Add ignore-vars. Change nologin-shell dep. on OS

roles/ansible-os-hardening/tasks/user_accounts.yml

@@ -1,11 +1,11 @@
 ---
 
 - name: get UID_MIN from login.defs
-  shell: perl -ne 'print $1 if /^\s*UID_MIN\s+(\d+)(\s*#.*)?$/' /etc/login.defs removes=/etc/login.defs
+  shell: awk '/^\s*UID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs removes=/etc/login.defs
   register: uid_min
   changed_when: False
 
-- name: calculate UID_MAX from UID_MIN
+- name: calculate UID_MAX from UID_MIN by substracting 1
   set_fact: uid_max='{{ uid_min.stdout | int - 1 }}'
   when: uid_min is defined
 
@@ -22,9 +22,11 @@
   changed_when: False
   register: sys_accs
 
-- debug: var="{{sys_accs.stdout_lines}}"
+- name: remove always ignored system accounts from list 
+  set_fact:
+    sys_accs_cond: '{{sys_accs.stdout_lines | difference(os_always_ignore_users) }}'
 
-- name: change system accounts
-  user: name='{{ item }}' shell='/sbin/nologin' password='*'
+- name: change system accounts not on the user provided ignore-list
+  user: name='{{ item }}' shell='{{os_nologin_shell_path}}' password='*'
   with_items:
-    - '{{sys_accs.stdout_lines}}'
+    - '{{sys_accs_cond | difference(os_ignore_users) }}'

roles/ansible-os-hardening/vars/Debian.yml

@@ -3,3 +3,4 @@ os_packages_pam_passwdqc: 'libpam-passwdqc'
 os_packages_pam_cracklib: 'libpam-cracklib'
 passwdqc_path: '/usr/share/pam-configs/passwdqc'
 tally2_path: '/usr/share/pam-configs/tally2'
+os_nologin_shell_path: '/usr/sbin/nologin/'

roles/ansible-os-hardening/vars/Oracle Linux.yml

@@ -1,4 +1,4 @@
 os_packages_pam_ccreds:  'pam_ccreds'
 os_packages_pam_passwdqc:  'pam_passwdqc'
 os_packages_pam_cracklib:  'pam_cracklib'
-
+os_nologin_shell_path: '/sbin/nologin/'

roles/ansible-os-hardening/vars/RedHat.yml

@@ -1,4 +1,4 @@
 os_packages_pam_ccreds:  'pam_ccreds'
 os_packages_pam_passwdqc:  'pam_passwdqc'
 os_packages_pam_cracklib:  'pam_cracklib'
-
+os_nologin_shell_path: '/sbin/nologin/'

roles/ansible-os-hardening/vars/main.yml

@@ -23,6 +23,8 @@ os_auth_gid_min: 1000
 os_chfn_restrict: ''
 # may contain: change_user
 os_security_users_allow: []
+# specify system accounts those login should not be disabled and password not changed
+os_ignore_users: ['vagrant']
 os_security_kernel_enable_module_loading: true
 os_security_kernel_enable_sysrq: false
 os_security_kernel_enable_core_dump: false
@@ -126,5 +128,6 @@ os_security_suid_sgid_system_whitelist:  [
   '/usr/lib/libvte-2.90-9/gnome-pty-helper'                     # gnome
 ]
 
-# set default cpu vendor
-os_security_cpu_vendor: 'intel'
+# system accounts that do not get their login disabled and pasword changed
+os_always_ignore_users: ['root','sync','shutdown','halt']
+