Improve VM based testing of SSH hardening (#878 )

update changelog
disable sshd socket activation first (#931 )
2026-03-20 22:24:57 +01:00 · 2026-03-20 14:11:16 +00:00 · 2026-03-20 15:06:59 +01:00 · 2026-03-14 10:53:31 +00:00 · 2026-03-14 11:51:58 +01:00 · 2026-03-14 11:51:31 +01:00
79 changed files with 888 additions and 437 deletions
@@ -5,11 +5,10 @@
 # option will be parsed relative to the CWD of execution.
 exclude_paths:
  - .cache/ # implicit unless exclude_paths is defined in config
+  - .ansible/ # somehow someone decided that the cache directory should be renamed
  # add all waivers individually, since exclude_files does not support globs
  - molecule/os_hardening/waivers.yaml
-  - molecule/ssh_hardening_bsd/waivers_freebsd13.yaml
-  - molecule/ssh_hardening_bsd/waivers_freebsd14.yaml
-  - molecule/ssh_hardening_bsd/waivers_openbsd7.yaml
+  - molecule/ssh_hardening_vm/waivers_*.yaml

 mock_roles:
  - geerlingguy.git
@@ -23,10 +23,10 @@ on:  # yamllint disable-line rule:truthy

 jobs:
  ansible-lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04

    steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

      - name: Lint Ansible Playbook
-        uses: ansible/ansible-lint@3b5bee19c2102ea35bc8619795a72c5c73797fc7 # v24
+        uses: ansible/ansible-lint@8ba9595a4acd1b906eb75568b34f6ef592cd1528 # v26
@@ -12,8 +12,8 @@ permissions:
 jobs:
  enforce-label:
    if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
    steps:
-      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
        with:
          repo-token: "${{ secrets.GITHUB_TOKEN }}"
@@ -9,20 +9,20 @@ on:  # yamllint disable-line rule:truthy
 jobs:
  deploy:
    if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
    steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

      # deploy the collection first, because if it fails, we don't want
      # to update the galaxy.yml
      - name: Deploy the collection
-        uses: artis3n/ansible_galaxy_collection@3368f56529a2ef47ef0ac1ecfcda039f90d0174a # v2
+        uses: artis3n/ansible_galaxy_collection@ffbca2460a5a1c600b941bbf1536bd61de1c2227 # v3
        with:
          api_key: ${{ secrets.GALAXY_API_KEY }}
          galaxy_version: ${{ github.event.release.tag_name }}

      # checkout master instead of the release-tag so we can push the galaxy.yml
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          ref: master

@@ -29,7 +29,7 @@ concurrency:

 jobs:
  build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -37,29 +37,34 @@ jobs:
      fail-fast: false
      matrix:
        molecule_distro:
+          - almalinux8
+          - almalinux9
+          # - almalinux10  # problem with baseline
          - centosstream9
          - rocky8
          - rocky9
+          # - rocky10 # problem with baseline
          - ubuntu2004
          - ubuntu2204
          - ubuntu2404
          - debian11
          - debian12
+          - debian13
          # - amazon  # geerlingguy.mysql does not support fedora
          # - arch  # geerlingguy.mysql does not support arch
          - opensuse_tumbleweed
          # - fedora  # geerlingguy.mysql does not support fedora
    steps:
      - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true

      - name: Set up Python
-        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
-          python-version: 3.12
+          python-version: 3.13
          cache: 'pip'

      - name: Install dependencies
@@ -67,9 +72,12 @@ jobs:
        working-directory: ansible_collections/devsec/hardening

      - name: Downgrade Ansible for Rocky 8 tests
-        run: pip install "ansible-core<2.17"
+        run: |
+            pip install "ansible-core<2.17"
+            ansible-galaxy collection install 'community.crypto:<3.0.0'
+            ansible-galaxy collection install 'community.general:<12.0.0'
        working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8'
+        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'

      # that was a hard one to fix. robert did it thankfully
      # https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212
@@ -28,7 +28,7 @@ concurrency:

 jobs:
  build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -36,29 +36,34 @@ jobs:
      fail-fast: false
      matrix:
        molecule_distro:
+          - almalinux8
+          - almalinux9
+          - almalinux10
          - centosstream9
          - rocky8
          - rocky9
+          - rocky10
          - ubuntu2004
          - ubuntu2204
          - ubuntu2404
          - debian11
          - debian12
+          - debian13
          - amazon2023
          # - arch  # needs to be fixed
          # - opensuse_tumbleweed  # needs to be fixed
          # - fedora  # no support from geerlingguy role
    steps:
      - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true

      - name: Set up Python
-        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
-          python-version: 3.12
+          python-version: 3.13
          cache: 'pip'

      - name: Install dependencies
@@ -66,9 +71,12 @@ jobs:
        working-directory: ansible_collections/devsec/hardening

      - name: Downgrade Ansible for Rocky 8 tests
-        run: pip install "ansible-core<2.17"
+        run: |
+            pip install "ansible-core<2.17"
+            ansible-galaxy collection install 'community.crypto:<3.0.0'
+            ansible-galaxy collection install 'community.general:<12.0.0'
        working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8'
+        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'

      # Molecule has problems detecting the proper location for installing roles
      # https://github.com/ansible/molecule/issues/3806
@@ -28,7 +28,7 @@ concurrency:

 jobs:
  build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -39,9 +39,13 @@ jobs:
          - molecule_distro: opensuse_tumbleweed
            molecule_docker_command: "/usr/lib/systemd/systemd"
        molecule_distro:
+          - almalinux8
+          - almalinux9
+          - almalinux10
          - centosstream9
          - rocky8
          - rocky9
+          - rocky10
          - fedora39
          - fedora40
          - ubuntu2004
@@ -49,21 +53,22 @@ jobs:
          - ubuntu2404
          - debian11
          - debian12
+          - debian13
          - amazon2023
          - arch
        molecule_docker_command:
          - "/lib/systemd/systemd"
    steps:
      - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true

      - name: Set up Python
-        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
-          python-version: 3.12
+          python-version: 3.13
          cache: 'pip'

      - name: Install dependencies
@@ -71,9 +76,12 @@ jobs:
        working-directory: ansible_collections/devsec/hardening

      - name: Downgrade Ansible for Rocky 8 tests
-        run: pip install "ansible-core<2.17"
+        run: |
+            pip install "ansible-core<2.17"
+            ansible-galaxy collection install 'community.crypto:<3.0.0'
+            ansible-galaxy collection install 'community.general:<12.0.0'
        working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8'
+        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'

      - name: Test with molecule
        run: molecule test -s os_hardening
@@ -9,6 +9,7 @@ on:  # yamllint disable-line rule:truthy
      - 'molecule/os_hardening_vm/**'
      - '.github/workflows/os_hardening_vm.yml'
      - 'requirements.txt'
+      - 'requirements-vm.txt'
  pull_request:
    branches: [master]
    paths:
@@ -16,6 +17,7 @@ on:  # yamllint disable-line rule:truthy
      - 'molecule/os_hardening_vm/**'
      - '.github/workflows/os_hardening_vm.yml'
      - 'requirements.txt'
+      - 'requirements-vm.txt'
  schedule:
    - cron: '0 6 * * 2'

@@ -36,6 +38,9 @@ jobs:
      fail-fast: false
      matrix:
        molecule_distro:
+          - almalinux/8
+          - almalinux/9
+          # - almalinux/10  # boot loop
          - generic/centos9s
          - generic/rocky8
          - generic/rocky9
@@ -50,7 +55,7 @@ jobs:
          - generic/arch
    steps:
      - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
@@ -60,15 +65,20 @@ jobs:
          source ~/.venv/ansible-collection-hardening/bin/activate
          python -m pip install --no-cache-dir --upgrade pip
          pip install -r requirements.txt
-          pip install python-vagrant
+          pip install -r requirements-vm.txt
        working-directory: ansible_collections/devsec/hardening

      - name: Downgrade Ansible for Rocky 8 tests
        run: |
          source ~/.venv/ansible-collection-hardening/bin/activate
          pip install "ansible-core<2.17"
+          ansible-galaxy collection install 'community.crypto:<3.0.0'
+          ansible-galaxy collection install 'community.general:<12.0.0'
        working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'generic/rocky8' || matrix.molecule_distro == 'generic/opensuse15'
+        if: >
+          matrix.molecule_distro == 'generic/rocky8' ||
+          matrix.molecule_distro == 'almalinux/8' ||
+          matrix.molecule_distro == 'generic/opensuse15'

      - name: Update Vagrant Box
        run: |
@@ -77,6 +87,8 @@ jobs:
      - name: Test with molecule
        run: |
          source ~/.venv/ansible-collection-hardening/bin/activate
+          # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
+          export MOLECULE_VAGRANT_PLUGIN_DIR=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')/molecule_plugins/vagrant
          molecule test -s os_hardening_vm
        env:
          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
@@ -11,16 +11,16 @@ on:  # yamllint disable-line rule:truthy
 jobs:
  prettier-md:
    if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
    timeout-minutes: 1

    steps:
      - name: Git checkout
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          ref: ${{ github.head_ref }}

      - name: Prettify code
-        uses: creyD/prettier_action@31355f8eef017f8aeba2e0bc09d8502b13dbbad1 # v4.3
+        uses: creyD/prettier_action@8c18391fdc98ed0d884c6345f03975edac71b8f0 # v4.6
        with:
          prettier_options: --write {**/*,*}.md
@@ -11,9 +11,9 @@ jobs:
  generate_changelog:
    name: create release draft
    if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
    steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          fetch-depth: 0
          ref: master
@@ -58,12 +58,12 @@ jobs:

      - name: Read CHANGELOG.md
        id: package
-        uses: juliangruber/read-file-action@b549046febe0fe86f8cb4f93c24e284433f9ab58 # v1
+        uses: juliangruber/read-file-action@271ff311a4947af354c6abcd696a306553b9ec18 # v1
        with:
          path: ./CHANGELOGRELEASE.md

      - name: Delete old drafts
-        uses: hugo19941994/delete-draft-releases@1bdca1ea7ffb25ae7f468a7bdb40056dae98175e # v1.0.1
+        uses: hugo19941994/delete-draft-releases@d375ad67d25fed7520a8020c3a6561fff5260c1e # v2.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

@@ -17,7 +17,7 @@ on:  # yamllint disable-line rule:truthy
 jobs:
  readme:
    name: create roles readme
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
    strategy:
      matrix:
        roles:
@@ -27,12 +27,12 @@ jobs:
          - ssh_hardening
    steps:
      - name: Check out code
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

      - name: Set up Python
-        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
-          python-version: 3.12
+          python-version: 3.13
          cache: 'pip'

      - name: Install dependencies
@@ -28,7 +28,7 @@ concurrency:

 jobs:
  build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -42,9 +42,13 @@ jobs:
          - molecule_distro: alpine
            molecule_docker_command: "/sbin/init"
        molecule_distro:
+          - almalinux8
+          - almalinux9
+          - almalinux10
          - centosstream9
          - rocky8
          - rocky9
+          - rocky10
          - fedora39
          - fedora40
          - ubuntu2004
@@ -52,21 +56,22 @@ jobs:
          - ubuntu2404
          - debian11
          - debian12
+          - debian13
          - amazon2023
          - arch
        molecule_docker_command:
          - "/lib/systemd/systemd"
    steps:
      - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true

      - name: Set up Python
-        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
-          python-version: 3.12
+          python-version: 3.13
          cache: 'pip'

      - name: Install dependencies
@@ -74,9 +79,12 @@ jobs:
        working-directory: ansible_collections/devsec/hardening

      - name: Downgrade Ansible for Rocky 8 tests
-        run: pip install "ansible-core<2.17"
+        run: |
+            pip install "ansible-core<2.17"
+            ansible-galaxy collection install 'community.crypto:<3.0.0'
+            ansible-galaxy collection install 'community.general:<12.0.0'
        working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8'
+        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'

      - name: Test with molecule
        run: molecule test -s ssh_hardening
@@ -1,56 +0,0 @@
---
-name: "devsec.ssh_hardening BSD"
-on:  # yamllint disable-line rule:truthy
-  workflow_dispatch:
-  push:
-    branches: [master]
-    paths:
-      - 'roles/ssh_hardening/**'
-      - 'molecule/ssh_hardening_bsd/**'
-      - '.github/workflows/ssh_hardening_bsd.yml'
-      - 'requirements.txt'
-  pull_request:
-    branches: [master]
-    paths:
-      - 'roles/ssh_hardening/**'
-      - 'molecule/ssh_hardening_bsd/**'
-      - '.github/workflows/ssh_hardening_bsd.yml'
-      - 'requirements.txt'
-  schedule:
-    - cron: '0 6 * * 5'
-
-concurrency:
-  group: >-
-    ${{ github.workflow }}-${{
-      github.event.pull_request.number || github.sha
-    }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    runs-on: self-hosted
-    env:
-      PY_COLORS: 1
-      ANSIBLE_FORCE_COLOR: 1
-    strategy:
-      fail-fast: false
-      matrix:
-        molecule_distro:
-          - openbsd7
-          - freebsd13
-          - freebsd14
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
-        with:
-          path: ansible_collections/devsec/hardening
-          submodules: true
-
-      - name: Update Vagrant Box
-        run: vagrant box update --box generic/${{ matrix.molecule_distro }} || true
-
-      - name: Test with molecule
-        run: molecule test -s ssh_hardening_bsd
-        env:
-          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
-        working-directory: ansible_collections/devsec/hardening
@@ -28,7 +28,7 @@ concurrency:

 jobs:
  build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -42,9 +42,13 @@ jobs:
          - molecule_distro: alpine
            molecule_docker_command: "/sbin/init"
        molecule_distro:
+          - almalinux8
+          - almalinux9
+          - almalinux10
          - centosstream9
          - rocky8
          - rocky9
+          - rocky10
          - fedora39
          - fedora40
          - ubuntu2004
@@ -52,21 +56,22 @@ jobs:
          - ubuntu2404
          - debian11
          - debian12
+          - debian13
          - amazon2023
          - arch
        molecule_docker_command:
          - "/lib/systemd/systemd"
    steps:
      - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true

      - name: Set up Python
-        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
-          python-version: 3.12
+          python-version: 3.13
          cache: 'pip'

      - name: Install dependencies
@@ -74,9 +79,12 @@ jobs:
        working-directory: ansible_collections/devsec/hardening

      - name: Downgrade Ansible for Rocky 8 tests
-        run: pip install "ansible-core<2.17"
+        run: |
+            pip install "ansible-core<2.17"
+            ansible-galaxy collection install 'community.crypto:<3.0.0'
+            ansible-galaxy collection install 'community.general:<12.0.0'
        working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8'
+        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'

      - name: Test with molecule
        run: molecule test -s ssh_hardening_custom_tests
@@ -0,0 +1,73 @@
+---
+name: "devsec.ssh_hardening VM"
+on:  # yamllint disable-line rule:truthy
+  workflow_dispatch:
+  push:
+    branches: [master]
+    paths:
+      - 'roles/ssh_hardening/**'
+      - 'molecule/ssh_hardening_vm/**'
+      - '.github/workflows/ssh_hardening_vm.yml'
+      - 'requirements.txt'
+      - 'requirements-vm.txt'
+  pull_request:
+    branches: [master]
+    paths:
+      - 'roles/ssh_hardening/**'
+      - 'molecule/ssh_hardening_vm/**'
+      - '.github/workflows/ssh_hardening_vm.yml'
+      - 'requirements.txt'
+      - 'requirements-vm.txt'
+  schedule:
+    - cron: '0 6 * * 5'
+
+concurrency:
+  group: >-
+    ${{ github.workflow }}-${{
+      github.event.pull_request.number || github.sha
+    }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: self-hosted
+    env:
+      PY_COLORS: 1
+      ANSIBLE_FORCE_COLOR: 1
+    strategy:
+      fail-fast: false
+      matrix:
+        molecule_distro:
+          - generic/openbsd7
+          - generic/freebsd13
+          - generic/freebsd14
+          - cloud-image/debian-13
+          - cloud-image/ubuntu-24.04
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        with:
+          path: ansible_collections/devsec/hardening
+          submodules: true
+
+      - name: Install dependencies
+        run: |
+          source ~/.venv/ansible-collection-hardening/bin/activate
+          python -m pip install --no-cache-dir --upgrade pip
+          pip install -r requirements.txt
+          pip install -r requirements-vm.txt
+        working-directory: ansible_collections/devsec/hardening
+
+      - name: Update Vagrant Box
+        run: |
+          vagrant box update --box ${{ matrix.molecule_distro }} || true
+
+      - name: Test with molecule
+        run: |
+          source ~/.venv/ansible-collection-hardening/bin/activate
+          # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
+          export MOLECULE_VAGRANT_PLUGIN_DIR=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')/molecule_plugins/vagrant
+          molecule test -s ssh_hardening_vm
+        env:
+          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
+        working-directory: ansible_collections/devsec/hardening
@@ -1,12 +1,175 @@
 # Changelog

-## [10.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.1.0) (2024-10-13)
+## [10.5.1](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.1) (2026-03-20)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.0...10.5.1)
+
+**Fixed bugs:**
+
+- fix flaky failures on Ubuntu 24.04 and newer by disabling sshd socket activation first [\#931](https://github.com/dev-sec/ansible-collection-hardening/pull/931) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([kuglimon](https://github.com/kuglimon))
+
+**Closed issues:**
+
+- SSH issue after running devsec.hardening.ssh\_hardening role [\#854](https://github.com/dev-sec/ansible-collection-hardening/issues/854)
+
+**Merged pull requests:**
+
+- chore\(deps\): update juliangruber/read-file-action digest to 271ff31 [\#937](https://github.com/dev-sec/ansible-collection-hardening/pull/937) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 8ba9595 [\#934](https://github.com/dev-sec/ansible-collection-hardening/pull/934) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update artis3n/ansible\_galaxy\_collection action to v3 [\#933](https://github.com/dev-sec/ansible-collection-hardening/pull/933) ([renovate[bot]](https://github.com/apps/renovate))
+
+## [10.5.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.0) (2026-01-22)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.4.0...10.5.0)
+
+**Implemented enhancements:**
+
+- fix: replace deprecated community.general.yaml callback plugin [\#918](https://github.com/dev-sec/ansible-collection-hardening/pull/918) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([Normo](https://github.com/Normo))
+- Consistently access facts via the ansible\_facts.\* namespace [\#917](https://github.com/dev-sec/ansible-collection-hardening/pull/917) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([Normo](https://github.com/Normo))
+- disable systemd audit logging [\#902](https://github.com/dev-sec/ansible-collection-hardening/pull/902) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([z-bsod](https://github.com/z-bsod))
+
+**Fixed bugs:**
+
+- /etc/sysctl.conf is no longer honored in Debian 13 [\#905](https://github.com/dev-sec/ansible-collection-hardening/issues/905)
+
+**Merged pull requests:**
+
+- chore\(deps\): update dependency jmespath to v1.1.0 [\#930](https://github.com/dev-sec/ansible-collection-hardening/pull/930) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/setup-python digest to a309ff8 [\#929](https://github.com/dev-sec/ansible-collection-hardening/pull/929) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint action to v26 [\#928](https://github.com/dev-sec/ansible-collection-hardening/pull/928) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update artis3n/ansible\_galaxy\_collection digest to 415a92b - autoclosed [\#927](https://github.com/dev-sec/ansible-collection-hardening/pull/927) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to a2bc8b8 [\#924](https://github.com/dev-sec/ansible-collection-hardening/pull/924) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/setup-python digest to 83679a8 [\#920](https://github.com/dev-sec/ansible-collection-hardening/pull/920) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/checkout action to v6 [\#919](https://github.com/dev-sec/ansible-collection-hardening/pull/919) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency molecule to v25.12.0 [\#914](https://github.com/dev-sec/ansible-collection-hardening/pull/914) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 40f24c2 [\#913](https://github.com/dev-sec/ansible-collection-hardening/pull/913) ([renovate[bot]](https://github.com/apps/renovate))
+- Update test environments to current Ansible version [\#909](https://github.com/dev-sec/ansible-collection-hardening/pull/909) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([schurzi](https://github.com/schurzi))
+- chore\(deps\): update ansible/ansible-lint digest to d7cd7cf [\#903](https://github.com/dev-sec/ansible-collection-hardening/pull/903) ([renovate[bot]](https://github.com/apps/renovate))
+
+## [10.4.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.4.0) (2025-10-22)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.3.1...10.4.0)
+
+**Implemented enhancements:**
+
+- Support Debian 13 [\#891](https://github.com/dev-sec/ansible-collection-hardening/issues/891)
+- Support EL10 [\#870](https://github.com/dev-sec/ansible-collection-hardening/issues/870)
+- Add support for current versions of Debian and EL [\#893](https://github.com/dev-sec/ansible-collection-hardening/pull/893) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Add SSH config for EL/AlmaLinux 10 [\#888](https://github.com/dev-sec/ansible-collection-hardening/pull/888) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([jonathanspw](https://github.com/jonathanspw))
+
+**Fixed bugs:**
+
+- Write sysctl config to separate file [\#907](https://github.com/dev-sec/ansible-collection-hardening/pull/907) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+
+**Closed issues:**
+
+- sysctl-34 - fs.protected\_regular not set [\#536](https://github.com/dev-sec/ansible-collection-hardening/issues/536)
+
+**Merged pull requests:**
+
+- Update ArchLinux test environment before testing [\#908](https://github.com/dev-sec/ansible-collection-hardening/pull/908) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- chore\(deps\): update actions/setup-python action to v6 [\#901](https://github.com/dev-sec/ansible-collection-hardening/pull/901) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/labeler action to v6 [\#900](https://github.com/dev-sec/ansible-collection-hardening/pull/900) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 8861a73 [\#899](https://github.com/dev-sec/ansible-collection-hardening/pull/899) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/checkout action to v5 [\#895](https://github.com/dev-sec/ansible-collection-hardening/pull/895) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency python to 3.13 [\#892](https://github.com/dev-sec/ansible-collection-hardening/pull/892) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency aar-doc to v2.3.0 [\#890](https://github.com/dev-sec/ansible-collection-hardening/pull/890) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 9765b87 [\#889](https://github.com/dev-sec/ansible-collection-hardening/pull/889) ([renovate[bot]](https://github.com/apps/renovate))
+- Improve OS support accuracy [\#887](https://github.com/dev-sec/ansible-collection-hardening/pull/887) ([jonathanspw](https://github.com/jonathanspw))
+- chore\(deps\): update hugo19941994/delete-draft-releases action to v2 [\#885](https://github.com/dev-sec/ansible-collection-hardening/pull/885) ([renovate[bot]](https://github.com/apps/renovate))
+
+## [10.3.1](https://github.com/dev-sec/ansible-collection-hardening/tree/10.3.1) (2025-07-24)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.3.0...10.3.1)
+
+**Fixed bugs:**
+
+- Readme states Ansible \>= 2.9.10, but it uses password\_expire\_warn from  2.16 [\#871](https://github.com/dev-sec/ansible-collection-hardening/issues/871)
+
+**Merged pull requests:**
+
+- Use fixed test env for BSD VMs [\#884](https://github.com/dev-sec/ansible-collection-hardening/pull/884) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Downgrade community.crypto for rocky8 [\#882](https://github.com/dev-sec/ansible-collection-hardening/pull/882) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- chore\(deps\): update dependency aar-doc to v2.2.0 [\#877](https://github.com/dev-sec/ansible-collection-hardening/pull/877) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update creyd/prettier\_action action to v4.6 [\#876](https://github.com/dev-sec/ansible-collection-hardening/pull/876) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 06f616d [\#873](https://github.com/dev-sec/ansible-collection-hardening/pull/873) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency ansible-core to v2.18.6 [\#872](https://github.com/dev-sec/ansible-collection-hardening/pull/872) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update creyd/prettier\_action action to v4.5 [\#869](https://github.com/dev-sec/ansible-collection-hardening/pull/869) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(ssh\_hardening\): ansible 2.19 compatibility [\#868](https://github.com/dev-sec/ansible-collection-hardening/pull/868) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
+- chore\(deps\): update ansible/ansible-lint digest to e98f9b3 [\#867](https://github.com/dev-sec/ansible-collection-hardening/pull/867) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/setup-python digest to a26af69 [\#866](https://github.com/dev-sec/ansible-collection-hardening/pull/866) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency ansible-core to v2.18.5 [\#865](https://github.com/dev-sec/ansible-collection-hardening/pull/865) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to c16f018 [\#863](https://github.com/dev-sec/ansible-collection-hardening/pull/863) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 6a4fcdb [\#862](https://github.com/dev-sec/ansible-collection-hardening/pull/862) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency aar-doc to v2.1.0 [\#861](https://github.com/dev-sec/ansible-collection-hardening/pull/861) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency ansible-core to v2.18.4 [\#860](https://github.com/dev-sec/ansible-collection-hardening/pull/860) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/setup-python digest to 8d9ed9a [\#859](https://github.com/dev-sec/ansible-collection-hardening/pull/859) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- Fix: ForwardAgent j2 template space  [\#856](https://github.com/dev-sec/ansible-collection-hardening/pull/856) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([cod3mas0n](https://github.com/cod3mas0n))
+- chore\(deps\): update artis3n/ansible\_galaxy\_collection digest to f6110ae [\#853](https://github.com/dev-sec/ansible-collection-hardening/pull/853) ([renovate[bot]](https://github.com/apps/renovate))
+
+## [10.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.3.0) (2025-02-25)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.2.0...10.3.0)
+
+**Implemented enhancements:**
+
+- Password expiry for users without password should not block SSH key based login [\#681](https://github.com/dev-sec/ansible-collection-hardening/issues/681)
+- Set number of warning days before password expires for existing users [\#839](https://github.com/dev-sec/ansible-collection-hardening/pull/839) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Normo](https://github.com/Normo))
+- Allow to override settings for sftponly users [\#794](https://github.com/dev-sec/ansible-collection-hardening/pull/794) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([mib1185](https://github.com/mib1185))
+
+**Closed issues:**
+
+- os\_hardening & sysctl\_overwrite with host\_vars [\#837](https://github.com/dev-sec/ansible-collection-hardening/issues/837)
+
+**Merged pull requests:**
+
+- chore\(deps\): update dependency ansible-core to v2.18.3 [\#852](https://github.com/dev-sec/ansible-collection-hardening/pull/852) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 49ded6a [\#851](https://github.com/dev-sec/ansible-collection-hardening/pull/851) ([renovate[bot]](https://github.com/apps/renovate))
+- Pin runner image to specific version to decouple from GitHub updates [\#847](https://github.com/dev-sec/ansible-collection-hardening/pull/847) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Refactor: combine multiple set\_fact into single jinja filter [\#846](https://github.com/dev-sec/ansible-collection-hardening/pull/846) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Tinyblargon](https://github.com/Tinyblargon))
+- chore\(deps\): update actions/setup-python digest to 4237552 [\#844](https://github.com/dev-sec/ansible-collection-hardening/pull/844) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency ansible-core to v2.18.2 [\#843](https://github.com/dev-sec/ansible-collection-hardening/pull/843) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency molecule to v25 [\#841](https://github.com/dev-sec/ansible-collection-hardening/pull/841) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint action to v25 [\#840](https://github.com/dev-sec/ansible-collection-hardening/pull/840) ([renovate[bot]](https://github.com/apps/renovate))
+
+## [10.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.2.0) (2024-12-23)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.1.0...10.2.0)
+
+**Implemented enhancements:**
+
+- Re-enable OpenBSD tests [\#826](https://github.com/dev-sec/ansible-collection-hardening/issues/826) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
+- Allow configuring the name\_format variable in auditd config [\#796](https://github.com/dev-sec/ansible-collection-hardening/issues/796) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Modify PAM to allow SSH key based logins with locked passwords [\#835](https://github.com/dev-sec/ansible-collection-hardening/pull/835) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- adding switch for ForwardAgent in ssh\_config [\#818](https://github.com/dev-sec/ansible-collection-hardening/pull/818) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Shizzlebix](https://github.com/Shizzlebix))
+
+**Fixed bugs:**
+
+- File system loop detected; ‘/bin/X11’ is part of the same file system loop as ‘/bin’." [\#815](https://github.com/dev-sec/ansible-collection-hardening/issues/815) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Not working ssh\_hardening on Centos 7  [\#813](https://github.com/dev-sec/ansible-collection-hardening/issues/813) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
+
+**Merged pull requests:**
+
+- chore\(deps\): update dependency molecule-plugins to v23.6.0 [\#834](https://github.com/dev-sec/ansible-collection-hardening/pull/834) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 4ce8e49 [\#832](https://github.com/dev-sec/ansible-collection-hardening/pull/832) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency molecule to v24.12.0 [\#831](https://github.com/dev-sec/ansible-collection-hardening/pull/831) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency ansible-core to v2.18.1 [\#829](https://github.com/dev-sec/ansible-collection-hardening/pull/829) ([renovate[bot]](https://github.com/apps/renovate))
+- Change installation source for OpenBSD tests [\#828](https://github.com/dev-sec/ansible-collection-hardening/pull/828) ([schurzi](https://github.com/schurzi))
+- chore\(deps\): update ansible/ansible-lint digest to 44be233 [\#825](https://github.com/dev-sec/ansible-collection-hardening/pull/825) ([renovate[bot]](https://github.com/apps/renovate))
+- Bump ansible-core from 2.17.5 to 2.17.6 [\#820](https://github.com/dev-sec/ansible-collection-hardening/pull/820) ([dependabot[bot]](https://github.com/apps/dependabot))
+- chore\(deps\): update dependency ansible-core to v2.18.0 [\#819](https://github.com/dev-sec/ansible-collection-hardening/pull/819) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency aar-doc to v2.0.1 [\#817](https://github.com/dev-sec/ansible-collection-hardening/pull/817) ([renovate[bot]](https://github.com/apps/renovate))
+- Update actions/setup-python digest to 0b93645 [\#814](https://github.com/dev-sec/ansible-collection-hardening/pull/814) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/checkout digest to 11bd719 [\#812](https://github.com/dev-sec/ansible-collection-hardening/pull/812) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+
+## [10.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.1.0) (2024-10-22)

 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.0.0...10.1.0)

 **Implemented enhancements:**

 - Ubuntu 24.04 support [\#764](https://github.com/dev-sec/ansible-collection-hardening/issues/764)
+- Add variable to set name\_format for auditd [\#810](https://github.com/dev-sec/ansible-collection-hardening/pull/810) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
 - feat\(ssh\): add alpine support [\#809](https://github.com/dev-sec/ansible-collection-hardening/pull/809) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Provide granular noop for ssh configuration [\#789](https://github.com/dev-sec/ansible-collection-hardening/pull/789) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([seven-beep](https://github.com/seven-beep))

@@ -17,12 +180,9 @@
 - Error: Missing privilege separation directory: /run/sshd [\#752](https://github.com/dev-sec/ansible-collection-hardening/issues/752)
 - fix\(ssh\_hardening\): test setting kex to false, remove wrong default [\#808](https://github.com/dev-sec/ansible-collection-hardening/pull/808) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))

-**Closed issues:**
-
- Dependency Dashboard [\#655](https://github.com/dev-sec/ansible-collection-hardening/issues/655)
-
 **Merged pull requests:**

+- Pin python dependencies and optimize GitHub Actions [\#811](https://github.com/dev-sec/ansible-collection-hardening/pull/811) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
 - fix\(cicd\): test idempotence on ssh custom tests [\#807](https://github.com/dev-sec/ansible-collection-hardening/pull/807) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Document correct quotes for ssh\_permit\_tunnel parameter [\#806](https://github.com/dev-sec/ansible-collection-hardening/pull/806) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([vmpr](https://github.com/vmpr))
 - fix\(docs\): add 'become: true' to example playbooks. fix \#787 [\#804](https://github.com/dev-sec/ansible-collection-hardening/pull/804) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
@@ -911,7 +1071,6 @@
 - Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-collection-hardening/pull/251) ([dustinmiller](https://github.com/dustinmiller))
 - Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
 - Make max\_log\_file\_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-collection-hardening/pull/246) ([jandd](https://github.com/jandd))
- Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-collection-hardening/pull/240) ([ghost](https://github.com/ghost))
 - Fedora - Use new auto ansible\_python\_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-collection-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
 - add test support for CentOS8 [\#237](https://github.com/dev-sec/ansible-collection-hardening/pull/237) ([yeoldegrove](https://github.com/yeoldegrove))
 - Support configuring SELinux and default to enforcing [\#236](https://github.com/dev-sec/ansible-collection-hardening/pull/236) ([jaredledvina](https://github.com/jaredledvina))
@@ -952,7 +1111,7 @@
 - remove prelink package, control package-09 [\#135](https://github.com/dev-sec/ansible-collection-hardening/pull/135) ([rndmh3ro](https://github.com/rndmh3ro))
 - style update [\#134](https://github.com/dev-sec/ansible-collection-hardening/pull/134) ([rndmh3ro](https://github.com/rndmh3ro))
 - Remove deprecated include for static tasks and use instead import\_tasks fix \#131 [\#132](https://github.com/dev-sec/ansible-collection-hardening/pull/132) ([HelioCampos](https://github.com/HelioCampos))
- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-collection-hardening/pull/130) ([fazlearefin](https://github.com/fazlearefin))
+- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-collection-hardening/pull/130) ([FazleArefin](https://github.com/FazleArefin))
 - install initramfs-tools [\#114](https://github.com/dev-sec/ansible-collection-hardening/pull/114) ([rndmh3ro](https://github.com/rndmh3ro))
 - omit empty variables [\#106](https://github.com/dev-sec/ansible-collection-hardening/pull/106) ([rndmh3ro](https://github.com/rndmh3ro))
 - Supports --check mode [\#93](https://github.com/dev-sec/ansible-collection-hardening/pull/93) ([conorsch](https://github.com/conorsch))
@@ -1019,7 +1178,6 @@
 - replace module parameter fixed [\#297](https://github.com/dev-sec/ansible-collection-hardening/pull/297) ([danielkubat](https://github.com/danielkubat))
 - Addressing issue \#255 [\#258](https://github.com/dev-sec/ansible-collection-hardening/pull/258) ([ljkimmel](https://github.com/ljkimmel))
 - Fix \#247, cleanup conditions [\#248](https://github.com/dev-sec/ansible-collection-hardening/pull/248) ([fernandezcuesta](https://github.com/fernandezcuesta))
- Fix error on applying the sysctl vars on containers [\#243](https://github.com/dev-sec/ansible-collection-hardening/pull/243) ([ghost](https://github.com/ghost))
 - Update location of NSA RHEL 5 Guide [\#235](https://github.com/dev-sec/ansible-collection-hardening/pull/235) ([jaredledvina](https://github.com/jaredledvina))
 - Fix typo [\#212](https://github.com/dev-sec/ansible-collection-hardening/pull/212) ([ruslo](https://github.com/ruslo))
 - Update modprobe to 0644 [\#211](https://github.com/dev-sec/ansible-collection-hardening/pull/211) ([joshuatalb](https://github.com/joshuatalb))
@@ -3,7 +3,7 @@
 [![devsec.os_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml)
 [![devsec.os_hardening VM](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml)
 [![devsec.ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml)
-[![devsec.ssh_hardening BSD](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml)
+[![devsec.ssh_hardening VM](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml)
 [![devsec.ssh_hardening with custom tests](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml)
 [![devsec.nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml)
 [![devsec.mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
@@ -13,9 +13,10 @@
 This collection provides battle tested hardening for:

 - Linux operating systems:
-  - CentOS 9
-  - Rocky Linux 8/9
-  - Debian 11/12
+  - CentOS Stream 9
+  - AlmaLinux 8/9/10
+  - Rocky Linux 8/9/10
+  - Debian 11/12/13
  - Ubuntu 20.04/22.04/24.04
  - Amazon Linux (some roles supported)
  - Arch Linux (some roles supported)
@@ -50,7 +51,7 @@ The other roles are in separate archives repositories:

 ## Minimum required Ansible-version

- Ansible >= 2.9.10
+- Ansible >= 2.16

 ## Included content

@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 10.0.0
+version: 10.5.0
 readme: README.md
 authors:
  - dev-sec <[email protected]>
@@ -12,22 +12,22 @@
        mysql_python_package_debian: python3-pymysql
      when:
        - mysql_python_package_debian is not defined
-        - ansible_distribution == "Ubuntu"
-        - ansible_distribution_major_version|int > 19
+        - ansible_facts.distribution == "Ubuntu"
+        - ansible_facts.distribution_major_version|int > 19

    - name: Determine required MySQL Python libraries.
      ansible.builtin.set_fact:
        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
      when:
        - mysql_python_package_debian is not defined
-        - ansible_distribution != "Ubuntu"
-        - ansible_distribution_major_version|int < 20
+        - ansible_facts.distribution != "Ubuntu"
+        - ansible_facts.distribution_major_version|int < 20

    - name: Use Python 3 on Suse
      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
-        - ansible_os_family == 'Suse'
+        - ansible_facts.os_family == 'Suse'

    - name: Include mysql_hardening role
      ansible.builtin.include_role:
@@ -22,7 +22,9 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      # Currently not supported by dev-sec.mysql role
+      # inject_facts_as_vars: false
 verifier:
  name: ansible

@@ -17,25 +17,25 @@
      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
-        - ansible_distribution == 'Debian'
-        - ansible_distribution_major_version|int >= 11
+        - ansible_facts.distribution == 'Debian'
+        - ansible_facts.distribution_major_version|int >= 11

    - name: Use Python 3 on Suse
      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
-        - ansible_os_family == 'Suse'
+        - ansible_facts.os_family == 'Suse'

    - name: Run the equivalent of "apt-get update && apt-get upgrade"
      ansible.builtin.apt:
        upgrade: safe
        update_cache: true
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'

    - name: Install required python packages on Suse
-      ansible.builtin.command: zypper -n install python-xml python3-rpm python3-PyMySQL
+      ansible.builtin.command: zypper -n install python311-rpm python311-PyMySQL
      changed_when: false
-      when: ansible_os_family == 'Suse'
+      when: ansible_facts.os_family == 'Suse'

    - name: Create missing directory
      ansible.builtin.file:
@@ -48,23 +48,23 @@
        mysql_python_package_debian: python3-pymysql
      when:
        - mysql_python_package_debian is not defined
-        - ansible_distribution == "Ubuntu"
-        - ansible_distribution_major_version|int > 19
+        - ansible_facts.distribution == "Ubuntu"
+        - ansible_facts.distribution_major_version|int > 19

    - name: Determine required MySQL Python libraries.
      ansible.builtin.set_fact:
        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
      when:
        - mysql_python_package_debian is not defined
-        - ansible_distribution != "Ubuntu"
-        - ansible_distribution_major_version|int < 20
+        - ansible_facts.distribution != "Ubuntu"
+        - ansible_facts.distribution_major_version|int < 20

    - name: Install required MySQL Python libraries on RHEL
      ansible.builtin.dnf:
        name: "{% if 'python3' in ansible_python_interpreter | default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
      when:
-        - ansible_os_family == "RedHat"
-        - ansible_distribution_major_version == "7"
+        - ansible_facts.os_family == "RedHat"
+        - ansible_facts.distribution_major_version == "7"

    - name: Install mysql with a generic Ansible role
      ansible.builtin.include_role:
@@ -11,14 +11,14 @@
      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
-        - ansible_os_family == 'Suse'
+        - ansible_facts.os_family == 'Suse'

    - name: Install procps for debian systems
      ansible.builtin.apt:
        name: procps
        state: present
        update_cache: true
-      when: ansible_distribution == 'Debian'
+      when: ansible_facts.distribution == 'Debian'

    - name: Include tests for the service
      ansible.builtin.include_tasks: verify_tasks/service.yml
@@ -21,7 +21,9 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      # Currently not supported by geerlingguy.nginx role
+      # inject_facts_as_vars: false
 verifier:
  name: ansible

@@ -7,12 +7,6 @@
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
-    - name: Install required tools on SuSE
-      community.general.zypper:
-        name: python-xml
-        state: present
-      when: ansible_facts.os_family == 'Suse'
-
    - name: Install required packages
      ansible.builtin.package:
        name: python3-apt
@@ -22,7 +16,7 @@
    - name: Set correct distribution Version for Amazon Linux
      ansible.builtin.set_fact:
        ansible_distribution_major_version: 7
-      when: ansible_distribution == 'Amazon'
+      when: ansible_facts.distribution == 'Amazon'

    - name: Install nginx with a generic Ansible role
      ansible.builtin.include_role:
@@ -12,7 +12,7 @@
        name: procps
        state: present
        update_cache: true
-      when: ansible_distribution == 'Debian'
+      when: ansible_facts.distribution == 'Debian'

 - name: Verify
  hosts: localhost
@@ -17,7 +17,8 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      inject_facts_as_vars: false
 verifier:
  name: ansible

@@ -16,11 +16,11 @@
      ansible.builtin.apt:
        upgrade: safe
        update_cache: true
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'

    - name: Install required tools on SuSE
      # cannot use zypper module, since it depends on python-xml
-      ansible.builtin.command: zypper -n install python-xml awk
+      ansible.builtin.command: zypper -n install awk
      changed_when: false
      when: ansible_facts.os_family == 'Suse'

@@ -20,6 +20,7 @@
        - verify_tasks/pw_ageing.yml
        - verify_tasks/netrc.yml
        - verify_tasks/ignore_home_folders.yml
+        - verify_tasks/ssh_auth_locked.yml

    # temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
    #    - name: Include PAM tests
@@ -19,7 +19,7 @@
    # this uses the date from the expire_date variable and subtracts the current date.
    # it should be bigger that the password_expire_min of the user "pw_no_ageing"
    that:
-      - ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_date_time.date | to_datetime('%Y-%m-%d')).days == 60
+      - ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_facts.date_time.date | to_datetime('%Y-%m-%d')).days == 60

 - name: Get Password Expiry warning days for pw_ageing
  ansible.builtin.shell: chage -l pw_ageing | grep "warning before password expires" | cut -d ":" -f 2
@@ -0,0 +1,90 @@
+---
+- name: Install tools
+  package:
+    name: "{{ item }}"
+    state: present
+  ignore_errors: true
+  loop:
+    - sshpass
+    - openssh
+    - openssh-clients
+    - openssh-server
+
+- name: Allow password Login for sshd
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    search_string: PasswordAuthentication no
+    line: PasswordAuthentication yes
+  when:
+    - ansible_facts.distribution == "Amazon"
+
+- name: Start sshd service
+  ansible.builtin.service:
+    name: "{{ item }}"
+    state: started
+  ignore_errors: true
+  loop:
+    - sshd
+    - ssh
+
+- name: Set password for test
+  ansible.builtin.set_fact:
+    test_pw: myTest!pw
+
+- name: Create locked_user
+  user:
+    name: locked_user
+    password: "{{ test_pw | password_hash('sha512') }}"
+
+- name: Create ssh-client-keypair
+  community.crypto.openssh_keypair:
+    path: /root/locked_user_id
+    type: ed25519
+    state: present
+  register: generated_key
+
+- name: Add ssh-public-key to locked_user
+  ansible.posix.authorized_key:
+    user: locked_user
+    key: "{{ generated_key.public_key }}"
+    state: present
+
+- name: Check successful login with password
+  ansible.builtin.shell:
+    cmd: sshpass -p {{ test_pw }} ssh -o StrictHostKeyChecking=no locked_user@localhost echo "success"
+
+- name: Check successful login with ssh key
+  ansible.builtin.shell:
+    cmd: ssh -i /root/locked_user_id -o StrictHostKeyChecking=no locked_user@localhost echo "success"
+
+- name: Set password change date for locked_user
+  ansible.builtin.shell:
+    cmd: chage -d 2020-01-01 locked_user
+
+- name: Check unsuccessful login with password
+  ansible.builtin.shell:
+    cmd: sshpass -p {{ test_pw }} ssh -o StrictHostKeyChecking=no locked_user@localhost echo "success"
+  register: output
+  ignore_errors: true
+
+- name: Assert check unsuccessful login
+  ansible.builtin.assert:
+    that:
+      - output.rc | int == 1
+      - "'WARNING: Your password has expired.' in output.stderr"
+      - "'success' not in output.stdout"
+  when:
+    - ansible_facts.os_family != "Suse"
+
+- name: Assert check unsuccessful login
+  ansible.builtin.assert:
+    that:
+      - output.rc | int == 5
+      - output.stderr | length == 0
+      - output.stdout | length == 0
+  when:
+    - ansible_facts.os_family == "Suse"
+
+- name: Check successful login with ssh key
+  ansible.builtin.shell:
+    cmd: ssh -i /root/locked_user_id -o StrictHostKeyChecking=no locked_user@localhost echo "success"
@@ -6,4 +6,4 @@
 - name: Check that shell_sys_acc's shell is still bash
  ansible.builtin.assert:
    that:
-      - getent_passwd['shell_sys_acc'][5] == "/bin/bash"
+      - ansible_facts.getent_passwd['shell_sys_acc'][5] == "/bin/bash"
@@ -30,7 +30,7 @@
        os_mnt_var_options: rw,nosuid,nodev,compress=zstd:1,subvol=var
      when:
        - ansible_facts.distribution == 'Fedora'
-        - ansible_distribution_major_version|int == 40
+        - ansible_facts.distribution_major_version|int == 40

    - name: Include os_hardening role
      ansible.builtin.include_role:
@@ -24,7 +24,10 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
+      library: "${MOLECULE_PROJECT_DIRECTORY}/plugins/modules:/usr/share/ansible:${MOLECULE_VAGRANT_PLUGIN_DIR}"
+      inject_facts_as_vars: false
 verifier:
  name: ansible
  env:
@@ -26,7 +26,7 @@
      ansible.builtin.dpkg_selections:
        name: grub-pc
        selection: hold
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'

    # we need to free up space, since the /boot partition in some Vagrant images is
    # pretty small and system updates might fail
@@ -35,26 +35,20 @@
        paths: /boot
        patterns: "initrd.img*"
      register: find_results
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'

    - name: Delete all initrd.img to free space on /boot
      ansible.builtin.file:
        path: "{{ item['path'] }}"
        state: absent
      with_items: "{{ find_results['files'] }}"
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'

    - name: Run the equivalent of "apt-get update && apt-get upgrade"
      ansible.builtin.apt:
        upgrade: safe
        update_cache: true
-      when: ansible_os_family == 'Debian'
-
-    - name: Install required tools on SuSE
-      # cannot use zypper module, since it depends on python-xml
-      ansible.builtin.command: zypper -n install python-xml
-      changed_when: false
-      when: ansible_facts.os_family == 'Suse'
+      when: ansible_facts.os_family == 'Debian'

    - name: Install required tools on fedora
      ansible.builtin.dnf:
@@ -65,14 +59,27 @@
          - python3-libselinux
      when: ansible_facts.distribution == 'Fedora'

+    - name: Install required tools on AlmaLinux
+      ansible.builtin.dnf:
+        name:
+          - initscripts
+      when: ansible_facts.distribution == 'AlmaLinux'
+
    - name: Install required tools on Arch
      community.general.pacman:
        name:
          - awk
-        state: present
+          - archlinux-keyring
+        state: latest
        update_cache: true
      when: ansible_facts.os_family == 'Archlinux'

+    - name: Run the equivalent of "pacman -Syu"
+      community.general.pacman:
+        update_cache: true
+        upgrade: true
+      when: ansible_facts.os_family == 'Archlinux'
+
    - name: Install required tools on RHEL # noqa ignore-errors
      ansible.builtin.dnf:
        name:
@@ -90,7 +97,6 @@
      ansible.posix.mount:
        path: /boot/efi
        state: unmounted
-      when: ansible_facts.distribution == 'Fedora'

    - name: Include YUM prepare tasks
      ansible.builtin.include_tasks: prepare_tasks/yum.yml
@@ -5,5 +5,5 @@
    - name: Make sure environment variable for MOLECULE_DISTRO is set
      ansible.builtin.assert:
        that:
-          - "lookup('env','MOLECULE_DISTRO')"
+          - "lookup('env','MOLECULE_DISTRO') | length > 0"
        fail_msg: "You need to set MOLECULE_DISTRO to a supported image name. See CONTRIBUTING.md"
@@ -17,7 +17,8 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      inject_facts_as_vars: false
  inventory:
    host_vars:
      # https://molecule.readthedocs.io/en/latest/examples.html#docker-with-non-privileged-user
@@ -12,27 +12,32 @@
        ansible_python_interpreter: /usr/bin/python3
      when: ansible_facts.distribution == 'Fedora'

-    - name: Install packages # noqa ignore-errors
+    - name: Install dnf packages # noqa ignore-errors
      ansible.builtin.dnf:
        name:
          - openssh-clients
          - openssh-server
+        state: present
+        update_cache: true
+      ignore_errors: true
+
+    - name: Install libselinux-python # noqa ignore-errors
+      ansible.builtin.dnf:
+        name:
          - libselinux-python
        state: present
        update_cache: true
      ignore_errors: true

-    - name: Install packages # noqa ignore-errors
+    - name: Install procps-ng # noqa ignore-errors
      ansible.builtin.dnf:
        name:
-          - openssh-clients
-          - openssh-server
          - procps-ng
        state: present
        update_cache: true
      ignore_errors: true

-    - name: Install packages # noqa ignore-errors
+    - name: Install apt packages # noqa ignore-errors
      ansible.builtin.apt:
        name:
          - openssh-client
@@ -47,7 +52,7 @@
      changed_when: false
      when: ansible_facts.os_family == 'Suse'

-    - name: Install packages
+    - name: Install packages on SuSE
      community.general.zypper:
        name:
          - openssh
@@ -70,11 +75,6 @@
        update_cache: true
      when: ansible_facts.os_family == 'Archlinux'

-    - name: Create ssh host keys # noqa ignore-errors
+    - name: Create ssh host keys # noqa ignore-errors no-changed-when
      ansible.builtin.command: ssh-keygen -A
-      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
-        or ansible_facts.distribution == "Fedora"
-        or ansible_facts.distribution == "Amazon"
-        or ansible_facts.os_family == "Suse"
-      changed_when: false
      ignore_errors: true
@@ -17,7 +17,8 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      inject_facts_as_vars: false
 verifier:
  name: ansible

@@ -12,27 +12,32 @@
        ansible_python_interpreter: /usr/bin/python3
      when: ansible_facts.distribution == 'Fedora'

-    - name: Install packages # noqa ignore-errors
+    - name: Install dnf packages # noqa ignore-errors
      ansible.builtin.dnf:
        name:
          - openssh-clients
          - openssh-server
+        state: present
+        update_cache: true
+      ignore_errors: true
+
+    - name: Install libselinux-python # noqa ignore-errors
+      ansible.builtin.dnf:
+        name:
          - libselinux-python
        state: present
        update_cache: true
      ignore_errors: true

-    - name: Install packages # noqa ignore-errors
+    - name: Install procps-ng # noqa ignore-errors
      ansible.builtin.dnf:
        name:
-          - openssh-clients
-          - openssh-server
          - procps-ng
        state: present
        update_cache: true
      ignore_errors: true

-    - name: Install packages # noqa ignore-errors
+    - name: Install apt packages # noqa ignore-errors
      ansible.builtin.apt:
        name:
          - openssh-client
@@ -47,7 +52,7 @@
      changed_when: false
      when: ansible_facts.os_family == 'Suse'

-    - name: Install packages
+    - name: Install packages on SuSE
      community.general.zypper:
        name:
          - openssh
@@ -70,11 +75,6 @@
        update_cache: true
      when: ansible_facts.os_family == 'Alpine'

-    - name: Create ssh host keys # noqa ignore-errors
+    - name: Create ssh host keys # noqa ignore-errors no-changed-when
      ansible.builtin.command: ssh-keygen -A
-      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
-        or ansible_facts.distribution == "Fedora"
-        or ansible_facts.distribution == "Amazon"
-        or ansible_facts.os_family == "Suse"
-      changed_when: false
      ignore_errors: true
@@ -8,7 +8,7 @@ platforms:
  # since we also need to use different OS users to run the tests because of how molecule operates,
  # the VM names must be predictable by OS user (to clean up canceled runs)
  - name: ${USER}
-    box: generic/${MOLECULE_DISTRO}
+    box: ${MOLECULE_DISTRO}
    memory: 1024
    cpus: 2
 provisioner:
@@ -20,7 +20,10 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
+      library: "${MOLECULE_PROJECT_DIRECTORY}/plugins/modules:/usr/share/ansible:${MOLECULE_VAGRANT_PLUGIN_DIR}"
+      inject_facts_as_vars: false
 verifier:
  name: ansible
  env:
@@ -4,11 +4,17 @@
  become: true
  gather_facts: false
  tasks:
+    - name: Change installation source
+      # temporary fix for https://github.com/lavabit/robox/issues/305
+      ansible.builtin.raw: echo "https://ftp.eu.openbsd.org/pub/OpenBSD" > /etc/installurl
+      changed_when: false
+      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
+
    - name: Install python
      # BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
-      ansible.builtin.raw: pkg_add python%3.10
+      ansible.builtin.raw: pkg_add -I python%3.11
      changed_when: false
-      when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
+      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'

 - name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
  hosts: all
@@ -9,7 +9,7 @@
        dest: /usr/bin/type
        state: hard
        mode: "0770"
-      when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
+      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'

 - name: Verify
  hosts: localhost
@@ -36,7 +36,7 @@
      ansible.builtin.command: >
        docker run --rm
        --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
-        --volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') }}.yaml:/waivers.yaml
+        --volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') | regex_replace('^.*/', '') }}.yaml:/waivers.yaml
        docker.io/cincproject/auditor exec
        --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
        -t ssh://{{ lookup('env', 'USER') }}
@@ -0,0 +1,2 @@
+---
+{}
@@ -0,0 +1,2 @@
+---
+{}
@@ -0,0 +1,2 @@
+---
+{}
@@ -0,0 +1 @@
+molecule-plugins[vagrant]==25.8.12
@@ -1,6 +1,7 @@
-molecule==24.9.0
-molecule-plugins[docker]==23.5.3
-ansible-core==2.17.5
+molecule==25.12.0
+molecule-plugins[docker]==25.8.12
+ansible-core==2.19.3
 docker==7.1.0
-jmespath==1.0.1
-aar-doc==2.0.0
+jmespath==1.1.0
+aar-doc==2.3.0
+passlib==1.7.4
@@ -24,20 +24,19 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
 <!-- BEGIN_ANSIBLE_DOCS -->

 ## Supported Operating Systems
-
 - EL
-  - 8, 9
+  - 8, 9, 10
 - Ubuntu
  - focal, jammy, noble
 - Debian
-  - bullseye, bookworm
+  - trixie, bookworm, bullseye
 - Amazon
 - opensuse

 ## Role Variables

 - `mysql_daemon_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Whether to enable the MySQL-service so it starts on boot
  - Type: bool
  - Required: no
@@ -52,7 +51,7 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
  - Type: int
  - Required: no
 - `mysql_hardening_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Whether to run the hardening
  - Type: bool
  - Required: no
@@ -87,12 +86,12 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
  - Type: int
  - Required: no
 - `mysql_hardening_restart_mysql`
-  - Default: `true`
+  - Default: `True`
  - Description: Restart mysql after running this role
  - Type: bool
  - Required: no
 - `mysql_hardening_skip_grant_tables:`
-  - Default: `false`
+  - Default: `False`
  - Description: [skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)
  - Type: bool
  - Required: no
@@ -102,17 +101,17 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
  - Type: int
  - Required: no
 - `mysql_remove_anonymous_users`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to `false` to keep users without authentication
  - Type: bool
  - Required: no
 - `mysql_remove_remote_root`
-  - Default: `true`
+  - Default: `True`
  - Description: If `true`, root can only connect from localhost. Set to `false` to not remove remote root users.
  - Type: bool
  - Required: no
 - `mysql_remove_test_database`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to `false` to keep the test database
  - Type: bool
  - Required: no
@@ -10,6 +10,7 @@ galaxy_info:
      versions:
        - "8"
        - "9"
+        - "10"
    - name: Ubuntu
      versions:
        - focal
@@ -17,8 +18,9 @@ galaxy_info:
        - noble
    - name: Debian
      versions:
-        - bullseye
+        - trixie
        - bookworm
+        - bullseye
    - name: Amazon
    - name: opensuse
  galaxy_tags:
@@ -17,21 +17,20 @@ It works with the following nginx-roles, including, but not limited to:
 <!-- BEGIN_ANSIBLE_DOCS -->

 ## Supported Operating Systems
-
 - EL
-  - 8, 9
+  - 8, 9, 10
 - Ubuntu
  - focal, jammy, noble
 - Debian
-  - bookworm, bullseye
+  - trixie, bookworm, bullseye
 - Amazon

 ## Role Variables

 - `nginx_add_header`
-  - Default: `["X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"", "Content-Security-Policy \\\"script-src 'self'; object-src 'self'\\\""]`
+  - Default: `['X-Frame-Options SAMEORIGIN', 'X-Content-Type-Options nosniff', 'X-XSS-Protection "1; mode=block"', 'Content-Security-Policy \\"script-src \'self\'; object-src \'self\'\\"']`
  - Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See [nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `nginx_client_body_buffer_size`
  - Default: `1k`
@@ -104,7 +103,7 @@ It works with the following nginx-roles, including, but not limited to:
  - Type: str
  - Required: no
 - `nginx_remove_default_site`
-  - Default: `true`
+  - Default: `True`
  - Description: Disables the default site. Set to false to enable the default site in nginx.
  - Type: bool
  - Required: no
@@ -10,6 +10,7 @@ galaxy_info:
      versions:
        - "8"
        - "9"
+        - "10"
    - name: Ubuntu
      versions:
        - focal
@@ -17,6 +18,7 @@ galaxy_info:
        - noble
    - name: Debian
      versions:
+        - trixie
        - bookworm
        - bullseye
    - name: Amazon
@@ -94,6 +94,18 @@ We are setting this sysctl to a default of `32`, some systems only support small
      vm.mmap_rnd_bits: 16
 ```

+### password expiry and SSH key based logins
+
+With default PAM configuration setting a password expiry for users will also block SSH key logins after the password has expired.
+We have added a flag for PAM to ignore the expiry if SSH keys or other login mechanisms are used.
+If you choose to use your own PAM configuration please adjust it accordingly to contain `no_pass_expiry` in the `account` stage for the `pam_unix.so` module.
+
+A valid example would look like this:
+
+```text
+account     required      pam_unix.so no_pass_expiry
+```
+
 ## Testing with inspec

 If you're using inspec to test your machines after applying this role, please make sure to add the connecting user to the `os_ignore_users`-variable.
@@ -145,13 +157,12 @@ This role is mostly based on guides by:
 <!-- BEGIN_ANSIBLE_DOCS -->

 ## Supported Operating Systems
-
 - EL
-  - 8, 9
+  - 8, 9, 10
 - Ubuntu
  - focal, jammy, noble
 - Debian
-  - bookworm, bullseye
+  - trixie, bookworm, bullseye
 - Amazon
 - Fedora
 - ArchLinux
@@ -161,7 +172,7 @@ This role is mostly based on guides by:
 ## Role Variables

 - `os_apt_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to disable installing and configuring apt.
  - Type: bool
  - Required: no
@@ -191,7 +202,7 @@ This role is mostly based on guides by:
  - Type: str
  - Required: no
 - `os_auditd_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to disable installing and configuring auditd.
  - Type: bool
  - Required: no
@@ -220,6 +231,16 @@ This role is mostly based on guides by:
  - Description: Defines the behaviour of auditd when its log file is filled up. Possible other values are described in the auditd.conf man page. The most common alternative to the default may be `rotate`.
  - Type: str
  - Required: no
+- `os_auditd_name_format`
+  - Default: `NONE`
+  - Description: This keyword specifies how computer node names are inserted into the audit event stream.
+  - Type: str
+  - Required: no
+  - Choices:
+    - NONE
+    - hostname
+    - fqd
+    - numeric
 - `os_auditd_num_logs`
  - Default: `5`
  - Description: This keyword specifies the number of log files to keep if `rotate` is given as the max_log_file_action. The value given must be numeric.
@@ -236,7 +257,7 @@ This role is mostly based on guides by:
  - Type: str
  - Required: no
 - `os_auth_allow_homeless`
-  - Default: `false`
+  - Default: `False`
  - Description: true if to allow users without home to login.
  - Type: bool
  - Required: no
@@ -256,12 +277,12 @@ This role is mostly based on guides by:
  - Type: int
  - Required: no
 - `os_auth_pam_oddjob_mkhomedir`
-  - Default: `false`
+  - Default: `False`
  - Description: Enables automatic homedir e.g. in FreeIPA environments
  - Type: bool
  - Required: no
 - `os_auth_pam_passwdqc_enable`
-  - Default: `true`
+  - Default: `True`
  - Description: true if you want to use strong password checking in PAM using passwdqc.
  - Type: bool
  - Required: no
@@ -301,9 +322,9 @@ This role is mostly based on guides by:
  - Type: int
  - Required: no
 - `os_auth_root_ttys`
-  - Default: `["console", "tty1", "tty2", "tty3", "tty4", "tty5", "tty6"]`
+  - Default: `['console', 'tty1', 'tty2', 'tty3', 'tty4', 'tty5', 'tty6']`
  - Description: A list of TTYs, from which root can log in, see `man securetty` for reference
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `os_auth_sub_gid_count`
  - Default: `65536`
@@ -356,67 +377,67 @@ This role is mostly based on guides by:
  - Type: str
  - Required: no
 - `os_chmod_home_folders`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to `false` to disable "chmod 700" of home folders for regular users
  - Type: bool
  - Required: no
 - `os_chmod_rootuser_home_folder`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to `false` to disable "chmod 700" of root's home folder
  - Type: bool
  - Required: no
 - `os_cron_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to disable installing and configuring cron.
  - Type: bool
  - Required: no
 - `os_ctrlaltdel_disabled`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to true to disable ctrl-alt-delete key combination.
  - Type: bool
  - Required: no
 - `os_env_extra_user_paths`
-  - Default: `"[]"`
+  - Default: `[]`
  - Description: Specify additional paths that should be checked for binaries where access will be minimized
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `os_env_user_paths`
-  - Default: `["/usr/local/sbin", "/usr/local/bin", "/usr/sbin", "/usr/bin", "/sbin", "/bin"]`
+  - Default: `['/usr/local/sbin', '/usr/local/bin', '/usr/sbin', '/usr/bin', '/sbin', '/bin']`
  - Description: Specify paths that should be checked for binaries where access will be minimized
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `os_filesystem_whitelist`
-  - Default: `"[]"`
+  - Default: `[]`
  - Description: A list of filesystems that should not be disabled
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `os_hardening_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Whether to run the hardening
  - Type: bool
  - Required: no
 - `os_ignore_home_folder_users`
-  - Default: `"[]"`
+  - Default: `[]`
  - Description: Specify user accounts, whose home folders shouldn't be chmodded to 700 when "os_chmod_home_folders" is enabled.
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `os_ignore_users`
-  - Default: `["vagrant", "kitchen"]`
+  - Default: `['vagrant', 'kitchen']`
  - Description: Specify system accounts whose login should not be disabled and password not changed
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `os_limits_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to disable installing and configuring limits.
  - Type: bool
  - Required: no
 - `os_login_defs_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to disable installing and configuring login_defs for newly created users.
  - Type: bool
  - Required: no
 - `os_minimize_access_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to disable installing and configuring minimize_access.
  - Type: bool
  - Required: no
@@ -431,7 +452,7 @@ This role is mostly based on guides by:
  - Type: str
  - Required: no
 - `os_mnt_boot_enabled`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to true to configure /boot mountpoint
  - Type: bool
  - Required: no
@@ -466,7 +487,7 @@ This role is mostly based on guides by:
  - Type: str
  - Required: no
 - `os_mnt_dev_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to ignore /dev mountpoint
  - Type: bool
  - Required: no
@@ -496,7 +517,7 @@ This role is mostly based on guides by:
  - Type: str
  - Required: no
 - `os_mnt_dev_shm_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to ignore /dev/shm mountpoint
  - Type: bool
  - Required: no
@@ -536,7 +557,7 @@ This role is mostly based on guides by:
  - Type: str
  - Required: no
 - `os_mnt_home_enabled`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to true to configure /home mountpoint
  - Type: bool
  - Required: no
@@ -571,7 +592,7 @@ This role is mostly based on guides by:
  - Type: str
  - Required: no
 - `os_mnt_run_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to ignore /run mountpoint
  - Type: bool
  - Required: no
@@ -606,7 +627,7 @@ This role is mostly based on guides by:
  - Type: str
  - Required: no
 - `os_mnt_tmp_enabled`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to true to configure /tmp mountpoint
  - Type: bool
  - Required: no
@@ -641,7 +662,7 @@ This role is mostly based on guides by:
  - Type: str
  - Required: no
 - `os_mnt_var_enabled`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to true to configure /var mountpoint
  - Type: bool
  - Required: no
@@ -661,7 +682,7 @@ This role is mostly based on guides by:
  - Type: str
  - Required: no
 - `os_mnt_var_log_audit_enabled`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to true to configure /var/log/audit mountpoint
  - Type: bool
  - Required: no
@@ -696,7 +717,7 @@ This role is mostly based on guides by:
  - Type: str
  - Required: no
 - `os_mnt_var_log_enabled`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to true to configure /var/log mountpoint
  - Type: bool
  - Required: no
@@ -746,7 +767,7 @@ This role is mostly based on guides by:
  - Type: str
  - Required: no
 - `os_mnt_var_tmp_enabled`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to true to configure /var/tmp mountpoint
  - Type: bool
  - Required: no
@@ -771,47 +792,47 @@ This role is mostly based on guides by:
  - Type: str
  - Required: no
 - `os_modprobe_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to disable installing and configuring modprobe.
  - Type: bool
  - Required: no
 - `os_netrc_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Configure filesystem for existence of .netrc file in homedir
  - Type: bool
  - Required: no
 - `os_netrc_whitelist_user`
-  - Default: `"[]"`
+  - Default: `[]`
  - Description: Add list of user to allow creation of .netrc in users homedir
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `os_pam_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to disable installing and configuring pam.
  - Type: bool
  - Required: no
 - `os_profile_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to disable installing and configuring profile.
  - Type: bool
  - Required: no
 - `os_remove_additional_root_users`
-  - Default: `false`
+  - Default: `False`
  - Description: When enabled and there are multiple users with UID=0, only "root" will be kept. Others will be deleted.
  - Type: bool
  - Required: no
 - `os_rhosts_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to disable installing and configuring rhosts.
  - Type: bool
  - Required: no
 - `os_rootuser_pw_ageing`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to true to enforce password age settings for root user(s)
  - Type: bool
  - Required: no
 - `os_securetty_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to disable installing and configuring securetty.
  - Type: bool
  - Required: no
@@ -821,57 +842,57 @@ This role is mostly based on guides by:
  - Type: int
  - Required: no
 - `os_security_init_prompt`
-  - Default: `true`
+  - Default: `True`
  - Description: The PROMPT option provides console users the ability to interactively boot the system and select which services to start on boot.
  - Type: bool
  - Required: no
 - `os_security_init_single`
-  - Default: `false`
+  - Default: `False`
  - Description: Single-user mode is intended as a system recovery method, providing a single user root access to the system by providing a boot option at startup. By default, no authentication is performed if single-user mode is selected. To require entry of the root password even if the system is started in single-user mode, set this to false
  - Type: bool
  - Required: no
 - `os_security_kernel_enable_core_dump`
-  - Default: `false`
+  - Default: `False`
  - Description: kernel is crashing or otherwise misbehaving and a kernel core dump is created.
  - Type: bool
  - Required: no
 - `os_security_packages_clean`
-  - Default: `true`
+  - Default: `True`
  - Description: removes packages with known issues. See section packages.
  - Type: bool
  - Required: no
 - `os_security_packages_list`
-  - Default: `["xinetd", "inetd", "ypserv", "telnet-server", "rsh-server", "prelink"]`
+  - Default: `['xinetd', 'inetd', 'ypserv', 'telnet-server', 'rsh-server', 'prelink']`
  - Description: List of deprecated or insecure packages to remove
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `os_security_suid_sgid_blacklist`
-  - Default: `"[]"`
+  - Default: `[]`
  - Description: a list of paths which should have their SUID/SGID bits removed.
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `os_security_suid_sgid_enforce`
-  - Default: `true`
+  - Default: `True`
  - Description: true if you want to reduce SUID/SGID bits. There is already a list of items which are searched for configured, but you can also add your own.
  - Type: bool
  - Required: no
 - `os_security_suid_sgid_remove_from_unknown`
-  - Default: `false`
+  - Default: `False`
  - Description: true if you want to remove SUID/SGID bits from any file, that is not explicitly configured in a `blacklist`. This will make every Ansible-run search through the mounted filesystems looking for SUID/SGID bits that are not configured in the default and user blacklist. If it finds an SUID/SGID bit, it will be removed, unless this file is in your `whitelist`.
  - Type: bool
  - Required: no
 - `os_security_suid_sgid_whitelist`
-  - Default: `"[]"`
+  - Default: `[]`
  - Description: a list of paths which should not have their SUID/SGID bits altered.
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `os_security_users_allow`
-  - Default: `"[]"`
+  - Default: `[]`
  - Description: list of things, that a user is allowed to do. May contain `change_user`.
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `os_selinux_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to disable installing and configuring selinux.
  - Type: bool
  - Required: no
@@ -896,39 +917,39 @@ This role is mostly based on guides by:
  - Type: int
  - Required: no
 - `os_sysctl_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to disable installing and configuring sysctl.
  - Type: bool
  - Required: no
 - `os_unused_filesystems`
-  - Default: `["cramfs", "freevxfs", "jffs2", "hfs", "hfsplus", "squashfs", "udf", "vfat", "dccp", "rds", "sctp", "tipc"]`
+  - Default: `['cramfs', 'freevxfs', 'jffs2', 'hfs', 'hfsplus', 'squashfs', 'udf', 'vfat', 'dccp', 'rds', 'sctp', 'tipc']`
  - Description: Disable this list of unused filesystems
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `os_user_accounts_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to disable installing and configuring user_accounts.
  - Type: bool
  - Required: no
 - `os_user_pw_ageing`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to disable password age enforcement on existing users
  - Type: bool
  - Required: no
 - `os_users_without_password_ageing`
-  - Default: `"[]"`
+  - Default: `[]`
  - Description: List of users, where password ageing should not be enforced even if "os_user_pw_ageing" is enabled
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `os_yum_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to false to disable installing and configuring yum.
  - Type: bool
  - Required: no
 - `os_yum_repo_file_whitelist`
-  - Default: `"[]"`
+  - Default: `[]`
  - Description: List of yum repository files under /etc/yum.repos.d/ which should not be altered.
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `proc_mnt_options`
  - Default: `rw,nosuid,nodev,noexec,relatime`
@@ -966,7 +987,7 @@ This role is mostly based on guides by:
  - Type: str
  - Required: no
 - `ufw_enable_ipv6`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to `true` to apply rules to support IPv6 (no means only IPv6 on loopback accepted).
  - Type: bool
  - Required: no
@@ -986,7 +1007,7 @@ This role is mostly based on guides by:
  - Type: str
  - Required: no
 - `ufw_manage_defaults`
-  - Default: `true`
+  - Default: `True`
  - Description: true means apply all settings with `ufw_` prefix.
  - Type: bool
  - Required: no
@@ -146,7 +146,7 @@ sysctl_config:
  # The PTRACE system is used for debugging.  With it, a single user process
  # can attach to any other dumpable process owned by the same user.  In the
  # case of malicious software, it is possible to use PTRACE to access
-  # credentials that exist in memory (re-using existing SSH connections,
+  # credentials that exist in memory (reusing existing SSH connections,
  # extracting GPG agent information, etc).
  #
  # A PTRACE scope of "0" is the more permissive mode.  A scope of "1" limits
@@ -27,3 +27,8 @@
    path: "{{ item }}"
    state: remounted
  loop: "{{ mountpoints_changed }}"
+
+- name: Restart journald
+  ansible.builtin.systemd:
+    name: systemd-journald.service
+    state: restarted
@@ -4,12 +4,13 @@ galaxy_info:
  description: This Ansible role provides numerous security-related ssh configurations, providing all-round base protection.
  company: Hardening Framework Team
  license: Apache License 2.0
-  min_ansible_version: "2.11"
+  min_ansible_version: "2.16"
  platforms:
    - name: EL
      versions:
        - "8"
        - "9"
+        - "10"
    - name: Ubuntu
      versions:
        - focal
@@ -17,6 +18,7 @@ galaxy_info:
        - noble
    - name: Debian
      versions:
+        - trixie
        - bookworm
        - bullseye
    - name: Amazon
@@ -16,3 +16,15 @@
    - Restart auditd via service
    - Restart auditd via systemd
  tags: auditd
+
+- name: Disable systemd-journald.audit
+  when:
+    - ansible_facts.os_family != 'Suse'  # socket doesn't seem to exist on suse
+  ansible.builtin.systemd:
+    name: systemd-journald-audit.socket
+    state: stopped
+    enabled: false
+    masked: true
+  notify:
+    - Restart journald
+  tags: auditd
@@ -4,4 +4,4 @@
    name: ctrl-alt-del.target
    masked: true
    daemon_reload: true
-  when: ansible_service_mgr == "systemd"
+  when: ansible_facts.service_mgr == "systemd"
@@ -37,7 +37,7 @@
        group: root
        mode: "0755"
        state: directory
-      when: ansible_service_mgr == "systemd"
+      when: ansible_facts.service_mgr == "systemd"

    - name: Create custom.conf for disabling coredumps
      ansible.builtin.template:
@@ -46,7 +46,7 @@
        owner: root
        group: root
        mode: "0644"
-      when: ansible_service_mgr == "systemd"
+      when: ansible_facts.service_mgr == "systemd"
      notify: Reload systemd

 - name: Enable coredumps
@@ -56,7 +56,7 @@
      ansible.builtin.file:
        path: /etc/systemd/coredump.conf.d
        state: absent
-      when: ansible_service_mgr == "systemd"
+      when: ansible_facts.service_mgr == "systemd"
      notify: Reload systemd

    - name: Remove 10.hardcore.conf config file
@@ -89,7 +89,7 @@

 - name: Generate list of current available mounted filesystems on the system
  ansible.builtin.set_fact:
-    mountpoints_list: "{{ ansible_mounts | map(attribute='mount') | list }}"
+    mountpoints_list: "{{ ansible_facts.mounts | map(attribute='mount') | list }}"

 - name: Append special devices list to valid mountpoint list
  ansible.builtin.set_fact:
@@ -13,7 +13,7 @@
    - mount.enabled | bool
    - mount.path in mountpoints_list
  vars:
-    mountinfo: "{{ ansible_mounts | selectattr('mount', 'equalto', mount.path) | list | first | default(None) }}"
+    mountinfo: "{{ ansible_facts.mounts | selectattr('mount', 'equalto', mount.path) | list | first | default(None) }}"
  notify: Remount filesystems

 - name: "Check for existence of mount {{ mount.path }}"
@@ -18,7 +18,7 @@

 - name: Remove used filesystems from fs-list
  ansible.builtin.set_fact:
-    os_unused_filesystems: "{{ os_unused_filesystems | difference(ansible_mounts | map(attribute='fstype') | list) }}"
+    os_unused_filesystems: "{{ os_unused_filesystems | difference(ansible_facts.mounts | map(attribute='fstype') | list) }}"

 - name: Disable unused filesystems | os-10
  ansible.builtin.template:
@@ -27,6 +27,24 @@
  when:
    - ansible_facts.os_family == 'RedHat'

+- name: Allow Login with SSH Keys, when user password is expired
+  ansible.builtin.lineinfile:
+    path: /etc/pam.d/system-auth
+    backrefs: true
+    regexp: "^(account.*pam_unix.so(?!.*no_pass_expiry).*)$"
+    line: '\1 no_pass_expiry'
+  when:
+    - ansible_facts.os_family == 'Archlinux'
+
+- name: Allow Login with SSH Keys, when user password is expired
+  ansible.builtin.lineinfile:
+    path: /etc/pam.d/common-account
+    backrefs: true
+    regexp: "^(account.*pam_unix.so(?!.*no_pass_expiry).*)$"
+    line: '\1 no_pass_expiry'
+  when:
+    - ansible_facts.os_family == 'Suse'
+
 - name: NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
  ansible.builtin.template:
    src: etc/libuser.conf.j2
@@ -118,3 +118,10 @@
    state: absent
  when:
    - not os_auth_pam_passwdqc_enable
+
+- name: Allow Login with SSH Keys, when user password is expired
+  ansible.builtin.lineinfile:
+    path: /etc/pam.d/common-account
+    backrefs: true
+    regexp: "^(account.*pam_unix.so(?!.*no_pass_expiry).*)$"
+    line: '\1 no_pass_expiry'
@@ -1,14 +1,4 @@
 ---
- name: Protect sysctl.conf
-  ansible.builtin.file:
-    path: /etc/sysctl.conf
-    owner: root
-    group: root
-    mode: "0440"
-    state: touch
-    modification_time: preserve
-    access_time: preserve
-
 - name: Set Daemon umask, do config for rhel-family | NSA 2.2.4.1
  ansible.builtin.template:
    src: etc/sysconfig/rhel_sysconfig_init.j2
@@ -19,33 +9,33 @@
  when: ansible_facts.os_family == 'RedHat'

 - name: Change sysctls
-  when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']
+  when: ansible_facts.virtualization_type not in ['docker', 'lxc', 'openvz']
  block:
-    - name: Create a combined sysctl-dict if os-dependent sysctls are defined
-      ansible.builtin.set_fact:
-        sysctl_config: "{{ sysctl_config | combine(sysctl_custom_config) }}"
-      when: sysctl_custom_config | default()
-
-    # sysctl_rhel_config is kept for backwards-compatibility. use sysctl_custom_config instead
-    - name: Create a combined sysctl-dict if os-dependent sysctls are defined
-      ansible.builtin.set_fact:
-        sysctl_config: "{{ sysctl_config | combine(sysctl_rhel_config) }}"
-      when: sysctl_rhel_config | default()
-
-    - name: Create a combined sysctl-dict if overwrites are defined
-      ansible.builtin.set_fact:
-        sysctl_config: "{{ sysctl_config | combine(sysctl_overwrite) }}"
-      when: sysctl_overwrite | default()
+    - name: Protect sysctl.conf
+      ansible.builtin.file:
+        path: /etc/sysctl.d/90-dev-sec.conf
+        owner: root
+        group: root
+        mode: "0440"
+        state: touch
+        modification_time: preserve
+        access_time: preserve

    - name: Change various sysctl-settings, look at the sysctl-vars file for documentation
      ansible.posix.sysctl:
        name: "{{ item.key }}"
        value: "{{ item.value }}"
        sysctl_set: true
+        sysctl_file: /etc/sysctl.d/90-dev-sec.conf
        state: present
        reload: true
        ignoreerrors: true
-      with_dict: "{{ sysctl_config }}"
+      # sysctl_rhel_config is kept for backwards-compatibility. use sysctl_custom_config instead
+      # combines all sysctl-dicts into one, adds empty dicts if they are not defined
+      with_dict: "{{ ((sysctl_config
+        | combine(sysctl_custom_config | default({})))
+        | combine(sysctl_rhel_config | default({})))
+        | combine(sysctl_overwrite | default({})) }}"
      when: item.key not in sysctl_unsupported_entries | default()

 - name: Apply ufw defaults
@@ -4,28 +4,28 @@
    database: passwd
    # creates a dict for each user containing UID/HOMEDIR etc...
  # skip this task if getent was run before without specifying a key (single entry)
-  when: getent_passwd is undefined or
-        getent_passwd | length <= 1
+  when: ansible_facts.getent_passwd is undefined or
+        ansible_facts.getent_passwd | length <= 1

 - name: Read local linux shadow database
  ansible.builtin.getent:
    database: shadow

 - name: Extract system accounts from local user database
-  loop: "{{ getent_passwd.keys() | list }}"
+  loop: "{{ ansible_facts.getent_passwd.keys() | list }}"
  when:
-    - getent_passwd[item][1]|int > 0
-    - getent_passwd[item][1]|int <= os_auth_sys_uid_max|int
+    - ansible_facts.getent_passwd[item][1]|int > 0
+    - ansible_facts.getent_passwd[item][1]|int <= os_auth_sys_uid_max|int
    - item is not in os_always_ignore_users     # skip users from "os_always_ignore_users" list (taken from role "vars")
    - item is not in os_ignore_users            # skip users from "os_ignore_users"        list (taken from role "defaults")
  ansible.builtin.set_fact:
    system_users: "{{ system_users | default([]) + [item] }}"

 - name: Extract regular (non-system, non-root) accounts from local user database
-  loop: "{{ getent_passwd.keys() | list }}"
+  loop: "{{ ansible_facts.getent_passwd.keys() | list }}"
  when:
-    - getent_passwd[item][1]|int >= os_auth_uid_min|int
-    - getent_passwd[item][1]|int <= os_auth_uid_max|int
+    - ansible_facts.getent_passwd[item][1]|int >= os_auth_uid_min|int
+    - ansible_facts.getent_passwd[item][1]|int <= os_auth_uid_max|int
    - item is not in os_always_ignore_users # skip users from "os_always_ignore_users" list (taken from role "vars")
    - item is not in os_ignore_users # skip users from "os_ignore_users"        list (taken from role "defaults")
  ansible.builtin.set_fact:
@@ -36,18 +36,20 @@
    name: "{{ item }}"
    password_expire_min: "{{ os_auth_pw_min_age }}"
    password_expire_max: "{{ os_auth_pw_max_age }}"
+    password_expire_warn: "{{ os_auth_pw_warn_age }}"
  loop: "{{ regular_users }}"
  when:
    - os_user_pw_ageing
    - regular_users is defined and (regular_users | length > 0)
    - item not in os_users_without_password_ageing
-    - getent_shadow[item][0] is not match("\*") # password hashes containing illegal characters like "*" are unusable (locked) and don't need to age
-    - getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable (locked) and don't need to age
+    # password hashes with illegal characters like "*" or "!" are unusable (locked) and don't need to age
+    - ansible_facts.getent_shadow[item][0] is not match("\*")
+    - ansible_facts.getent_shadow[item][0] is not match("\!")

 - name: Extract root account(s) from local user database
-  loop: "{{ getent_passwd.keys() | list }}"
+  loop: "{{ ansible_facts.getent_passwd.keys() | list }}"
  when:
-    - getent_passwd[item][1]|int == 0
+    - ansible_facts.getent_passwd[item][1]|int == 0
  ansible.builtin.set_fact:
    root_users: "{{ root_users | default([]) + [item] }}"

@@ -55,7 +57,7 @@
  ansible.builtin.file:
    mode: "0700"
    owner: "{{ item }}"
-    path: "{{ getent_passwd[item][4] }}"
+    path: "{{ ansible_facts.getent_passwd[item][4] }}"
    state: directory
  loop: "{{ root_users }}"
  when:
@@ -66,11 +68,13 @@
    name: "{{ item }}"
    password_expire_min: "{{ os_auth_pw_min_age }}"
    password_expire_max: "{{ os_auth_pw_max_age }}"
+    password_expire_warn: "{{ os_auth_pw_warn_age }}"
  loop: "{{ root_users }}"
  when:
    - os_rootuser_pw_ageing | bool
-    - getent_shadow[item][0] is not match("\*") # password hashes containing illegal characters like "*" are unusable (locked) and don't need to age
-    - getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable (locked) and don't need to age
+    # password hashes with illegal characters like "*" or "!" are unusable (locked) and don't need to age
+    - ansible_facts.getent_shadow[item][0] is not match("\*")
+    - ansible_facts.getent_shadow[item][0] is not match("\!")

 - name: Remove additional users with UID=0 ("root" user is not touched)
  ansible.builtin.user:
@@ -96,13 +100,13 @@
    createhome: false
  loop: "{{ system_users }}"
  when:
-    - getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable already (locked)
+    - ansible_facts.getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable already (locked)

 - name: Limit access to home directories of regular (non-system, non-root) accounts
  ansible.builtin.file:
    mode: "0700"
    owner: "{{ item }}"
-    path: "{{ getent_passwd[item][4] }}"
+    path: "{{ ansible_facts.getent_passwd[item][4] }}"
    state: directory
  loop: "{{ regular_users }}"
  when:
@@ -24,7 +24,7 @@ auth        required      pam_deny.so
 {% if os_auth_retries|int > 0 %}
 account     required      pam_faillock.so
 {% endif %}
-account     required      pam_unix.so
+account     required      pam_unix.so no_pass_expiry
 account     sufficient    pam_localuser.so
 account     sufficient    pam_succeed_if.so uid < 1000 quiet
 {% if (os_auth_pam_sssd_enable | bool) %}
@@ -1,7 +1,7 @@
 # dev-sec.ssh_hardening

 [![devsec.ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml)
-[![devsec.ssh_hardening BSD](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml)
+[![devsec.ssh_hardening VM](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml)
 [![devsec.ssh_hardening with custom tests](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml)

 ## Description
@@ -46,13 +46,12 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
 <!-- BEGIN_ANSIBLE_DOCS -->

 ## Supported Operating Systems
-
 - EL
-  - 8, 9
+  - 8, 9, 10
 - Ubuntu
  - focal, jammy, noble
 - Debian
-  - bookworm, bullseye
+  - trixie, bookworm, bullseye
 - Alpine
 - Amazon
 - Fedora
@@ -66,12 +65,12 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
 ## Role Variables

 - `network_ipv6_enable`
-  - Default: `true`
+  - Default: `True`
  - Description: `false` if IPv6 is not needed. `ssh_listen_to` must also be set to listen to IPv6 addresses (for example `[::]`).
  - Type: bool
  - Required: no
 - `sftp_chroot`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to `false` to disable chroot for sftp.
  - Type: bool
  - Required: no
@@ -81,7 +80,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
  - Type: str
  - Required: no
 - `sftp_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to `false` to disable sftp configuration.
  - Type: bool
  - Required: no
@@ -91,7 +90,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
  - Type: str
  - Required: no
 - `ssh_allow_agent_forwarding`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to `false` to disable Agent Forwarding. Set to `true` to allow Agent Forwarding.
  - Type: bool
  - Required: no
@@ -116,9 +115,9 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
  - Type: str
  - Required: no
 - `ssh_authorized_principals`
-  - Default: ``
+  - Default: `[]`
  - Description: list of hashes containing file paths and authorized principals, see `default_cstom.yml` for all options. Only used if `ssh_authorized_principals_file` is set
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `ssh_authorized_principals_file`
  - Default: ``
@@ -126,7 +125,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
  - Type: str
  - Required: no
 - `ssh_banner`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to `true` to print a banner on login.
  - Type: bool
  - Required: no
@@ -136,14 +135,14 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
  - Type: str
  - Required: no
 - `ssh_challengeresponseauthentication`
-  - Default: `false`
+  - Default: `False`
  - Description: Specifies whether challenge-response authentication is allowed (e.g. via PAM).
  - Type: bool
  - Required: no
 - `ssh_ciphers`
  - Default: ``
  - Description: Change this list to overwrite ciphers. Defaults found in `defaults/main.yml`
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `ssh_client_alive_count`
  - Default: `3`
@@ -156,7 +155,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
  - Type: int
  - Required: no
 - `ssh_client_compression`
-  - Default: `false`
+  - Default: `False`
  - Description: Specifies whether the client requests compression.
  - Type: bool
  - Required: no
@@ -166,17 +165,17 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
  - Type: str
  - Required: no
 - `ssh_client_hardening`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to `false` to stop harden the client.
  - Type: bool
  - Required: no
 - `ssh_client_host_key_algorithms`
-  - Default: ``
+  - Default: `[]`
  - Description: Specifies the host key algorithms that the client wants to use in order of preference. If empty the default list will be used. Otherwise overrides the setting with specified list of algorithms. Check `man ssh_config`, `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make sure you check the correct version!
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `ssh_client_password_login`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to `true` to allow password-based authentication with the ssh client.
  - Type: bool
  - Required: no
@@ -186,19 +185,19 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
  - Type: str
  - Required: no
 - `ssh_client_roaming`
-  - Default: `false`
+  - Default: `False`
  - Description: enable experimental client roaming.
  - Type: bool
  - Required: no
 - `ssh_compression`
-  - Default: `false`
+  - Default: `False`
  - Description: Specifies whether server-side compression is enabled after the user has authenticated successfully.
  - Type: bool
  - Required: no
 - `ssh_custom_options`
-  - Default: ``
+  - Default: `[]`
  - Description: Custom lines for SSH client configuration.
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `ssh_custom_selinux_dir`
  - Default: `/etc/selinux/local-policies`
@@ -215,40 +214,45 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
  - Description: if specified, login is disallowed for user names that match one of the patterns.
  - Type: str
  - Required: no
+- `ssh_forward_agent`
+  - Default: `no`
+  - Description: Enables the ssh forward agent for the Cli if set to 'yes'
+  - Type: str
+  - Required: no
 - `ssh_gateway_ports`
  - Default: `False`
  - Description: Set to `false` to disable binding forwarded ports to non-loopback addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified` to allow the client to specify which address to bind to.
  - Type: raw
  - Required: no
 - `ssh_gssapi_delegation`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to `true` to enable GSSAPI credential forwarding.
  - Type: bool
  - Required: no
 - `ssh_gssapi_support`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to `true` to enable GSSAPI authentication (both client and server).
  - Type: bool
  - Required: no
 - `ssh_hardening_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Whether to run the hardening
  - Type: bool
  - Required: no
 - `ssh_host_certificates`
-  - Default: ``
+  - Default: `[]`
  - Description: Host certificates to look for when starting sshd
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `ssh_host_key_algorithms`
-  - Default: ``
+  - Default: `[]`
  - Description: Host key algorithms that the server offers. If empty the default list will be used. Otherwise overrides the setting with specified list of algorithms. Check `man sshd_config`, `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make sure you check the correct version
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `ssh_host_key_files`
  - Default: ``
  - Description: Host keys for sshd. If empty ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key', '/etc/ssh/ssh_host_ed25519_key'] will be used, as far as supported by the installed sshd version.
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `ssh_host_rsa_key_size`
  - Default: `4096`
@@ -256,19 +260,19 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
  - Type: int
  - Required: no
 - `ssh_kerberos_support`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to `true` if SSH has Kerberos support.
  - Type: bool
  - Required: no
 - `ssh_kex`
  - Default: ``
  - Description: Change this list to overwrite kexs. Defaults found in `defaults/main.yml`
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `ssh_listen_to`
-  - Default: `["0.0.0.0"]`
+  - Default: `['0.0.0.0']`
  - Description: one or more ip addresses, to which ssh-server should listen to. Default is all IPv4 addresses, but should be configured to specific addresses for security reasons
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `ssh_login_grace_time`
  - Default: `30s`
@@ -278,7 +282,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
 - `ssh_macs`
  - Default: ``
  - Description: Change this list to overwrite macs. Defaults found in `defaults/main.yml`
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `ssh_max_auth_retries`
  - Default: `2`
@@ -296,7 +300,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
  - Type: str
  - Required: no
 - `ssh_pam_support`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to `true` if SSH has PAM support.
  - Type: bool
  - Required: no
@@ -316,22 +320,22 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
    - point-to-point
    - ethernet
 - `ssh_print_debian_banner`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to `true` to print debian specific banner.
  - Type: bool
  - Required: no
 - `ssh_print_last_log`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to `false` to disable display of last login information.
  - Type: bool
  - Required: no
 - `ssh_print_motd`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to `false` to disable printing of the MOTD.
  - Type: bool
  - Required: no
 - `ssh_print_pam_motd`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to `false` to disable printing of the MOTD via pam (Debian and Ubuntu).
  - Type: bool
  - Required: no
@@ -341,9 +345,9 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
  - Type: str
  - Required: no
 - `ssh_remote_hosts`
-  - Default: ``
+  - Default: `[]`
  - Description: one or more hosts and their custom options for the ssh-client. Default is empty. See examples in `defaults/main.yml`
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `ssh_server_accept_env_vars`
  - Default: ``
@@ -356,12 +360,12 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
  - Type: str
  - Required: no
 - `ssh_server_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to `false` to disable the opensshd server.
  - Type: bool
  - Required: no
 - `ssh_server_hardening`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to `false` to stop harden the server.
  - Type: bool
  - Required: no
@@ -386,7 +390,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
  - Type: str
  - Required: no
 - `ssh_server_password_login`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to `true` to allow password-based authentication to the ssh server. You probably also need to change `sshd_authenticationmethods` to include `password` if you set `ssh_server_password_login`: `true`.
  - Type: bool
  - Required: no
@@ -396,24 +400,24 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
  - Type: str
  - Required: no
 - `ssh_server_ports`
-  - Default: `["22"]`
+  - Default: `['22']`
  - Description: ports on which ssh-server should listen.
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `ssh_server_revoked_keys`
-  - Default: ``
+  - Default: `[]`
  - Description: a list of revoked public keys that the ssh server will always reject, useful to revoke known weak or compromised keys.
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `ssh_server_service_enabled`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to `false` to disable starting sshd at boot.
  - Type: bool
  - Required: no
 - `ssh_trusted_user_ca_keys`
-  - Default: ``
+  - Default: `[]`
  - Description: set the trusted certificate authorities public keys used to sign user certificates. Only used if `ssh_trusted_user_ca_keys_file` is set.
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `ssh_trusted_user_ca_keys_file`
  - Default: ``
@@ -421,17 +425,17 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
  - Type: str
  - Required: no
 - `ssh_use_dns`
-  - Default: `false`
+  - Default: `False`
  - Description: Specifies whether sshd should look up the remote host name, and to check that the resolved host name for the remote IP address maps back to the very same IP address.
  - Type: bool
  - Required: no
 - `ssh_use_pam`
-  - Default: `true`
+  - Default: `True`
  - Description: Set to `false` to disable pam authentication.
  - Type: bool
  - Required: no
 - `ssh_x11_forwarding`
-  - Default: `false`
+  - Default: `False`
  - Description: Set to `false` to disable X11 Forwarding. Set to `true` to allow X11 Forwarding.
  - Type: bool
  - Required: no
@@ -441,9 +445,9 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
  - Type: str
  - Required: no
 - `sshd_custom_options`
-  - Default: ``
+  - Default: `[]`
  - Description: Custom lines for SSH daemon configuration.
-  - Type: list
+  - Type: list of ''
  - Required: no
 - `sshd_log_level`
  - Default: `VERBOSE`
@@ -461,7 +465,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
  - Type: int
  - Required: no
 - `sshd_strict_modes`
-  - Default: `true`
+  - Default: `True`
  - Description: Check file modes and ownership of the user's files and home directory before accepting login.
  - Type: bool
  - Required: no
@@ -365,3 +365,6 @@ argument_specs:
        default: sandbox
        description: Specifies whether sshd separates privileges by creating an unprivileged
          child process to deal with incoming network traffic.
+      ssh_forward_agent:
+        default: 'no'
+        description: Enables the ssh forward agent for the Cli if set to 'yes'
@@ -10,6 +10,7 @@ galaxy_info:
      versions:
        - "8"
        - "9"
+        - "10"
    - name: Ubuntu
      versions:
        - focal
@@ -17,6 +18,7 @@ galaxy_info:
        - noble
    - name: Debian
      versions:
+        - trixie
        - bookworm
        - bullseye
    - name: Alpine
@@ -1,4 +1,11 @@
 ---
+- name: Disable systemd-socket activation
+  ansible.builtin.systemd:
+    name: ssh.socket
+    state: stopped
+    enabled: false
+    masked: true
+
 - name: Remove ssh service systemd-socket file
  ansible.builtin.file:
    path: "{{ item }}"
@@ -8,9 +15,8 @@
    - /etc/systemd/system/ssh.service.requires/ssh.socket
    - /etc/systemd/system/sockets.target.wants/ssh.socket

- name: Disable systemd-socket activation
+- name: Ensure ssh service is started after disabling socket activation
  ansible.builtin.systemd:
-    name: ssh.socket
-    state: stopped
-    enabled: false
-    masked: true
+    name: "{{ sshd_service_name }}"
+    state: started
+    enabled: true
@@ -113,7 +113,7 @@
  notify: Restart sshd
  when:
    - ssh_server_hardening | bool
-    - sshd_register_moduli.stdout
+    - sshd_register_moduli.stdout is truthy

 - name: Include tasks to setup ca keys and principals
  ansible.builtin.include_tasks: ca_keys_and_principals.yml
@@ -1,4 +1,4 @@
-#jinja2: trim_blocks: "true", lstrip_blocks: "true"
+#jinja2: trim_blocks:True, lstrip_blocks:True
 {{ ansible_managed | comment }}
 # Generated by Ansible role {{ ansible_role_name }}

@@ -90,7 +90,9 @@ StrictHostKeyChecking ask

 {% endif %}
 # Disable agent forwarding, since local agent could be accessed through forwarded connection.
-ForwardAgent no
+
+ForwardAgent {{ ((ssh_forward_agent) if ssh_forward_agent is defined else 'no') }}
+

 # Disable X11 forwarding, since local X11 display could be accessed through forwarded connection.
 ForwardX11 no
@@ -1,4 +1,4 @@
-#jinja2: trim_blocks: "true", lstrip_blocks: "true"
+#jinja2: trim_blocks:True, lstrip_blocks:True
 {{ ansible_managed | comment }}
 # Generated by Ansible role {{ ansible_role_name }}

@@ -274,18 +274,6 @@ RevokedKeys /etc/ssh/revoked_keys
 # Subsystem sftp /opt/app/openssh5/libexec/sftp-server

 Subsystem sftp internal-sftp -l INFO -f LOCAL6 -u {{ sftp_umask }}
-
-# These lines must appear at the *end* of sshd_config
-Match Group sftponly
-    ForceCommand internal-sftp -l INFO -f LOCAL6 -u {{ sftp_umask }}
-{% if sftp_chroot %}
-    ChrootDirectory {{ sftp_chroot_dir }}
-{% endif %}
-    AllowTcpForwarding no
-    AllowAgentForwarding no
-    PasswordAuthentication {{ 'yes' if (ssh_server_password_login|bool) else 'no' }}
-    PermitRootLogin no
-    X11Forwarding no
 {% endif %}
 {% if ssh_server_match_address %}

@@ -335,3 +323,17 @@ Match LocalPort {{ item.port }}
  {% endfor %}
 {% endfor %}
 {% endif %}
+
+{% if sftp_enabled %}
+# These lines must appear at the *end* of sshd_config
+Match Group sftponly
+    ForceCommand internal-sftp -l INFO -f LOCAL6 -u {{ sftp_umask }}
+{% if sftp_chroot %}
+    ChrootDirectory {{ sftp_chroot_dir }}
+{% endif %}
+    AllowTcpForwarding no
+    AllowAgentForwarding no
+    PasswordAuthentication {{ 'yes' if (ssh_server_password_login|bool) else 'no' }}
+    PermitRootLogin no
+    X11Forwarding no
+{% endif %}
@@ -0,0 +1,26 @@
+---
+ssh_pkgs:
+  - openssh
+sshd_path: /usr/sbin/sshd
+ssh_host_keys_dir: /etc/ssh
+sshd_service_name: sshd
+ssh_owner: root
+ssh_group: root
+ssh_host_keys_owner: root
+ssh_host_keys_group: root
+ssh_host_keys_mode: "0600"
+ssh_selinux_packages:
+  - policycoreutils-python-utils
+  - checkpolicy
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: /etc/ssh/moduli
+
+# disable CRYPTO_POLICY to take settings from sshd configuration
+# see: https://access.redhat.com/solutions/4410591
+sshd_disable_crypto_policy: true