add hardening of root user account(s) (#579)

roles/os_hardening/defaults/main.yml

@@ -15,13 +15,21 @@ os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]
 
 os_chfn_restrict: ''
 
-# Set to false to disable chmod /home folders to 700
+# Set to false to disable chmod userhome folders to 700
+os_chmod_rootuser_home_folder: true
 os_chmod_home_folders: true
 
 # May contain: change_user
 os_security_users_allow: []
 # Specify user home folders in /home that shouldn't be chmodded to 700
 os_ignore_home_folder_users: ['lost+found']
+
+# Set to false to disable password age enforcement on existing users
+os_rootuser_pw_ageing: false
+
+# When enabled and there are multiple users with UID=0, only "root" will be kept. Others will be deleted.
+os_remove_additional_root_users: false
+
 # Specify system accounts whose login should not be disabled and password not changed
 os_ignore_users: ['vagrant', 'kitchen']
 os_security_kernel_enable_module_loading: true
@@ -338,7 +346,7 @@ os_ctrlaltdel_disabled: false
 # Set to false to disable installing and configuring limits.
 os_limits_enabled: true
 
-# Set to false to disable installing and configuring login_defs.
+# Set to false to disable installing and configuring login_defs for newly created users.
 os_login_defs_enabled: true
 
 # Set to false to disable installing and configuring minimize_access.