++ tasks/aide.yml | 86 ++++++++++++++++++++++ tasks/boot.yml | 4 +- tasks/kernel.yml | 2 +- tasks/main.yml | 1 + tasks/misc.yml | 49 ------------ templates/osas-auditd.j2 | 8 +- 22 files changed, 293 insertions(+), 94 deletions(-)

1 0

openstack-ansible-security 13.3.6
by no-reply＠openstack.org 26 May '17

26 May '17

We are psyched to announce the release of: openstack-ansible-security 13.3.6: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.5..13.3.6 ---------------------------------------------------- d57be75 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

openstack-ansible-security 13.1.3
by no-reply＠openstack.org 26 May '17

26 May '17

We are pumped to announce the release of: openstack-ansible-security 13.1.3: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 13.1.3 ^^^^^^ Bug Fixes * The security role previously set the permissions on all audit log files in "/var/log/audit" to "0400", but this prevents the audit daemon from writing to the active log file. This will prevent "auditd" from starting or restarting cleanly. The task now removes any permissions that are not allowed by the STIG. Any log files that meet or exceed the STIG requirements will not be modified.

1 0

openstack-ansible-security 14.2.3 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We are excited to announce the release of: openstack-ansible-security 14.2.3: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.1.1..14.2.3 ---------------------------------------------------- 5f49ce1 Add missing STIG ID tags e7185d2 Install python2-pyOpenSSL package on CentOS dd52e48 Prepare vagrant centos/7 box for role testing 2a2b1e6 Fix auditd restart handler d97e7b8 Add conf file entry for chrony Diffstat (except docs and test files) ------------------------------------- Vagrantfile | 9 +++++++++ bindep.txt | 2 +- handlers/main.yml | 11 +++++++---- tasks/misc.yml | 10 +++++++++- vars/redhat.yml | 1 + vars/ubuntu.yml | 1 + 8 files changed, 38 insertions(+), 6 deletions(-)

1 0

openstack-ansible-security 14.1.0 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We are tickled pink to announce the release of: openstack-ansible-security 14.1.0: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.0.8..14.1.0 ---------------------------------------------------- f33e72f Handle SELinux properly when it is disabled Diffstat (except docs and test files) ------------------------------------- tasks/misc.yml | 1 + 1 file changed, 1 insertion(+)

1 0

openstack-ansible-security 13.3.5
by no-reply＠openstack.org 26 May '17

26 May '17

We contentedly announce the release of: openstack-ansible-security 13.3.5: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.4..13.3.5 ---------------------------------------------------- 1446cc3 Fix a minor documentation typo. Diffstat (except docs and test files) ------------------------------------- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

openstack-ansible-security 13.3.3
by no-reply＠openstack.org 26 May '17

26 May '17

We exuberantly announce the release of: openstack-ansible-security 13.3.3: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.0..13.3.3 ---------------------------------------------------- 373a03e Fix duplicated config options in auditd.conf Diffstat (except docs and test files) ------------------------------------- tasks/auditd.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

openstack-ansible-security 14.2.2 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We are jazzed to announce the release of: openstack-ansible-security 14.2.2: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.1.1..14.2.2 ---------------------------------------------------- 5f49ce1 Add missing STIG ID tags e7185d2 Install python2-pyOpenSSL package on CentOS dd52e48 Prepare vagrant centos/7 box for role testing 2a2b1e6 Fix auditd restart handler d97e7b8 Add conf file entry for chrony Diffstat (except docs and test files) ------------------------------------- Vagrantfile | 9 +++++++++ bindep.txt | 2 +- handlers/main.yml | 11 +++++++---- tasks/misc.yml | 10 +++++++++- vars/redhat.yml | 1 + vars/ubuntu.yml | 1 + 8 files changed, 38 insertions(+), 6 deletions(-)

1 0

openstack-ansible-security 13.3.11
by no-reply＠openstack.org 26 May '17

26 May '17

We are satisfied to announce the release of: openstack-ansible-security 13.3.11: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.5..13.3.11 ----------------------------------------------------- d57be75 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

openstack-ansible-security 13.2.0
by no-reply＠openstack.org 26 May '17

26 May '17

We enthusiastically announce the release of: openstack-ansible-security 13.2.0: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0