Skip to content

Commit 81b2deb

Browse files
georgenalengeorgenalen
authored
Merge pull request #402 from ansible-lockdown/devel
* Issue #397 updated thanks to danbarr * Issue #398 updated thanks to danbarr * STIG Benchmark version 3 release 6 updates * added UID facts * added tags to uid facts * added auditd handlers * auditd now template * added collections requirements * Issue #400 updated thanks to danbarr * added missing deps * tidyup layout * updated workflows * updates to pipelines * added tag to audit * updated tags * updated README layout and added join us * updated Discord reference in README * updated pipeline info in README Signed-off-by: George Nalen <[email protected]>
2 parents 6bd9fc5 + 592f6ec commit 81b2deb

25 files changed

+1377
-451
lines changed

‎.github/workflows/OS.tfvars‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#Ami centos 7.11
2+
ami_id = "ami-00e87074e52e6c9f9"
3+
ami_os = "centos7"
4+
ami_username = "centos"
5+
ami_user_home = "/home/centos"
6+
instance_tags = {
7+
Name = "RHEL7-STIG"
8+
Environment = "lockdown_github_repo_workflow"
9+
}

‎.github/workflows/communitytodevel.yml‎

Lines changed: 0 additions & 38 deletions
This file was deleted.

‎.github/workflows/develtomain.yml‎

Lines changed: 0 additions & 38 deletions
This file was deleted.

‎.github/workflows/github_networks.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
resource "aws_vpc" "Main" {
2+
cidr_block = var.main_vpc_cidr
3+
tags = var.instance_tags
4+
}
5+
6+
resource "aws_internet_gateway" "IGW" {
7+
vpc_id = aws_vpc.Main.id
8+
tags = {
9+
Name = "${var.namespace}-IGW"
10+
}
11+
}

‎.github/workflows/github_vars.tfvars‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
// github_actions variables
2+
// Resourced in github_networks.tf
3+
// Declared in variables.tf
4+
//
5+
6+
namespace = "github_actions"
7+
8+
// Matching pair name found in AWS for keypairs PEM key
9+
ami_key_pair_name = "github_actions"
10+
main_vpc_cidr = "172.22.0.0/24"
11+
public_subnets = "172.22.0.128/26"
12+
private_subnets = "172.22.0.192/26"

‎.github/workflows/linux_benchmark_testing.yml‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
# This is a basic workflow to help you get started with Actions
2+
3+
name: linux_benchmark_pipeline
4+
5+
# Controls when the action will run.
6+
# Triggers the workflow on push or pull request
7+
# events but only for the devel branch
8+
on:
9+
pull_request_target:
10+
types: [opened, reopened, synchronize]
11+
branches:
12+
- devel
13+
- main
14+
paths:
15+
- '**.yml'
16+
- '**.sh'
17+
- '**.j2'
18+
- '**.ps1'
19+
- '**.cfg'
20+
21+
# A workflow run is made up of one or more jobs
22+
# that can run sequentially or in parallel
23+
jobs:
24+
# This will create messages for first time contributers and direct them to the Discord server
25+
welcome:
26+
runs-on: ubuntu-latest
27+
28+
steps:
29+
- uses: actions/[email protected]
30+
with:
31+
repo-token: ${{ secrets.GITHUB_TOKEN }}
32+
pr-message: |-
33+
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
34+
Please join in the conversation happening on the [Discord Server](https://discord.gg/JFxpSgPFEJ) as well.
35+
# This workflow contains a single job called "build"
36+
build:
37+
# The type of runner that the job will run on
38+
runs-on: ubuntu-latest
39+
40+
env:
41+
ENABLE_DEBUG: false
42+
43+
# Steps represent a sequence of tasks that will be executed as part of the job
44+
steps:
45+
# Checks-out your repository under $GITHUB_WORKSPACE,
46+
# so your job can access it
47+
- uses: actions/checkout@v2
48+
with:
49+
ref: ${{ github.event.pull_request.head.sha }}
50+
51+
- name: Add_ssh_key
52+
working-directory: .github/workflows
53+
env:
54+
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
55+
PRIVATE_KEY: "${{ secrets.SSH_PRV_KEY }}"
56+
run: |
57+
mkdir .ssh
58+
chmod 700 .ssh
59+
echo $PRIVATE_KEY > .ssh/github_actions.pem
60+
chmod 600 .ssh/github_actions.pem
61+
62+
### Build out the server
63+
- name: Terraform_Init
64+
working-directory: .github/workflows
65+
run: terraform init
66+
67+
- name: Terraform_Validate
68+
working-directory: .github/workflows
69+
run: terraform validate
70+
71+
- name: Terraform_Apply
72+
working-directory: .github/workflows
73+
env:
74+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
75+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
76+
run: terraform apply -var-file "OS.tfvars" -var-file "github_vars.tfvars" --auto-approve -input=false
77+
78+
## Debug Section
79+
- name: DEBUG - Show Ansible hostfile
80+
if: env.ENABLE_DEBUG == 'true'
81+
working-directory: .github/workflows
82+
run: cat hosts.yml
83+
84+
# Centos 7 images take a while to come up insert sleep or playbook fails
85+
86+
- name: Check if test os is rhel7
87+
working-directory: .github/workflows
88+
id: test_os
89+
run: >-
90+
echo "::set-output name=RHEL7::$(
91+
grep -c RHEL7 OS.tfvars
92+
)"
93+
94+
- name: if RHEL7 - Sleep for 60 seconds
95+
if: steps.test_os.outputs.RHEL7 >= 1
96+
run: sleep 60s
97+
shell: bash
98+
99+
# Run the ansible playbook
100+
- name: Run_Ansible_Playbook
101+
uses: arillso/action.playbook@master
102+
with:
103+
playbook: site.yml
104+
inventory: .github/workflows/hosts.yml
105+
galaxy_file: collections/requirements.yml
106+
private_key: ${{ secrets.SSH_PRV_KEY }}
107+
# verbose: 3
108+
env:
109+
ANSIBLE_HOST_KEY_CHECKING: "false"
110+
ANSIBLE_DEPRECATION_WARNINGS: "false"
111+
112+
# Remove test system - User secrets to keep if necessary
113+
114+
- name: Terraform_Destroy
115+
working-directory: .github/workflows
116+
if: always() && env.ENABLE_DEBUG == 'false'
117+
env:
118+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
119+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
120+
run: terraform destroy -var-file "OS.tfvars" -var-file "github_vars.tfvars" --auto-approve -input=false

‎.github/workflows/main.tf‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
provider "aws" {
2+
profile = ""
3+
region = var.aws_region
4+
}
5+
6+
// Create a security group with access to port 22 and port 80 open to serve HTTP traffic
7+
8+
data "aws_vpc" "default" {
9+
default = true
10+
}
11+
12+
resource "random_id" "server" {
13+
keepers = {
14+
# Generate a new id each time we switch to a new AMI id
15+
ami_id = "${var.ami_id}"
16+
}
17+
18+
byte_length = 8
19+
}
20+
21+
resource "aws_security_group" "github_actions" {
22+
name = "${var.namespace}-${random_id.server.hex}"
23+
vpc_id = data.aws_vpc.default.id
24+
25+
ingress {
26+
from_port = 22
27+
to_port = 22
28+
protocol = "tcp"
29+
cidr_blocks = ["0.0.0.0/0"]
30+
}
31+
32+
ingress {
33+
from_port = 80
34+
to_port = 80
35+
protocol = "tcp"
36+
cidr_blocks = ["0.0.0.0/0"]
37+
}
38+
39+
egress {
40+
from_port = 0
41+
to_port = 0
42+
protocol = "-1"
43+
cidr_blocks = ["0.0.0.0/0"]
44+
}
45+
tags = {
46+
Name = "${var.namespace}-SG"
47+
}
48+
}
49+
50+
// instance setup
51+
52+
resource "aws_instance" "testing_vm" {
53+
ami = var.ami_id
54+
associate_public_ip_address = true
55+
key_name = var.ami_key_pair_name # This is the key as known in the ec2 key_pairs
56+
instance_type = var.instance_type
57+
tags = var.instance_tags
58+
vpc_security_group_ids = [aws_security_group.github_actions.id]
59+
root_block_device {
60+
delete_on_termination = true
61+
}
62+
}
63+
64+
// generate inventory file
65+
resource "local_file" "inventory" {
66+
filename = "./hosts.yml"
67+
directory_permission = "0755"
68+
file_permission = "0644"
69+
content = <<EOF
70+
# benchmark host
71+
all:
72+
hosts:
73+
${var.ami_os}:
74+
ansible_host: ${aws_instance.testing_vm.public_ip}
75+
ansible_user: ${var.ami_username}
76+
vars:
77+
setup_audit: true
78+
run_audit: true
79+
system_is_ec2: true
80+
audit_git_version: devel
81+
EOF
82+
}
83+

‎.github/workflows/terraform.tfvars‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
// vars should be loaded by OSname.tfvars
2+
aws_region = "us-east-1"
3+
ami_os = var.ami_os
4+
ami_username = var.ami_username
5+
instance_tags = var.instance_tags

‎.github/workflows/test.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
RHEL7=$(grep -c RHEL7 OS.tfvars)
2+
if [ `echo $?` != 0 ]; then
3+
exit 0
4+
fi
5+
6+

‎.github/workflows/variables.tf‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
// Taken from the OSname.tfvars
2+
3+
variable "aws_region" {
4+
description = "AWS region"
5+
default = "us-east-1"
6+
type = string
7+
}
8+
9+
variable "instance_type" {
10+
description = "EC2 Instance Type"
11+
default = "t3.micro"
12+
type = string
13+
}
14+
15+
variable "instance_tags" {
16+
description = "Tags to set for instances"
17+
type = map(string)
18+
}
19+
20+
variable "ami_key_pair_name" {
21+
description = "Name of key pair in AWS thats used"
22+
type = string
23+
}
24+
25+
variable "ami_os" {
26+
description = "AMI OS Type"
27+
type = string
28+
}
29+
30+
variable "ami_id" {
31+
description = "AMI ID reference"
32+
type = string
33+
}
34+
35+
variable "ami_username" {
36+
description = "Username for the ami id"
37+
type = string
38+
}
39+
40+
variable "ami_user_home" {
41+
description = "home dir for the username"
42+
type = string
43+
}
44+
45+
variable "namespace" {
46+
description = "Name used across all tags"
47+
type = string
48+
}
49+
50+
// taken from github_vars.tfvars &
51+
52+
variable "main_vpc_cidr" {
53+
description = "Private cidr block to be used for vpc"
54+
type = string
55+
}
56+
57+
variable "public_subnets" {
58+
description = "public subnet cidr block"
59+
type = string
60+
}
61+
62+
variable "private_subnets" {
63+
description = "private subnet cidr block"
64+
type = string
65+
}

0 commit comments

Comments
 (0)