Consider replacing our security role with dev-sec

[dguido]

https://github.com/dev-sec/ansible-ssh-hardening
https://github.com/dev-sec/ansible-os-hardening

I need to look through these Ansible roles and see if they are a suitable replacement. I have not looked at them closely yet. It would be nice if someone else maintains this feature for us.

[dguido]

This might be an interesting way to rewrite some of our security rules:
https://chrisshort.net/lineinfile-be-damned/

[conorsch]

The dev-sec roles are great, I highly recommend giving them a shot.

How do you plan to incorporate them in this repo—via git submodule? In general I find it difficult to strike a balance between distributing Ansible code as projects (like this one) versus modular roles.

[dguido]

Not sure yet! We're pretty against having submodules due to the difficulty of working with them, and since we have to support normal users in a variety of ways. We're open to ideas and would appreciate references to other projects where you've seen it done well. We're not planning to start working on this until a release or two has gone by. We're planning to conduct a review of all of our optional roles during the 1.2 release cycle.

[dguido]

I think we should come back to this issue earlier than we planned. It would make the project simpler and more maintainable if we eliminate any coupling between our "security" role and the other roles we run.

[conorsch]

@dguido Consider breaking out the core algo functionality into a single discrete role, that would be included into this project. Then you can have a simple reusable role that's appropriate for inclusion by admins already running Ansible with existing site projects—I'm one such—and still provide a batteries-included setup for folks unfamiliar with managing Ansible projects, that will include all system hardening you require.

For comparison, see these two roles:

• https://github.com/Stouts/Stouts.openvpn # core OpenVPN config
• https://github.com/robbintt/popup-openvpn # wrappers to include cloud host spin-up

The approach with two repos seems the best of both worlds. As for managing the external roles, I personally have stopped using Ansible Galaxy in favor of git submodules, but consider sticking with Galaxy for its scriptability and comparative ease of use.

[dguido]

Neat, thanks for the tip! This sounds like a good idea and we'll take a closer look at this approach.