search

dev-sec / ansible-collection-hardening

This Ansible collection provides battle tested hardening for Linux, SSH, nginx, MySQL
http://dev-sec.io/
Apache License 2.0
4.04k stars 731 forks source link

Documentation should be updated #361

Closed joubbi closed 3 years ago

joubbi commented 3 years ago

Is your feature request related to a problem? Please describe. I found this project by googling. It's the second google hit after https://github.com/openstack/ansible-hardening. I've used ansible-hardening before. It works and their documentation is great. Unfortunately the project seems to be sleeping.

When I found this project, the first thing I tried to understand is to figure out what it does and if it is still relevant.

I want to harden my systems so that they are at least CIS level 1 compliant. I have figured out that this project doesn't try to follow any one standard for hardening, which is perfectly fine. But...

At the bottom of the os_hardening github page there are links to guides that the project is based on. One of the links: "NSA: Guide to the Secure Configuration of Red Hat Enterprise Linux 5" gives a 404. The README for os_hardening doesn't state which Linux distros are supported. The README for the collection states CentOS7/8. It looks outdated with a guide to RHEL5.

I found the page https://dev-sec.io/project/ by googling. It also links to a RHEL5 guide. I have not found a link to dev-sec.io from GitHub, but there is a link from dev-sec.io to GitHub.

Describe the solution you'd like I would like the dev-sec.io page and the READMEs to be updated with the current state and goals of the project. I would like the documentation to state if the project follows CIS benchmark. If it doesn't follow CIS recommendations, then why not? I would like the variables and other lists to be alphabetically sorted in the documentation and configuration files so that they can be easily found.

Additional context I am happy that this project exists and is free. I have saved a lot of time by using it instead of creating my own hardening from nothing.

rndmh3ro commented 3 years ago

Thanks for this issue, @joubbi. Good to get a thorough examination of this collection. It was developed over several years and there are surely mistakes and errors.

One of the links: "NSA: Guide to the Secure Configuration of Red Hat Enterprise Linux 5" gives a 404.

This should be fixed.

The README for os_hardening doesn't state which Linux distros are supported. The README for the collection states CentOS7/8.

It is stated in the collection-readme and in the meta-file of the role. I don't want to document the supported distros on even more places, because we have to manually update these.

It looks outdated with a guide to RHEL5.

Can you tell me which part exactly is outdated? A general statement like this is unhelpful.

I have not found a link to dev-sec.io from GitHub, but there is a link from dev-sec.io to GitHub.

See here: Unbenannt

I would like the dev-sec.io page and the READMEs to be updated with the current state and goals of the project.

What in the description in the README is not clear to you about the state and goals? https://github.com/dev-sec/ansible-collection-hardening#description

I would like the documentation to state if the project follows CIS benchmark. If it doesn't follow CIS recommendations, then why not? As you found out yourself, it doesn't follow it. Why? Because nobody validated the collection against the CIS recommendations and documented it. See this issue for details: https://github.com/dev-sec/ansible-collection-hardening/issues/76 Basically we can update the linux-baseline to follow CIS rec. or use the cis-baseline

I would like the variables and other lists to be alphabetically sorted in the documentation and configuration files so that they can be easily found.

I see you already created a PR for this. I'll take a look. Personally I just grep for the relevant variables instead of searching for them, but an alphabetical order is appreciated nonetheless.

joubbi commented 3 years ago

Thanks for this issue, @joubbi. Good to get a thorough examination of this collection. It was developed over several years and there are surely mistakes and errors.

One of the links: "NSA: Guide to the Secure Configuration of Red Hat Enterprise Linux 5" gives a 404.

This should be fixed.

The README for os_hardening doesn't state which Linux distros are supported. The README for the collection states CentOS7/8.

It is stated in the collection-readme and in the meta-file of the role. I don't want to document the supported distros on even more places, because we have to manually update these.

It looks outdated with a guide to RHEL5.

Can you tell me which part exactly is outdated? A general statement like this is unhelpful.

What I got confused about is that one place says that CentOS7/8 is supported but you use a hardening guide for RHEL 5. Do you support RHEL5 as well? (I guess not).

What I think is outdated is a link to a hardening guide for Red Hat Enterprise Linux 5, which was end of life almost eight years ago. Maybe you should use a hardening guide for RHEL 8 instead?

I have not found a link to dev-sec.io from GitHub, but there is a link from dev-sec.io to GitHub.

See here: Unbenannt

My bad. I was only reading the README.

I would like the dev-sec.io page and the READMEs to be updated with the current state and goals of the project.

What in the description in the README is not clear to you about the state and goals? https://github.com/dev-sec/ansible-collection-hardening#description

Landing on the GitHub page without knowing anything about the project, at least what I wanted to know since it's a security related project was: How does this compare with hardening standards and recommendations that I am familiar with CIS, NIST, PCI-DSS..? Who is behind this project? Is it someone I can trust? Now as I have read all the different READMEs and pages, I understand that it doesn't follow one standard since no page mentions this. I think it would have helped if some page explicitly explained that you are not following one standard and that you don't intend to, if this is how you see it. I don't have a problem with you not following a standard. I think this is a good thing.

I would like the documentation to state if the project follows CIS benchmark. If it doesn't follow CIS recommendations, then why not? As you found out yourself, it doesn't follow it. Why? Because nobody validated the collection against the CIS recommendations and documented it. See this issue for details: #76 Basically we can update the linux-baseline to follow CIS rec. or use the cis-baseline

Thank you for mentioning #76. This discussion was exactly what I was after: https://github.com/dev-sec/linux-baseline/issues/110 Take the reply from @chris-rock in that issue and document it in the README and my issue is solved.

I would like the variables and other lists to be alphabetically sorted in the documentation and configuration files so that they can be easily found.

I see you already created a PR for this. I'll take a look. Personally I just grep for the relevant variables instead of searching for them, but an alphabetical order is appreciated nonetheless.

grepis great if you know what you are looking for. Running the role for the first time you have to read through the whole list in order to know which variables are available. I have missed that variables exist since I assumed things and didn't scroll down the whole page. But maybe most people are smarter than me and reads more carefully without assuming ;-)

rndmh3ro commented 3 years ago

Hey @joubbi,

is there anything here you still want to change?

rndmh3ro commented 3 years ago

Feel free to reopen, if more is needed.