diff --git a/roles/ssh_hardening/tasks/selinux.yml b/roles/ssh_hardening/tasks/selinux.yml index 9d3adc66..fd87bb5b 100644 --- a/roles/ssh_hardening/tasks/selinux.yml +++ b/roles/ssh_hardening/tasks/selinux.yml @@ -57,7 +57,7 @@ # The following tasks only get executed when selinux is installed, UsePam is # 'yes' and the ssh_password module is installed. See # http://danwalsh.livejournal.com/12333.html for more info -- name: Remove selinux-policy when Pam is used, because Allowing sshd to read the shadow file directly is considered a potential security risk # noqa no-changed-when +- name: Remove selinux-policy when PAM is used, because allowing sshd to read the shadow file is considered a security risk # noqa no-changed-when ansible.builtin.command: semodule -r ssh_password when: - ssh_use_pam | bool