diff --git a/roles/mysql_hardening/templates/hardening.cnf.j2 b/roles/mysql_hardening/templates/hardening.cnf.j2 index 727cbb5a..01664499 100644 --- a/roles/mysql_hardening/templates/hardening.cnf.j2 +++ b/roles/mysql_hardening/templates/hardening.cnf.j2 @@ -1,3 +1,6 @@ +{{ ansible_managed | comment }} +# Generated by Ansible role {{ ansible_role_name }} + [mysqld] {% if mysql_hardening_skip_show_database -%} skip-show-database diff --git a/roles/mysql_hardening/templates/my.cnf.j2 b/roles/mysql_hardening/templates/my.cnf.j2 index ce66b13e..3b10d8ae 100644 --- a/roles/mysql_hardening/templates/my.cnf.j2 +++ b/roles/mysql_hardening/templates/my.cnf.j2 @@ -1,3 +1,6 @@ +{{ ansible_managed | comment }} +# Generated by Ansible role {{ ansible_role_name }} + [client] user=root password='{{ mysql_root_password | mandatory }}' diff --git a/roles/nginx_hardening/templates/hardening.conf.j2 b/roles/nginx_hardening/templates/hardening.conf.j2 index 7710f595..838bc374 100644 --- a/roles/nginx_hardening/templates/hardening.conf.j2 +++ b/roles/nginx_hardening/templates/hardening.conf.j2 @@ -1,5 +1,5 @@ # {{ ansible_managed|comment }} -# Generated by Ansible {{ ansible_role_name }} +# Generated by Ansible role {{ ansible_role_name }} # Additional configuration for Nginx. client_header_buffer_size {{ nginx_client_header_buffer_size }}; diff --git a/roles/os_hardening/templates/etc/audit/auditd.conf.j2 b/roles/os_hardening/templates/etc/audit/auditd.conf.j2 index 21b37c1f..51ed6776 100644 --- a/roles/os_hardening/templates/etc/audit/auditd.conf.j2 +++ b/roles/os_hardening/templates/etc/audit/auditd.conf.j2 @@ -1,5 +1,5 @@ {{ ansible_managed | comment }} -# Generated by Ansible {{ ansible_role_name }} +# Generated by Ansible role {{ ansible_role_name }} log_file = /var/log/audit/audit.log log_format = RAW diff --git a/roles/os_hardening/templates/etc/default/ufw.j2 b/roles/os_hardening/templates/etc/default/ufw.j2 index d668e620..3b70135f 100644 --- a/roles/os_hardening/templates/etc/default/ufw.j2 +++ b/roles/os_hardening/templates/etc/default/ufw.j2 @@ -1,5 +1,5 @@ {{ ansible_managed | comment }} -# Generated by Ansible {{ ansible_role_name }} +# Generated by Ansible role {{ ansible_role_name }} # /etc/default/ufw # diff --git a/roles/os_hardening/templates/etc/initramfs-tools/modules.j2 b/roles/os_hardening/templates/etc/initramfs-tools/modules.j2 index 52b7a332..765ce2b4 100644 --- a/roles/os_hardening/templates/etc/initramfs-tools/modules.j2 +++ b/roles/os_hardening/templates/etc/initramfs-tools/modules.j2 @@ -1,5 +1,5 @@ {{ ansible_managed | comment }} -# Generated by Ansible {{ ansible_role_name }} +# Generated by Ansible role {{ ansible_role_name }} # This file contains the names of kernel modules that should be loaded at boot time, one per line. Lines beginning with "#" are ignored. # diff --git a/roles/os_hardening/templates/etc/libuser.conf.j2 b/roles/os_hardening/templates/etc/libuser.conf.j2 index 58564e91..b739463e 100644 --- a/roles/os_hardening/templates/etc/libuser.conf.j2 +++ b/roles/os_hardening/templates/etc/libuser.conf.j2 @@ -1,5 +1,5 @@ {{ ansible_managed | comment }} -# Generated by Ansible {{ ansible_role_name }} +# Generated by Ansible role {{ ansible_role_name }} # See libuser.conf(5) for more information. diff --git a/roles/os_hardening/templates/etc/login.defs.j2 b/roles/os_hardening/templates/etc/login.defs.j2 index e210d162..5c850439 100644 --- a/roles/os_hardening/templates/etc/login.defs.j2 +++ b/roles/os_hardening/templates/etc/login.defs.j2 @@ -1,5 +1,5 @@ {{ ansible_managed | comment }} -# Generated by Ansible {{ ansible_role_name }} +# Generated by Ansible role {{ ansible_role_name }} # Configuration control definitions for the login package. # diff --git a/roles/os_hardening/templates/etc/modprobe.d/modprobe.j2 b/roles/os_hardening/templates/etc/modprobe.d/modprobe.j2 index c2626d3d..dd3ea090 100644 --- a/roles/os_hardening/templates/etc/modprobe.d/modprobe.j2 +++ b/roles/os_hardening/templates/etc/modprobe.d/modprobe.j2 @@ -1,5 +1,5 @@ {{ ansible_managed | comment }} -# Generated by Ansible {{ ansible_role_name }} +# Generated by Ansible role {{ ansible_role_name }} {% for fs in os_unused_filesystems | difference(os_filesystem_whitelist) %} install {{fs}} /bin/true diff --git a/roles/os_hardening/templates/etc/pam.d/rhel_system_auth.j2 b/roles/os_hardening/templates/etc/pam.d/rhel_system_auth.j2 index c50af6ed..ed37dcfd 100644 --- a/roles/os_hardening/templates/etc/pam.d/rhel_system_auth.j2 +++ b/roles/os_hardening/templates/etc/pam.d/rhel_system_auth.j2 @@ -1,5 +1,5 @@ {{ ansible_managed | comment }} -# Generated by Ansible {{ ansible_role_name }} +# Generated by Ansible role {{ ansible_role_name }} #%PAM-1.0 {% if os_auth_retries > 0 %} diff --git a/roles/os_hardening/templates/etc/profile.d/profile.conf.j2 b/roles/os_hardening/templates/etc/profile.d/profile.conf.j2 index a6e2a9d4..1f97e9ad 100644 --- a/roles/os_hardening/templates/etc/profile.d/profile.conf.j2 +++ b/roles/os_hardening/templates/etc/profile.d/profile.conf.j2 @@ -1,5 +1,5 @@ {{ ansible_managed | comment }} -# Generated by Ansible {{ ansible_role_name }} +# Generated by Ansible role {{ ansible_role_name }} # Disable core dumps via soft limits for all users. Compliance to this setting is voluntary and can be modified by users up to a hard limit. This setting is a sane default. ulimit -S -c 0 > /dev/null 2>&1 diff --git a/roles/os_hardening/templates/etc/securetty.j2 b/roles/os_hardening/templates/etc/securetty.j2 index b08965a9..871083be 100644 --- a/roles/os_hardening/templates/etc/securetty.j2 +++ b/roles/os_hardening/templates/etc/securetty.j2 @@ -1,5 +1,5 @@ {{ ansible_managed | comment }} -# Generated by Ansible {{ ansible_role_name }} +# Generated by Ansible role {{ ansible_role_name }} # A list of TTYs, from which root can log in # see `man securetty` for reference diff --git a/roles/os_hardening/templates/etc/sysconfig/rhel_sysconfig_init.j2 b/roles/os_hardening/templates/etc/sysconfig/rhel_sysconfig_init.j2 index f5a8ca6a..422babde 100644 --- a/roles/os_hardening/templates/etc/sysconfig/rhel_sysconfig_init.j2 +++ b/roles/os_hardening/templates/etc/sysconfig/rhel_sysconfig_init.j2 @@ -1,5 +1,5 @@ {{ ansible_managed | comment }} -# Generated by Ansible {{ ansible_role_name }} +# Generated by Ansible role {{ ansible_role_name }} # color => new RH6.0 bootup # verbose => old-style bootup diff --git a/roles/os_hardening/templates/usr/share/pam-configs/pam_passwdqd.j2 b/roles/os_hardening/templates/usr/share/pam-configs/pam_passwdqd.j2 index 77f9ab1f..b1ca9fa8 100644 --- a/roles/os_hardening/templates/usr/share/pam-configs/pam_passwdqd.j2 +++ b/roles/os_hardening/templates/usr/share/pam-configs/pam_passwdqd.j2 @@ -1,5 +1,5 @@ {{ ansible_managed | comment }} -# Generated by Ansible {{ ansible_role_name }} +# Generated by Ansible role {{ ansible_role_name }} Name: passwdqc password strength enforcement Default: yes diff --git a/roles/os_hardening/templates/usr/share/pam-configs/pam_tally2.j2 b/roles/os_hardening/templates/usr/share/pam-configs/pam_tally2.j2 index 8023f565..2a7132a2 100644 --- a/roles/os_hardening/templates/usr/share/pam-configs/pam_tally2.j2 +++ b/roles/os_hardening/templates/usr/share/pam-configs/pam_tally2.j2 @@ -1,5 +1,5 @@ {{ ansible_managed | comment }} -# Generated by Ansible {{ ansible_role_name }} +# Generated by Ansible role {{ ansible_role_name }} Name: tally2 lockout after failed attempts enforcement Default: yes diff --git a/roles/ssh_hardening/templates/authorized_principals.j2 b/roles/ssh_hardening/templates/authorized_principals.j2 index aaaba5ee..1c28c481 100644 --- a/roles/ssh_hardening/templates/authorized_principals.j2 +++ b/roles/ssh_hardening/templates/authorized_principals.j2 @@ -1,5 +1,5 @@ {{ ansible_managed | comment }} -# Generated by Ansible {{ ansible_role_name }} +# Generated by Ansible role {{ ansible_role_name }} {% for principal in item.principals %} {{ principal }} diff --git a/roles/ssh_hardening/templates/openssh.conf.j2 b/roles/ssh_hardening/templates/openssh.conf.j2 index 13ff1a6a..afe589ee 100644 --- a/roles/ssh_hardening/templates/openssh.conf.j2 +++ b/roles/ssh_hardening/templates/openssh.conf.j2 @@ -1,6 +1,6 @@ #jinja2: trim_blocks: "true", lstrip_blocks: "true" {{ ansible_managed | comment }} -# Generated by Ansible {{ ansible_role_name }} +# Generated by Ansible role {{ ansible_role_name }} # This is the ssh client system-wide configuration file. # See ssh_config(5) for more information on any settings used. diff --git a/roles/ssh_hardening/templates/opensshd.conf.j2 b/roles/ssh_hardening/templates/opensshd.conf.j2 index 1fd5f5b4..299f5f1f 100644 --- a/roles/ssh_hardening/templates/opensshd.conf.j2 +++ b/roles/ssh_hardening/templates/opensshd.conf.j2 @@ -1,6 +1,6 @@ #jinja2: trim_blocks: "true", lstrip_blocks: "true" {{ ansible_managed | comment }} -# Generated by Ansible {{ ansible_role_name }} +# Generated by Ansible role {{ ansible_role_name }} # This is the sshd server system-wide configuration file. # See sshd_config(5) for more information. diff --git a/roles/ssh_hardening/templates/revoked_keys.j2 b/roles/ssh_hardening/templates/revoked_keys.j2 index 654b52fd..5d1b5b3f 100644 --- a/roles/ssh_hardening/templates/revoked_keys.j2 +++ b/roles/ssh_hardening/templates/revoked_keys.j2 @@ -1,5 +1,5 @@ {{ ansible_managed | comment }} -# Generated by Ansible {{ ansible_role_name }} +# Generated by Ansible role {{ ansible_role_name }} {% for key in ssh_server_revoked_keys %} {{ key }} diff --git a/roles/ssh_hardening/templates/trusted_user_ca_keys.j2 b/roles/ssh_hardening/templates/trusted_user_ca_keys.j2 index a627fb0d..dddd12ba 100644 --- a/roles/ssh_hardening/templates/trusted_user_ca_keys.j2 +++ b/roles/ssh_hardening/templates/trusted_user_ca_keys.j2 @@ -1,5 +1,5 @@ {{ ansible_managed | comment }} -# Generated by Ansible {{ ansible_role_name }} +# Generated by Ansible role {{ ansible_role_name }} {% for key in ssh_trusted_user_ca_keys %} {{ key }}