Add task to remove unused repos and pkgs

roles/ansible-os-hardening/tasks/main.yml

@@ -10,4 +10,6 @@
 - include: securetty.yml
 - include: suid_sgid.yml
 - include: sysctl.yml
+
 - include: yum.yml
+  when: ansible_os_family == 'RedHat' or ansible_os_family == 'Oracle Linux'

roles/ansible-os-hardening/tasks/yum.yml

@@ -1,8 +1,24 @@
 ---
 - name: activate gpg-check for yum-repos in yum.conf
   shell: "sed -i 's/gpgcheck=0/gpgcheck=1/g' /etc/yum.conf"
-  when: ansible_os_family == 'RedHat' or ansible_os_family == 'Oracle Linux'
 
 - name: activate gpg-check for yum-repos in yum-repositories
   shell: "sed -i 's/gpgcheck=0/gpgcheck=1/g' /etc/yum.repos.d/*.repo"
-  when: ansible_os_family == 'RedHat' or ansible_os_family == 'Oracle Linux'
+
+- name: remove unused repositories
+  file: name='/etc/yum.repos.d/{{item}}.repo' state=absent
+  with_items:
+    - 'CentOS-Debuginfo'
+    - 'CentOS-Media'
+    - 'CentOS-Vault'
+  when: os_security_packages_clean
+
+- name: remove packages
+  yum: name='{{item}}' state=removed
+  with_items:
+    - xinetd
+    - inetd
+    - ypserv
+    - telnet-server
+    - rsh-server
+  when: os_security_packages_clean