create Ansible role for operating system hardening

afeld commented 7 years ago

Breaking this conversation out from #1.

@jeremy-gillikin Before I knew you were actively working on this, @JJediny and I had been talking about having a common Ansible role we could share between the data.gov and D2D projects (to start) for hardening the operating systems. The projects use Ubuntu and RHEL 7, respectively.

We've been collecting examples of other hardedning roles in this Trello card. As you can see, there are a lot of them, so my first suggestion would be for us to evaluate what's out there, to avoid reinventing the wheel. We may, for example, be able to use an existing role (or two), and either:

Submit pull requests to add what we'd like to see, and direct projects to use the community-maintained role directly
Create a GSA-specific role that uses/wraps an existing one as one of its dependencies, and adds on whatever we want/need

One I'd like to call out in particular is https://github.com/RedHatGov/ansible-role-800-53, where they are mapping tasks to particular controls in NIST 800-53 via tags. This is interesting, in that it could allow us to come full-circle in terms of connecting automation bits back to the compliance documentation. From @jason-callaway, one of the maintainers, in the OpenControl Slack:

That role currently only supports RHEL, but I'd love to add support for other Linuxes, and Windows is theoretically possible because Ansible supports Powershell

[Proposed] acceptance criteria

I propose these as the medium/long-term goals.

[ ] A single role can be included that brings an operating system to Compliance
[ ] Continuous integration to ensure that the hardening provided by the role continues to pass Nessus (or whatever) scans
- Might be interesting to do this as a first step, as a means to evaluate existing roles
[ ] The role supports whatever server operating systems GSA supports
- [ ] RHEL 7
- [ ] Ubuntu
- [ ] Windows (this might be different enough that we would want to split it out to its own role...not sure)

Thoughts?

afeld commented 7 years ago

Maybe the title for this issue would more aptly be "have Security-blessed Ansible role(s) for operating system hardening", as we don't necessarily need to create it.

afeld commented 7 years ago

Some non-Ansible hardening examples at TTS:

https://github.com/fisma-ready/ubuntu-lts
https://github.com/18F/cg-harden-boshrelease/tree/master/src/harden - this is what cloud.gov uses

(will keep adding to this list as I find out about more)

mogul commented 7 years ago

Note that cg-harden-boshrelease is on top of hardening done at the upstream stemcell level by the Cloud Foundry community. Pivotal does their own, described here: https://docs.pivotal.io/pivotalcf/1-9/security/pcf-infrastructure/stemcell-hardening.html