Added option to disable system accounts

roles/ansible-os-hardening/tasks/main.yml

@@ -11,6 +11,7 @@
 - include: securetty.yml tags=securetty
 - include: suid_sgid.yml tags=suid_sgid
 - include: sysctl.yml tags=sysctl
+- include: user_accounts.yml tags=user_accounts
 
 - include: yum.yml tags=yum
   when: ansible_os_family == 'RedHat' or ansible_os_family == 'Oracle Linux'

roles/ansible-os-hardening/tasks/user_accounts.yml

@@ -0,0 +1,30 @@
+---
+
+- name: get UID_MIN from login.defs
+  shell: perl -ne 'print $1 if /^\s*UID_MIN\s+(\d+)(\s*#.*)?$/' /etc/login.defs removes=/etc/login.defs
+  register: uid_min
+  changed_when: False
+
+- name: calculate UID_MAX from UID_MIN
+  set_fact: uid_max='{{ uid_min.stdout | int - 1 }}'
+  when: uid_min is defined
+
+- name: set UID_MAX on Debian-systems if no login.defs exist
+  set_fact: uid_max='999'
+  when: ansible_os_family == 'Debian' and not uid_min
+
+- name: set UID_MAX on other systems if no login.defs exist
+  set_fact: uid_max='499'
+  when: not uid_min
+
+- name: get all system accounts
+  command: awk -F'':'' '{ if ( $3 <= {{uid_max|quote}} ) print $1}' /etc/passwd removes=/etc/passwd 
+  changed_when: False
+  register: sys_accs
+
+- debug: var="{{sys_accs.stdout_lines}}"
+
+- name: change system accounts
+  user: name='{{ item }}' shell='/sbin/nologin' password='*'
+  with_items:
+    - '{{sys_accs.stdout_lines}}'