Accept strings and lists for ssh_allow_users

Signed-off-by: Martin Schurz <[email protected]>

.config/ansible-lint.yml

@@ -5,6 +5,7 @@
 # option will be parsed relative to the CWD of execution.
 exclude_paths:
   - .cache/ # implicit unless exclude_paths is defined in config
+  - .ansible/ # somehow someone decided that the cache directory should be renamed
   # add all waivers individually, since exclude_files does not support globs
   - molecule/os_hardening/waivers.yaml
   - molecule/ssh_hardening_bsd/waivers_freebsd13.yaml

.github/workflows/ansible-lint.yml

@@ -23,10 +23,10 @@ on:  # yamllint disable-line rule:truthy
 
 jobs:
   ansible-lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Lint Ansible Playbook
-        uses: ansible/ansible-lint@3b5bee19c2102ea35bc8619795a72c5c73797fc7 # v24
+        uses: ansible/ansible-lint@9cf49a01ac6b34f45aab16f0bbac1196fcd681e5 # v25

.github/workflows/enforce-labels.yml

@@ -12,7 +12,7 @@ permissions:
 jobs:
   enforce-label:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
         with:

.github/workflows/galaxy-publish.yml

@@ -9,9 +9,9 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   deploy:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       # deploy the collection first, because if it fails, we don't want
       # to update the galaxy.yml
@@ -22,7 +22,7 @@ jobs:
           galaxy_version: ${{ github.event.release.tag_name }}
 
       # checkout master instead of the release-tag so we can push the galaxy.yml
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: master
 

.github/workflows/mysql_hardening.yml

@@ -29,7 +29,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -51,13 +51,13 @@ jobs:
           # - fedora  # geerlingguy.mysql does not support fedora
     steps:
       - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
       - name: Set up Python
-        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: 3.12
           cache: 'pip'

.github/workflows/nginx_hardening.yml

@@ -28,7 +28,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -50,13 +50,13 @@ jobs:
           # - fedora  # no support from geerlingguy role
     steps:
       - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
       - name: Set up Python
-        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: 3.12
           cache: 'pip'

.github/workflows/os_hardening.yml

@@ -28,7 +28,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -55,13 +55,13 @@ jobs:
           - "/lib/systemd/systemd"
     steps:
       - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
       - name: Set up Python
-        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: 3.12
           cache: 'pip'

.github/workflows/os_hardening_vm.yml

@@ -50,7 +50,7 @@ jobs:
           - generic/arch
     steps:
       - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true

.github/workflows/prettier-md.yml

@@ -11,12 +11,12 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   prettier-md:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 1
 
     steps:
       - name: Git checkout
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ github.head_ref }}
 

.github/workflows/release.yml

@@ -11,9 +11,9 @@ jobs:
   generate_changelog:
     name: create release draft
     if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
           ref: master

.github/workflows/roles-readme.yml

@@ -17,7 +17,7 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   readme:
     name: create roles readme
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     strategy:
       matrix:
         roles:
@@ -27,10 +27,10 @@ jobs:
           - ssh_hardening
     steps:
       - name: Check out code
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up Python
-        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: 3.12
           cache: 'pip'

.github/workflows/ssh_hardening.yml

@@ -28,7 +28,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -58,13 +58,13 @@ jobs:
           - "/lib/systemd/systemd"
     steps:
       - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
       - name: Set up Python
-        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: 3.12
           cache: 'pip'

.github/workflows/ssh_hardening_bsd.yml

@@ -41,7 +41,7 @@ jobs:
           - freebsd14
     steps:
       - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true

.github/workflows/ssh_hardening_custom_tests.yml

@@ -28,7 +28,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -58,13 +58,13 @@ jobs:
           - "/lib/systemd/systemd"
     steps:
       - name: Checkout repo
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
       - name: Set up Python
-        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: 3.12
           cache: 'pip'

CHANGELOG.md

@@ -1,12 +1,64 @@
 # Changelog
 
-## [10.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.1.0) (2024-10-13)
+## [10.2.1](https://github.com/dev-sec/ansible-collection-hardening/tree/10.2.1) (2025-02-08)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.2.0...10.2.1)
+
+**Implemented enhancements:**
+
+- Password expiry for users without password should not block SSH key based login [\#681](https://github.com/dev-sec/ansible-collection-hardening/issues/681)
+
+**Closed issues:**
+
+- os\_hardening & sysctl\_overwrite with host\_vars [\#837](https://github.com/dev-sec/ansible-collection-hardening/issues/837)
+
+**Merged pull requests:**
+
+- Pin runner image to specific version to decouple from GitHub updates [\#847](https://github.com/dev-sec/ansible-collection-hardening/pull/847) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Refactor: combine multiple set\_fact into single jinja filter [\#846](https://github.com/dev-sec/ansible-collection-hardening/pull/846) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Tinyblargon](https://github.com/Tinyblargon))
+- chore\(deps\): update actions/setup-python digest to 4237552 [\#844](https://github.com/dev-sec/ansible-collection-hardening/pull/844) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency ansible-core to v2.18.2 [\#843](https://github.com/dev-sec/ansible-collection-hardening/pull/843) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency molecule to v25 [\#841](https://github.com/dev-sec/ansible-collection-hardening/pull/841) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint action to v25 [\#840](https://github.com/dev-sec/ansible-collection-hardening/pull/840) ([renovate[bot]](https://github.com/apps/renovate))
+
+## [10.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.2.0) (2024-12-23)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.1.0...10.2.0)
+
+**Implemented enhancements:**
+
+- Re-enable OpenBSD tests [\#826](https://github.com/dev-sec/ansible-collection-hardening/issues/826) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
+- Allow configuring the name\_format variable in auditd config [\#796](https://github.com/dev-sec/ansible-collection-hardening/issues/796) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Modify PAM to allow SSH key based logins with locked passwords [\#835](https://github.com/dev-sec/ansible-collection-hardening/pull/835) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- adding switch for ForwardAgent in ssh\_config [\#818](https://github.com/dev-sec/ansible-collection-hardening/pull/818) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Shizzlebix](https://github.com/Shizzlebix))
+
+**Fixed bugs:**
+
+- File system loop detected; ‘/bin/X11’ is part of the same file system loop as ‘/bin’." [\#815](https://github.com/dev-sec/ansible-collection-hardening/issues/815) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Not working ssh\_hardening on Centos 7  [\#813](https://github.com/dev-sec/ansible-collection-hardening/issues/813) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
+
+**Merged pull requests:**
+
+- chore\(deps\): update dependency molecule-plugins to v23.6.0 [\#834](https://github.com/dev-sec/ansible-collection-hardening/pull/834) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 4ce8e49 [\#832](https://github.com/dev-sec/ansible-collection-hardening/pull/832) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency molecule to v24.12.0 [\#831](https://github.com/dev-sec/ansible-collection-hardening/pull/831) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency ansible-core to v2.18.1 [\#829](https://github.com/dev-sec/ansible-collection-hardening/pull/829) ([renovate[bot]](https://github.com/apps/renovate))
+- Change installation source for OpenBSD tests [\#828](https://github.com/dev-sec/ansible-collection-hardening/pull/828) ([schurzi](https://github.com/schurzi))
+- chore\(deps\): update ansible/ansible-lint digest to 44be233 [\#825](https://github.com/dev-sec/ansible-collection-hardening/pull/825) ([renovate[bot]](https://github.com/apps/renovate))
+- Bump ansible-core from 2.17.5 to 2.17.6 [\#820](https://github.com/dev-sec/ansible-collection-hardening/pull/820) ([dependabot[bot]](https://github.com/apps/dependabot))
+- chore\(deps\): update dependency ansible-core to v2.18.0 [\#819](https://github.com/dev-sec/ansible-collection-hardening/pull/819) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency aar-doc to v2.0.1 [\#817](https://github.com/dev-sec/ansible-collection-hardening/pull/817) ([renovate[bot]](https://github.com/apps/renovate))
+- Update actions/setup-python digest to 0b93645 [\#814](https://github.com/dev-sec/ansible-collection-hardening/pull/814) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/checkout digest to 11bd719 [\#812](https://github.com/dev-sec/ansible-collection-hardening/pull/812) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+
+## [10.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.1.0) (2024-10-22)
 
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.0.0...10.1.0)
 
 **Implemented enhancements:**
 
 - Ubuntu 24.04 support [\#764](https://github.com/dev-sec/ansible-collection-hardening/issues/764)
+- Add variable to set name\_format for auditd [\#810](https://github.com/dev-sec/ansible-collection-hardening/pull/810) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
 - feat\(ssh\): add alpine support [\#809](https://github.com/dev-sec/ansible-collection-hardening/pull/809) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Provide granular noop for ssh configuration [\#789](https://github.com/dev-sec/ansible-collection-hardening/pull/789) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([seven-beep](https://github.com/seven-beep))
 
@@ -17,12 +69,9 @@
 - Error: Missing privilege separation directory: /run/sshd [\#752](https://github.com/dev-sec/ansible-collection-hardening/issues/752)
 - fix\(ssh\_hardening\): test setting kex to false, remove wrong default [\#808](https://github.com/dev-sec/ansible-collection-hardening/pull/808) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 
-**Closed issues:**
-
-- Dependency Dashboard [\#655](https://github.com/dev-sec/ansible-collection-hardening/issues/655)
-
 **Merged pull requests:**
 
+- Pin python dependencies and optimize GitHub Actions [\#811](https://github.com/dev-sec/ansible-collection-hardening/pull/811) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
 - fix\(cicd\): test idempotence on ssh custom tests [\#807](https://github.com/dev-sec/ansible-collection-hardening/pull/807) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Document correct quotes for ssh\_permit\_tunnel parameter [\#806](https://github.com/dev-sec/ansible-collection-hardening/pull/806) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([vmpr](https://github.com/vmpr))
 - fix\(docs\): add 'become: true' to example playbooks. fix \#787 [\#804](https://github.com/dev-sec/ansible-collection-hardening/pull/804) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))

galaxy.yml

@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 10.0.0
+version: 10.2.0
 readme: README.md
 authors:
   - dev-sec <[email protected]>

molecule/mysql_hardening/prepare.yml

@@ -33,7 +33,7 @@
       when: ansible_os_family == 'Debian'
 
     - name: Install required python packages on Suse
-      ansible.builtin.command: zypper -n install python-xml python3-rpm python3-PyMySQL
+      ansible.builtin.command: zypper -n install python311-rpm python311-PyMySQL
       changed_when: false
       when: ansible_os_family == 'Suse'
 

molecule/nginx_hardening/prepare.yml

@@ -7,12 +7,6 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: Install required tools on SuSE
-      community.general.zypper:
-        name: python-xml
-        state: present
-      when: ansible_facts.os_family == 'Suse'
-
     - name: Install required packages
       ansible.builtin.package:
         name: python3-apt

molecule/os_hardening/prepare.yml

@@ -20,7 +20,7 @@
 
     - name: Install required tools on SuSE
       # cannot use zypper module, since it depends on python-xml
-      ansible.builtin.command: zypper -n install python-xml awk
+      ansible.builtin.command: zypper -n install awk
       changed_when: false
       when: ansible_facts.os_family == 'Suse'
 

molecule/os_hardening/verify.yml

@@ -20,6 +20,7 @@
         - verify_tasks/pw_ageing.yml
         - verify_tasks/netrc.yml
         - verify_tasks/ignore_home_folders.yml
+        - verify_tasks/ssh_auth_locked.yml
 
     # temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
     #    - name: Include PAM tests

molecule/os_hardening/verify_tasks/ssh_auth_locked.yml

@@ -0,0 +1,90 @@
+---
+- name: Install tools
+  package:
+    name: "{{ item }}"
+    state: present
+  ignore_errors: true
+  loop:
+    - sshpass
+    - openssh
+    - openssh-clients
+    - openssh-server
+
+- name: Allow password Login for sshd
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    search_string: PasswordAuthentication no
+    line: PasswordAuthentication yes
+  when:
+    - ansible_facts.distribution == "Amazon"
+
+- name: Start sshd service
+  ansible.builtin.service:
+    name: "{{ item }}"
+    state: started
+  ignore_errors: true
+  loop:
+    - sshd
+    - ssh
+
+- name: Set password for test
+  ansible.builtin.set_fact:
+    test_pw: myTest!pw
+
+- name: Create locked_user
+  user:
+    name: locked_user
+    password: "{{ test_pw | password_hash('sha512') }}"
+
+- name: Create ssh-client-keypair
+  community.crypto.openssh_keypair:
+    path: /root/locked_user_id
+    type: ed25519
+    state: present
+  register: generated_key
+
+- name: Add ssh-public-key to locked_user
+  ansible.posix.authorized_key:
+    user: locked_user
+    key: "{{ generated_key.public_key }}"
+    state: present
+
+- name: Check successful login with password
+  ansible.builtin.shell:
+    cmd: sshpass -p {{ test_pw }} ssh -o StrictHostKeyChecking=no locked_user@localhost echo "success"
+
+- name: Check successful login with ssh key
+  ansible.builtin.shell:
+    cmd: ssh -i /root/locked_user_id -o StrictHostKeyChecking=no locked_user@localhost echo "success"
+
+- name: Set password change date for locked_user
+  ansible.builtin.shell:
+    cmd: chage -d 2020-01-01 locked_user
+
+- name: Check unsuccessful login with password
+  ansible.builtin.shell:
+    cmd: sshpass -p {{ test_pw }} ssh -o StrictHostKeyChecking=no locked_user@localhost echo "success"
+  register: output
+  ignore_errors: true
+
+- name: Assert check unsuccessful login
+  ansible.builtin.assert:
+    that:
+      - output.rc | int == 1
+      - "'WARNING: Your password has expired.' in output.stderr"
+      - "'success' not in output.stdout"
+  when:
+    - ansible_facts.os_family != "Suse"
+
+- name: Assert check unsuccessful login
+  ansible.builtin.assert:
+    that:
+      - output.rc | int == 5
+      - output.stderr | length == 0
+      - output.stdout | length == 0
+  when:
+    - ansible_facts.os_family == "Suse"
+
+- name: Check successful login with ssh key
+  ansible.builtin.shell:
+    cmd: ssh -i /root/locked_user_id -o StrictHostKeyChecking=no locked_user@localhost echo "success"

molecule/os_hardening_vm/prepare.yml

@@ -50,12 +50,6 @@
         update_cache: true
       when: ansible_os_family == 'Debian'
 
-    - name: Install required tools on SuSE
-      # cannot use zypper module, since it depends on python-xml
-      ansible.builtin.command: zypper -n install python-xml
-      changed_when: false
-      when: ansible_facts.os_family == 'Suse'
-
     - name: Install required tools on fedora
       ansible.builtin.dnf:
         name:

molecule/ssh_hardening_bsd/prepare.yml

@@ -4,6 +4,12 @@
   become: true
   gather_facts: false
   tasks:
+    - name: Change installation source
+      # temporary fix for https://github.com/lavabit/robox/issues/305
+      ansible.builtin.raw: echo "https://ftp.eu.openbsd.org/pub/OpenBSD" > /etc/installurl
+      changed_when: false
+      when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
+
     - name: Install python
       # BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
       ansible.builtin.raw: pkg_add python%3.10

requirements.txt

@@ -1,6 +1,7 @@
-molecule==24.9.0
-molecule-plugins[docker]==23.5.3
-ansible-core==2.17.5
+molecule==25.1.0
+molecule-plugins[docker]==23.7.0
+ansible-core==2.18.2
 docker==7.1.0
 jmespath==1.0.1
-aar-doc==2.0.0
+aar-doc==2.0.1
+passlib==1.7.4

roles/mysql_hardening/README.md

@@ -37,7 +37,7 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
 ## Role Variables
 
 - `mysql_daemon_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Whether to enable the MySQL-service so it starts on boot
   - Type: bool
   - Required: no
@@ -52,7 +52,7 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
   - Type: int
   - Required: no
 - `mysql_hardening_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Whether to run the hardening
   - Type: bool
   - Required: no
@@ -87,12 +87,12 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
   - Type: int
   - Required: no
 - `mysql_hardening_restart_mysql`
-  - Default: `true`
+  - Default: `True`
   - Description: Restart mysql after running this role
   - Type: bool
   - Required: no
 - `mysql_hardening_skip_grant_tables:`
-  - Default: `false`
+  - Default: `False`
   - Description: [skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)
   - Type: bool
   - Required: no
@@ -102,17 +102,17 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
   - Type: int
   - Required: no
 - `mysql_remove_anonymous_users`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to `false` to keep users without authentication
   - Type: bool
   - Required: no
 - `mysql_remove_remote_root`
-  - Default: `true`
+  - Default: `True`
   - Description: If `true`, root can only connect from localhost. Set to `false` to not remove remote root users.
   - Type: bool
   - Required: no
 - `mysql_remove_test_database`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to `false` to keep the test database
   - Type: bool
   - Required: no

roles/nginx_hardening/README.md

@@ -29,9 +29,9 @@ It works with the following nginx-roles, including, but not limited to:
 ## Role Variables
 
 - `nginx_add_header`
-  - Default: `["X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"", "Content-Security-Policy \\\"script-src 'self'; object-src 'self'\\\""]`
+  - Default: `['X-Frame-Options SAMEORIGIN', 'X-Content-Type-Options nosniff', 'X-XSS-Protection "1; mode=block"', 'Content-Security-Policy \\"script-src \'self\'; object-src \'self\'\\"']`
   - Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See [nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `nginx_client_body_buffer_size`
   - Default: `1k`
@@ -104,7 +104,7 @@ It works with the following nginx-roles, including, but not limited to:
   - Type: str
   - Required: no
 - `nginx_remove_default_site`
-  - Default: `true`
+  - Default: `True`
   - Description: Disables the default site. Set to false to enable the default site in nginx.
   - Type: bool
   - Required: no

roles/os_hardening/README.md

@@ -94,6 +94,18 @@ We are setting this sysctl to a default of `32`, some systems only support small
       vm.mmap_rnd_bits: 16
 ```
 
+### password expiry and SSH key based logins
+
+With default PAM configuration setting a password expiry for users will also block SSH key logins after the password has expired.
+We have added a flag for PAM to ignore the expiry if SSH keys or other login mechanisms are used.
+If you choose to use your own PAM configuration please adjust it accordingly to contain `no_pass_expiry` in the `account` stage for the `pam_unix.so` module.
+
+A valid example would look like this:
+
+```text
+account     required      pam_unix.so no_pass_expiry
+```
+
 ## Testing with inspec
 
 If you're using inspec to test your machines after applying this role, please make sure to add the connecting user to the `os_ignore_users`-variable.
@@ -161,7 +173,7 @@ This role is mostly based on guides by:
 ## Role Variables
 
 - `os_apt_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to disable installing and configuring apt.
   - Type: bool
   - Required: no
@@ -191,7 +203,7 @@ This role is mostly based on guides by:
   - Type: str
   - Required: no
 - `os_auditd_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to disable installing and configuring auditd.
   - Type: bool
   - Required: no
@@ -220,6 +232,16 @@ This role is mostly based on guides by:
   - Description: Defines the behaviour of auditd when its log file is filled up. Possible other values are described in the auditd.conf man page. The most common alternative to the default may be `rotate`.
   - Type: str
   - Required: no
+- `os_auditd_name_format`
+  - Default: `NONE`
+  - Description: This keyword specifies how computer node names are inserted into the audit event stream.
+  - Type: str
+  - Required: no
+  - Choices:
+    - NONE
+    - hostname
+    - fqd
+    - numeric
 - `os_auditd_num_logs`
   - Default: `5`
   - Description: This keyword specifies the number of log files to keep if `rotate` is given as the max_log_file_action. The value given must be numeric.
@@ -236,7 +258,7 @@ This role is mostly based on guides by:
   - Type: str
   - Required: no
 - `os_auth_allow_homeless`
-  - Default: `false`
+  - Default: `False`
   - Description: true if to allow users without home to login.
   - Type: bool
   - Required: no
@@ -256,12 +278,12 @@ This role is mostly based on guides by:
   - Type: int
   - Required: no
 - `os_auth_pam_oddjob_mkhomedir`
-  - Default: `false`
+  - Default: `False`
   - Description: Enables automatic homedir e.g. in FreeIPA environments
   - Type: bool
   - Required: no
 - `os_auth_pam_passwdqc_enable`
-  - Default: `true`
+  - Default: `True`
   - Description: true if you want to use strong password checking in PAM using passwdqc.
   - Type: bool
   - Required: no
@@ -301,9 +323,9 @@ This role is mostly based on guides by:
   - Type: int
   - Required: no
 - `os_auth_root_ttys`
-  - Default: `["console", "tty1", "tty2", "tty3", "tty4", "tty5", "tty6"]`
+  - Default: `['console', 'tty1', 'tty2', 'tty3', 'tty4', 'tty5', 'tty6']`
   - Description: A list of TTYs, from which root can log in, see `man securetty` for reference
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `os_auth_sub_gid_count`
   - Default: `65536`
@@ -356,67 +378,67 @@ This role is mostly based on guides by:
   - Type: str
   - Required: no
 - `os_chmod_home_folders`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to `false` to disable "chmod 700" of home folders for regular users
   - Type: bool
   - Required: no
 - `os_chmod_rootuser_home_folder`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to `false` to disable "chmod 700" of root's home folder
   - Type: bool
   - Required: no
 - `os_cron_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to disable installing and configuring cron.
   - Type: bool
   - Required: no
 - `os_ctrlaltdel_disabled`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to true to disable ctrl-alt-delete key combination.
   - Type: bool
   - Required: no
 - `os_env_extra_user_paths`
-  - Default: `"[]"`
+  - Default: `[]`
   - Description: Specify additional paths that should be checked for binaries where access will be minimized
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `os_env_user_paths`
-  - Default: `["/usr/local/sbin", "/usr/local/bin", "/usr/sbin", "/usr/bin", "/sbin", "/bin"]`
+  - Default: `['/usr/local/sbin', '/usr/local/bin', '/usr/sbin', '/usr/bin', '/sbin', '/bin']`
   - Description: Specify paths that should be checked for binaries where access will be minimized
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `os_filesystem_whitelist`
-  - Default: `"[]"`
+  - Default: `[]`
   - Description: A list of filesystems that should not be disabled
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `os_hardening_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Whether to run the hardening
   - Type: bool
   - Required: no
 - `os_ignore_home_folder_users`
-  - Default: `"[]"`
+  - Default: `[]`
   - Description: Specify user accounts, whose home folders shouldn't be chmodded to 700 when "os_chmod_home_folders" is enabled.
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `os_ignore_users`
-  - Default: `["vagrant", "kitchen"]`
+  - Default: `['vagrant', 'kitchen']`
   - Description: Specify system accounts whose login should not be disabled and password not changed
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `os_limits_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to disable installing and configuring limits.
   - Type: bool
   - Required: no
 - `os_login_defs_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to disable installing and configuring login_defs for newly created users.
   - Type: bool
   - Required: no
 - `os_minimize_access_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to disable installing and configuring minimize_access.
   - Type: bool
   - Required: no
@@ -431,7 +453,7 @@ This role is mostly based on guides by:
   - Type: str
   - Required: no
 - `os_mnt_boot_enabled`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to true to configure /boot mountpoint
   - Type: bool
   - Required: no
@@ -466,7 +488,7 @@ This role is mostly based on guides by:
   - Type: str
   - Required: no
 - `os_mnt_dev_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to ignore /dev mountpoint
   - Type: bool
   - Required: no
@@ -496,7 +518,7 @@ This role is mostly based on guides by:
   - Type: str
   - Required: no
 - `os_mnt_dev_shm_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to ignore /dev/shm mountpoint
   - Type: bool
   - Required: no
@@ -536,7 +558,7 @@ This role is mostly based on guides by:
   - Type: str
   - Required: no
 - `os_mnt_home_enabled`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to true to configure /home mountpoint
   - Type: bool
   - Required: no
@@ -571,7 +593,7 @@ This role is mostly based on guides by:
   - Type: str
   - Required: no
 - `os_mnt_run_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to ignore /run mountpoint
   - Type: bool
   - Required: no
@@ -606,7 +628,7 @@ This role is mostly based on guides by:
   - Type: str
   - Required: no
 - `os_mnt_tmp_enabled`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to true to configure /tmp mountpoint
   - Type: bool
   - Required: no
@@ -641,7 +663,7 @@ This role is mostly based on guides by:
   - Type: str
   - Required: no
 - `os_mnt_var_enabled`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to true to configure /var mountpoint
   - Type: bool
   - Required: no
@@ -661,7 +683,7 @@ This role is mostly based on guides by:
   - Type: str
   - Required: no
 - `os_mnt_var_log_audit_enabled`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to true to configure /var/log/audit mountpoint
   - Type: bool
   - Required: no
@@ -696,7 +718,7 @@ This role is mostly based on guides by:
   - Type: str
   - Required: no
 - `os_mnt_var_log_enabled`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to true to configure /var/log mountpoint
   - Type: bool
   - Required: no
@@ -746,7 +768,7 @@ This role is mostly based on guides by:
   - Type: str
   - Required: no
 - `os_mnt_var_tmp_enabled`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to true to configure /var/tmp mountpoint
   - Type: bool
   - Required: no
@@ -771,47 +793,47 @@ This role is mostly based on guides by:
   - Type: str
   - Required: no
 - `os_modprobe_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to disable installing and configuring modprobe.
   - Type: bool
   - Required: no
 - `os_netrc_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Configure filesystem for existence of .netrc file in homedir
   - Type: bool
   - Required: no
 - `os_netrc_whitelist_user`
-  - Default: `"[]"`
+  - Default: `[]`
   - Description: Add list of user to allow creation of .netrc in users homedir
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `os_pam_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to disable installing and configuring pam.
   - Type: bool
   - Required: no
 - `os_profile_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to disable installing and configuring profile.
   - Type: bool
   - Required: no
 - `os_remove_additional_root_users`
-  - Default: `false`
+  - Default: `False`
   - Description: When enabled and there are multiple users with UID=0, only "root" will be kept. Others will be deleted.
   - Type: bool
   - Required: no
 - `os_rhosts_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to disable installing and configuring rhosts.
   - Type: bool
   - Required: no
 - `os_rootuser_pw_ageing`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to true to enforce password age settings for root user(s)
   - Type: bool
   - Required: no
 - `os_securetty_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to disable installing and configuring securetty.
   - Type: bool
   - Required: no
@@ -821,57 +843,57 @@ This role is mostly based on guides by:
   - Type: int
   - Required: no
 - `os_security_init_prompt`
-  - Default: `true`
+  - Default: `True`
   - Description: The PROMPT option provides console users the ability to interactively boot the system and select which services to start on boot.
   - Type: bool
   - Required: no
 - `os_security_init_single`
-  - Default: `false`
+  - Default: `False`
   - Description: Single-user mode is intended as a system recovery method, providing a single user root access to the system by providing a boot option at startup. By default, no authentication is performed if single-user mode is selected. To require entry of the root password even if the system is started in single-user mode, set this to false
   - Type: bool
   - Required: no
 - `os_security_kernel_enable_core_dump`
-  - Default: `false`
+  - Default: `False`
   - Description: kernel is crashing or otherwise misbehaving and a kernel core dump is created.
   - Type: bool
   - Required: no
 - `os_security_packages_clean`
-  - Default: `true`
+  - Default: `True`
   - Description: removes packages with known issues. See section packages.
   - Type: bool
   - Required: no
 - `os_security_packages_list`
-  - Default: `["xinetd", "inetd", "ypserv", "telnet-server", "rsh-server", "prelink"]`
+  - Default: `['xinetd', 'inetd', 'ypserv', 'telnet-server', 'rsh-server', 'prelink']`
   - Description: List of deprecated or insecure packages to remove
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `os_security_suid_sgid_blacklist`
-  - Default: `"[]"`
+  - Default: `[]`
   - Description: a list of paths which should have their SUID/SGID bits removed.
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `os_security_suid_sgid_enforce`
-  - Default: `true`
+  - Default: `True`
   - Description: true if you want to reduce SUID/SGID bits. There is already a list of items which are searched for configured, but you can also add your own.
   - Type: bool
   - Required: no
 - `os_security_suid_sgid_remove_from_unknown`
-  - Default: `false`
+  - Default: `False`
   - Description: true if you want to remove SUID/SGID bits from any file, that is not explicitly configured in a `blacklist`. This will make every Ansible-run search through the mounted filesystems looking for SUID/SGID bits that are not configured in the default and user blacklist. If it finds an SUID/SGID bit, it will be removed, unless this file is in your `whitelist`.
   - Type: bool
   - Required: no
 - `os_security_suid_sgid_whitelist`
-  - Default: `"[]"`
+  - Default: `[]`
   - Description: a list of paths which should not have their SUID/SGID bits altered.
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `os_security_users_allow`
-  - Default: `"[]"`
+  - Default: `[]`
   - Description: list of things, that a user is allowed to do. May contain `change_user`.
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `os_selinux_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to disable installing and configuring selinux.
   - Type: bool
   - Required: no
@@ -896,39 +918,39 @@ This role is mostly based on guides by:
   - Type: int
   - Required: no
 - `os_sysctl_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to disable installing and configuring sysctl.
   - Type: bool
   - Required: no
 - `os_unused_filesystems`
-  - Default: `["cramfs", "freevxfs", "jffs2", "hfs", "hfsplus", "squashfs", "udf", "vfat", "dccp", "rds", "sctp", "tipc"]`
+  - Default: `['cramfs', 'freevxfs', 'jffs2', 'hfs', 'hfsplus', 'squashfs', 'udf', 'vfat', 'dccp', 'rds', 'sctp', 'tipc']`
   - Description: Disable this list of unused filesystems
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `os_user_accounts_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to disable installing and configuring user_accounts.
   - Type: bool
   - Required: no
 - `os_user_pw_ageing`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to disable password age enforcement on existing users
   - Type: bool
   - Required: no
 - `os_users_without_password_ageing`
-  - Default: `"[]"`
+  - Default: `[]`
   - Description: List of users, where password ageing should not be enforced even if "os_user_pw_ageing" is enabled
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `os_yum_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to false to disable installing and configuring yum.
   - Type: bool
   - Required: no
 - `os_yum_repo_file_whitelist`
-  - Default: `"[]"`
+  - Default: `[]`
   - Description: List of yum repository files under /etc/yum.repos.d/ which should not be altered.
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `proc_mnt_options`
   - Default: `rw,nosuid,nodev,noexec,relatime`
@@ -966,7 +988,7 @@ This role is mostly based on guides by:
   - Type: str
   - Required: no
 - `ufw_enable_ipv6`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to `true` to apply rules to support IPv6 (no means only IPv6 on loopback accepted).
   - Type: bool
   - Required: no
@@ -986,7 +1008,7 @@ This role is mostly based on guides by:
   - Type: str
   - Required: no
 - `ufw_manage_defaults`
-  - Default: `true`
+  - Default: `True`
   - Description: true means apply all settings with `ufw_` prefix.
   - Type: bool
   - Required: no

roles/os_hardening/defaults/main.yml

@@ -146,7 +146,7 @@ sysctl_config:
   # The PTRACE system is used for debugging.  With it, a single user process
   # can attach to any other dumpable process owned by the same user.  In the
   # case of malicious software, it is possible to use PTRACE to access
-  # credentials that exist in memory (re-using existing SSH connections,
+  # credentials that exist in memory (reusing existing SSH connections,
   # extracting GPG agent information, etc).
   #
   # A PTRACE scope of "0" is the more permissive mode.  A scope of "1" limits

roles/os_hardening/tasks/pam.yml

@@ -27,6 +27,24 @@
   when:
     - ansible_facts.os_family == 'RedHat'
 
+- name: Allow Login with SSH Keys, when user password is expired
+  ansible.builtin.lineinfile:
+    path: /etc/pam.d/system-auth
+    backrefs: true
+    regexp: "^(account.*pam_unix.so(?!.*no_pass_expiry).*)$"
+    line: '\1 no_pass_expiry'
+  when:
+    - ansible_facts.os_family == 'Archlinux'
+
+- name: Allow Login with SSH Keys, when user password is expired
+  ansible.builtin.lineinfile:
+    path: /etc/pam.d/common-account
+    backrefs: true
+    regexp: "^(account.*pam_unix.so(?!.*no_pass_expiry).*)$"
+    line: '\1 no_pass_expiry'
+  when:
+    - ansible_facts.os_family == 'Suse'
+
 - name: NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
   ansible.builtin.template:
     src: etc/libuser.conf.j2

roles/os_hardening/tasks/pam_debian.yml

@@ -118,3 +118,10 @@
     state: absent
   when:
     - not os_auth_pam_passwdqc_enable
+
+- name: Allow Login with SSH Keys, when user password is expired
+  ansible.builtin.lineinfile:
+    path: /etc/pam.d/common-account
+    backrefs: true
+    regexp: "^(account.*pam_unix.so(?!.*no_pass_expiry).*)$"
+    line: '\1 no_pass_expiry'

roles/os_hardening/tasks/sysctl.yml

@@ -21,22 +21,6 @@
 - name: Change sysctls
   when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']
   block:
-    - name: Create a combined sysctl-dict if os-dependent sysctls are defined
-      ansible.builtin.set_fact:
-        sysctl_config: "{{ sysctl_config | combine(sysctl_custom_config) }}"
-      when: sysctl_custom_config | default()
-
-    # sysctl_rhel_config is kept for backwards-compatibility. use sysctl_custom_config instead
-    - name: Create a combined sysctl-dict if os-dependent sysctls are defined
-      ansible.builtin.set_fact:
-        sysctl_config: "{{ sysctl_config | combine(sysctl_rhel_config) }}"
-      when: sysctl_rhel_config | default()
-
-    - name: Create a combined sysctl-dict if overwrites are defined
-      ansible.builtin.set_fact:
-        sysctl_config: "{{ sysctl_config | combine(sysctl_overwrite) }}"
-      when: sysctl_overwrite | default()
-
     - name: Change various sysctl-settings, look at the sysctl-vars file for documentation
       ansible.posix.sysctl:
         name: "{{ item.key }}"
@@ -45,7 +29,12 @@
         state: present
         reload: true
         ignoreerrors: true
-      with_dict: "{{ sysctl_config }}"
+      # sysctl_rhel_config is kept for backwards-compatibility. use sysctl_custom_config instead
+      # combines all sysctl-dicts into one, adds empty dicts if they are not defined
+      with_dict: "{{ ((sysctl_config
+        | combine(sysctl_custom_config | default({})))
+        | combine(sysctl_rhel_config | default({})))
+        | combine(sysctl_overwrite | default({})) }}"
       when: item.key not in sysctl_unsupported_entries | default()
 
 - name: Apply ufw defaults

roles/os_hardening/templates/etc/pam.d/rhel_auth.j2

@@ -24,7 +24,7 @@ auth        required      pam_deny.so
 {% if os_auth_retries|int > 0 %}
 account     required      pam_faillock.so
 {% endif %}
-account     required      pam_unix.so
+account     required      pam_unix.so no_pass_expiry
 account     sufficient    pam_localuser.so
 account     sufficient    pam_succeed_if.so uid < 1000 quiet
 {% if (os_auth_pam_sssd_enable | bool) %}

roles/ssh_hardening/README.md

@@ -66,12 +66,12 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
 ## Role Variables
 
 - `network_ipv6_enable`
-  - Default: `true`
+  - Default: `True`
   - Description: `false` if IPv6 is not needed. `ssh_listen_to` must also be set to listen to IPv6 addresses (for example `[::]`).
   - Type: bool
   - Required: no
 - `sftp_chroot`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to `false` to disable chroot for sftp.
   - Type: bool
   - Required: no
@@ -81,7 +81,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Type: str
   - Required: no
 - `sftp_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to `false` to disable sftp configuration.
   - Type: bool
   - Required: no
@@ -91,7 +91,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Type: str
   - Required: no
 - `ssh_allow_agent_forwarding`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to `false` to disable Agent Forwarding. Set to `true` to allow Agent Forwarding.
   - Type: bool
   - Required: no
@@ -116,9 +116,9 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Type: str
   - Required: no
 - `ssh_authorized_principals`
-  - Default: ``
+  - Default: `[]`
   - Description: list of hashes containing file paths and authorized principals, see `default_cstom.yml` for all options. Only used if `ssh_authorized_principals_file` is set
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `ssh_authorized_principals_file`
   - Default: ``
@@ -126,7 +126,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Type: str
   - Required: no
 - `ssh_banner`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to `true` to print a banner on login.
   - Type: bool
   - Required: no
@@ -136,14 +136,14 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Type: str
   - Required: no
 - `ssh_challengeresponseauthentication`
-  - Default: `false`
+  - Default: `False`
   - Description: Specifies whether challenge-response authentication is allowed (e.g. via PAM).
   - Type: bool
   - Required: no
 - `ssh_ciphers`
   - Default: ``
   - Description: Change this list to overwrite ciphers. Defaults found in `defaults/main.yml`
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `ssh_client_alive_count`
   - Default: `3`
@@ -156,7 +156,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Type: int
   - Required: no
 - `ssh_client_compression`
-  - Default: `false`
+  - Default: `False`
   - Description: Specifies whether the client requests compression.
   - Type: bool
   - Required: no
@@ -166,17 +166,17 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Type: str
   - Required: no
 - `ssh_client_hardening`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to `false` to stop harden the client.
   - Type: bool
   - Required: no
 - `ssh_client_host_key_algorithms`
-  - Default: ``
+  - Default: `[]`
   - Description: Specifies the host key algorithms that the client wants to use in order of preference. If empty the default list will be used. Otherwise overrides the setting with specified list of algorithms. Check `man ssh_config`, `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make sure you check the correct version!
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `ssh_client_password_login`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to `true` to allow password-based authentication with the ssh client.
   - Type: bool
   - Required: no
@@ -186,19 +186,19 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Type: str
   - Required: no
 - `ssh_client_roaming`
-  - Default: `false`
+  - Default: `False`
   - Description: enable experimental client roaming.
   - Type: bool
   - Required: no
 - `ssh_compression`
-  - Default: `false`
+  - Default: `False`
   - Description: Specifies whether server-side compression is enabled after the user has authenticated successfully.
   - Type: bool
   - Required: no
 - `ssh_custom_options`
-  - Default: ``
+  - Default: `[]`
   - Description: Custom lines for SSH client configuration.
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `ssh_custom_selinux_dir`
   - Default: `/etc/selinux/local-policies`
@@ -215,40 +215,45 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Description: if specified, login is disallowed for user names that match one of the patterns.
   - Type: str
   - Required: no
+- `ssh_forward_agent`
+  - Default: `no`
+  - Description: Enables the ssh forward agent for the Cli if set to 'yes'
+  - Type: str
+  - Required: no
 - `ssh_gateway_ports`
   - Default: `False`
   - Description: Set to `false` to disable binding forwarded ports to non-loopback addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified` to allow the client to specify which address to bind to.
   - Type: raw
   - Required: no
 - `ssh_gssapi_delegation`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to `true` to enable GSSAPI credential forwarding.
   - Type: bool
   - Required: no
 - `ssh_gssapi_support`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to `true` to enable GSSAPI authentication (both client and server).
   - Type: bool
   - Required: no
 - `ssh_hardening_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Whether to run the hardening
   - Type: bool
   - Required: no
 - `ssh_host_certificates`
-  - Default: ``
+  - Default: `[]`
   - Description: Host certificates to look for when starting sshd
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `ssh_host_key_algorithms`
-  - Default: ``
+  - Default: `[]`
   - Description: Host key algorithms that the server offers. If empty the default list will be used. Otherwise overrides the setting with specified list of algorithms. Check `man sshd_config`, `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make sure you check the correct version
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `ssh_host_key_files`
   - Default: ``
   - Description: Host keys for sshd. If empty ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key', '/etc/ssh/ssh_host_ed25519_key'] will be used, as far as supported by the installed sshd version.
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `ssh_host_rsa_key_size`
   - Default: `4096`
@@ -256,19 +261,19 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Type: int
   - Required: no
 - `ssh_kerberos_support`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to `true` if SSH has Kerberos support.
   - Type: bool
   - Required: no
 - `ssh_kex`
   - Default: ``
   - Description: Change this list to overwrite kexs. Defaults found in `defaults/main.yml`
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `ssh_listen_to`
-  - Default: `["0.0.0.0"]`
+  - Default: `['0.0.0.0']`
   - Description: one or more ip addresses, to which ssh-server should listen to. Default is all IPv4 addresses, but should be configured to specific addresses for security reasons
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `ssh_login_grace_time`
   - Default: `30s`
@@ -278,7 +283,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
 - `ssh_macs`
   - Default: ``
   - Description: Change this list to overwrite macs. Defaults found in `defaults/main.yml`
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `ssh_max_auth_retries`
   - Default: `2`
@@ -296,7 +301,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Type: str
   - Required: no
 - `ssh_pam_support`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to `true` if SSH has PAM support.
   - Type: bool
   - Required: no
@@ -316,22 +321,22 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
     - point-to-point
     - ethernet
 - `ssh_print_debian_banner`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to `true` to print debian specific banner.
   - Type: bool
   - Required: no
 - `ssh_print_last_log`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to `false` to disable display of last login information.
   - Type: bool
   - Required: no
 - `ssh_print_motd`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to `false` to disable printing of the MOTD.
   - Type: bool
   - Required: no
 - `ssh_print_pam_motd`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to `false` to disable printing of the MOTD via pam (Debian and Ubuntu).
   - Type: bool
   - Required: no
@@ -341,9 +346,9 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Type: str
   - Required: no
 - `ssh_remote_hosts`
-  - Default: ``
+  - Default: `[]`
   - Description: one or more hosts and their custom options for the ssh-client. Default is empty. See examples in `defaults/main.yml`
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `ssh_server_accept_env_vars`
   - Default: ``
@@ -356,12 +361,12 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Type: str
   - Required: no
 - `ssh_server_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to `false` to disable the opensshd server.
   - Type: bool
   - Required: no
 - `ssh_server_hardening`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to `false` to stop harden the server.
   - Type: bool
   - Required: no
@@ -386,7 +391,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Type: str
   - Required: no
 - `ssh_server_password_login`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to `true` to allow password-based authentication to the ssh server. You probably also need to change `sshd_authenticationmethods` to include `password` if you set `ssh_server_password_login`: `true`.
   - Type: bool
   - Required: no
@@ -396,24 +401,24 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Type: str
   - Required: no
 - `ssh_server_ports`
-  - Default: `["22"]`
+  - Default: `['22']`
   - Description: ports on which ssh-server should listen.
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `ssh_server_revoked_keys`
-  - Default: ``
+  - Default: `[]`
   - Description: a list of revoked public keys that the ssh server will always reject, useful to revoke known weak or compromised keys.
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `ssh_server_service_enabled`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to `false` to disable starting sshd at boot.
   - Type: bool
   - Required: no
 - `ssh_trusted_user_ca_keys`
-  - Default: ``
+  - Default: `[]`
   - Description: set the trusted certificate authorities public keys used to sign user certificates. Only used if `ssh_trusted_user_ca_keys_file` is set.
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `ssh_trusted_user_ca_keys_file`
   - Default: ``
@@ -421,17 +426,17 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Type: str
   - Required: no
 - `ssh_use_dns`
-  - Default: `false`
+  - Default: `False`
   - Description: Specifies whether sshd should look up the remote host name, and to check that the resolved host name for the remote IP address maps back to the very same IP address.
   - Type: bool
   - Required: no
 - `ssh_use_pam`
-  - Default: `true`
+  - Default: `True`
   - Description: Set to `false` to disable pam authentication.
   - Type: bool
   - Required: no
 - `ssh_x11_forwarding`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to `false` to disable X11 Forwarding. Set to `true` to allow X11 Forwarding.
   - Type: bool
   - Required: no
@@ -441,9 +446,9 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Type: str
   - Required: no
 - `sshd_custom_options`
-  - Default: ``
+  - Default: `[]`
   - Description: Custom lines for SSH daemon configuration.
-  - Type: list
+  - Type: list of ''
   - Required: no
 - `sshd_log_level`
   - Default: `VERBOSE`
@@ -461,7 +466,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Type: int
   - Required: no
 - `sshd_strict_modes`
-  - Default: `true`
+  - Default: `True`
   - Description: Check file modes and ownership of the user's files and home directory before accepting login.
   - Type: bool
   - Required: no

roles/ssh_hardening/meta/argument_specs.yml

@@ -365,3 +365,6 @@ argument_specs:
         default: sandbox
         description: Specifies whether sshd separates privileges by creating an unprivileged
           child process to deal with incoming network traffic.
+      ssh_forward_agent:
+        default: 'no'
+        description: Enables the ssh forward agent for the Cli if set to 'yes'

roles/ssh_hardening/templates/openssh.conf.j2

@@ -90,7 +90,9 @@ StrictHostKeyChecking ask
 
 {% endif %}
 # Disable agent forwarding, since local agent could be accessed through forwarded connection.
-ForwardAgent no
+
+ForwardAgent {{ ((ssh_forward_agent) if ssh_forward_agent is defined else 'no')}} 
+
 
 # Disable X11 forwarding, since local X11 display could be accessed through forwarded connection.
 ForwardX11 no

roles/ssh_hardening/templates/opensshd.conf.j2

@@ -171,7 +171,7 @@ DenyUsers {{ ssh_deny_users }}
 
 {% endif %}
 {% if ssh_allow_users %}
-AllowUsers {{ ssh_allow_users }}
+AllowUsers {{ ssh_allow_users if (ssh_allow_users is string) else (ssh_allow_users|join(' ')) }}
 
 {% endif %}
 {% if ssh_deny_groups %}