9662e8b4ab
* Feature (rhel7/httpd 2.4) : hardening apache and code refactoring * remove hard returns * Add default Listen 80 in httpd.conf In case there no vhosts defined in pillar httpd will listen on port 80. Without this default it will not start * empty file autoindex.conf instead of deleting it * explicit hardening items and references from CIS * add #3.5 hardening rule * explain CIS recommendations categories * add dependencies before start service * add recommendation #7.1 Install mod_ssl * link in readme to hardening doc
87 lines
2.4 KiB
Plaintext
87 lines
2.4 KiB
Plaintext
{%- import_yaml "apache/hardening-values.yaml" as hardening_values %}
|
|
|
|
{% if grains['os_family']=="Debian" %}
|
|
|
|
include:
|
|
- apache
|
|
|
|
{% for module in salt['pillar.get']('apache:modules:enabled', []) %}
|
|
a2enmod {{ module }}:
|
|
cmd.run:
|
|
- unless: ls /etc/apache2/mods-enabled/{{ module }}.load
|
|
- order: 225
|
|
- require:
|
|
- pkg: apache
|
|
- watch_in:
|
|
- module: apache-restart
|
|
{% endfor %}
|
|
|
|
{% for module in salt['pillar.get']('apache:modules:disabled', []) %}
|
|
a2dismod -f {{ module }}:
|
|
cmd.run:
|
|
- onlyif: ls /etc/apache2/mods-enabled/{{ module }}.load
|
|
- order: 225
|
|
- require:
|
|
- pkg: apache
|
|
- watch_in:
|
|
- module: apache-restart
|
|
{% endfor %}
|
|
|
|
{% elif grains['os_family']=="RedHat" %}
|
|
|
|
include:
|
|
- apache
|
|
|
|
{% for module in salt['pillar.get']('apache:modules:enabled', default=hardening_values.modules.enforce_enabled, merge=True) if module not in hardening_values.modules.enforce_disabled %}
|
|
find /etc/httpd/ -name '*.conf' -type f -exec sed -i -e 's/\(^#\)\(\s*LoadModule.{{ module }}_module\)/\2/g' {} \;:
|
|
cmd.run:
|
|
- unless: httpd -M 2> /dev/null | grep "[[:space:]]{{ module }}_module"
|
|
- order: 225
|
|
- require:
|
|
- pkg: apache
|
|
- watch_in:
|
|
- module: apache-restart
|
|
{% endfor %}
|
|
|
|
{% for module in salt['pillar.get']('apache:modules:disabled', default=hardening_values.modules.enforce_disabled, merge=True) if module not in hardening_values.modules.enforce_enabled %}
|
|
find /etc/httpd/ -name '*.conf' -type f -exec sed -i -e 's/\(^\s*LoadModule.{{ module }}_module\)/#\1/g' {} \;:
|
|
cmd.run:
|
|
- onlyif: httpd -M 2> /dev/null | grep "[[:space:]]{{ module }}_module"
|
|
- order: 225
|
|
- require:
|
|
- pkg: apache
|
|
- watch_in:
|
|
- module: apache-restart
|
|
{% endfor %}
|
|
|
|
|
|
|
|
{% elif salt['grains.get']('os_family') == 'Suse' or salt['grains.get']('os') == 'SUSE' %}
|
|
|
|
include:
|
|
- apache
|
|
|
|
{% for module in salt['pillar.get']('apache:modules:enabled', []) %}
|
|
a2enmod {{ module }}:
|
|
cmd.run:
|
|
- unless: egrep "^APACHE_MODULES=" /etc/sysconfig/apache2 | grep {{ module }}
|
|
- order: 225
|
|
- require:
|
|
- pkg: apache
|
|
- watch_in:
|
|
- module: apache-restart
|
|
{% endfor %}
|
|
|
|
{% for module in salt['pillar.get']('apache:modules:disabled', []) %}
|
|
a2dismod -f {{ module }}:
|
|
cmd.run:
|
|
- onlyif: egrep "^APACHE_MODULES=" /etc/sysconfig/apache2 | grep {{ module }}
|
|
- order: 225
|
|
- require:
|
|
- pkg: apache
|
|
- watch_in:
|
|
- module: apache-restart
|
|
{% endfor %}
|
|
|
|
{% endif %}
|