linting (#603)

* linting

Signed-off-by: Sebastian Gumprich <[email protected]>

* more linting

Signed-off-by: Sebastian Gumprich <[email protected]>

* change line length issues

Signed-off-by: Sebastian Gumprich <[email protected]>

* replace yes with true in tasks

Signed-off-by: Sebastian Gumprich <[email protected]>

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

Signed-off-by: Sebastian Gumprich <[email protected]>

* use manual line-wrapping because ansible-lint does not support it correctly.

see https://github.com/ansible/ansible-lint/issues/2522

Signed-off-by: Sebastian Gumprich <[email protected]>

* add exception for task

Signed-off-by: Sebastian Gumprich <[email protected]>

* remove trailing whitespace

* add back deleted params

Signed-off-by: Sebastian Gumprich <[email protected]>

* add back deleted params

Signed-off-by: Sebastian Gumprich <[email protected]>

* add back tasks

Signed-off-by: Sebastian Gumprich <[email protected]>

roles/ssh_hardening/tasks/ca_keys_and_principals.yml

@@ -1,27 +1,27 @@
 ---
 - name: Set ssh CA pub keys
-  template:
-    src: 'trusted_user_ca_keys.j2'
-    dest: '{{ ssh_trusted_user_ca_keys_file }}'
-    mode: '0644'
-    owner: '{{ ssh_owner }}'
-    group: '{{ ssh_group }}'
+  ansible.builtin.template:
+    src: trusted_user_ca_keys.j2
+    dest: "{{ ssh_trusted_user_ca_keys_file }}"
+    mode: "0644"
+    owner: "{{ ssh_owner }}"
+    group: "{{ ssh_group }}"
   notify: Restart sshd
 
 - name: Create ssh authorized principals directories
-  file:
-    path: '{{ item.path | dirname }}'
+  ansible.builtin.file:
+    path: "{{ item.path | dirname }}"
     mode: '{{ item.directorymode | default("700") }}'
-    owner: '{{ item.directoryowner | default(ssh_owner) }}'
-    group: '{{ item.directorygroup | default(ssh_group) }}'
+    owner: "{{ item.directoryowner | default(ssh_owner) }}"
+    group: "{{ item.directorygroup | default(ssh_group) }}"
     state: directory
-  loop: '{{ ssh_authorized_principals }}'
+  loop: "{{ ssh_authorized_principals }}"
 
 - name: Set ssh authorized principals
-  template:
-    src: 'authorized_principals.j2'
-    dest: '{{ item.path }}'
+  ansible.builtin.template:
+    src: authorized_principals.j2
+    dest: "{{ item.path }}"
     mode: '{{ item.filemode | default("600") }}'
-    owner: '{{ item.owner | default(ssh_owner) }}'
-    group: '{{ item.group | default(ssh_group) }}'
-  loop: '{{ ssh_authorized_principals }}'
+    owner: "{{ item.owner | default(ssh_owner) }}"
+    group: "{{ item.group | default(ssh_group) }}"
+  loop: "{{ ssh_authorized_principals }}"

roles/ssh_hardening/tasks/crypto_ciphers.yml

@@ -1,10 +1,10 @@
 ---
 - name: Set ciphers according to openssh-version if openssh >= 5.3
-  set_fact:
-    ssh_ciphers: '{{ ssh_ciphers_53_default }}'
+  ansible.builtin.set_fact:
+    ssh_ciphers: "{{ ssh_ciphers_53_default }}"
   when: sshd_version is version('5.3', '>=')
 
 - name: Set ciphers according to openssh-version if openssh >= 6.6
-  set_fact:
-    ssh_ciphers: '{{ ssh_ciphers_66_default }}'
+  ansible.builtin.set_fact:
+    ssh_ciphers: "{{ ssh_ciphers_66_default }}"
   when: sshd_version is version('6.6', '>=')

roles/ssh_hardening/tasks/crypto_hostkeys.yml

@@ -11,28 +11,28 @@
 # In RHEL and Fedora, the 'ssh_keys' group is the group owner of the host private SSH keys.
 # Since the openssh_keypair module needs to read the key to provide idempotency, we need to set ownership and group based on specific OS vars.
 - name: Change host private key ownership, group and permissions
-  file:
+  ansible.builtin.file:
     path: "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
     owner: "{{ ssh_host_keys_owner }}"
     group: "{{ ssh_host_keys_group }}"
     mode: "0640"
-  when: "ansible_facts.os_family == 'RedHat'"
+  when: ansible_facts.os_family == 'RedHat'
 
 - name: Set hostkeys according to openssh-version if openssh >= 5.3
-  set_fact:
+  ansible.builtin.set_fact:
     ssh_host_key_files:
       - "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
   when: sshd_version is version('5.3', '>=')
 
 - name: Set hostkeys according to openssh-version if openssh >= 6.0
-  set_fact:
+  ansible.builtin.set_fact:
     ssh_host_key_files:
       - "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
       - "{{ ssh_host_keys_dir }}/ssh_host_ecdsa_key"
   when: sshd_version is version('6.0', '>=')
 
 - name: Set hostkeys according to openssh-version if openssh >= 6.3
-  set_fact:
+  ansible.builtin.set_fact:
     ssh_host_key_files:
       - "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
       - "{{ ssh_host_keys_dir }}/ssh_host_ecdsa_key"

roles/ssh_hardening/tasks/crypto_kex.yml

@@ -1,20 +1,20 @@
 ---
 - name: Set kex according to openssh-version if openssh >= 5.9
-  set_fact:
-    ssh_kex: '{{ ssh_kex_59_default }}'
+  ansible.builtin.set_fact:
+    ssh_kex: "{{ ssh_kex_59_default }}"
   when: sshd_version is version('5.9', '>=')
 
 - name: Set kex according to openssh-version if openssh >= 6.6
-  set_fact:
-    ssh_kex: '{{ ssh_kex_66_default }}'
+  ansible.builtin.set_fact:
+    ssh_kex: "{{ ssh_kex_66_default }}"
   when: sshd_version is version('6.6', '>=')
 
 - name: Set kex according to openssh-version if openssh >= 8.0
-  set_fact:
-    ssh_kex: '{{ ssh_kex_80_default }}'
+  ansible.builtin.set_fact:
+    ssh_kex: "{{ ssh_kex_80_default }}"
   when: sshd_version is version('8.0', '>=')
 
 - name: Set kex according to openssh-version if openssh >= 8.5
-  set_fact:
-    ssh_kex: '{{ ssh_kex_85_default }}'
+  ansible.builtin.set_fact:
+    ssh_kex: "{{ ssh_kex_85_default }}"
   when: sshd_version is version('8.5', '>=')

roles/ssh_hardening/tasks/crypto_macs.yml

@@ -1,20 +1,20 @@
 ---
 - name: Set macs according to openssh-version if openssh >= 5.3
-  set_fact:
-    ssh_macs: '{{ ssh_macs_53_default }}'
+  ansible.builtin.set_fact:
+    ssh_macs: "{{ ssh_macs_53_default }}"
   when: sshd_version is version('5.3', '>=')
 
 - name: Set macs according to openssh-version if openssh >= 5.9
-  set_fact:
-    ssh_macs: '{{ ssh_macs_59_default }}'
+  ansible.builtin.set_fact:
+    ssh_macs: "{{ ssh_macs_59_default }}"
   when: sshd_version is version('5.9', '>=')
 
 - name: Set macs according to openssh-version if openssh >= 6.6
-  set_fact:
-    ssh_macs: '{{ ssh_macs_66_default }}'
+  ansible.builtin.set_fact:
+    ssh_macs: "{{ ssh_macs_66_default }}"
   when: sshd_version is version('6.6', '>=')
 
 - name: Set macs according to openssh-version if openssh >= 7.6
-  set_fact:
-    ssh_macs: '{{ ssh_macs_76_default }}'
+  ansible.builtin.set_fact:
+    ssh_macs: "{{ ssh_macs_76_default }}"
   when: sshd_version is version('7.6', '>=')

roles/ssh_hardening/tasks/hardening.yml

@@ -1,78 +1,78 @@
 ---
 - name: Fetch OS dependent variables
-  include_vars:
-    file: '{{ item }}'
-    name: 'os_vars'
+  ansible.builtin.include_vars:
+    file: "{{ item }}"
+    name: os_vars
   with_first_found:
     - files:
-        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version | default() }}.yml'
-        - '{{ ansible_facts.distribution }}.yml'
-        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version | default() }}.yml'
-        - '{{ ansible_facts.os_family }}.yml'
+        - "{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version | default() }}.yml"
+        - "{{ ansible_facts.distribution }}.yml"
+        - "{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version | default() }}.yml"
+        - "{{ ansible_facts.os_family }}.yml"
       skip: true
   tags: always
 
 # we only override variables with our default, if they have not been specified already
 # by default the lookup functions finds all varnames containing the string, therefore
 # we add ^ and $ to denote start and end of string, so this returns only exact matches
-- name: Set OS dependent variables, if not already defined by user  # noqa var-naming
-  set_fact:
-    '{{ item.key }}': '{{ item.value }}'
-  when: "not lookup('varnames', '^' + item.key + '$')"
-  with_dict: '{{ os_vars }}'
+- name: Set OS dependent variables, if not already defined by user # noqa var-naming
+  ansible.builtin.set_fact:
+    "{{ item.key }}": "{{ item.value }}"
+  when: not lookup('varnames', '^' + item.key + '$')
+  with_dict: "{{ os_vars }}"
   tags: always
 
 - name: Get openssh-version
-  command: ssh -V
+  ansible.builtin.command: ssh -V
   register: sshd_version_raw
   changed_when: false
   check_mode: false
 
 - name: Parse openssh-version
-  set_fact:
+  ansible.builtin.set_fact:
     sshd_version: "{{ sshd_version_raw.stderr | regex_replace('.*_([0-9]*.[0-9]).*', '\\1') }}"
 
 - name: Set default for ssh_host_key_files if not supplied
-  include_tasks: crypto_hostkeys.yml
+  ansible.builtin.include_tasks: crypto_hostkeys.yml
   when:
     - ssh_server_hardening | bool
     - not ssh_host_key_files
 
 - name: Set default for ssh_macs if not supplied
-  include_tasks: crypto_macs.yml
+  ansible.builtin.include_tasks: crypto_macs.yml
   when: not ssh_macs
 
 - name: Set default for ssh_ciphers if not supplied
-  include_tasks: crypto_ciphers.yml
+  ansible.builtin.include_tasks: crypto_ciphers.yml
   when: not ssh_ciphers
 
 - name: Set default for ssh_kex if not supplied
-  include_tasks: crypto_kex.yml
+  ansible.builtin.include_tasks: crypto_kex.yml
   when: not ssh_kex
 
 - name: Create revoked_keys and set permissions to root/600
-  template:
-    src: 'revoked_keys.j2'
-    dest: '/etc/ssh/revoked_keys'
-    mode: '0600'
-    owner: '{{ ssh_owner }}'
-    group: '{{ ssh_group }}'
+  ansible.builtin.template:
+    src: revoked_keys.j2
+    dest: /etc/ssh/revoked_keys
+    mode: "0600"
+    owner: "{{ ssh_owner }}"
+    group: "{{ ssh_group }}"
   notify: Restart sshd
   when: ssh_server_hardening | bool
 
 - name: Create sshd_config and set permissions to root/600
-  template:
-    src: 'opensshd.conf.j2'
+  ansible.builtin.template:
+    src: opensshd.conf.j2
     dest: "{{ ssh_server_config_file }}"
-    mode: '0600'
-    owner: '{{ ssh_owner }}'
-    group: '{{ ssh_group }}'
-    validate: '{{ sshd_path }} -T -C user=root -C host=localhost -C addr=localhost -C lport=22 -f %s'
+    mode: "0600"
+    owner: "{{ ssh_owner }}"
+    group: "{{ ssh_group }}"
+    validate: "{{ sshd_path }} -T -C user=root -C host=localhost -C addr=localhost -C lport=22 -f %s"
   notify: Restart sshd
   when: ssh_server_hardening | bool
 
 - name: Disable dynamic MOTD
-  pamd:
+  community.general.pamd:
     name: sshd
     type: session
     control: optional
@@ -85,52 +85,53 @@
     - not (ssh_print_pam_motd | bool)
 
 - name: Create ssh_config and set permissions to root/644
-  template:
-    src: 'openssh.conf.j2'
+  ansible.builtin.template:
+    src: openssh.conf.j2
     dest: "{{ ssh_client_config_file }}"
-    mode: '0644'
-    owner: '{{ ssh_owner }}'
-    group: '{{ ssh_group }}'
+    mode: "0644"
+    owner: "{{ ssh_owner }}"
+    group: "{{ ssh_group }}"
   when: ssh_client_hardening | bool
 
 - name: Check if {{ sshd_moduli_file }} contains weak DH parameters
-  shell: awk '$5 < {{ sshd_moduli_minimum }}' {{ sshd_moduli_file }}
+  ansible.builtin.shell: awk '$5 < {{ sshd_moduli_minimum }}' {{ sshd_moduli_file }}
   register: sshd_register_moduli
   changed_when: false
   check_mode: false
   when: ssh_server_hardening | bool
 
 - name: Remove all small primes
-  shell: awk '$5 >= {{ sshd_moduli_minimum }}' {{ sshd_moduli_file }} > {{ sshd_moduli_file }}.new ;
-         [ -r {{ sshd_moduli_file }}.new -a -s {{ sshd_moduli_file }}.new ] && mv {{ sshd_moduli_file }}.new {{ sshd_moduli_file }} || true
+  ansible.builtin.shell: >
+    awk '$5 >= {{ sshd_moduli_minimum }}' {{ sshd_moduli_file }} > {{ sshd_moduli_file }}.new ; [ -r {{ sshd_moduli_file }}.new
+    -a -s {{ sshd_moduli_file }}.new ] && mv {{ sshd_moduli_file }}.new {{ sshd_moduli_file }} || true
   notify: Restart sshd
   when:
     - ssh_server_hardening | bool
     - sshd_register_moduli.stdout
 
 - name: Include tasks to setup ca keys and principals
-  include_tasks: ca_keys_and_principals.yml
+  ansible.builtin.include_tasks: ca_keys_and_principals.yml
   when:
     - ssh_trusted_user_ca_keys_file | length > 0
     - ssh_trusted_user_ca_keys | length > 0
 
 - name: Include selinux specific tasks
-  include_tasks: selinux.yml
+  ansible.builtin.include_tasks: selinux.yml
   when: ansible_facts.selinux and ansible_facts.selinux.status == "enabled"
 
 - name: Gather package facts
-  package_facts:
+  ansible.builtin.package_facts:
   check_mode: false
   when:
     - sshd_disable_crypto_policy | bool
 
 - name: Disable SSH server CRYPTO_POLICY
-  copy:
+  ansible.builtin.copy:
     src: sshd
     dest: /etc/sysconfig/sshd
-    owner: 'root'
-    group: 'root'
-    mode: '0640'
+    owner: root
+    group: root
+    mode: "0640"
   when:
     - sshd_disable_crypto_policy | bool
     - ('crypto-policies' in ansible_facts.packages)

roles/ssh_hardening/tasks/main.yml

@@ -1,6 +1,6 @@
 ---
 - name: Include hardening tasks
-  include_tasks: hardening.yml
+  ansible.builtin.include_tasks: hardening.yml
   args:
     apply:
       become: true

roles/ssh_hardening/tasks/selinux.yml

@@ -1,19 +1,19 @@
 ---
 - name: Install selinux dependencies when selinux is installed
-  package:
-    name: '{{ ssh_selinux_packages }}'
+  ansible.builtin.package:
+    name: "{{ ssh_selinux_packages }}"
     state: present
 
 - name: Authorize {{ ssh_server_ports }} ports for selinux
-  seport:
-    ports: '{{ item }}'
+  community.general.seport:
+    ports: "{{ item }}"
     proto: tcp
     setype: ssh_port_t
     state: present
-  loop: '{{ ssh_server_ports }}'
+  loop: "{{ ssh_server_ports }}"
 
 - name: Check if ssh_password module is already installed
-  shell: 'set -o pipefail && semodule -l | grep ssh_password'
+  ansible.builtin.shell: set -o pipefail && semodule -l | grep ssh_password
   args:
     executable: /bin/bash
   register: ssh_password_module
@@ -30,36 +30,35 @@
     - ('ssh_password' not in ssh_password_module.stdout)
   block:
     - name: Create selinux custom policy drop folder
-      file:
-        path: '{{ ssh_custom_selinux_dir }}'
-        state: 'directory'
-        owner: 'root'
-        group: 'root'
-        mode: '0750'
+      ansible.builtin.file:
+        path: "{{ ssh_custom_selinux_dir }}"
+        state: directory
+        owner: root
+        group: root
+        mode: "0750"
 
     - name: Distributing custom selinux policies
-      copy:
-        src: 'ssh_password'
-        dest: '{{ ssh_custom_selinux_dir }}'
-        owner: 'root'
-        group: 'root'
-        mode: '0600'
+      ansible.builtin.copy:
+        src: ssh_password
+        dest: "{{ ssh_custom_selinux_dir }}"
+        owner: root
+        group: root
+        mode: "0600"
 
-    - name: Check and compile policy  # noqa no-changed-when
-      command: checkmodule -M -m -o {{ ssh_custom_selinux_dir }}/ssh_password.mod {{ ssh_custom_selinux_dir }}/ssh_password
+    - name: Check and compile policy # noqa no-changed-when
+      ansible.builtin.command: checkmodule -M -m -o {{ ssh_custom_selinux_dir }}/ssh_password.mod {{ ssh_custom_selinux_dir }}/ssh_password
 
-    - name: Create selinux policy module package  # noqa no-changed-when
-      command: semodule_package -o {{ ssh_custom_selinux_dir }}/ssh_password.pp  -m {{ ssh_custom_selinux_dir }}/ssh_password.mod
-
-    - name: Install selinux policy  # noqa no-changed-when
-      command: semodule -i {{ ssh_custom_selinux_dir }}/ssh_password.pp
+    - name: Create selinux policy module package # noqa no-changed-when
+      ansible.builtin.command: semodule_package -o {{ ssh_custom_selinux_dir }}/ssh_password.pp  -m {{ ssh_custom_selinux_dir }}/ssh_password.mod
 
+    - name: Install selinux policy # noqa no-changed-when
+      ansible.builtin.command: semodule -i {{ ssh_custom_selinux_dir }}/ssh_password.pp
 
 # The following tasks only get executed when selinux is installed, UsePam is
 # 'yes' and the ssh_password module is installed. See
 # http://danwalsh.livejournal.com/12333.html for more info
 - name: Remove selinux-policy when Pam is used, because Allowing sshd to read the shadow file directly is considered a potential security risk
-  command: semodule -r ssh_password
+  ansible.builtin.command: semodule -r ssh_password
   when:
     - ssh_use_pam | bool
     - ('ssh_password' in ssh_password_module.stdout)