update changelog

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.config/ansible-lint.yml

@@ -5,11 +5,10 @@
 # option will be parsed relative to the CWD of execution.
 exclude_paths:
   - .cache/ # implicit unless exclude_paths is defined in config
+  - .ansible/ # somehow someone decided that the cache directory should be renamed
   # add all waivers individually, since exclude_files does not support globs
   - molecule/os_hardening/waivers.yaml
-  - molecule/ssh_hardening_bsd/waivers_freebsd13.yaml
+  - molecule/ssh_hardening_vm/waivers_*.yaml
-  - molecule/ssh_hardening_bsd/waivers_freebsd14.yaml
-  - molecule/ssh_hardening_bsd/waivers_openbsd7.yaml
 
 mock_roles:
   - geerlingguy.git

.github/workflows/ansible-lint.yml

@@ -23,10 +23,10 @@ on:  # yamllint disable-line rule:truthy
 
 jobs:
   ansible-lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Lint Ansible Playbook
-        uses: ansible/ansible-lint@4ce8e497d462cf73b4d4fac1e97b4ace4f317dcc # v24
+        uses: ansible/ansible-lint@5fac056c45595896c973fbde871f01f6cb14d74c # v26

.github/workflows/codespell.yml

@@ -9,6 +9,6 @@ on:  # yamllint disable-line rule:truthy
 
 jobs:
   codespell:
-    uses: "dev-sec/.github/.github/workflows/codespell.yml@main"
+    uses: "dev-sec/.github/.github/workflows/codespell.yml@2cd00282cfdb322243d879a96d9494ce64e76119" # main
     with:
       ignore_words_list: "chage,BOOTUP"

.github/workflows/enforce-labels.yml

@@ -12,8 +12,8 @@ permissions:
 jobs:
   enforce-label:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
-      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/galaxy-publish.yml

@@ -9,20 +9,20 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   deploy:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       # deploy the collection first, because if it fails, we don't want
       # to update the galaxy.yml
       - name: Deploy the collection
-        uses: artis3n/ansible_galaxy_collection@3368f56529a2ef47ef0ac1ecfcda039f90d0174a # v2
+        uses: artis3n/ansible_galaxy_collection@ffbca2460a5a1c600b941bbf1536bd61de1c2227 # v3
         with:
           api_key: ${{ secrets.GALAXY_API_KEY }}
           galaxy_version: ${{ github.event.release.tag_name }}
 
       # checkout master instead of the release-tag so we can push the galaxy.yml
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: master
 

.github/workflows/mysql_hardening.yml

@@ -29,7 +29,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -37,29 +37,34 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
+          - almalinux8
+          - almalinux9
+          # - almalinux10  # problem with baseline
           - centosstream9
           - rocky8
           - rocky9
-          - ubuntu2004
+          # - rocky10 # problem with baseline
           - ubuntu2204
           - ubuntu2404
+          # - ubuntu2604 # problem with test setup
           - debian11
           - debian12
+          - debian13
           # - amazon  # geerlingguy.mysql does not support fedora
           # - arch  # geerlingguy.mysql does not support arch
           - opensuse_tumbleweed
           # - fedora  # geerlingguy.mysql does not support fedora
     steps:
       - name: Checkout repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
       - name: Set up Python
-        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: 3.12
+          python-version: 3.13
           cache: 'pip'
 
       - name: Install dependencies
@@ -67,9 +72,12 @@ jobs:
         working-directory: ansible_collections/devsec/hardening
 
       - name: Downgrade Ansible for Rocky 8 tests
-        run: pip install "ansible-core<2.17"
+        run: |
+            pip install "ansible-core<2.17"
+            ansible-galaxy collection install 'community.crypto:<3.0.0'
+            ansible-galaxy collection install 'community.general:<12.0.0'
         working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8'
+        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
 
       # that was a hard one to fix. robert did it thankfully
       # https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212

.github/workflows/nginx_hardening.yml

@@ -28,7 +28,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -36,29 +36,34 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
+          - almalinux8
+          - almalinux9
+          - almalinux10
           - centosstream9
           - rocky8
           - rocky9
-          - ubuntu2004
+          - rocky10
           - ubuntu2204
           - ubuntu2404
+          - ubuntu2604
           - debian11
           - debian12
+          - debian13
           - amazon2023
           # - arch  # needs to be fixed
           # - opensuse_tumbleweed  # needs to be fixed
           # - fedora  # no support from geerlingguy role
     steps:
       - name: Checkout repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
       - name: Set up Python
-        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: 3.12
+          python-version: 3.13
           cache: 'pip'
 
       - name: Install dependencies
@@ -66,9 +71,12 @@ jobs:
         working-directory: ansible_collections/devsec/hardening
 
       - name: Downgrade Ansible for Rocky 8 tests
-        run: pip install "ansible-core<2.17"
+        run: |
+            pip install "ansible-core<2.17"
+            ansible-galaxy collection install 'community.crypto:<3.0.0'
+            ansible-galaxy collection install 'community.general:<12.0.0'
         working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8'
+        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
 
       # Molecule has problems detecting the proper location for installing roles
       # https://github.com/ansible/molecule/issues/3806

.github/workflows/os_hardening.yml

@@ -28,7 +28,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -39,31 +39,37 @@ jobs:
           - molecule_distro: opensuse_tumbleweed
             molecule_docker_command: "/usr/lib/systemd/systemd"
         molecule_distro:
+          - almalinux8
+          - almalinux9
+          - almalinux10
           - centosstream9
           - rocky8
           - rocky9
-          - fedora39
+          - rocky10
-          - fedora40
+          - fedora42
-          - ubuntu2004
+          - fedora43
+          - fedora44
           - ubuntu2204
           - ubuntu2404
+          - ubuntu2604
           - debian11
           - debian12
+          - debian13
           - amazon2023
           - arch
         molecule_docker_command:
           - "/lib/systemd/systemd"
     steps:
       - name: Checkout repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
       - name: Set up Python
-        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: 3.12
+          python-version: 3.13
           cache: 'pip'
 
       - name: Install dependencies
@@ -71,9 +77,12 @@ jobs:
         working-directory: ansible_collections/devsec/hardening
 
       - name: Downgrade Ansible for Rocky 8 tests
-        run: pip install "ansible-core<2.17"
+        run: |
+            pip install "ansible-core<2.17"
+            ansible-galaxy collection install 'community.crypto:<3.0.0'
+            ansible-galaxy collection install 'community.general:<12.0.0'
         working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8'
+        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
 
       - name: Test with molecule
         run: molecule test -s os_hardening

.github/workflows/os_hardening_vm.yml

@@ -9,6 +9,7 @@ on:  # yamllint disable-line rule:truthy
       - 'molecule/os_hardening_vm/**'
       - '.github/workflows/os_hardening_vm.yml'
       - 'requirements.txt'
+      - 'requirements-vm.txt'
   pull_request:
     branches: [master]
     paths:
@@ -16,6 +17,7 @@ on:  # yamllint disable-line rule:truthy
       - 'molecule/os_hardening_vm/**'
       - '.github/workflows/os_hardening_vm.yml'
       - 'requirements.txt'
+      - 'requirements-vm.txt'
   schedule:
     - cron: '0 6 * * 2'
 
@@ -36,21 +38,25 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
+          - almalinux/8
+          - almalinux/9
+          # - almalinux/10  # boot loop
           - generic/centos9s
           - generic/rocky8
           - generic/rocky9
-          - fedora/39-cloud-base
+          - alvistack/fedora-42
-          - fedora/40-cloud-base
+          # - alvistack/fedora-43 # no compatible test image
-          - generic/ubuntu2004
           - generic/ubuntu2204
           - alvistack/ubuntu-24.04
+          # - alvistack/ubuntu-26.04 # no compatible test image
           - generic/debian11
           - generic/debian12
+          - cloud-image/debian-13
           - generic/opensuse15
           - generic/arch
     steps:
       - name: Checkout repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
@@ -60,15 +66,20 @@ jobs:
           source ~/.venv/ansible-collection-hardening/bin/activate
           python -m pip install --no-cache-dir --upgrade pip
           pip install -r requirements.txt
-          pip install python-vagrant
+          pip install -r requirements-vm.txt
         working-directory: ansible_collections/devsec/hardening
 
       - name: Downgrade Ansible for Rocky 8 tests
         run: |
           source ~/.venv/ansible-collection-hardening/bin/activate
           pip install "ansible-core<2.17"
+          ansible-galaxy collection install 'community.crypto:<3.0.0'
+          ansible-galaxy collection install 'community.general:<12.0.0'
         working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'generic/rocky8' || matrix.molecule_distro == 'generic/opensuse15'
+        if: >
+          matrix.molecule_distro == 'generic/rocky8' ||
+          matrix.molecule_distro == 'almalinux/8' ||
+          matrix.molecule_distro == 'generic/opensuse15'
 
       - name: Update Vagrant Box
         run: |
@@ -77,6 +88,8 @@ jobs:
       - name: Test with molecule
         run: |
           source ~/.venv/ansible-collection-hardening/bin/activate
+          # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
+          export MOLECULE_VAGRANT_PLUGIN_DIR=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')/molecule_plugins/vagrant
           molecule test -s os_hardening_vm
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}

.github/workflows/prettier-md.yml

@@ -11,16 +11,16 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   prettier-md:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 1
 
     steps:
       - name: Git checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: ${{ github.head_ref }}
 
       - name: Prettify code
-        uses: creyD/prettier_action@31355f8eef017f8aeba2e0bc09d8502b13dbbad1 # v4.3
+        uses: creyD/prettier_action@8c18391fdc98ed0d884c6345f03975edac71b8f0 # v4.6
         with:
           prettier_options: --write {**/*,*}.md

.github/workflows/release.yml

@@ -11,16 +11,16 @@ jobs:
   generate_changelog:
     name: create release draft
     if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           ref: master
 
       - name: 'Get Previous tag'
         id: previoustag
-        uses: "WyriHaximus/github-action-get-previous-tag@master"
+        uses: "WyriHaximus/github-action-get-previous-tag@61819f33034117e6c686e6a31dba995a85afc9de" # master
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
 
@@ -58,12 +58,12 @@ jobs:
 
       - name: Read CHANGELOG.md
         id: package
-        uses: juliangruber/read-file-action@b549046febe0fe86f8cb4f93c24e284433f9ab58 # v1
+        uses: juliangruber/read-file-action@271ff311a4947af354c6abcd696a306553b9ec18 # v1
         with:
           path: ./CHANGELOGRELEASE.md
 
       - name: Delete old drafts
-        uses: hugo19941994/delete-draft-releases@1bdca1ea7ffb25ae7f468a7bdb40056dae98175e # v1.0.1
+        uses: hugo19941994/delete-draft-releases@3f19a25abf2ce87850c2268938f98f14e4d3d1f1 # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/roles-readme.yml

@@ -17,7 +17,7 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   readme:
     name: create roles readme
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     strategy:
       matrix:
         roles:
@@ -27,12 +27,12 @@ jobs:
           - ssh_hardening
     steps:
       - name: Check out code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Python
-        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: 3.12
+          python-version: 3.13
           cache: 'pip'
 
       - name: Install dependencies

.github/workflows/ssh_hardening.yml

@@ -28,7 +28,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -42,31 +42,37 @@ jobs:
           - molecule_distro: alpine
             molecule_docker_command: "/sbin/init"
         molecule_distro:
+          - almalinux8
+          - almalinux9
+          - almalinux10
           - centosstream9
           - rocky8
           - rocky9
-          - fedora39
+          - rocky10
-          - fedora40
+          - fedora42
-          - ubuntu2004
+          - fedora43
+          - fedora44
           - ubuntu2204
           - ubuntu2404
+          - ubuntu2604
           - debian11
           - debian12
+          - debian13
           - amazon2023
           - arch
         molecule_docker_command:
           - "/lib/systemd/systemd"
     steps:
       - name: Checkout repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
       - name: Set up Python
-        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: 3.12
+          python-version: 3.13
           cache: 'pip'
 
       - name: Install dependencies
@@ -74,9 +80,12 @@ jobs:
         working-directory: ansible_collections/devsec/hardening
 
       - name: Downgrade Ansible for Rocky 8 tests
-        run: pip install "ansible-core<2.17"
+        run: |
+            pip install "ansible-core<2.17"
+            ansible-galaxy collection install 'community.crypto:<3.0.0'
+            ansible-galaxy collection install 'community.general:<12.0.0'
         working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8'
+        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
 
       - name: Test with molecule
         run: molecule test -s ssh_hardening

.github/workflows/ssh_hardening_bsd.yml

@@ -1,56 +0,0 @@
----
-name: "devsec.ssh_hardening BSD"
-on:  # yamllint disable-line rule:truthy
-  workflow_dispatch:
-  push:
-    branches: [master]
-    paths:
-      - 'roles/ssh_hardening/**'
-      - 'molecule/ssh_hardening_bsd/**'
-      - '.github/workflows/ssh_hardening_bsd.yml'
-      - 'requirements.txt'
-  pull_request:
-    branches: [master]
-    paths:
-      - 'roles/ssh_hardening/**'
-      - 'molecule/ssh_hardening_bsd/**'
-      - '.github/workflows/ssh_hardening_bsd.yml'
-      - 'requirements.txt'
-  schedule:
-    - cron: '0 6 * * 5'
-
-concurrency:
-  group: >-
-    ${{ github.workflow }}-${{
-      github.event.pull_request.number || github.sha
-    }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    runs-on: self-hosted
-    env:
-      PY_COLORS: 1
-      ANSIBLE_FORCE_COLOR: 1
-    strategy:
-      fail-fast: false
-      matrix:
-        molecule_distro:
-          - openbsd7
-          - freebsd13
-          - freebsd14
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          path: ansible_collections/devsec/hardening
-          submodules: true
-
-      - name: Update Vagrant Box
-        run: vagrant box update --box generic/${{ matrix.molecule_distro }} || true
-
-      - name: Test with molecule
-        run: molecule test -s ssh_hardening_bsd
-        env:
-          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
-        working-directory: ansible_collections/devsec/hardening

.github/workflows/ssh_hardening_custom_tests.yml

@@ -28,7 +28,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -42,31 +42,37 @@ jobs:
           - molecule_distro: alpine
             molecule_docker_command: "/sbin/init"
         molecule_distro:
+          - almalinux8
+          - almalinux9
+          - almalinux10
           - centosstream9
           - rocky8
           - rocky9
-          - fedora39
+          - rocky10
-          - fedora40
+          - fedora42
-          - ubuntu2004
+          - fedora43
+          - fedora44
           - ubuntu2204
           - ubuntu2404
+          - ubuntu2604
           - debian11
           - debian12
+          - debian13
           - amazon2023
           - arch
         molecule_docker_command:
           - "/lib/systemd/systemd"
     steps:
       - name: Checkout repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
       - name: Set up Python
-        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: 3.12
+          python-version: 3.13
           cache: 'pip'
 
       - name: Install dependencies
@@ -74,9 +80,12 @@ jobs:
         working-directory: ansible_collections/devsec/hardening
 
       - name: Downgrade Ansible for Rocky 8 tests
-        run: pip install "ansible-core<2.17"
+        run: |
+            pip install "ansible-core<2.17"
+            ansible-galaxy collection install 'community.crypto:<3.0.0'
+            ansible-galaxy collection install 'community.general:<12.0.0'
         working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8'
+        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
 
       - name: Test with molecule
         run: molecule test -s ssh_hardening_custom_tests

.github/workflows/ssh_hardening_vm.yml

@@ -0,0 +1,73 @@
+---
+name: "devsec.ssh_hardening VM"
+on:  # yamllint disable-line rule:truthy
+  workflow_dispatch:
+  push:
+    branches: [master]
+    paths:
+      - 'roles/ssh_hardening/**'
+      - 'molecule/ssh_hardening_vm/**'
+      - '.github/workflows/ssh_hardening_vm.yml'
+      - 'requirements.txt'
+      - 'requirements-vm.txt'
+  pull_request:
+    branches: [master]
+    paths:
+      - 'roles/ssh_hardening/**'
+      - 'molecule/ssh_hardening_vm/**'
+      - '.github/workflows/ssh_hardening_vm.yml'
+      - 'requirements.txt'
+      - 'requirements-vm.txt'
+  schedule:
+    - cron: '0 6 * * 5'
+
+concurrency:
+  group: >-
+    ${{ github.workflow }}-${{
+      github.event.pull_request.number || github.sha
+    }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: self-hosted
+    env:
+      PY_COLORS: 1
+      ANSIBLE_FORCE_COLOR: 1
+    strategy:
+      fail-fast: false
+      matrix:
+        molecule_distro:
+          - generic/openbsd7
+          - generic/freebsd14
+          - cloud-image/debian-13
+          - cloud-image/ubuntu-24.04
+          - cloud-image/ubuntu-26.04
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          path: ansible_collections/devsec/hardening
+          submodules: true
+
+      - name: Install dependencies
+        run: |
+          source ~/.venv/ansible-collection-hardening/bin/activate
+          python -m pip install --no-cache-dir --upgrade pip
+          pip install -r requirements.txt
+          pip install -r requirements-vm.txt
+        working-directory: ansible_collections/devsec/hardening
+
+      - name: Update Vagrant Box
+        run: |
+          vagrant box update --box ${{ matrix.molecule_distro }} || true
+
+      - name: Test with molecule
+        run: |
+          source ~/.venv/ansible-collection-hardening/bin/activate
+          # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
+          export MOLECULE_VAGRANT_PLUGIN_DIR=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')/molecule_plugins/vagrant
+          molecule test -s ssh_hardening_vm
+        env:
+          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
+        working-directory: ansible_collections/devsec/hardening

CHANGELOG.md

@@ -1,20 +1,184 @@
 # Changelog
 
+## [10.6.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.6.0) (2026-05-13)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.2...10.6.0)
+
+**Implemented enhancements:**
+
+- Update APT package cache before installing any package in case freshly installed system. [\#945](https://github.com/dev-sec/ansible-collection-hardening/issues/945)
+- Update supported OS versions to current Fedora \(42/43/44\) and Ubuntu \(22.04/24.04/26.04\) [\#946](https://github.com/dev-sec/ansible-collection-hardening/pull/946) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+
+**Merged pull requests:**
+
+- Update actions/labeler action to v6.1.0 [\#947](https://github.com/dev-sec/ansible-collection-hardening/pull/947) ([renovate[bot]](https://github.com/apps/renovate))
+- Update dev-sec/.github digest to 2cd0028 [\#943](https://github.com/dev-sec/ansible-collection-hardening/pull/943) ([renovate[bot]](https://github.com/apps/renovate))
+- Update ansible/ansible-lint digest to 5fac056 [\#942](https://github.com/dev-sec/ansible-collection-hardening/pull/942) ([renovate[bot]](https://github.com/apps/renovate))
+- Update dependency molecule to v26 [\#935](https://github.com/dev-sec/ansible-collection-hardening/pull/935) ([renovate[bot]](https://github.com/apps/renovate))
+- Update dependency ansible-core to v2.20.5 [\#910](https://github.com/dev-sec/ansible-collection-hardening/pull/910) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+
+## [10.5.2](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.2) (2026-03-28)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.1...10.5.2)
+
+**Fixed bugs:**
+
+- do not update apt cache when installing libpam-passwdqc [\#939](https://github.com/dev-sec/ansible-collection-hardening/pull/939) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([eikesauer](https://github.com/eikesauer))
+
+**Merged pull requests:**
+
+- chore\(deps\): update hugo19941994/delete-draft-releases action to v3 [\#940](https://github.com/dev-sec/ansible-collection-hardening/pull/940) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): pin dependencies [\#938](https://github.com/dev-sec/ansible-collection-hardening/pull/938) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/checkout digest to de0fac2 [\#932](https://github.com/dev-sec/ansible-collection-hardening/pull/932) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+
+## [10.5.1](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.1) (2026-03-20)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.0...10.5.1)
+
+**Fixed bugs:**
+
+- fix flaky failures on Ubuntu 24.04 and newer by disabling sshd socket activation first [\#931](https://github.com/dev-sec/ansible-collection-hardening/pull/931) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([kuglimon](https://github.com/kuglimon))
+
+**Closed issues:**
+
+- SSH issue after running devsec.hardening.ssh\_hardening role [\#854](https://github.com/dev-sec/ansible-collection-hardening/issues/854)
+
+**Merged pull requests:**
+
+- chore\(deps\): update juliangruber/read-file-action digest to 271ff31 [\#937](https://github.com/dev-sec/ansible-collection-hardening/pull/937) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 8ba9595 [\#934](https://github.com/dev-sec/ansible-collection-hardening/pull/934) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update artis3n/ansible\_galaxy\_collection action to v3 [\#933](https://github.com/dev-sec/ansible-collection-hardening/pull/933) ([renovate[bot]](https://github.com/apps/renovate))
+- Improve VM based testing of SSH hardening [\#878](https://github.com/dev-sec/ansible-collection-hardening/pull/878) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+
+## [10.5.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.0) (2026-01-22)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.4.0...10.5.0)
+
+**Implemented enhancements:**
+
+- fix: replace deprecated community.general.yaml callback plugin [\#918](https://github.com/dev-sec/ansible-collection-hardening/pull/918) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([Normo](https://github.com/Normo))
+- Consistently access facts via the ansible\_facts.\* namespace [\#917](https://github.com/dev-sec/ansible-collection-hardening/pull/917) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([Normo](https://github.com/Normo))
+- disable systemd audit logging [\#902](https://github.com/dev-sec/ansible-collection-hardening/pull/902) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([z-bsod](https://github.com/z-bsod))
+
+**Fixed bugs:**
+
+- /etc/sysctl.conf is no longer honored in Debian 13 [\#905](https://github.com/dev-sec/ansible-collection-hardening/issues/905)
+
+**Merged pull requests:**
+
+- chore\(deps\): update dependency jmespath to v1.1.0 [\#930](https://github.com/dev-sec/ansible-collection-hardening/pull/930) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/setup-python digest to a309ff8 [\#929](https://github.com/dev-sec/ansible-collection-hardening/pull/929) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint action to v26 [\#928](https://github.com/dev-sec/ansible-collection-hardening/pull/928) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update artis3n/ansible\_galaxy\_collection digest to 415a92b - autoclosed [\#927](https://github.com/dev-sec/ansible-collection-hardening/pull/927) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to a2bc8b8 [\#924](https://github.com/dev-sec/ansible-collection-hardening/pull/924) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/setup-python digest to 83679a8 [\#920](https://github.com/dev-sec/ansible-collection-hardening/pull/920) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/checkout action to v6 [\#919](https://github.com/dev-sec/ansible-collection-hardening/pull/919) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency molecule to v25.12.0 [\#914](https://github.com/dev-sec/ansible-collection-hardening/pull/914) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 40f24c2 [\#913](https://github.com/dev-sec/ansible-collection-hardening/pull/913) ([renovate[bot]](https://github.com/apps/renovate))
+- Update test environments to current Ansible version [\#909](https://github.com/dev-sec/ansible-collection-hardening/pull/909) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([schurzi](https://github.com/schurzi))
+- chore\(deps\): update ansible/ansible-lint digest to d7cd7cf [\#903](https://github.com/dev-sec/ansible-collection-hardening/pull/903) ([renovate[bot]](https://github.com/apps/renovate))
+
+## [10.4.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.4.0) (2025-10-22)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.3.1...10.4.0)
+
+**Implemented enhancements:**
+
+- Support Debian 13 [\#891](https://github.com/dev-sec/ansible-collection-hardening/issues/891)
+- Support EL10 [\#870](https://github.com/dev-sec/ansible-collection-hardening/issues/870)
+- Add support for current versions of Debian and EL [\#893](https://github.com/dev-sec/ansible-collection-hardening/pull/893) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Add SSH config for EL/AlmaLinux 10 [\#888](https://github.com/dev-sec/ansible-collection-hardening/pull/888) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([jonathanspw](https://github.com/jonathanspw))
+
+**Fixed bugs:**
+
+- Write sysctl config to separate file [\#907](https://github.com/dev-sec/ansible-collection-hardening/pull/907) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+
+**Closed issues:**
+
+- sysctl-34 - fs.protected\_regular not set [\#536](https://github.com/dev-sec/ansible-collection-hardening/issues/536)
+
+**Merged pull requests:**
+
+- Update ArchLinux test environment before testing [\#908](https://github.com/dev-sec/ansible-collection-hardening/pull/908) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- chore\(deps\): update actions/setup-python action to v6 [\#901](https://github.com/dev-sec/ansible-collection-hardening/pull/901) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/labeler action to v6 [\#900](https://github.com/dev-sec/ansible-collection-hardening/pull/900) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 8861a73 [\#899](https://github.com/dev-sec/ansible-collection-hardening/pull/899) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/checkout action to v5 [\#895](https://github.com/dev-sec/ansible-collection-hardening/pull/895) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency python to 3.13 [\#892](https://github.com/dev-sec/ansible-collection-hardening/pull/892) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency aar-doc to v2.3.0 [\#890](https://github.com/dev-sec/ansible-collection-hardening/pull/890) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 9765b87 [\#889](https://github.com/dev-sec/ansible-collection-hardening/pull/889) ([renovate[bot]](https://github.com/apps/renovate))
+- Improve OS support accuracy [\#887](https://github.com/dev-sec/ansible-collection-hardening/pull/887) ([jonathanspw](https://github.com/jonathanspw))
+- chore\(deps\): update hugo19941994/delete-draft-releases action to v2 [\#885](https://github.com/dev-sec/ansible-collection-hardening/pull/885) ([renovate[bot]](https://github.com/apps/renovate))
+
+## [10.3.1](https://github.com/dev-sec/ansible-collection-hardening/tree/10.3.1) (2025-07-24)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.3.0...10.3.1)
+
+**Fixed bugs:**
+
+- Readme states Ansible \>= 2.9.10, but it uses password\_expire\_warn from  2.16 [\#871](https://github.com/dev-sec/ansible-collection-hardening/issues/871)
+
+**Merged pull requests:**
+
+- Use fixed test env for BSD VMs [\#884](https://github.com/dev-sec/ansible-collection-hardening/pull/884) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Downgrade community.crypto for rocky8 [\#882](https://github.com/dev-sec/ansible-collection-hardening/pull/882) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- chore\(deps\): update dependency aar-doc to v2.2.0 [\#877](https://github.com/dev-sec/ansible-collection-hardening/pull/877) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update creyd/prettier\_action action to v4.6 [\#876](https://github.com/dev-sec/ansible-collection-hardening/pull/876) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 06f616d [\#873](https://github.com/dev-sec/ansible-collection-hardening/pull/873) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency ansible-core to v2.18.6 [\#872](https://github.com/dev-sec/ansible-collection-hardening/pull/872) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update creyd/prettier\_action action to v4.5 [\#869](https://github.com/dev-sec/ansible-collection-hardening/pull/869) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(ssh\_hardening\): ansible 2.19 compatibility [\#868](https://github.com/dev-sec/ansible-collection-hardening/pull/868) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
+- chore\(deps\): update ansible/ansible-lint digest to e98f9b3 [\#867](https://github.com/dev-sec/ansible-collection-hardening/pull/867) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/setup-python digest to a26af69 [\#866](https://github.com/dev-sec/ansible-collection-hardening/pull/866) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency ansible-core to v2.18.5 [\#865](https://github.com/dev-sec/ansible-collection-hardening/pull/865) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to c16f018 [\#863](https://github.com/dev-sec/ansible-collection-hardening/pull/863) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 6a4fcdb [\#862](https://github.com/dev-sec/ansible-collection-hardening/pull/862) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency aar-doc to v2.1.0 [\#861](https://github.com/dev-sec/ansible-collection-hardening/pull/861) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency ansible-core to v2.18.4 [\#860](https://github.com/dev-sec/ansible-collection-hardening/pull/860) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/setup-python digest to 8d9ed9a [\#859](https://github.com/dev-sec/ansible-collection-hardening/pull/859) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- Fix: ForwardAgent j2 template space  [\#856](https://github.com/dev-sec/ansible-collection-hardening/pull/856) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([cod3mas0n](https://github.com/cod3mas0n))
+- chore\(deps\): update artis3n/ansible\_galaxy\_collection digest to f6110ae [\#853](https://github.com/dev-sec/ansible-collection-hardening/pull/853) ([renovate[bot]](https://github.com/apps/renovate))
+
+## [10.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.3.0) (2025-02-25)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.2.0...10.3.0)
+
+**Implemented enhancements:**
+
+- Password expiry for users without password should not block SSH key based login [\#681](https://github.com/dev-sec/ansible-collection-hardening/issues/681)
+- Set number of warning days before password expires for existing users [\#839](https://github.com/dev-sec/ansible-collection-hardening/pull/839) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Normo](https://github.com/Normo))
+- Allow to override settings for sftponly users [\#794](https://github.com/dev-sec/ansible-collection-hardening/pull/794) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([mib1185](https://github.com/mib1185))
+
+**Closed issues:**
+
+- os\_hardening & sysctl\_overwrite with host\_vars [\#837](https://github.com/dev-sec/ansible-collection-hardening/issues/837)
+
+**Merged pull requests:**
+
+- chore\(deps\): update dependency ansible-core to v2.18.3 [\#852](https://github.com/dev-sec/ansible-collection-hardening/pull/852) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 49ded6a [\#851](https://github.com/dev-sec/ansible-collection-hardening/pull/851) ([renovate[bot]](https://github.com/apps/renovate))
+- Pin runner image to specific version to decouple from GitHub updates [\#847](https://github.com/dev-sec/ansible-collection-hardening/pull/847) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Refactor: combine multiple set\_fact into single jinja filter [\#846](https://github.com/dev-sec/ansible-collection-hardening/pull/846) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Tinyblargon](https://github.com/Tinyblargon))
+- chore\(deps\): update actions/setup-python digest to 4237552 [\#844](https://github.com/dev-sec/ansible-collection-hardening/pull/844) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency ansible-core to v2.18.2 [\#843](https://github.com/dev-sec/ansible-collection-hardening/pull/843) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency molecule to v25 [\#841](https://github.com/dev-sec/ansible-collection-hardening/pull/841) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint action to v25 [\#840](https://github.com/dev-sec/ansible-collection-hardening/pull/840) ([renovate[bot]](https://github.com/apps/renovate))
+
 ## [10.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.2.0) (2024-12-23)
 
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.1.0...10.2.0)
 
 **Implemented enhancements:**
 
-- Re-enable OpenBSD tests [\#826](https://github.com/dev-sec/ansible-collection-hardening/issues/826)
+- Re-enable OpenBSD tests [\#826](https://github.com/dev-sec/ansible-collection-hardening/issues/826) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
-- Allow configuring the name\_format variable in auditd config [\#796](https://github.com/dev-sec/ansible-collection-hardening/issues/796)
+- Allow configuring the name\_format variable in auditd config [\#796](https://github.com/dev-sec/ansible-collection-hardening/issues/796) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Modify PAM to allow SSH key based logins with locked passwords [\#835](https://github.com/dev-sec/ansible-collection-hardening/pull/835) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
 - adding switch for ForwardAgent in ssh\_config [\#818](https://github.com/dev-sec/ansible-collection-hardening/pull/818) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Shizzlebix](https://github.com/Shizzlebix))
 
 **Fixed bugs:**
 
-- ssh\_hardening error on 10.1.0. Probably... Missing privilege separation directory: /run/sshd [\#830](https://github.com/dev-sec/ansible-collection-hardening/issues/830)
+- File system loop detected; ‘/bin/X11’ is part of the same file system loop as ‘/bin’." [\#815](https://github.com/dev-sec/ansible-collection-hardening/issues/815) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
-- File system loop detected; ‘/bin/X11’ is part of the same file system loop as ‘/bin’." [\#815](https://github.com/dev-sec/ansible-collection-hardening/issues/815)
+- Not working ssh\_hardening on Centos 7  [\#813](https://github.com/dev-sec/ansible-collection-hardening/issues/813) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
-- Not working ssh\_hardening on Centos 7  [\#813](https://github.com/dev-sec/ansible-collection-hardening/issues/813)
 
 **Merged pull requests:**
 
@@ -939,7 +1103,6 @@
 - Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-collection-hardening/pull/251) ([dustinmiller](https://github.com/dustinmiller))
 - Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
 - Make max\_log\_file\_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-collection-hardening/pull/246) ([jandd](https://github.com/jandd))
-- Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-collection-hardening/pull/240) ([ghost](https://github.com/ghost))
 - Fedora - Use new auto ansible\_python\_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-collection-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
 - add test support for CentOS8 [\#237](https://github.com/dev-sec/ansible-collection-hardening/pull/237) ([yeoldegrove](https://github.com/yeoldegrove))
 - Support configuring SELinux and default to enforcing [\#236](https://github.com/dev-sec/ansible-collection-hardening/pull/236) ([jaredledvina](https://github.com/jaredledvina))
@@ -980,7 +1143,7 @@
 - remove prelink package, control package-09 [\#135](https://github.com/dev-sec/ansible-collection-hardening/pull/135) ([rndmh3ro](https://github.com/rndmh3ro))
 - style update [\#134](https://github.com/dev-sec/ansible-collection-hardening/pull/134) ([rndmh3ro](https://github.com/rndmh3ro))
 - Remove deprecated include for static tasks and use instead import\_tasks fix \#131 [\#132](https://github.com/dev-sec/ansible-collection-hardening/pull/132) ([HelioCampos](https://github.com/HelioCampos))
-- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-collection-hardening/pull/130) ([fazlearefin](https://github.com/fazlearefin))
+- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-collection-hardening/pull/130) ([FazleArefin](https://github.com/FazleArefin))
 - install initramfs-tools [\#114](https://github.com/dev-sec/ansible-collection-hardening/pull/114) ([rndmh3ro](https://github.com/rndmh3ro))
 - omit empty variables [\#106](https://github.com/dev-sec/ansible-collection-hardening/pull/106) ([rndmh3ro](https://github.com/rndmh3ro))
 - Supports --check mode [\#93](https://github.com/dev-sec/ansible-collection-hardening/pull/93) ([conorsch](https://github.com/conorsch))
@@ -1047,7 +1210,6 @@
 - replace module parameter fixed [\#297](https://github.com/dev-sec/ansible-collection-hardening/pull/297) ([danielkubat](https://github.com/danielkubat))
 - Addressing issue \#255 [\#258](https://github.com/dev-sec/ansible-collection-hardening/pull/258) ([ljkimmel](https://github.com/ljkimmel))
 - Fix \#247, cleanup conditions [\#248](https://github.com/dev-sec/ansible-collection-hardening/pull/248) ([fernandezcuesta](https://github.com/fernandezcuesta))
-- Fix error on applying the sysctl vars on containers [\#243](https://github.com/dev-sec/ansible-collection-hardening/pull/243) ([ghost](https://github.com/ghost))
 - Update location of NSA RHEL 5 Guide [\#235](https://github.com/dev-sec/ansible-collection-hardening/pull/235) ([jaredledvina](https://github.com/jaredledvina))
 - Fix typo [\#212](https://github.com/dev-sec/ansible-collection-hardening/pull/212) ([ruslo](https://github.com/ruslo))
 - Update modprobe to 0644 [\#211](https://github.com/dev-sec/ansible-collection-hardening/pull/211) ([joshuatalb](https://github.com/joshuatalb))

README.md

@@ -3,7 +3,7 @@
 [![devsec.os_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml)
 [![devsec.os_hardening VM](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml)
 [![devsec.ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml)
-[![devsec.ssh_hardening BSD](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml)
+[![devsec.ssh_hardening VM](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml)
 [![devsec.ssh_hardening with custom tests](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml)
 [![devsec.nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml)
 [![devsec.mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
@@ -13,13 +13,14 @@
 This collection provides battle tested hardening for:
 
 - Linux operating systems:
-  - CentOS 9
+  - CentOS Stream 9
-  - Rocky Linux 8/9
+  - AlmaLinux 8/9/10
-  - Debian 11/12
+  - Rocky Linux 8/9/10
-  - Ubuntu 20.04/22.04/24.04
+  - Debian 11/12/13
+  - Ubuntu 22.04/24.04/26.04
   - Amazon Linux (some roles supported)
   - Arch Linux (some roles supported)
-  - Fedora 39/40 (some roles supported)
+  - Fedora 42/43/44 (some roles supported)
   - Suse Tumbleweed (some roles supported)
 - MySQL
   - MariaDB >= 5.5.65, >= 10.1.45, >= 10.3.17
@@ -50,7 +51,7 @@ The other roles are in separate archives repositories:
 
 ## Minimum required Ansible-version
 
-- Ansible >= 2.9.10
+- Ansible >= 2.16
 
 ## Included content
 

galaxy.yml

@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 10.1.0
+version: 10.5.2
 readme: README.md
 authors:
   - dev-sec <[email protected]>

molecule/mysql_hardening/converge.yml

@@ -12,22 +12,14 @@
         mysql_python_package_debian: python3-pymysql
       when:
         - mysql_python_package_debian is not defined
-        - ansible_distribution == "Ubuntu"
+        - ansible_facts.distribution == "Ubuntu"
-        - ansible_distribution_major_version|int > 19
+        - ansible_facts.distribution_major_version|int > 19
-
-    - name: Determine required MySQL Python libraries.
-      ansible.builtin.set_fact:
-        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
-      when:
-        - mysql_python_package_debian is not defined
-        - ansible_distribution != "Ubuntu"
-        - ansible_distribution_major_version|int < 20
 
     - name: Use Python 3 on Suse
       ansible.builtin.set_fact:
         ansible_python_interpreter: /usr/bin/python3
       when:
-        - ansible_os_family == 'Suse'
+        - ansible_facts.os_family == 'Suse'
 
     - name: Include mysql_hardening role
       ansible.builtin.include_role:

molecule/mysql_hardening/molecule.yml

@@ -22,7 +22,9 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      # Currently not supported by dev-sec.mysql role
+      # inject_facts_as_vars: false
 verifier:
   name: ansible
 

molecule/mysql_hardening/prepare.yml

@@ -17,25 +17,25 @@
       ansible.builtin.set_fact:
         ansible_python_interpreter: /usr/bin/python3
       when:
-        - ansible_distribution == 'Debian'
+        - ansible_facts.distribution == 'Debian'
-        - ansible_distribution_major_version|int >= 11
+        - ansible_facts.distribution_major_version|int >= 11
 
     - name: Use Python 3 on Suse
       ansible.builtin.set_fact:
         ansible_python_interpreter: /usr/bin/python3
       when:
-        - ansible_os_family == 'Suse'
+        - ansible_facts.os_family == 'Suse'
 
     - name: Run the equivalent of "apt-get update && apt-get upgrade"
       ansible.builtin.apt:
         upgrade: safe
         update_cache: true
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'
 
     - name: Install required python packages on Suse
-      ansible.builtin.command: zypper -n install python-xml python3-rpm python3-PyMySQL
+      ansible.builtin.command: zypper -n install python311-rpm python311-PyMySQL
       changed_when: false
-      when: ansible_os_family == 'Suse'
+      when: ansible_facts.os_family == 'Suse'
 
     - name: Create missing directory
       ansible.builtin.file:
@@ -48,23 +48,15 @@
         mysql_python_package_debian: python3-pymysql
       when:
         - mysql_python_package_debian is not defined
-        - ansible_distribution == "Ubuntu"
+        - ansible_facts.distribution == "Ubuntu"
-        - ansible_distribution_major_version|int > 19
+        - ansible_facts.distribution_major_version|int > 19
-
-    - name: Determine required MySQL Python libraries.
-      ansible.builtin.set_fact:
-        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
-      when:
-        - mysql_python_package_debian is not defined
-        - ansible_distribution != "Ubuntu"
-        - ansible_distribution_major_version|int < 20
 
     - name: Install required MySQL Python libraries on RHEL
       ansible.builtin.dnf:
         name: "{% if 'python3' in ansible_python_interpreter | default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
       when:
-        - ansible_os_family == "RedHat"
+        - ansible_facts.os_family == "RedHat"
-        - ansible_distribution_major_version == "7"
+        - ansible_facts.distribution_major_version == "7"
 
     - name: Install mysql with a generic Ansible role
       ansible.builtin.include_role:

molecule/mysql_hardening/prepare_tasks/mysql_users.yml

@@ -1,6 +1,6 @@
 ---
 - name: Create users for test
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query:
       - CREATE USER 'user'@'delete';
       - CREATE USER 'user'@'127.0.0.1';
@@ -15,7 +15,7 @@
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
 
 - name: Detect role support on MySQL
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query: >
       SELECT 1 FROM information_schema.COLUMNS
                 WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
@@ -24,7 +24,7 @@
   register: mysql_role_support
 
 - name: Create roles for test
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query:
       - CREATE ROLE 'role_keep';
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"

molecule/mysql_hardening/requirements.yml

@@ -2,8 +2,3 @@
 roles:
   - name: dev-sec.mysql
     version: master
-
-collections:
-  - name: https://github.com/ansible-collections/community.mysql.git
-    type: git
-    version: main

molecule/mysql_hardening/verify.yml

@@ -11,14 +11,14 @@
       ansible.builtin.set_fact:
         ansible_python_interpreter: /usr/bin/python3
       when:
-        - ansible_os_family == 'Suse'
+        - ansible_facts.os_family == 'Suse'
 
     - name: Install procps for debian systems
       ansible.builtin.apt:
         name: procps
         state: present
         update_cache: true
-      when: ansible_distribution == 'Debian'
+      when: ansible_facts.distribution == 'Debian'
 
     - name: Include tests for the service
       ansible.builtin.include_tasks: verify_tasks/service.yml

molecule/mysql_hardening/verify_tasks/mysql_users.yml

@@ -1,6 +1,6 @@
 ---
 - name: Get all users from MySQL server
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query: >
       SELECT CONCAT(USER, '@', HOST) AS users FROM mysql.user;
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
@@ -25,7 +25,7 @@
       - '"[email protected].%" in mysql_users_list'
 
 - name: Detect role support on MySQL
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query: >
       SELECT 1 FROM information_schema.COLUMNS
                 WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'

molecule/nginx_hardening/molecule.yml

@@ -21,7 +21,9 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      # Currently not supported by geerlingguy.nginx role
+      # inject_facts_as_vars: false
 verifier:
   name: ansible
 

molecule/nginx_hardening/prepare.yml

@@ -7,12 +7,6 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: Install required tools on SuSE
-      community.general.zypper:
-        name: python-xml
-        state: present
-      when: ansible_facts.os_family == 'Suse'
-
     - name: Install required packages
       ansible.builtin.package:
         name: python3-apt
@@ -22,7 +16,7 @@
     - name: Set correct distribution Version for Amazon Linux
       ansible.builtin.set_fact:
         ansible_distribution_major_version: 7
-      when: ansible_distribution == 'Amazon'
+      when: ansible_facts.distribution == 'Amazon'
 
     - name: Install nginx with a generic Ansible role
       ansible.builtin.include_role:

molecule/nginx_hardening/verify.yml

@@ -12,7 +12,7 @@
         name: procps
         state: present
         update_cache: true
-      when: ansible_distribution == 'Debian'
+      when: ansible_facts.distribution == 'Debian'
 
 - name: Verify
   hosts: localhost

molecule/os_hardening/molecule.yml

@@ -17,7 +17,8 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      inject_facts_as_vars: false
 verifier:
   name: ansible
 

molecule/os_hardening/prepare.yml

@@ -16,11 +16,11 @@
       ansible.builtin.apt:
         upgrade: safe
         update_cache: true
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'
 
     - name: Install required tools on SuSE
       # cannot use zypper module, since it depends on python-xml
-      ansible.builtin.command: zypper -n install python-xml awk
+      ansible.builtin.command: zypper -n install awk
       changed_when: false
       when: ansible_facts.os_family == 'Suse'
 

molecule/os_hardening/prepare_tasks/pw_ageing.yml

@@ -3,8 +3,10 @@
   user:
     name: pw_no_ageing
     password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
+    password_expire_max: "-1"
 
 - name: Create user those password ageing should be changed
   user:
     name: pw_ageing
     password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
+    password_expire_max: "-1"

molecule/os_hardening/verify_tasks/pw_ageing.yml

@@ -19,7 +19,7 @@
     # this uses the date from the expire_date variable and subtracts the current date.
     # it should be bigger that the password_expire_min of the user "pw_no_ageing"
     that:
-      - ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_date_time.date | to_datetime('%Y-%m-%d')).days == 60
+      - ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_facts.date_time.date | to_datetime('%Y-%m-%d')).days == 60
 
 - name: Get Password Expiry warning days for pw_ageing
   ansible.builtin.shell: chage -l pw_ageing | grep "warning before password expires" | cut -d ":" -f 2

molecule/os_hardening/verify_tasks/ssh_auth_locked.yml

@@ -80,7 +80,7 @@
   ansible.builtin.assert:
     that:
       - output.rc | int == 5
-      - output.stderr | length == 0
+      - "'(password expired)' in output.stderr"
       - output.stdout | length == 0
   when:
     - ansible_facts.os_family == "Suse"

molecule/os_hardening/verify_tasks/sys_account_shell.yml

@@ -6,4 +6,4 @@
 - name: Check that shell_sys_acc's shell is still bash
   ansible.builtin.assert:
     that:
-      - getent_passwd['shell_sys_acc'][5] == "/bin/bash"
+      - ansible_facts.getent_passwd['shell_sys_acc'][5] == "/bin/bash"

molecule/os_hardening_vm/converge.yml

@@ -30,7 +30,16 @@
         os_mnt_var_options: rw,nosuid,nodev,compress=zstd:1,subvol=var
       when:
         - ansible_facts.distribution == 'Fedora'
-        - ansible_distribution_major_version|int == 40
+        - ansible_facts.distribution_major_version|int == 40
+
+    - name: Overrides for Debian 13 image
+      ansible.builtin.set_fact:
+        os_mnt_tmp_enabled: true
+        os_mnt_tmp_src: tmpfs
+        os_mnt_tmp_filesystem: tmpfs
+      when:
+        - ansible_facts.distribution == 'Debian'
+        - ansible_facts.distribution_major_version|int == 13
 
     - name: Include os_hardening role
       ansible.builtin.include_role:

molecule/os_hardening_vm/molecule.yml

@@ -24,7 +24,10 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
+      library: "${MOLECULE_PROJECT_DIRECTORY}/plugins/modules:/usr/share/ansible:${MOLECULE_VAGRANT_PLUGIN_DIR}"
+      inject_facts_as_vars: false
 verifier:
   name: ansible
   env:

molecule/os_hardening_vm/prepare.yml

@@ -4,6 +4,16 @@
   become: true
   gather_facts: false
   tasks:
+    - name: Update keyring
+      ansible.builtin.raw: pacman --noconfirm -Sy archlinux-keyring
+      changed_when: false
+      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
+
+    - name: Update OS
+      ansible.builtin.raw: pacman --noconfirm -Suy
+      changed_when: false
+      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
+
     - name: Install python, since it's not installed by default
       ansible.builtin.raw: pacman --noconfirm -Sy python
       changed_when: false
@@ -26,7 +36,7 @@
       ansible.builtin.dpkg_selections:
         name: grub-pc
         selection: hold
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'
 
     # we need to free up space, since the /boot partition in some Vagrant images is
     # pretty small and system updates might fail
@@ -35,26 +45,20 @@
         paths: /boot
         patterns: "initrd.img*"
       register: find_results
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'
 
     - name: Delete all initrd.img to free space on /boot
       ansible.builtin.file:
         path: "{{ item['path'] }}"
         state: absent
       with_items: "{{ find_results['files'] }}"
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'
 
     - name: Run the equivalent of "apt-get update && apt-get upgrade"
       ansible.builtin.apt:
         upgrade: safe
         update_cache: true
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'
-
-    - name: Install required tools on SuSE
-      # cannot use zypper module, since it depends on python-xml
-      ansible.builtin.command: zypper -n install python-xml
-      changed_when: false
-      when: ansible_facts.os_family == 'Suse'
 
     - name: Install required tools on fedora
       ansible.builtin.dnf:
@@ -65,14 +69,27 @@
           - python3-libselinux
       when: ansible_facts.distribution == 'Fedora'
 
+    - name: Install required tools on AlmaLinux
+      ansible.builtin.dnf:
+        name:
+          - initscripts
+      when: ansible_facts.distribution == 'AlmaLinux'
+
     - name: Install required tools on Arch
       community.general.pacman:
         name:
           - awk
-        state: present
+          - archlinux-keyring
+        state: latest
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
+    - name: Run the equivalent of "pacman -Syu"
+      community.general.pacman:
+        update_cache: true
+        upgrade: true
+      when: ansible_facts.os_family == 'Archlinux'
+
     - name: Install required tools on RHEL # noqa ignore-errors
       ansible.builtin.dnf:
         name:
@@ -90,7 +107,6 @@
       ansible.posix.mount:
         path: /boot/efi
         state: unmounted
-      when: ansible_facts.distribution == 'Fedora'
 
     - name: Include YUM prepare tasks
       ansible.builtin.include_tasks: prepare_tasks/yum.yml

molecule/shared/prerequisites.yml

@@ -5,5 +5,5 @@
     - name: Make sure environment variable for MOLECULE_DISTRO is set
       ansible.builtin.assert:
         that:
-          - "lookup('env','MOLECULE_DISTRO')"
+          - "lookup('env','MOLECULE_DISTRO') | length > 0"
         fail_msg: "You need to set MOLECULE_DISTRO to a supported image name. See CONTRIBUTING.md"

molecule/ssh_hardening/molecule.yml

@@ -17,7 +17,8 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      inject_facts_as_vars: false
   inventory:
     host_vars:
       # https://molecule.readthedocs.io/en/latest/examples.html#docker-with-non-privileged-user

molecule/ssh_hardening/prepare.yml

@@ -12,27 +12,32 @@
         ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: Install packages # noqa ignore-errors
+    - name: Install dnf packages # noqa ignore-errors
       ansible.builtin.dnf:
         name:
           - openssh-clients
           - openssh-server
+        state: present
+        update_cache: true
+      ignore_errors: true
+
+    - name: Install libselinux-python # noqa ignore-errors
+      ansible.builtin.dnf:
+        name:
           - libselinux-python
         state: present
         update_cache: true
       ignore_errors: true
 
-    - name: Install packages # noqa ignore-errors
+    - name: Install procps-ng # noqa ignore-errors
       ansible.builtin.dnf:
         name:
-          - openssh-clients
-          - openssh-server
           - procps-ng
         state: present
         update_cache: true
       ignore_errors: true
 
-    - name: Install packages # noqa ignore-errors
+    - name: Install apt packages # noqa ignore-errors
       ansible.builtin.apt:
         name:
           - openssh-client
@@ -47,7 +52,7 @@
       changed_when: false
       when: ansible_facts.os_family == 'Suse'
 
-    - name: Install packages
+    - name: Install packages on SuSE
       community.general.zypper:
         name:
           - openssh
@@ -70,11 +75,6 @@
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: Create ssh host keys # noqa ignore-errors
+    - name: Create ssh host keys # noqa ignore-errors no-changed-when
       ansible.builtin.command: ssh-keygen -A
-      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
-        or ansible_facts.distribution == "Fedora"
-        or ansible_facts.distribution == "Amazon"
-        or ansible_facts.os_family == "Suse"
-      changed_when: false
       ignore_errors: true

molecule/ssh_hardening_bsd/waivers_freebsd13.yaml

@@ -1,3 +0,0 @@
-sshd-45:
-  run: false
-  justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"

molecule/ssh_hardening_custom_tests/molecule.yml

@@ -17,7 +17,8 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      inject_facts_as_vars: false
 verifier:
   name: ansible
 

molecule/ssh_hardening_custom_tests/prepare.yml

@@ -12,27 +12,32 @@
         ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: Install packages # noqa ignore-errors
+    - name: Install dnf packages # noqa ignore-errors
       ansible.builtin.dnf:
         name:
           - openssh-clients
           - openssh-server
+        state: present
+        update_cache: true
+      ignore_errors: true
+
+    - name: Install libselinux-python # noqa ignore-errors
+      ansible.builtin.dnf:
+        name:
           - libselinux-python
         state: present
         update_cache: true
       ignore_errors: true
 
-    - name: Install packages # noqa ignore-errors
+    - name: Install procps-ng # noqa ignore-errors
       ansible.builtin.dnf:
         name:
-          - openssh-clients
-          - openssh-server
           - procps-ng
         state: present
         update_cache: true
       ignore_errors: true
 
-    - name: Install packages # noqa ignore-errors
+    - name: Install apt packages # noqa ignore-errors
       ansible.builtin.apt:
         name:
           - openssh-client
@@ -47,7 +52,7 @@
       changed_when: false
       when: ansible_facts.os_family == 'Suse'
 
-    - name: Install packages
+    - name: Install packages on SuSE
       community.general.zypper:
         name:
           - openssh
@@ -70,11 +75,6 @@
         update_cache: true
       when: ansible_facts.os_family == 'Alpine'
 
-    - name: Create ssh host keys # noqa ignore-errors
+    - name: Create ssh host keys # noqa ignore-errors no-changed-when
       ansible.builtin.command: ssh-keygen -A
-      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
-        or ansible_facts.distribution == "Fedora"
-        or ansible_facts.distribution == "Amazon"
-        or ansible_facts.os_family == "Suse"
-      changed_when: false
       ignore_errors: true

molecule/ssh_hardening_vm/molecule.yml

@@ -8,7 +8,7 @@ platforms:
   # since we also need to use different OS users to run the tests because of how molecule operates,
   # the VM names must be predictable by OS user (to clean up canceled runs)
   - name: ${USER}
-    box: generic/${MOLECULE_DISTRO}
+    box: ${MOLECULE_DISTRO}
     memory: 1024
     cpus: 2
 provisioner:
@@ -20,7 +20,10 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
+      library: "${MOLECULE_PROJECT_DIRECTORY}/plugins/modules:/usr/share/ansible:${MOLECULE_VAGRANT_PLUGIN_DIR}"
+      inject_facts_as_vars: false
 verifier:
   name: ansible
   env:

molecule/ssh_hardening_vm/prepare.yml

@@ -8,13 +8,13 @@
       # temporary fix for https://github.com/lavabit/robox/issues/305
       ansible.builtin.raw: echo "https://ftp.eu.openbsd.org/pub/OpenBSD" > /etc/installurl
       changed_when: false
-      when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
+      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
 
     - name: Install python
       # BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
-      ansible.builtin.raw: pkg_add python%3.10
+      ansible.builtin.raw: pkg_add -I python%3.11
       changed_when: false
-      when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
+      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
 
 - name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all

molecule/ssh_hardening_vm/verify.yml

@@ -9,7 +9,7 @@
         dest: /usr/bin/type
         state: hard
         mode: "0770"
-      when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
+      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
 
 - name: Verify
   hosts: localhost
@@ -36,7 +36,7 @@
       ansible.builtin.command: >
         docker run --rm
         --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
-        --volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') }}.yaml:/waivers.yaml
+        --volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') | regex_replace('^.*/', '') }}.yaml:/waivers.yaml
         docker.io/cincproject/auditor exec
         --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
         -t ssh://{{ lookup('env', 'USER') }}

molecule/ssh_hardening_vm/waivers_almalinux-10.yaml

@@ -0,0 +1,3 @@
+unrelated:
+  run: false
+  justification: "cinc-auditor needs at least one waived control"

molecule/ssh_hardening_vm/waivers_debian-13.yaml

@@ -0,0 +1,3 @@
+unrelated:
+  run: false
+  justification: "cinc-auditor needs at least one waived control"

molecule/ssh_hardening_vm/waivers_ubuntu-24.04.yaml

@@ -0,0 +1,3 @@
+unrelated:
+  run: false
+  justification: "cinc-auditor needs at least one waived control"

molecule/ssh_hardening_vm/waivers_ubuntu-26.04.yaml

@@ -0,0 +1,3 @@
+unrelated:
+  run: false
+  justification: "cinc-auditor needs at least one waived control"

requirements-vm.txt

@@ -0,0 +1 @@
+molecule-plugins[vagrant]==25.8.12

requirements.txt

@@ -1,7 +1,7 @@
-molecule==24.12.0
+molecule==26.4.0
-molecule-plugins[docker]==23.6.0
+molecule-plugins[docker]==25.8.12
-ansible-core==2.18.1
+ansible-core==2.20.5
 docker==7.1.0
-jmespath==1.0.1
+jmespath==1.1.0
-aar-doc==2.0.1
+aar-doc==2.3.0
 passlib==1.7.4

roles/mysql_hardening/README.md

@@ -25,11 +25,11 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
 
 ## Supported Operating Systems
 - EL
-  - 8, 9
+  - 8, 9, 10
 - Ubuntu
-  - focal, jammy, noble
+  - jammy, noble
 - Debian
-  - bullseye, bookworm
+  - trixie, bookworm, bullseye
 - Amazon
 - opensuse
 

roles/mysql_hardening/meta/main.yml

@@ -10,15 +10,16 @@ galaxy_info:
       versions:
         - "8"
         - "9"
+        - "10"
     - name: Ubuntu
       versions:
-        - focal
         - jammy
         - noble
     - name: Debian
       versions:
-        - bullseye
+        - trixie
         - bookworm
+        - bullseye
     - name: Amazon
     - name: opensuse
   galaxy_tags:

roles/mysql_hardening/tasks/configure.yml

@@ -14,7 +14,7 @@
     state: directory
     owner: "{{ mysql_hardening_user }}"
     group: "{{ mysql_hardening_user }}"
-    mode: "0750"
+    mode: '{{ mysql_hardening_datadir_permissions | default("0750") }}'
   when: item is defined and item != ""
   loop:
     - "{{ mysql_settings.settings.datadir }}"

roles/mysql_hardening/tasks/main.yml

@@ -39,13 +39,13 @@
   when: not mysql_distribution is defined
 
 - name: Check which MySQL/MariaDB version is used
-  community.mysql.mysql_info:
+  ansible.mysql.mysql_info:
     filter: version
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   register: mysql_version
 
 - name: Check MySQL/MariaDB settings
-  community.mysql.mysql_info:
+  ansible.mysql.mysql_info:
     filter: settings
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   register: mysql_settings

roles/mysql_hardening/tasks/mysql_secure_installation.yml

@@ -5,7 +5,7 @@
   when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'
 
 - name: Ensure that the root password is present
-  community.mysql.mysql_user:
+  ansible.mysql.mysql_user:
     name: root
     host_all: true
     password: "{{ mysql_root_password | mandatory }}"
@@ -20,14 +20,14 @@
   tags: my_cnf
 
 - name: Ensure that the test database is absent
-  community.mysql.mysql_db:
+  ansible.mysql.mysql_db:
     name: test
     state: absent
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   when: mysql_remove_test_database
 
 - name: Ensure that anonymous users are absent
-  community.mysql.mysql_user:
+  ansible.mysql.mysql_user:
     name: ""
     state: absent
     host_all: true
@@ -35,7 +35,7 @@
   when: mysql_remove_anonymous_users
 
 - name: Ensure that root can only login from localhost
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query: >
       DELETE
       FROM mysql.user
@@ -47,7 +47,7 @@
   when: mysql_remove_remote_root
 
 - name: Detect role support on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query: >
       SELECT 1 FROM information_schema.COLUMNS
                 WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
@@ -57,7 +57,7 @@
   check_mode: false
 
 - name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query: >
       SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
       FROM mysql.user
@@ -76,7 +76,7 @@
     is version('10.4.0', '>='))
 
 - name: Get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query: >
       SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
       FROM mysql.user
@@ -97,7 +97,7 @@
     version('10.4.0', '<'))
 
 - name: Ensure that there are no users without password or authentication_string
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query:
       - DROP USER {{ item.user }}
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"

roles/mysql_hardening/vars/Suse.yml

@@ -6,5 +6,7 @@ mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
 mysql_cnf_owner: 'root'  # owner of /etc/my.cnf.d/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/my.cnf.d/*.cnf files
 
+mysql_hardening_datadir_permissions: "0700"
+
 mysql_hardening_group: 'mysql'
 login_unix_socket: '/run/mysql/mysql.sock'

roles/nginx_hardening/README.md

@@ -18,11 +18,11 @@ It works with the following nginx-roles, including, but not limited to:
 
 ## Supported Operating Systems
 - EL
-  - 8, 9
+  - 8, 9, 10
 - Ubuntu
-  - focal, jammy, noble
+  - jammy, noble, resolute
 - Debian
-  - bookworm, bullseye
+  - trixie, bookworm, bullseye
 - Amazon
 
 ## Role Variables

roles/nginx_hardening/meta/main.yml

@@ -10,13 +10,15 @@ galaxy_info:
       versions:
         - "8"
         - "9"
+        - "10"
     - name: Ubuntu
       versions:
-        - focal
         - jammy
         - noble
+        - resolute
     - name: Debian
       versions:
+        - trixie
         - bookworm
         - bullseye
     - name: Amazon

roles/os_hardening/README.md

@@ -158,11 +158,11 @@ This role is mostly based on guides by:
 
 ## Supported Operating Systems
 - EL
-  - 8, 9
+  - 8, 9, 10
 - Ubuntu
-  - focal, jammy, noble
+  - jammy, noble, resolute
 - Debian
-  - bookworm, bullseye
+  - trixie, bookworm, bullseye
 - Amazon
 - Fedora
 - ArchLinux

roles/os_hardening/defaults/main.yml

@@ -146,7 +146,7 @@ sysctl_config:
   # The PTRACE system is used for debugging.  With it, a single user process
   # can attach to any other dumpable process owned by the same user.  In the
   # case of malicious software, it is possible to use PTRACE to access
-  # credentials that exist in memory (re-using existing SSH connections,
+  # credentials that exist in memory (reusing existing SSH connections,
   # extracting GPG agent information, etc).
   #
   # A PTRACE scope of "0" is the more permissive mode.  A scope of "1" limits

roles/os_hardening/handlers/main.yml

@@ -27,3 +27,8 @@
     path: "{{ item }}"
     state: remounted
   loop: "{{ mountpoints_changed }}"
+
+- name: Restart journald
+  ansible.builtin.systemd:
+    name: systemd-journald.service
+    state: restarted

roles/os_hardening/meta/main.yml

@@ -4,19 +4,21 @@ galaxy_info:
   description: This Ansible role provides numerous security-related ssh configurations, providing all-round base protection.
   company: Hardening Framework Team
   license: Apache License 2.0
-  min_ansible_version: "2.11"
+  min_ansible_version: "2.16"
   platforms:
     - name: EL
       versions:
         - "8"
         - "9"
+        - "10"
     - name: Ubuntu
       versions:
-        - focal
         - jammy
         - noble
+        - resolute
     - name: Debian
       versions:
+        - trixie
         - bookworm
         - bullseye
     - name: Amazon

roles/os_hardening/tasks/auditd.yml

@@ -16,3 +16,15 @@
     - Restart auditd via service
     - Restart auditd via systemd
   tags: auditd
+
+- name: Disable systemd-journald.audit
+  when:
+    - ansible_facts.os_family != 'Suse'  # socket doesn't seem to exist on suse
+  ansible.builtin.systemd:
+    name: systemd-journald-audit.socket
+    state: stopped
+    enabled: false
+    masked: true
+  notify:
+    - Restart journald
+  tags: auditd

roles/os_hardening/tasks/ctrlaltdel.yml

@@ -4,4 +4,4 @@
     name: ctrl-alt-del.target
     masked: true
     daemon_reload: true
-  when: ansible_service_mgr == "systemd"
+  when: ansible_facts.service_mgr == "systemd"

roles/os_hardening/tasks/limits.yml

@@ -37,7 +37,7 @@
         group: root
         mode: "0755"
         state: directory
-      when: ansible_service_mgr == "systemd"
+      when: ansible_facts.service_mgr == "systemd"
 
     - name: Create custom.conf for disabling coredumps
       ansible.builtin.template:
@@ -46,7 +46,7 @@
         owner: root
         group: root
         mode: "0644"
-      when: ansible_service_mgr == "systemd"
+      when: ansible_facts.service_mgr == "systemd"
       notify: Reload systemd
 
 - name: Enable coredumps
@@ -56,7 +56,7 @@
       ansible.builtin.file:
         path: /etc/systemd/coredump.conf.d
         state: absent
-      when: ansible_service_mgr == "systemd"
+      when: ansible_facts.service_mgr == "systemd"
       notify: Reload systemd
 
     - name: Remove 10.hardcore.conf config file

roles/os_hardening/tasks/minimize_access.yml

@@ -89,7 +89,7 @@
 
 - name: Generate list of current available mounted filesystems on the system
   ansible.builtin.set_fact:
-    mountpoints_list: "{{ ansible_mounts | map(attribute='mount') | list }}"
+    mountpoints_list: "{{ ansible_facts.mounts | map(attribute='mount') | list }}"
 
 - name: Append special devices list to valid mountpoint list
   ansible.builtin.set_fact:

roles/os_hardening/tasks/minimize_access_fs.yml

@@ -13,7 +13,7 @@
     - mount.enabled | bool
     - mount.path in mountpoints_list
   vars:
-    mountinfo: "{{ ansible_mounts | selectattr('mount', 'equalto', mount.path) | list | first | default(None) }}"
+    mountinfo: "{{ ansible_facts.mounts | selectattr('mount', 'equalto', mount.path) | list | first | default(None) }}"
   notify: Remount filesystems
 
 - name: "Check for existence of mount {{ mount.path }}"

roles/os_hardening/tasks/modprobe.yml

@@ -18,7 +18,7 @@
 
 - name: Remove used filesystems from fs-list
   ansible.builtin.set_fact:
-    os_unused_filesystems: "{{ os_unused_filesystems | difference(ansible_mounts | map(attribute='fstype') | list) }}"
+    os_unused_filesystems: "{{ os_unused_filesystems | difference(ansible_facts.mounts | map(attribute='fstype') | list) }}"
 
 - name: Disable unused filesystems | os-10
   ansible.builtin.template:

roles/os_hardening/tasks/pam_debian.yml

@@ -3,7 +3,6 @@
   ansible.builtin.apt:
     name: libpam-passwdqc
     state: present
-    update_cache: true
   when:
     - os_auth_pam_passwdqc_enable
 

roles/os_hardening/tasks/sysctl.yml

@@ -1,14 +1,4 @@
 ---
-- name: Protect sysctl.conf
-  ansible.builtin.file:
-    path: /etc/sysctl.conf
-    owner: root
-    group: root
-    mode: "0440"
-    state: touch
-    modification_time: preserve
-    access_time: preserve
-
 - name: Set Daemon umask, do config for rhel-family | NSA 2.2.4.1
   ansible.builtin.template:
     src: etc/sysconfig/rhel_sysconfig_init.j2
@@ -19,33 +9,33 @@
   when: ansible_facts.os_family == 'RedHat'
 
 - name: Change sysctls
-  when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']
+  when: ansible_facts.virtualization_type not in ['docker', 'lxc', 'openvz']
   block:
-    - name: Create a combined sysctl-dict if os-dependent sysctls are defined
+    - name: Protect sysctl.conf
-      ansible.builtin.set_fact:
+      ansible.builtin.file:
-        sysctl_config: "{{ sysctl_config | combine(sysctl_custom_config) }}"
+        path: /etc/sysctl.d/90-dev-sec.conf
-      when: sysctl_custom_config | default()
+        owner: root
-
+        group: root
-    # sysctl_rhel_config is kept for backwards-compatibility. use sysctl_custom_config instead
+        mode: "0440"
-    - name: Create a combined sysctl-dict if os-dependent sysctls are defined
+        state: touch
-      ansible.builtin.set_fact:
+        modification_time: preserve
-        sysctl_config: "{{ sysctl_config | combine(sysctl_rhel_config) }}"
+        access_time: preserve
-      when: sysctl_rhel_config | default()
-
-    - name: Create a combined sysctl-dict if overwrites are defined
-      ansible.builtin.set_fact:
-        sysctl_config: "{{ sysctl_config | combine(sysctl_overwrite) }}"
-      when: sysctl_overwrite | default()
 
     - name: Change various sysctl-settings, look at the sysctl-vars file for documentation
       ansible.posix.sysctl:
         name: "{{ item.key }}"
         value: "{{ item.value }}"
         sysctl_set: true
+        sysctl_file: /etc/sysctl.d/90-dev-sec.conf
         state: present
         reload: true
         ignoreerrors: true
-      with_dict: "{{ sysctl_config }}"
+      # sysctl_rhel_config is kept for backwards-compatibility. use sysctl_custom_config instead
+      # combines all sysctl-dicts into one, adds empty dicts if they are not defined
+      with_dict: "{{ ((sysctl_config
+        | combine(sysctl_custom_config | default({})))
+        | combine(sysctl_rhel_config | default({})))
+        | combine(sysctl_overwrite | default({})) }}"
       when: item.key not in sysctl_unsupported_entries | default()
 
 - name: Apply ufw defaults

roles/os_hardening/tasks/user_accounts.yml

@@ -4,28 +4,28 @@
     database: passwd
     # creates a dict for each user containing UID/HOMEDIR etc...
   # skip this task if getent was run before without specifying a key (single entry)
-  when: getent_passwd is undefined or
+  when: ansible_facts.getent_passwd is undefined or
-        getent_passwd | length <= 1
+        ansible_facts.getent_passwd | length <= 1
 
 - name: Read local linux shadow database
   ansible.builtin.getent:
     database: shadow
 
 - name: Extract system accounts from local user database
-  loop: "{{ getent_passwd.keys() | list }}"
+  loop: "{{ ansible_facts.getent_passwd.keys() | list }}"
   when:
-    - getent_passwd[item][1]|int > 0
+    - ansible_facts.getent_passwd[item][1]|int > 0
-    - getent_passwd[item][1]|int <= os_auth_sys_uid_max|int
+    - ansible_facts.getent_passwd[item][1]|int <= os_auth_sys_uid_max|int
     - item is not in os_always_ignore_users     # skip users from "os_always_ignore_users" list (taken from role "vars")
     - item is not in os_ignore_users            # skip users from "os_ignore_users"        list (taken from role "defaults")
   ansible.builtin.set_fact:
     system_users: "{{ system_users | default([]) + [item] }}"
 
 - name: Extract regular (non-system, non-root) accounts from local user database
-  loop: "{{ getent_passwd.keys() | list }}"
+  loop: "{{ ansible_facts.getent_passwd.keys() | list }}"
   when:
-    - getent_passwd[item][1]|int >= os_auth_uid_min|int
+    - ansible_facts.getent_passwd[item][1]|int >= os_auth_uid_min|int
-    - getent_passwd[item][1]|int <= os_auth_uid_max|int
+    - ansible_facts.getent_passwd[item][1]|int <= os_auth_uid_max|int
     - item is not in os_always_ignore_users # skip users from "os_always_ignore_users" list (taken from role "vars")
     - item is not in os_ignore_users # skip users from "os_ignore_users"        list (taken from role "defaults")
   ansible.builtin.set_fact:
@@ -36,18 +36,20 @@
     name: "{{ item }}"
     password_expire_min: "{{ os_auth_pw_min_age }}"
     password_expire_max: "{{ os_auth_pw_max_age }}"
+    password_expire_warn: "{{ os_auth_pw_warn_age }}"
   loop: "{{ regular_users }}"
   when:
     - os_user_pw_ageing
     - regular_users is defined and (regular_users | length > 0)
     - item not in os_users_without_password_ageing
-    - getent_shadow[item][0] is not match("\*") # password hashes containing illegal characters like "*" are unusable (locked) and don't need to age
+    # password hashes with illegal characters like "*" or "!" are unusable (locked) and don't need to age
-    - getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable (locked) and don't need to age
+    - ansible_facts.getent_shadow[item][0] is not match("\*")
+    - ansible_facts.getent_shadow[item][0] is not match("\!")
 
 - name: Extract root account(s) from local user database
-  loop: "{{ getent_passwd.keys() | list }}"
+  loop: "{{ ansible_facts.getent_passwd.keys() | list }}"
   when:
-    - getent_passwd[item][1]|int == 0
+    - ansible_facts.getent_passwd[item][1]|int == 0
   ansible.builtin.set_fact:
     root_users: "{{ root_users | default([]) + [item] }}"
 
@@ -55,7 +57,7 @@
   ansible.builtin.file:
     mode: "0700"
     owner: "{{ item }}"
-    path: "{{ getent_passwd[item][4] }}"
+    path: "{{ ansible_facts.getent_passwd[item][4] }}"
     state: directory
   loop: "{{ root_users }}"
   when:
@@ -66,11 +68,13 @@
     name: "{{ item }}"
     password_expire_min: "{{ os_auth_pw_min_age }}"
     password_expire_max: "{{ os_auth_pw_max_age }}"
+    password_expire_warn: "{{ os_auth_pw_warn_age }}"
   loop: "{{ root_users }}"
   when:
     - os_rootuser_pw_ageing | bool
-    - getent_shadow[item][0] is not match("\*") # password hashes containing illegal characters like "*" are unusable (locked) and don't need to age
+    # password hashes with illegal characters like "*" or "!" are unusable (locked) and don't need to age
-    - getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable (locked) and don't need to age
+    - ansible_facts.getent_shadow[item][0] is not match("\*")
+    - ansible_facts.getent_shadow[item][0] is not match("\!")
 
 - name: Remove additional users with UID=0 ("root" user is not touched)
   ansible.builtin.user:
@@ -96,13 +100,13 @@
     createhome: false
   loop: "{{ system_users }}"
   when:
-    - getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable already (locked)
+    - ansible_facts.getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable already (locked)
 
 - name: Limit access to home directories of regular (non-system, non-root) accounts
   ansible.builtin.file:
     mode: "0700"
     owner: "{{ item }}"
-    path: "{{ getent_passwd[item][4] }}"
+    path: "{{ ansible_facts.getent_passwd[item][4] }}"
     state: directory
   loop: "{{ regular_users }}"
   when:

roles/os_hardening/templates/etc/login.defs.j2

@@ -5,7 +5,7 @@
 #
 # Three items must be defined:  `MAIL_DIR`, `ENV_SUPATH`, and `ENV_PATH`. If unspecified, some arbitrary (and possibly incorrect) value will be assumed.  All other items are optional - if not specified then the described action or option will be inhibited.
 #
-# Comment lines (lines beginning with `#`) and blank lines are ignored.
+# Comment lines and blank lines are ignored.
 #
 #-- Modified for Linux.  --marekm
 
@@ -35,7 +35,7 @@ FAILLOG_ENAB      yes
 
 # Enable display of unknown usernames when login failures are recorded.
 #
-# *WARNING*: Unknown usernames may become world readable. See #290803 and #298773 for details about how this could become a security concern
+# *WARNING*: Unknown usernames may become world readable. See 290803 and 298773 for details about how this could become a security concern
 LOG_UNKFAIL_ENAB  no
 
 # Enable logging of successful logins
@@ -56,7 +56,7 @@ SYSLOG_SG_ENAB    yes
 # If defined, login failures will be logged here in a utmp format last, when invoked as lastb, will read `/var/log/btmp`, so...
 FTMP_FILE         /var/log/btmp
 
-# If defined, the command name to display when running "su -".  For # example, if this is defined as "su" then a "ps" will display the command is "-su".  If not defined, then "ps" would display the name of the shell actually being run, e.g. something like "-sh".
+# If defined, the command name to display when running "su -".  For example, if this is defined as "su" then a "ps" will display the command is "-su".  If not defined, then "ps" would display the name of the shell actually being run, e.g. something like "-sh".
 SU_NAME           su
 
 # If defined, file which inhibits all the usual chatter during the login sequence.  If a full pathname, then hushed mode will be enabled if the user's name or shell are found in the file.  If not a full pathname, then hushed mode will be enabled if the file exists in the user's home directory.
@@ -96,7 +96,7 @@ KILLCHAR          025
 UMASK             {{ os_env_umask }}
 
 # Enable setting of the umask group bits to be the same as owner bits (examples: `022` -> `002`, `077` -> `007`) for non-root users, if the uid is the same as gid, and username is the same as the primary group name.
-# If set to yes, userdel will remove the user´s group if it contains no more members, and useradd will create by default a group with the name of the user.
+# If set to yes, userdel will remove the user's group if it contains no more members, and useradd will create by default a group with the name of the user.
 USERGROUPS_ENAB   yes
 
 

roles/ssh_hardening/README.md

@@ -1,7 +1,7 @@
 # dev-sec.ssh_hardening
 
 [![devsec.ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml)
-[![devsec.ssh_hardening BSD](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml)
+[![devsec.ssh_hardening VM](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml)
 [![devsec.ssh_hardening with custom tests](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml)
 
 ## Description
@@ -47,18 +47,18 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
 
 ## Supported Operating Systems
 - EL
-  - 8, 9
+  - 8, 9, 10
 - Ubuntu
-  - focal, jammy, noble
+  - jammy, noble, resolute
 - Debian
-  - bookworm, bullseye
+  - trixie, bookworm, bullseye
 - Alpine
 - Amazon
 - Fedora
 - ArchLinux
 - SmartOS
 - FreeBSD
-  - 13.2, 14.0
+  - 14.0
 - OpenBSD
   - 7.0
 

roles/ssh_hardening/meta/main.yml

@@ -10,13 +10,15 @@ galaxy_info:
       versions:
         - "8"
         - "9"
+        - "10"
     - name: Ubuntu
       versions:
-        - focal
         - jammy
         - noble
+        - resolute
     - name: Debian
       versions:
+        - trixie
         - bookworm
         - bullseye
     - name: Alpine
@@ -26,7 +28,6 @@ galaxy_info:
     - name: SmartOS
     - name: FreeBSD
       versions:
-        - "13.2"
         - "14.0"
     - name: OpenBSD
       versions:

roles/ssh_hardening/tasks/disable-systemd-socket.yml

@@ -1,4 +1,11 @@
 ---
+- name: Disable systemd-socket activation
+  ansible.builtin.systemd:
+    name: ssh.socket
+    state: stopped
+    enabled: false
+    masked: true
+
 - name: Remove ssh service systemd-socket file
   ansible.builtin.file:
     path: "{{ item }}"
@@ -8,9 +15,8 @@
     - /etc/systemd/system/ssh.service.requires/ssh.socket
     - /etc/systemd/system/sockets.target.wants/ssh.socket
 
-- name: Disable systemd-socket activation
+- name: Ensure ssh service is started after disabling socket activation
   ansible.builtin.systemd:
-    name: ssh.socket
+    name: "{{ sshd_service_name }}"
-    state: stopped
+    state: started
-    enabled: false
+    enabled: true
-    masked: true

roles/ssh_hardening/tasks/hardening.yml

@@ -113,7 +113,7 @@
   notify: Restart sshd
   when:
     - ssh_server_hardening | bool
-    - sshd_register_moduli.stdout
+    - sshd_register_moduli.stdout is truthy
 
 - name: Include tasks to setup ca keys and principals
   ansible.builtin.include_tasks: ca_keys_and_principals.yml

roles/ssh_hardening/templates/openssh.conf.j2

@@ -1,4 +1,4 @@
-#jinja2: trim_blocks: "true", lstrip_blocks: "true"
+#jinja2: trim_blocks:True, lstrip_blocks:True
 {{ ansible_managed | comment }}
 # Generated by Ansible role {{ ansible_role_name }}
 
@@ -91,7 +91,7 @@ StrictHostKeyChecking ask
 {% endif %}
 # Disable agent forwarding, since local agent could be accessed through forwarded connection.
 
-ForwardAgent {{ ((ssh_forward_agent) if ssh_forward_agent is defined else 'no')}} 
+ForwardAgent {{ ((ssh_forward_agent) if ssh_forward_agent is defined else 'no') }}
 
 
 # Disable X11 forwarding, since local X11 display could be accessed through forwarded connection.

roles/ssh_hardening/templates/opensshd.conf.j2

@@ -1,4 +1,4 @@
-#jinja2: trim_blocks: "true", lstrip_blocks: "true"
+#jinja2: trim_blocks:True, lstrip_blocks:True
 {{ ansible_managed | comment }}
 # Generated by Ansible role {{ ansible_role_name }}
 
@@ -274,18 +274,6 @@ RevokedKeys /etc/ssh/revoked_keys
 # Subsystem sftp /opt/app/openssh5/libexec/sftp-server
 
 Subsystem sftp internal-sftp -l INFO -f LOCAL6 -u {{ sftp_umask }}
-
-# These lines must appear at the *end* of sshd_config
-Match Group sftponly
-    ForceCommand internal-sftp -l INFO -f LOCAL6 -u {{ sftp_umask }}
-{% if sftp_chroot %}
-    ChrootDirectory {{ sftp_chroot_dir }}
-{% endif %}
-    AllowTcpForwarding no
-    AllowAgentForwarding no
-    PasswordAuthentication {{ 'yes' if (ssh_server_password_login|bool) else 'no' }}
-    PermitRootLogin no
-    X11Forwarding no
 {% endif %}
 {% if ssh_server_match_address %}
 
@@ -335,3 +323,17 @@ Match LocalPort {{ item.port }}
   {% endfor %}
 {% endfor %}
 {% endif %}
+
+{% if sftp_enabled %}
+# These lines must appear at the *end* of sshd_config
+Match Group sftponly
+    ForceCommand internal-sftp -l INFO -f LOCAL6 -u {{ sftp_umask }}
+{% if sftp_chroot %}
+    ChrootDirectory {{ sftp_chroot_dir }}
+{% endif %}
+    AllowTcpForwarding no
+    AllowAgentForwarding no
+    PasswordAuthentication {{ 'yes' if (ssh_server_password_login|bool) else 'no' }}
+    PermitRootLogin no
+    X11Forwarding no
+{% endif %}

roles/ssh_hardening/vars/RedHat_10.yml

@@ -0,0 +1,26 @@
+---
+ssh_pkgs:
+  - openssh
+sshd_path: /usr/sbin/sshd
+ssh_host_keys_dir: /etc/ssh
+sshd_service_name: sshd
+ssh_owner: root
+ssh_group: root
+ssh_host_keys_owner: root
+ssh_host_keys_group: root
+ssh_host_keys_mode: "0600"
+ssh_selinux_packages:
+  - policycoreutils-python-utils
+  - checkpolicy
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: /etc/ssh/moduli
+
+# disable CRYPTO_POLICY to take settings from sshd configuration
+# see: https://access.redhat.com/solutions/4410591
+sshd_disable_crypto_policy: true