Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
C
configuration
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
OpenEdx
configuration
Commits
149fff01
Commit
149fff01
authored
Sep 24, 2014
by
Carson Gee
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Add play for fixing and checking bash vulnerability
Change var name and use defaults
parent
c09f9b94
Hide whitespace changes
Inline
Side-by-side
Showing
4 changed files
with
21 additions
and
0 deletions
+21
-0
playbooks/roles/common/defaults/main.yml
+1
-0
playbooks/roles/common/tasks/main.yml
+5
-0
playbooks/roles/common/tasks/security-ubuntu.yml
+8
-0
playbooks/security.yml
+7
-0
No files found.
playbooks/roles/common/defaults/main.yml
View file @
149fff01
...
...
@@ -43,6 +43,7 @@ COMMON_CUSTOM_DHCLIENT_CONFIG: false
COMMON_MOTD_TEMPLATE
:
"
motd.tail.j2"
COMMON_SSH_PASSWORD_AUTH
:
"
no"
COMMON_SECURITY_UPDATES
:
no
# These are three maintenance accounts across all databases
# the read only user is is granted select privs on all dbs
# the admin user is granted create user privs on all dbs
...
...
playbooks/roles/common/tasks/main.yml
View file @
149fff01
---
-
include
:
security-ubuntu.yml
when
:
-
COMMON_SECURITY_UPDATES|bool
-
ansible_distribution == 'Ubuntu'
-
name
:
Add user www-data
# This is the default user for nginx
user
:
>
...
...
playbooks/roles/common/tasks/security-ubuntu.yml
0 → 100644
View file @
149fff01
-
name
:
Apply bash security update
apt
:
name=bash state=latest update_cache=true
-
name
:
Check and fail if we are still vulnerable
shell
:
excutable=bash env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
register
:
test_vuln
failed_when
:
"
'vulnerable'
in
test_vuln.stdout"
playbooks/security.yml
0 → 100644
View file @
149fff01
-
name
:
Apply Upgrade for bash vulnerability in Ubuntu
hosts
:
all
sudo
:
yes
vars
:
COMMON_SECURITY_UPDATES
:
yes
roles
:
-
common
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment