Uppercased first letter of task names. (#422)

Signed-off-by: Farid Joubbi <[email protected]>

roles/mysql_hardening/handlers/main.yml

@@ -1,6 +1,6 @@
 ---
 
-- name: restart mysql
+- name: Restart mysql
   service:
     name: '{{ mysql_daemon }}'
     state: restarted

roles/mysql_hardening/tasks/configure.yml

@@ -1,5 +1,5 @@
 ---
-- name: protect my.cnf
+- name: Protect my.cnf
   file:
     path: '{{ mysql_hardening_mysql_conf_file }}'
     mode: '0640'
@@ -8,7 +8,7 @@
     follow: true
     state: file
 
-- name: ensure permissions on mysql-datadir are correct
+- name: Ensure permissions on mysql-datadir are correct
   file:
     path: '{{ mysql_datadir }}'
     state: directory
@@ -16,7 +16,7 @@
     group: '{{ mysql_hardening_user }}'
     mode: '0750'
 
-- name: ensure permissions on mysql-logfile are correct
+- name: Ensure permissions on mysql-logfile are correct
   file:
     path: '{{ mysql_hardening_log_file }}'
     state: file
@@ -24,7 +24,7 @@
     group: '{{ mysql_hardening_group }}'
     mode: '0640'
 
-- name: check mysql configuration-directory exists and has right permissions
+- name: Check mysql configuration-directory exists and has right permissions
   file:
     path: '{{ mysql_hardening_mysql_confd_dir }}'
     state: directory
@@ -32,25 +32,25 @@
     group: '{{ mysql_hardening_group }}'
     mode: '0750'
 
-- name: check include-dir directive is present in my.cnf
+- name: Check include-dir directive is present in my.cnf
   lineinfile:
     dest: '{{ mysql_hardening_mysql_conf_file }}'
     line: '!includedir {{ mysql_hardening_mysql_confd_dir }}'
     insertafter: 'EOF'
     state: present
     backup: true
-  notify: restart mysql
+  notify: Restart mysql
 
-- name: apply hardening configuration
+- name: Apply hardening configuration
   template:
     src: 'hardening.cnf.j2'
     dest: '{{ mysql_hardening_mysql_hardening_conf_file }}'
     owner: '{{ mysql_cnf_owner }}'
     group: '{{ mysql_cnf_group }}'
     mode: '0640'
-  notify: restart mysql
+  notify: Restart mysql
 
-- name: enable mysql
+- name: Enable mysql
   service:
     name: '{{ mysql_daemon }}'
     enabled: '{{ mysql_daemon_enabled }}'

roles/mysql_hardening/tasks/mysql_secure_installation.yml

@@ -1,10 +1,10 @@
 ---
-- name: fail the role if the mysql root password was not set
+- name: Fail the role if the mysql root password was not set
   fail:
     msg: 'ERROR - you have to change default mysql_root_password'
   when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'
 
-- name: root password is present
+- name: Root password is present
   mysql_user:
     name: 'root'
     host_all: true
@@ -12,21 +12,21 @@
     state: present
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
 
-- name: install .my.cnf with credentials
+- name: Install .my.cnf with credentials
   template:
     src: 'my.cnf.j2'
     dest: '{{ mysql_user_home }}/.my.cnf'
     mode: '0400'
   tags: my_cnf
 
-- name: test database is absent
+- name: Test database is absent
   mysql_db:
     name: test
     state: absent
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   when: mysql_remove_test_database
 
-- name: anonymous users are absent
+- name: Anonymous users are absent
   mysql_user:
     name: ''
     state: absent
@@ -34,7 +34,7 @@
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   when: mysql_remove_anonymous_users
 
-- name: remove remote root
+- name: Remove remote root
   community.mysql.mysql_query:
     query:
       - DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1')

roles/nginx_hardening/handlers/main.yml

@@ -1,5 +1,5 @@
 ---
-- name: restart nginx
+- name: Restart nginx
   service:
     name: "nginx"
     state: restarted

roles/nginx_hardening/tasks/main.yml

@@ -1,14 +1,14 @@
 ---
-- name: create additional configuration
+- name: Create additional configuration
   template:
     src: "hardening.conf.j2"
     dest: "/etc/nginx/conf.d/90.hardening.conf"
     mode: '0600'
     owner: "root"
     group: "root"
-  notify: restart nginx
+  notify: Restart nginx
 
-- name: change configuration in main nginx.conf
+- name: Change configuration in main nginx.conf
   lineinfile:
     dest: "/etc/nginx/nginx.conf"
     regexp: '^\s*server_tokens'
@@ -17,9 +17,9 @@
     mode: '0640'
     owner: "root"
     group: "root"
-  notify: restart nginx
+  notify: Restart nginx
 
-- name: change ssl_protocols in main nginx.conf
+- name: Change ssl_protocols in main nginx.conf
   lineinfile:
     dest: "/etc/nginx/nginx.conf"
     regexp: '^\s*ssl_protocols'
@@ -28,9 +28,9 @@
     mode: '0640'
     owner: "root"
     group: "root"
-  notify: restart nginx
+  notify: Restart nginx
 
-- name: change ssl_prefer_server_ciphers in main nginx.conf
+- name: Change ssl_prefer_server_ciphers in main nginx.conf
   lineinfile:
     dest: "/etc/nginx/nginx.conf"
     regexp: '^\s*ssl_prefer_server_ciphers'
@@ -39,9 +39,9 @@
     mode: '0640'
     owner: "root"
     group: "root"
-  notify: restart nginx
+  notify: Restart nginx
 
-- name: change client_max_body_size in main nginx.conf
+- name: Change client_max_body_size in main nginx.conf
   lineinfile:
     dest: "/etc/nginx/nginx.conf"
     regexp: '^\s*client_max_body_size'
@@ -50,9 +50,9 @@
     mode: '0640'
     owner: "root"
     group: "root"
-  notify: restart nginx
+  notify: Restart nginx
 
-- name: change client_body_buffer_size in main nginx.conf
+- name: Change client_body_buffer_size in main nginx.conf
   lineinfile:
     dest: "/etc/nginx/nginx.conf"
     regexp: '^\s*client_body_buffer_size'
@@ -61,9 +61,9 @@
     mode: '0640'
     owner: "root"
     group: "root"
-  notify: restart nginx
+  notify: Restart nginx
 
-- name: change keepalive_timeout in main nginx.conf
+- name: Change keepalive_timeout in main nginx.conf
   lineinfile:
     dest: "/etc/nginx/nginx.conf"
     regexp: '^\s*keepalive_timeout'
@@ -72,23 +72,23 @@
     mode: '0640'
     owner: "root"
     group: "root"
-  notify: restart nginx
+  notify: Restart nginx
 
-- name: remove default.conf
+- name: Remove default.conf
   file:
     path: "{{ item }}"
     state: absent
   when: nginx_remove_default_site
-  notify: restart nginx
+  notify: Restart nginx
   loop:
     - "/etc/nginx/conf.d/default.conf"
     - "/etc/nginx/sites-enabled/default"
 
-- name: generate dh group
+- name: Generate dh group
   openssl_dhparam:
     path: "/etc/nginx/dh{{ nginx_dh_size }}.pem"
     size: "{{ nginx_dh_size }}"
     mode: '0640'
     owner: "root"
     group: "root"
-  notify: restart nginx
+  notify: Restart nginx

roles/os_hardening/handlers/main.yml

@@ -1,3 +1,3 @@
 ---
-- name: update-initramfs
+- name: Update-initramfs
   command: 'update-initramfs -u'

roles/os_hardening/tasks/apt.yml

@@ -1,5 +1,5 @@
 ---
-- name: remove deprecated or insecure packages | package-01 - package-09
+- name: Remove deprecated or insecure packages | package-01 - package-09
   apt:
     name: '{{ os_security_packages_list }}'
     state: 'absent'

roles/os_hardening/tasks/auditd.yml

@@ -1,10 +1,10 @@
 ---
-- name: install auditd package | package-08
+- name: Install auditd package | package-08
   package:
     name: '{{ auditd_package }}'
     state: 'present'
 
-- name: configure auditd | package-08
+- name: Configure auditd | package-08
   template:
     src: 'etc/audit/auditd.conf.j2'
     dest: '/etc/audit/auditd.conf'

roles/os_hardening/tasks/limits.yml

@@ -1,6 +1,6 @@
 ---
 - block:
-  - name: create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
+  - name: Create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
     file:
       path: '/etc/security/limits.d'
       owner: 'root'
@@ -8,7 +8,7 @@
       mode: '0755'
       state: 'directory'
 
-  - name: create additional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
+  - name: Create additional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
     pam_limits:
       dest: '/etc/security/limits.d/10.hardcore.conf'
       domain: '*'
@@ -17,7 +17,7 @@
       value: '0'
       comment: Prevent core dumps for all users. These are usually not needed and may contain sensitive information
 
-  - name: set 10.hardcore.conf perms to 0400 and root ownership
+  - name: Set 10.hardcore.conf perms to 0400 and root ownership
     file:
       path: /etc/security/limits.d/10.hardcore.conf
       owner: 'root'
@@ -29,7 +29,7 @@
 
   when: not os_security_kernel_enable_core_dump | bool
 
-- name: remove 10.hardcore.conf config file
+- name: Remove 10.hardcore.conf config file
   file:
     path: /etc/security/limits.d/10.hardcore.conf
     state: absent

roles/os_hardening/tasks/login_defs.yml

@@ -1,5 +1,5 @@
 ---
-- name: create login.defs | os-05, os-05b
+- name: Create login.defs | os-05, os-05b
   template:
     src: 'etc/login.defs.j2'
     dest: '/etc/login.defs'

roles/os_hardening/tasks/minimize_access.yml

@@ -4,7 +4,7 @@
 # still getting found and the permissions minimized in the next task.
 # This is also the reason why there's ignore_errors: true on the task.
 # also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
-- name: find files with write-permissions for group
+- name: Find files with write-permissions for group
   shell: "find -L {{ item }} -perm /go+w -type f"  # noqa command-instead-of-shell
   with_flattened:
     - '/usr/local/sbin'
@@ -18,7 +18,7 @@
   ignore_errors: true
   changed_when: false
 
-- name: minimize access on found files
+- name: Minimize access on found files
   file:
     path: '{{ item.1 }}'
     mode: 'go-w'
@@ -27,21 +27,21 @@
     - "{{ minimize_access_directories.results }}"
     - stdout_lines
 
-- name: change shadow ownership to root and mode to 0600 | os-02
+- name: Change shadow ownership to root and mode to 0600 | os-02
   file:
     dest: '/etc/shadow'
     owner: '{{ os_shadow_perms.owner }}'
     group: '{{ os_shadow_perms.group }}'
     mode: '{{ os_shadow_perms.mode }}'
 
-- name: change passwd ownership to root and mode to 0644 | os-03
+- name: Change passwd ownership to root and mode to 0644 | os-03
   file:
     dest: '/etc/passwd'
     owner: '{{ os_passwd_perms.owner }}'
     group: '{{ os_passwd_perms.group }}'
     mode: '{{ os_passwd_perms.mode }}'
 
-- name: change su-binary to only be accessible to user and group root
+- name: Change su-binary to only be accessible to user and group root
   file:
     dest: '/bin/su'
     owner: 'root'
@@ -49,7 +49,7 @@
     mode: '0750'
   when: '"change_user" not in os_security_users_allow'
 
-- name: set option hidepid for proc filesystem
+- name: Set option hidepid for proc filesystem
   mount:
     path: /proc
     src: proc

roles/os_hardening/tasks/modprobe.yml

@@ -1,28 +1,28 @@
 ---
-- name: install modprobe to disable filesystems | os-10
+- name: Install modprobe to disable filesystems | os-10
   package:
     name: '{{ modprobe_package }}'
     state: 'present'
 
-- name: check if efi is installed
+- name: Check if efi is installed
   stat:
     path: "/sys/firmware/efi"
   register: efi_installed
 
-- name: remove vfat from fs-list if efi is used
+- name: Remove vfat from fs-list if efi is used
   set_fact:
     os_unused_filesystems: "{{ os_unused_filesystems | difference('vfat') }}"
   when:
     - efi_installed.stat.isdir is defined
     - efi_installed.stat.isdir
 
-- name: remove used filesystems from fs-list
+- name: Remove used filesystems from fs-list
   set_fact:
     os_unused_filesystems: "{{ os_unused_filesystems | difference(ansible_mounts | map(attribute='fstype') | list) }}"
   # we cannot do this on el6 and below, because these systems don't support the map function
   when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
 
-- name: disable unused filesystems | os-10
+- name: Disable unused filesystems | os-10
   template:
     src: 'etc/modprobe.d/modprobe.j2'
     dest: '/etc/modprobe.d/dev-sec.conf'

roles/os_hardening/tasks/pam.yml

@@ -10,7 +10,7 @@
 # that isn't connected to an LDAP server anymore.
 # normally caching credentials shouldn't be necessary for most machines.
 # removing it provides some more security while not removing usability.
-- name: remove pam ccreds to disable password caching
+- name: Remove pam ccreds to disable password caching
   package:
     name: '{{ os_packages_pam_ccreds }}'
     state: 'absent'

roles/os_hardening/tasks/pam_debian.yml

@@ -1,5 +1,5 @@
 ---
-- name: install the package for strong password checking
+- name: Install the package for strong password checking
   apt:
     name: 'libpam-passwdqc'
     state: 'present'
@@ -7,7 +7,7 @@
   when:
     - os_auth_pam_passwdqc_enable
 
-- name: configure passwdqc
+- name: Configure passwdqc
   template:
     src: 'usr/share/pam-configs/pam_passwdqc.j2'
     dest: '{{ passwdqc_path }}'
@@ -17,16 +17,16 @@
   when:
     - os_auth_pam_passwdqc_enable
 
-- name: install tally2
+- name: Install tally2
   apt:
     name: 'libpam-modules'
     state: 'present'
   when:
     - os_auth_retries > 0
 
-- name: manage tally on Debian stable
+- name: Manage tally on Debian stable
   block:
-    - name: configure tally2
+    - name: Configure tally2
       template:
         src: 'usr/share/pam-configs/pam_tally2.j2'
         dest: '{{ tally2_path }}'
@@ -36,7 +36,7 @@
       when:
         - os_auth_retries > 0
 
-    - name: delete tally2 when retries is 0
+    - name: Delete tally2 when retries is 0
       file:
         path: '{{ tally2_path }}'
         state: 'absent'
@@ -46,9 +46,9 @@
     - "'libpam-modules' in ansible_facts.packages"
     - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '<')"
 
-- name: manage tally/faillock on Debian unstable
+- name: Manage tally/faillock on Debian unstable
   block:
-    - name: delete tally2
+    - name: Delete tally2
       file:
         path: '{{ tally2_path }}'
         state: 'absent'
@@ -61,7 +61,7 @@
         owner: 'root'
         group: 'root'
 
-    - name: configure faillock
+    - name: Configure faillock
       template:
         src: 'etc/security/faillock.conf.j2'
         dest: '/etc/security/faillock.conf'
@@ -69,7 +69,7 @@
         owner: 'root'
         group: 'root'
 
-    - name: configure faillock pam
+    - name: Configure faillock pam
       template:
         src: 'usr/share/pam-configs/pam_faillock.j2'
         dest: '/usr/share/pam-configs/faillock'
@@ -79,7 +79,7 @@
       when:
         - os_auth_retries > 0
 
-    - name: configure faillock pam authfail
+    - name: Configure faillock pam authfail
       template:
         src: 'usr/share/pam-configs/pam_faillock_authfail.j2'
         dest: '/usr/share/pam-configs/faillock_authfail'
@@ -89,14 +89,14 @@
       when:
         - os_auth_retries > 0
 
-    - name: delete faillock when retries is 0
+    - name: Delete faillock when retries is 0
       file:
         path: '/usr/share/pam-configs/faillock'
         state: 'absent'
       when:
         - os_auth_retries == 0
 
-    - name: delete faillock authfail when retries is 0
+    - name: Delete faillock authfail when retries is 0
       file:
         path: '/usr/share/pam-configs/faillock_authfail'
         state: 'absent'
@@ -106,13 +106,13 @@
     - "'libpam-modules' in ansible_facts.packages"
     - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '>=')"
 
-- name: update pam on Debian systems
+- name: Update pam on Debian systems
   command: 'pam-auth-update --package'
   environment:
     DEBIAN_FRONTEND: noninteractive
   changed_when: false
 
-- name: remove passwdqc
+- name: Remove passwdqc
   apt:
     name: 'libpam-passwdqc'
     state: 'absent'

roles/os_hardening/tasks/pam_rhel.yml

@@ -1,12 +1,12 @@
 ---
-- name: install sssd-clients
+- name: Install sssd-clients
   yum:
     name: sssd-client
     state: 'present'
   when:
     - os_auth_pam_sssd_enable | bool
 
-- name: configure passwdqc and faillock via central system-auth config
+- name: Configure passwdqc and faillock via central system-auth config
   template:
     src: 'etc/pam.d/rhel_auth.j2'
     dest: '/etc/pam.d/system-auth-local'
@@ -14,7 +14,7 @@
     owner: 'root'
     group: 'root'
 
-- name: enable our config for system-auth
+- name: Enable our config for system-auth
   file:
     src: /etc/pam.d/system-auth-local
     dest: /etc/pam.d/system-auth
@@ -24,7 +24,7 @@
     state: link
     force: true
 
-- name: configure passwdqc and faillock via central password-auth config
+- name: Configure passwdqc and faillock via central password-auth config
   template:
     src: 'etc/pam.d/rhel_auth.j2'
     dest: '/etc/pam.d/password-auth-local'
@@ -32,7 +32,7 @@
     owner: 'root'
     group: 'root'
 
-- name: enable our config for password-auth
+- name: Enable our config for password-auth
   file:
     src: /etc/pam.d/password-auth-local
     dest: /etc/pam.d/password-auth

roles/os_hardening/tasks/profile.yml

@@ -1,5 +1,5 @@
 ---
-- name: add pinerolo_profile.sh to profile.d
+- name: Add pinerolo_profile.sh to profile.d
   template:
     src: 'etc/profile.d/profile.conf.j2'
     dest: '/etc/profile.d/pinerolo_profile.sh'
@@ -8,7 +8,7 @@
     mode: '0750'
   when: not os_security_kernel_enable_core_dump | bool
 
-- name: remove pinerolo_profile.sh from profile.d
+- name: Remove pinerolo_profile.sh from profile.d
   file:
     path: /etc/profile.d/pinerolo_profile.sh
     state: absent

roles/os_hardening/tasks/rhosts.yml

@@ -5,18 +5,18 @@
   check_mode: false
   register: users_accounts
 
-- name: delete rhosts-files from system | os-09
+- name: Delete rhosts-files from system | os-09
   file:
     dest: '~{{ item }}/.rhosts'
     state: 'absent'
   with_flattened: '{{ users_accounts.stdout_lines | default([]) }}'
 
-- name: delete hosts.equiv from system | os-01
+- name: Delete hosts.equiv from system | os-01
   file:
     dest: '/etc/hosts.equiv'
     state: 'absent'
 
-- name: delete .netrc-files from system | os-09
+- name: Delete .netrc-files from system | os-09
   file:
     dest: '~{{ item }}/.netrc'
     state: 'absent'

roles/os_hardening/tasks/securetty.yml

@@ -1,5 +1,5 @@
 ---
-- name: create securetty
+- name: Create securetty
   template:
     src: 'etc/securetty.j2'
     dest: '/etc/securetty'

roles/os_hardening/tasks/selinux.yml

@@ -1,5 +1,5 @@
 ---
-- name: configure selinux | selinux-01
+- name: Configure selinux | selinux-01
   selinux:
     policy: "{{ os_selinux_policy }}"
     state: "{{ os_selinux_state }}"

roles/os_hardening/tasks/suid_sgid.yml

@@ -1,5 +1,5 @@
 ---
-- name: remove suid/sgid bit from binaries in blacklist | os-06
+- name: Remove suid/sgid bit from binaries in blacklist | os-06
   file:
     path: '{{ item }}'
     mode: 'a-s'
@@ -10,18 +10,18 @@
     - '{{ os_security_suid_sgid_system_blacklist }}'
     - '{{ os_security_suid_sgid_blacklist }}'
 
-- name: find binaries with suid/sgid set | os-06
+- name: Find binaries with suid/sgid set | os-06
   shell: find / -xdev \( -perm -4000 -o -perm -2000 \) -type f ! -path '/proc/*' -print 2>/dev/null
   register: sbit_binaries
   when: os_security_suid_sgid_remove_from_unknown | bool
   changed_when: false
 
-- name: gather files from which to remove suids/sgids and remove system white-listed files | os-06
+- name: Gather files from which to remove suids/sgids and remove system white-listed files | os-06
   set_fact:
     suid: '{{ sbit_binaries.stdout_lines | difference(os_security_suid_sgid_system_whitelist) }}'
   when: os_security_suid_sgid_remove_from_unknown | bool
 
-- name: remove suid/sgid bit from all binaries except in system and user whitelist | os-06
+- name: Remove suid/sgid bit from all binaries except in system and user whitelist | os-06
   file:
     path: '{{ item }}'
     mode: 'a-s'

roles/os_hardening/tasks/sysctl.yml

@@ -1,5 +1,5 @@
 ---
-- name: protect sysctl.conf
+- name: Protect sysctl.conf
   file:
     path: '/etc/sysctl.conf'
     owner: 'root'
@@ -9,7 +9,7 @@
     modification_time: preserve
     access_time: preserve
 
-- name: set Daemon umask, do config for rhel-family | NSA 2.2.4.1
+- name: Set Daemon umask, do config for rhel-family | NSA 2.2.4.1
   template:
     src: 'etc/sysconfig/rhel_sysconfig_init.j2'
     dest: '/etc/sysconfig/init'
@@ -18,7 +18,7 @@
     mode: '0544'
   when: ansible_facts.distribution in ['Amazon', 'CentOS', 'Fedora', 'RedHat']
 
-- name: install initramfs-tools
+- name: Install initramfs-tools
   apt:
     name: 'initramfs-tools'
     state: 'present'
@@ -27,7 +27,7 @@
     - ansible_facts.os_family == 'Debian'
     - os_security_kernel_enable_module_loading
 
-- name: rebuild initramfs with starting pack of modules, if module loading at runtime is disabled
+- name: Rebuild initramfs with starting pack of modules, if module loading at runtime is disabled
   template:
     src: 'etc/initramfs-tools/modules.j2'
     dest: '/etc/initramfs-tools/modules'
@@ -35,15 +35,15 @@
     group: 'root'
     mode: '0440'
   notify:
-    - update-initramfs
+    - Update-initramfs
   when:
     - ansible_facts.os_family == 'Debian'
     - os_security_kernel_enable_module_loading
   register: initramfs
 
-- name: change sysctls
+- name: Change sysctls
   block:
-    - name: create a combined sysctl-dict if overwrites are defined
+    - name: Create a combined sysctl-dict if overwrites are defined
       set_fact:
         sysctl_config: '{{ sysctl_config | combine(sysctl_overwrite) }}'
       when: sysctl_overwrite | default()

roles/os_hardening/tasks/user_accounts.yml

@@ -1,5 +1,5 @@
 ---
-- name: get UID_MIN from login.defs
+- name: Get UID_MIN from login.defs
   shell: awk '/^\s*UID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs
   args:
     removes: /etc/login.defs
@@ -7,24 +7,24 @@
   check_mode: false
   changed_when: false
 
-- name: calculate UID_MAX from UID_MIN by substracting 1
+- name: Calculate UID_MAX from UID_MIN by substracting 1
   set_fact:
     uid_max: '{{ uid_min.stdout | int - 1 }}'
   when: uid_min.stdout|int > 0
 
-- name: set UID_MAX on Debian-systems if no login.defs exist
+- name: Set UID_MAX on Debian-systems if no login.defs exist
   set_fact:
     uid_max: '999'
   when:
     - ansible_facts.os_family == 'Debian'
     - uid_max is not defined
 
-- name: set UID_MAX on other systems if no login.defs exist
+- name: Set UID_MAX on other systems if no login.defs exist
   set_fact:
     uid_max: '499'
   when: uid_max is not defined
 
-- name: get all system accounts
+- name: Get all system accounts
   command: awk -F'':'' '{ if ( $3 <= {{ uid_max|quote }} ) print $1}' /etc/passwd
   args:
     removes: /etc/passwd
@@ -32,12 +32,12 @@
   check_mode: false
   register: sys_accs
 
-- name: remove always ignored system accounts from list
+- name: Remove always ignored system accounts from list
   set_fact:
     sys_accs_cond: '{{ sys_accs.stdout_lines | difference(os_always_ignore_users) }}'
   check_mode: false
 
-- name: change system accounts not on the user provided ignore-list
+- name: Change system accounts not on the user provided ignore-list
   user:
     name: '{{ item }}'
     shell: '{{ os_nologin_shell_path }}'

roles/os_hardening/tasks/yum.yml

@@ -1,5 +1,5 @@
 ---
-- name: remove unused repositories
+- name: Remove unused repositories
   file:
     name: '/etc/yum.repos.d/{{ item }}.repo'
     state: 'absent'
@@ -9,7 +9,7 @@
     - 'CentOS-Vault'
   when: os_security_packages_clean | bool
 
-- name: get yum-repository-files
+- name: Get yum-repository-files
   find:
     paths: '/etc/yum.repos.d'
     patterns: '*.repo'
@@ -18,7 +18,7 @@
 # for the 'default([])' see here:
 # https://github.com/dev-sec/ansible-os-hardening/issues/99 and
 # https://stackoverflow.com/questions/37067827/ansible-deprecation-warning-for-undefined-variable-despite-when-clause
-- name: activate gpg-check for yum-repository-files
+- name: Activate gpg-check for yum-repository-files
   replace:
     path: '{{ item.path }}'
     regexp: '^\s*gpgcheck.*'
@@ -30,7 +30,7 @@
 # failed_when is needed because by default replace module will fail if the file doesn't exists.
 # status.rc is only defined if an error accrued and only error code (rc) 257 will be ignored.
 # All other errors will still be raised.
-- name: activate gpg-check for config files
+- name: Activate gpg-check for config files
   replace:
     path: '{{ item }}'
     regexp: '^\s*gpgcheck\W.*'
@@ -43,7 +43,7 @@
     - '/etc/dnf/dnf.conf'
     - '/etc/yum/pluginconf.d/rhnplugin.conf'
 
-- name: remove deprecated or insecure packages | package-01 - package-09
+- name: Remove deprecated or insecure packages | package-01 - package-09
   yum:
     name: '{{ os_security_packages_list }}'
     state: 'absent'

roles/ssh_hardening/handlers/main.yml

@@ -1,5 +1,5 @@
 ---
-- name: restart sshd
+- name: Restart sshd
   service:
     name: '{{ sshd_service_name }}'
     state: restarted

roles/ssh_hardening/tasks/ca_keys_and_principals.yml

@@ -1,14 +1,14 @@
 ---
-- name: set ssh CA pub keys
+- name: Set ssh CA pub keys
   template:
     src: 'trusted_user_ca_keys.j2'
     dest: '{{ ssh_trusted_user_ca_keys_file }}'
     mode: '0644'
     owner: '{{ ssh_owner }}'
     group: '{{ ssh_group }}'
-  notify: restart sshd
+  notify: Restart sshd
 
-- name: create ssh authorized principals directories
+- name: Create ssh authorized principals directories
   file:
     path: '{{ item.path | dirname }}'
     mode: '{{ item.directorymode | default(0700) }}'
@@ -17,7 +17,7 @@
     state: directory
   loop: '{{ ssh_authorized_principals }}'
 
-- name: set ssh authorized principals
+- name: Set ssh authorized principals
   template:
     src: 'authorized_principals.j2'
     dest: '{{ item.path }}'

roles/ssh_hardening/tasks/crypto_ciphers.yml

@@ -1,10 +1,10 @@
 ---
-- name: set ciphers according to openssh-version if openssh >= 5.3
+- name: Set ciphers according to openssh-version if openssh >= 5.3
   set_fact:
     ssh_ciphers: '{{ ssh_ciphers_53_default }}'
   when: sshd_version is version('5.3', '>=')
 
-- name: set ciphers according to openssh-version if openssh >= 6.6
+- name: Set ciphers according to openssh-version if openssh >= 6.6
   set_fact:
     ssh_ciphers: '{{ ssh_ciphers_66_default }}'
   when: sshd_version is version('6.6', '>=')

roles/ssh_hardening/tasks/crypto_hostkeys.yml

@@ -1,5 +1,5 @@
 ---
-- name: replace default 2048 bits RSA keypair
+- name: Replace default 2048 bits RSA keypair
   community.crypto.openssh_keypair:
     state: present
     type: rsa
@@ -10,7 +10,7 @@
 
 # In RHEL and Fedora, the 'ssh_keys' group is the group owner of the host private SSH keys.
 # Since the openssh_keypair module needs to read the key to provide idempotency, we need to set ownership and group based on specific OS vars.
-- name: change host private key ownership, group and permissions
+- name: Change host private key ownership, group and permissions
   file:
     path: "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
     owner: "{{ ssh_host_keys_owner }}"
@@ -18,20 +18,20 @@
     mode: "0640"
   when: "ansible_facts.distribution in ['CentOS', 'OracleLinux', 'RedHat']"
 
-- name: set hostkeys according to openssh-version if openssh >= 5.3
+- name: Set hostkeys according to openssh-version if openssh >= 5.3
   set_fact:
     ssh_host_key_files:
       - "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
   when: sshd_version is version('5.3', '>=')
 
-- name: set hostkeys according to openssh-version if openssh >= 6.0
+- name: Set hostkeys according to openssh-version if openssh >= 6.0
   set_fact:
     ssh_host_key_files:
       - "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
       - "{{ ssh_host_keys_dir }}/ssh_host_ecdsa_key"
   when: sshd_version is version('6.0', '>=')
 
-- name: set hostkeys according to openssh-version if openssh >= 6.3
+- name: Set hostkeys according to openssh-version if openssh >= 6.3
   set_fact:
     ssh_host_key_files:
       - "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"

roles/ssh_hardening/tasks/crypto_kex.yml

@@ -1,15 +1,15 @@
 ---
-- name: set kex according to openssh-version if openssh >= 5.9
+- name: Set kex according to openssh-version if openssh >= 5.9
   set_fact:
     ssh_kex: '{{ ssh_kex_59_default }}'
   when: sshd_version is version('5.9', '>=')
 
-- name: set kex according to openssh-version if openssh >= 6.6
+- name: Set kex according to openssh-version if openssh >= 6.6
   set_fact:
     ssh_kex: '{{ ssh_kex_66_default }}'
   when: sshd_version is version('6.6', '>=')
 
-- name: set kex according to openssh-version if openssh >= 8.0
+- name: Set kex according to openssh-version if openssh >= 8.0
   set_fact:
     ssh_kex: '{{ ssh_kex_80_default }}'
   when: sshd_version is version('8.0', '>=')

roles/ssh_hardening/tasks/crypto_macs.yml

@@ -1,27 +1,27 @@
 ---
-- name: set macs according to openssh-version if openssh >= 5.3
+- name: Set macs according to openssh-version if openssh >= 5.3
   set_fact:
     ssh_macs: '{{ ssh_macs_53_default }}'
   when: sshd_version is version('5.3', '>=')
 
-- name: set macs for Enterprise Linux >= 6.5 (openssh 5.3 with backports)
+- name: Set macs for Enterprise Linux >= 6.5 (openssh 5.3 with backports)
   set_fact:
     ssh_macs: '{{ ssh_macs_53_el_6_5_default }}'
   when:
     - ansible_facts.distribution in ['CentOS', 'OracleLinux', 'RedHat']
     - ansible_facts.distribution_version is version('6.5', '>=')
 
-- name: set macs according to openssh-version if openssh >= 5.9
+- name: Set macs according to openssh-version if openssh >= 5.9
   set_fact:
     ssh_macs: '{{ ssh_macs_59_default }}'
   when: sshd_version is version('5.9', '>=')
 
-- name: set macs according to openssh-version if openssh >= 6.6
+- name: Set macs according to openssh-version if openssh >= 6.6
   set_fact:
     ssh_macs: '{{ ssh_macs_66_default }}'
   when: sshd_version is version('6.6', '>=')
 
-- name: set macs according to openssh-version if openssh >= 7.6
+- name: Set macs according to openssh-version if openssh >= 7.6
   set_fact:
     ssh_macs: '{{ ssh_macs_76_default }}'
   when: sshd_version is version('7.6', '>=')

roles/ssh_hardening/tasks/hardening.yml

@@ -21,45 +21,45 @@
   when: "not lookup('varnames', '^' + item.key + '$')"
   with_dict: '{{ os_vars }}'
 
-- name: get openssh-version
+- name: Get openssh-version
   command: ssh -V
   register: sshd_version_raw
   changed_when: false
   check_mode: false
 
-- name: parse openssh-version
+- name: Parse openssh-version
   set_fact:
     sshd_version: "{{ sshd_version_raw.stderr | regex_replace('.*_([0-9]*.[0-9]).*', '\\1') }}"
 
-- name: set default for ssh_host_key_files if not supplied
+- name: Set default for ssh_host_key_files if not supplied
   include_tasks: crypto_hostkeys.yml
   when:
     - ssh_server_hardening | bool
     - not ssh_host_key_files
 
-- name: set default for ssh_macs if not supplied
+- name: Set default for ssh_macs if not supplied
   include_tasks: crypto_macs.yml
   when: not ssh_macs
 
-- name: set default for ssh_ciphers if not supplied
+- name: Set default for ssh_ciphers if not supplied
   include_tasks: crypto_ciphers.yml
   when: not ssh_ciphers
 
-- name: set default for ssh_kex if not supplied
+- name: Set default for ssh_kex if not supplied
   include_tasks: crypto_kex.yml
   when: not ssh_kex
 
-- name: create revoked_keys and set permissions to root/600
+- name: Create revoked_keys and set permissions to root/600
   template:
     src: 'revoked_keys.j2'
     dest: '/etc/ssh/revoked_keys'
     mode: '0600'
     owner: '{{ ssh_owner }}'
     group: '{{ ssh_group }}'
-  notify: restart sshd
+  notify: Restart sshd
   when: ssh_server_hardening | bool
 
-- name: create sshd_config and set permissions to root/600
+- name: Create sshd_config and set permissions to root/600
   template:
     src: 'opensshd.conf.j2'
     dest: "{{ ssh_server_config_file }}"
@@ -67,10 +67,10 @@
     owner: '{{ ssh_owner }}'
     group: '{{ ssh_group }}'
     validate: '{{ sshd_path }} -T -C user=root -C host=localhost -C addr=localhost -C lport=22 -f %s'
-  notify: restart sshd
+  notify: Restart sshd
   when: ssh_server_hardening | bool
 
-- name: disable dynamic MOTD
+- name: Disable dynamic MOTD
   pamd:
     name: sshd
     type: session
@@ -83,7 +83,7 @@
     - ssh_pam_support | bool
     - not (ssh_print_pam_motd | bool)
 
-- name: create ssh_config and set permissions to root/644
+- name: Create ssh_config and set permissions to root/644
   template:
     src: 'openssh.conf.j2'
     dest: "{{ ssh_client_config_file }}"
@@ -92,36 +92,36 @@
     group: '{{ ssh_group }}'
   when: ssh_client_hardening | bool
 
-- name: check if {{ sshd_moduli_file }} contains weak DH parameters
+- name: Check if {{ sshd_moduli_file }} contains weak DH parameters
   shell: awk '$5 < {{ sshd_moduli_minimum }}' {{ sshd_moduli_file }}
   register: sshd_register_moduli
   changed_when: false
   check_mode: false
   when: ssh_server_hardening | bool
 
-- name: remove all small primes
+- name: Remove all small primes
   shell: awk '$5 >= {{ sshd_moduli_minimum }}' {{ sshd_moduli_file }} > {{ sshd_moduli_file }}.new ;
          [ -r {{ sshd_moduli_file }}.new -a -s {{ sshd_moduli_file }}.new ] && mv {{ sshd_moduli_file }}.new {{ sshd_moduli_file }} || true
-  notify: restart sshd
+  notify: Restart sshd
   when:
     - ssh_server_hardening | bool
     - sshd_register_moduli.stdout
 
-- name: include tasks to setup ca keys and principals
+- name: Include tasks to setup ca keys and principals
   include_tasks: ca_keys_and_principals.yml
   when: ssh_trusted_user_ca_keys_file | length > 0
 
-- name: include selinux specific tasks
+- name: Include selinux specific tasks
   include_tasks: selinux.yml
   when: ansible_facts.selinux and ansible_facts.selinux.status == "enabled"
 
-- name: gather package facts
+- name: Gather package facts
   package_facts:
   check_mode: false
   when:
     - sshd_disable_crypto_policy | bool
 
-- name: disable SSH server CRYPTO_POLICY
+- name: Disable SSH server CRYPTO_POLICY
   copy:
     src: sshd
     dest: /etc/sysconfig/sshd

roles/ssh_hardening/tasks/selinux.yml

@@ -1,10 +1,10 @@
 ---
-- name: install selinux dependencies when selinux is installed
+- name: Install selinux dependencies when selinux is installed
   package:
     name: '{{ ssh_selinux_packages }}'
     state: present
 
-- name: authorize {{ ssh_server_ports }} ports for selinux
+- name: Authorize {{ ssh_server_ports }} ports for selinux
   seport:
     ports: '{{ item }}'
     proto: tcp
@@ -12,7 +12,7 @@
     state: present
   loop: '{{ ssh_server_ports }}'
 
-- name: check if ssh_password module is already installed
+- name: Check if ssh_password module is already installed
   shell: 'set -o pipefail && semodule -l | grep ssh_password'
   args:
     executable: /bin/bash
@@ -28,7 +28,7 @@
     - not (ssh_use_pam | bool)
     - ('ssh_password' not in ssh_password_module.stdout)
   block:
-    - name: create selinux custom policy drop folder
+    - name: Create selinux custom policy drop folder
       file:
         path: '{{ ssh_custom_selinux_dir }}'
         state: 'directory'
@@ -36,7 +36,7 @@
         group: 'root'
         mode: '0750'
 
-    - name: distributing custom selinux policies
+    - name: Distributing custom selinux policies
       copy:
         src: 'ssh_password'
         dest: '{{ ssh_custom_selinux_dir }}'
@@ -44,20 +44,20 @@
         group: 'root'
         mode: '0600'
 
-    - name: check and compile policy
+    - name: Check and compile policy
       command: checkmodule -M -m -o {{ ssh_custom_selinux_dir }}/ssh_password.mod {{ ssh_custom_selinux_dir }}/ssh_password
 
-    - name: create selinux policy module package
+    - name: Create selinux policy module package
       command: semodule_package -o {{ ssh_custom_selinux_dir }}/ssh_password.pp  -m {{ ssh_custom_selinux_dir }}/ssh_password.mod
 
-    - name: install selinux policy
+    - name: Install selinux policy
       command: semodule -i {{ ssh_custom_selinux_dir }}/ssh_password.pp
 
 
 # The following tasks only get executed when selinux is installed, UsePam is
 # 'yes' and the ssh_password module is installed. See
 # http://danwalsh.livejournal.com/12333.html for more info
-- name: remove selinux-policy when Pam is used, because Allowing sshd to read the shadow file directly is considered a potential security risk
+- name: Remove selinux-policy when Pam is used, because Allowing sshd to read the shadow file directly is considered a potential security risk
   command: semodule -r ssh_password
   when:
     - ssh_use_pam | bool