Update dependency ubuntu to v24

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
update changelog
2026-05-14 17:11:43 +00:00 · 2026-05-13 07:44:08 +00:00 · 2026-05-13 09:43:08 +02:00 · 2026-05-13 09:42:53 +02:00 · 2026-05-12 22:14:21 +00:00 · 2026-05-12 22:10:07 +00:00
55 changed files with 203 additions and 134 deletions
@@ -8,9 +8,7 @@ exclude_paths:
  - .ansible/ # somehow someone decided that the cache directory should be renamed
  # add all waivers individually, since exclude_files does not support globs
  - molecule/os_hardening/waivers.yaml
-  - molecule/ssh_hardening_bsd/waivers_freebsd13.yaml
-  - molecule/ssh_hardening_bsd/waivers_freebsd14.yaml
-  - molecule/ssh_hardening_bsd/waivers_openbsd7.yaml
+  - molecule/ssh_hardening_vm/waivers_*.yaml

 mock_roles:
  - geerlingguy.git
@@ -23,10 +23,10 @@ on:  # yamllint disable-line rule:truthy

 jobs:
  ansible-lint:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04

    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Lint Ansible Playbook
-        uses: ansible/ansible-lint@7f6abc5ef97d0fb043a0f3d416dfbc74399fbda0 # v26
+        uses: ansible/ansible-lint@5fac056c45595896c973fbde871f01f6cb14d74c # v26
@@ -9,6 +9,6 @@ on:  # yamllint disable-line rule:truthy

 jobs:
  codespell:
-    uses: "dev-sec/.github/.github/workflows/codespell.yml@main"
+    uses: "dev-sec/.github/.github/workflows/codespell.yml@2cd00282cfdb322243d879a96d9494ce64e76119" # main
    with:
      ignore_words_list: "chage,BOOTUP"
@@ -12,8 +12,8 @@ permissions:
 jobs:
  enforce-label:
    if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    steps:
-      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
        with:
          repo-token: "${{ secrets.GITHUB_TOKEN }}"
@@ -9,20 +9,20 @@ on:  # yamllint disable-line rule:truthy
 jobs:
  deploy:
    if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      # deploy the collection first, because if it fails, we don't want
      # to update the galaxy.yml
      - name: Deploy the collection
-        uses: artis3n/ansible_galaxy_collection@415a92b829b5898b6e8ca1dd7a69fe2a1e5fd4c0 # v2
+        uses: artis3n/ansible_galaxy_collection@ffbca2460a5a1c600b941bbf1536bd61de1c2227 # v3
        with:
          api_key: ${{ secrets.GALAXY_API_KEY }}
          galaxy_version: ${{ github.event.release.tag_name }}

      # checkout master instead of the release-tag so we can push the galaxy.yml
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: master

@@ -29,7 +29,7 @@ concurrency:

 jobs:
  build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -44,9 +44,9 @@ jobs:
          - rocky8
          - rocky9
          # - rocky10 # problem with baseline
-          - ubuntu2004
          - ubuntu2204
          - ubuntu2404
+          # - ubuntu2604 # problem with test setup
          - debian11
          - debian12
          - debian13
@@ -56,7 +56,7 @@ jobs:
          # - fedora  # geerlingguy.mysql does not support fedora
    steps:
      - name: Checkout repo
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
@@ -28,7 +28,7 @@ concurrency:

 jobs:
  build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -43,9 +43,9 @@ jobs:
          - rocky8
          - rocky9
          - rocky10
-          - ubuntu2004
          - ubuntu2204
          - ubuntu2404
+          - ubuntu2604
          - debian11
          - debian12
          - debian13
@@ -55,7 +55,7 @@ jobs:
          # - fedora  # no support from geerlingguy role
    steps:
      - name: Checkout repo
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
@@ -28,7 +28,7 @@ concurrency:

 jobs:
  build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -46,11 +46,12 @@ jobs:
          - rocky8
          - rocky9
          - rocky10
-          - fedora39
-          - fedora40
-          - ubuntu2004
+          - fedora42
+          - fedora43
+          - fedora44
          - ubuntu2204
          - ubuntu2404
+          - ubuntu2604
          - debian11
          - debian12
          - debian13
@@ -60,7 +61,7 @@ jobs:
          - "/lib/systemd/systemd"
    steps:
      - name: Checkout repo
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
@@ -44,18 +44,19 @@ jobs:
          - generic/centos9s
          - generic/rocky8
          - generic/rocky9
-          - fedora/39-cloud-base
-          - fedora/40-cloud-base
-          - generic/ubuntu2004
+          - alvistack/fedora-42
+          # - alvistack/fedora-43 # no compatible test image
          - generic/ubuntu2204
          - alvistack/ubuntu-24.04
+          # - alvistack/ubuntu-26.04 # no compatible test image
          - generic/debian11
          - generic/debian12
+          - cloud-image/debian-13
          - generic/opensuse15
          - generic/arch
    steps:
      - name: Checkout repo
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
@@ -11,12 +11,12 @@ on:  # yamllint disable-line rule:truthy
 jobs:
  prettier-md:
    if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 1

    steps:
      - name: Git checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ github.head_ref }}

@@ -11,16 +11,16 @@ jobs:
  generate_changelog:
    name: create release draft
    if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          ref: master

      - name: 'Get Previous tag'
        id: previoustag
-        uses: "WyriHaximus/github-action-get-previous-tag@master"
+        uses: "WyriHaximus/github-action-get-previous-tag@61819f33034117e6c686e6a31dba995a85afc9de" # master
        env:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

@@ -58,12 +58,12 @@ jobs:

      - name: Read CHANGELOG.md
        id: package
-        uses: juliangruber/read-file-action@b549046febe0fe86f8cb4f93c24e284433f9ab58 # v1
+        uses: juliangruber/read-file-action@271ff311a4947af354c6abcd696a306553b9ec18 # v1
        with:
          path: ./CHANGELOGRELEASE.md

      - name: Delete old drafts
-        uses: hugo19941994/delete-draft-releases@d375ad67d25fed7520a8020c3a6561fff5260c1e # v2.0.0
+        uses: hugo19941994/delete-draft-releases@3f19a25abf2ce87850c2268938f98f14e4d3d1f1 # v3.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

@@ -17,7 +17,7 @@ on:  # yamllint disable-line rule:truthy
 jobs:
  readme:
    name: create roles readme
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    strategy:
      matrix:
        roles:
@@ -27,7 +27,7 @@ jobs:
          - ssh_hardening
    steps:
      - name: Check out code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
@@ -28,7 +28,7 @@ concurrency:

 jobs:
  build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -49,11 +49,12 @@ jobs:
          - rocky8
          - rocky9
          - rocky10
-          - fedora39
-          - fedora40
-          - ubuntu2004
+          - fedora42
+          - fedora43
+          - fedora44
          - ubuntu2204
          - ubuntu2404
+          - ubuntu2604
          - debian11
          - debian12
          - debian13
@@ -63,7 +64,7 @@ jobs:
          - "/lib/systemd/systemd"
    steps:
      - name: Checkout repo
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
@@ -28,7 +28,7 @@ concurrency:

 jobs:
  build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -49,11 +49,12 @@ jobs:
          - rocky8
          - rocky9
          - rocky10
-          - fedora39
-          - fedora40
-          - ubuntu2004
+          - fedora42
+          - fedora43
+          - fedora44
          - ubuntu2204
          - ubuntu2404
+          - ubuntu2604
          - debian11
          - debian12
          - debian13
@@ -63,7 +64,7 @@ jobs:
          - "/lib/systemd/systemd"
    steps:
      - name: Checkout repo
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
@@ -1,21 +1,21 @@
 ---
-name: "devsec.ssh_hardening BSD"
+name: "devsec.ssh_hardening VM"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
-      - 'molecule/ssh_hardening_bsd/**'
-      - '.github/workflows/ssh_hardening_bsd.yml'
+      - 'molecule/ssh_hardening_vm/**'
+      - '.github/workflows/ssh_hardening_vm.yml'
      - 'requirements.txt'
      - 'requirements-vm.txt'
  pull_request:
    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
-      - 'molecule/ssh_hardening_bsd/**'
-      - '.github/workflows/ssh_hardening_bsd.yml'
+      - 'molecule/ssh_hardening_vm/**'
+      - '.github/workflows/ssh_hardening_vm.yml'
      - 'requirements.txt'
      - 'requirements-vm.txt'
  schedule:
@@ -38,12 +38,14 @@ jobs:
      fail-fast: false
      matrix:
        molecule_distro:
-          - openbsd7
-          - freebsd13
-          - freebsd14
+          - generic/openbsd7
+          - generic/freebsd14
+          - cloud-image/debian-13
+          - cloud-image/ubuntu-24.04
+          - cloud-image/ubuntu-26.04
    steps:
      - name: Checkout repo
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
@@ -58,14 +60,14 @@ jobs:

      - name: Update Vagrant Box
        run: |
-          vagrant box update --box generic/${{ matrix.molecule_distro }} || true
+          vagrant box update --box ${{ matrix.molecule_distro }} || true

      - name: Test with molecule
        run: |
          source ~/.venv/ansible-collection-hardening/bin/activate
          # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
          export MOLECULE_VAGRANT_PLUGIN_DIR=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')/molecule_plugins/vagrant
-          molecule test -s ssh_hardening_bsd
+          molecule test -s ssh_hardening_vm
        env:
          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
        working-directory: ansible_collections/devsec/hardening
@@ -1,8 +1,58 @@
 # Changelog

-## [Unreleased](https://github.com/dev-sec/ansible-collection-hardening/tree/HEAD)
+## [10.6.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.6.0) (2026-05-13)

-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.4.0...HEAD)
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.2...10.6.0)
+
+**Implemented enhancements:**
+
+- Update APT package cache before installing any package in case freshly installed system. [\#945](https://github.com/dev-sec/ansible-collection-hardening/issues/945)
+- Update supported OS versions to current Fedora \(42/43/44\) and Ubuntu \(22.04/24.04/26.04\) [\#946](https://github.com/dev-sec/ansible-collection-hardening/pull/946) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+
+**Merged pull requests:**
+
+- Update actions/labeler action to v6.1.0 [\#947](https://github.com/dev-sec/ansible-collection-hardening/pull/947) ([renovate[bot]](https://github.com/apps/renovate))
+- Update dev-sec/.github digest to 2cd0028 [\#943](https://github.com/dev-sec/ansible-collection-hardening/pull/943) ([renovate[bot]](https://github.com/apps/renovate))
+- Update ansible/ansible-lint digest to 5fac056 [\#942](https://github.com/dev-sec/ansible-collection-hardening/pull/942) ([renovate[bot]](https://github.com/apps/renovate))
+- Update dependency molecule to v26 [\#935](https://github.com/dev-sec/ansible-collection-hardening/pull/935) ([renovate[bot]](https://github.com/apps/renovate))
+- Update dependency ansible-core to v2.20.5 [\#910](https://github.com/dev-sec/ansible-collection-hardening/pull/910) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+
+## [10.5.2](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.2) (2026-03-28)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.1...10.5.2)
+
+**Fixed bugs:**
+
+- do not update apt cache when installing libpam-passwdqc [\#939](https://github.com/dev-sec/ansible-collection-hardening/pull/939) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([eikesauer](https://github.com/eikesauer))
+
+**Merged pull requests:**
+
+- chore\(deps\): update hugo19941994/delete-draft-releases action to v3 [\#940](https://github.com/dev-sec/ansible-collection-hardening/pull/940) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): pin dependencies [\#938](https://github.com/dev-sec/ansible-collection-hardening/pull/938) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/checkout digest to de0fac2 [\#932](https://github.com/dev-sec/ansible-collection-hardening/pull/932) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+
+## [10.5.1](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.1) (2026-03-20)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.0...10.5.1)
+
+**Fixed bugs:**
+
+- fix flaky failures on Ubuntu 24.04 and newer by disabling sshd socket activation first [\#931](https://github.com/dev-sec/ansible-collection-hardening/pull/931) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([kuglimon](https://github.com/kuglimon))
+
+**Closed issues:**
+
+- SSH issue after running devsec.hardening.ssh\_hardening role [\#854](https://github.com/dev-sec/ansible-collection-hardening/issues/854)
+
+**Merged pull requests:**
+
+- chore\(deps\): update juliangruber/read-file-action digest to 271ff31 [\#937](https://github.com/dev-sec/ansible-collection-hardening/pull/937) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 8ba9595 [\#934](https://github.com/dev-sec/ansible-collection-hardening/pull/934) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update artis3n/ansible\_galaxy\_collection action to v3 [\#933](https://github.com/dev-sec/ansible-collection-hardening/pull/933) ([renovate[bot]](https://github.com/apps/renovate))
+- Improve VM based testing of SSH hardening [\#878](https://github.com/dev-sec/ansible-collection-hardening/pull/878) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+
+## [10.5.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.0) (2026-01-22)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.4.0...10.5.0)

 **Implemented enhancements:**

@@ -16,6 +66,7 @@

 **Merged pull requests:**

+- chore\(deps\): update dependency jmespath to v1.1.0 [\#930](https://github.com/dev-sec/ansible-collection-hardening/pull/930) ([renovate[bot]](https://github.com/apps/renovate))
 - chore\(deps\): update actions/setup-python digest to a309ff8 [\#929](https://github.com/dev-sec/ansible-collection-hardening/pull/929) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
 - chore\(deps\): update ansible/ansible-lint action to v26 [\#928](https://github.com/dev-sec/ansible-collection-hardening/pull/928) ([renovate[bot]](https://github.com/apps/renovate))
 - chore\(deps\): update artis3n/ansible\_galaxy\_collection digest to 415a92b - autoclosed [\#927](https://github.com/dev-sec/ansible-collection-hardening/pull/927) ([renovate[bot]](https://github.com/apps/renovate))
@@ -3,7 +3,7 @@
 [![devsec.os_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml)
 [![devsec.os_hardening VM](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml)
 [![devsec.ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml)
-[![devsec.ssh_hardening BSD](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml)
+[![devsec.ssh_hardening VM](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml)
 [![devsec.ssh_hardening with custom tests](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml)
 [![devsec.nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml)
 [![devsec.mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
@@ -17,10 +17,10 @@ This collection provides battle tested hardening for:
  - AlmaLinux 8/9/10
  - Rocky Linux 8/9/10
  - Debian 11/12/13
-  - Ubuntu 20.04/22.04/24.04
+  - Ubuntu 22.04/24.04/26.04
  - Amazon Linux (some roles supported)
  - Arch Linux (some roles supported)
-  - Fedora 39/40 (some roles supported)
+  - Fedora 42/43/44 (some roles supported)
  - Suse Tumbleweed (some roles supported)
 - MySQL
  - MariaDB >= 5.5.65, >= 10.1.45, >= 10.3.17
@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 10.4.0
+version: 10.5.2
 readme: README.md
 authors:
  - dev-sec <[email protected]>
@@ -15,14 +15,6 @@
        - ansible_facts.distribution == "Ubuntu"
        - ansible_facts.distribution_major_version|int > 19

-    - name: Determine required MySQL Python libraries.
-      ansible.builtin.set_fact:
-        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
-      when:
-        - mysql_python_package_debian is not defined
-        - ansible_facts.distribution != "Ubuntu"
-        - ansible_facts.distribution_major_version|int < 20
-
    - name: Use Python 3 on Suse
      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
@@ -51,14 +51,6 @@
        - ansible_facts.distribution == "Ubuntu"
        - ansible_facts.distribution_major_version|int > 19

-    - name: Determine required MySQL Python libraries.
-      ansible.builtin.set_fact:
-        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
-      when:
-        - mysql_python_package_debian is not defined
-        - ansible_facts.distribution != "Ubuntu"
-        - ansible_facts.distribution_major_version|int < 20
-
    - name: Install required MySQL Python libraries on RHEL
      ansible.builtin.dnf:
        name: "{% if 'python3' in ansible_python_interpreter | default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
@@ -1,6 +1,6 @@
 ---
 - name: Create users for test
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
    query:
      - CREATE USER 'user'@'delete';
      - CREATE USER 'user'@'127.0.0.1';
@@ -15,7 +15,7 @@
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"

 - name: Detect role support on MySQL
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
    query: >
      SELECT 1 FROM information_schema.COLUMNS
                WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
@@ -24,7 +24,7 @@
  register: mysql_role_support

 - name: Create roles for test
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
    query:
      - CREATE ROLE 'role_keep';
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
@@ -2,8 +2,3 @@
 roles:
  - name: dev-sec.mysql
    version: master
-
-collections:
-  - name: https://github.com/ansible-collections/community.mysql.git
-    type: git
-    version: main
@@ -1,6 +1,6 @@
 ---
 - name: Get all users from MySQL server
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
    query: >
      SELECT CONCAT(USER, '@', HOST) AS users FROM mysql.user;
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
@@ -25,7 +25,7 @@
      - '"[email protected].%" in mysql_users_list'

 - name: Detect role support on MySQL
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
    query: >
      SELECT 1 FROM information_schema.COLUMNS
                WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
@@ -3,8 +3,10 @@
  user:
    name: pw_no_ageing
    password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
+    password_expire_max: "-1"

 - name: Create user those password ageing should be changed
  user:
    name: pw_ageing
    password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
+    password_expire_max: "-1"
@@ -80,7 +80,7 @@
  ansible.builtin.assert:
    that:
      - output.rc | int == 5
-      - output.stderr | length == 0
+      - "'(password expired)' in output.stderr"
      - output.stdout | length == 0
  when:
    - ansible_facts.os_family == "Suse"
@@ -32,6 +32,15 @@
        - ansible_facts.distribution == 'Fedora'
        - ansible_facts.distribution_major_version|int == 40

+    - name: Overrides for Debian 13 image
+      ansible.builtin.set_fact:
+        os_mnt_tmp_enabled: true
+        os_mnt_tmp_src: tmpfs
+        os_mnt_tmp_filesystem: tmpfs
+      when:
+        - ansible_facts.distribution == 'Debian'
+        - ansible_facts.distribution_major_version|int == 13
+
    - name: Include os_hardening role
      ansible.builtin.include_role:
        name: devsec.hardening.os_hardening
@@ -4,6 +4,16 @@
  become: true
  gather_facts: false
  tasks:
+    - name: Update keyring
+      ansible.builtin.raw: pacman --noconfirm -Sy archlinux-keyring
+      changed_when: false
+      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
+
+    - name: Update OS
+      ansible.builtin.raw: pacman --noconfirm -Suy
+      changed_when: false
+      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
+
    - name: Install python, since it's not installed by default
      ansible.builtin.raw: pacman --noconfirm -Sy python
      changed_when: false
@@ -1,3 +0,0 @@
-sshd-45:
-  run: false
-  justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"
@@ -8,7 +8,7 @@ platforms:
  # since we also need to use different OS users to run the tests because of how molecule operates,
  # the VM names must be predictable by OS user (to clean up canceled runs)
  - name: ${USER}
-    box: generic/${MOLECULE_DISTRO}
+    box: ${MOLECULE_DISTRO}
    memory: 1024
    cpus: 2
 provisioner:
@@ -8,13 +8,13 @@
      # temporary fix for https://github.com/lavabit/robox/issues/305
      ansible.builtin.raw: echo "https://ftp.eu.openbsd.org/pub/OpenBSD" > /etc/installurl
      changed_when: false
-      when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
+      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'

    - name: Install python
      # BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
-      ansible.builtin.raw: pkg_add python%3.10
+      ansible.builtin.raw: pkg_add -I python%3.11
      changed_when: false
-      when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
+      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'

 - name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
  hosts: all
@@ -9,7 +9,7 @@
        dest: /usr/bin/type
        state: hard
        mode: "0770"
-      when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
+      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'

 - name: Verify
  hosts: localhost
@@ -36,7 +36,7 @@
      ansible.builtin.command: >
        docker run --rm
        --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
-        --volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') }}.yaml:/waivers.yaml
+        --volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') | regex_replace('^.*/', '') }}.yaml:/waivers.yaml
        docker.io/cincproject/auditor exec
        --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
        -t ssh://{{ lookup('env', 'USER') }}
@@ -0,0 +1,3 @@
+unrelated:
+  run: false
+  justification: "cinc-auditor needs at least one waived control"
@@ -0,0 +1,3 @@
+unrelated:
+  run: false
+  justification: "cinc-auditor needs at least one waived control"
@@ -0,0 +1,3 @@
+unrelated:
+  run: false
+  justification: "cinc-auditor needs at least one waived control"
@@ -0,0 +1,3 @@
+unrelated:
+  run: false
+  justification: "cinc-auditor needs at least one waived control"
@@ -1,6 +1,6 @@
-molecule==25.12.0
+molecule==26.4.0
 molecule-plugins[docker]==25.8.12
-ansible-core==2.19.3
+ansible-core==2.20.5
 docker==7.1.0
 jmespath==1.1.0
 aar-doc==2.3.0
@@ -27,7 +27,7 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
 - EL
  - 8, 9, 10
 - Ubuntu
-  - focal, jammy, noble
+  - jammy, noble
 - Debian
  - trixie, bookworm, bullseye
 - Amazon
@@ -13,7 +13,6 @@ galaxy_info:
        - "10"
    - name: Ubuntu
      versions:
-        - focal
        - jammy
        - noble
    - name: Debian
@@ -14,7 +14,7 @@
    state: directory
    owner: "{{ mysql_hardening_user }}"
    group: "{{ mysql_hardening_user }}"
-    mode: "0750"
+    mode: '{{ mysql_hardening_datadir_permissions | default("0750") }}'
  when: item is defined and item != ""
  loop:
    - "{{ mysql_settings.settings.datadir }}"
@@ -39,13 +39,13 @@
  when: not mysql_distribution is defined

 - name: Check which MySQL/MariaDB version is used
-  community.mysql.mysql_info:
+  ansible.mysql.mysql_info:
    filter: version
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_version

 - name: Check MySQL/MariaDB settings
-  community.mysql.mysql_info:
+  ansible.mysql.mysql_info:
    filter: settings
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_settings
@@ -5,7 +5,7 @@
  when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'

 - name: Ensure that the root password is present
-  community.mysql.mysql_user:
+  ansible.mysql.mysql_user:
    name: root
    host_all: true
    password: "{{ mysql_root_password | mandatory }}"
@@ -20,14 +20,14 @@
  tags: my_cnf

 - name: Ensure that the test database is absent
-  community.mysql.mysql_db:
+  ansible.mysql.mysql_db:
    name: test
    state: absent
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_test_database

 - name: Ensure that anonymous users are absent
-  community.mysql.mysql_user:
+  ansible.mysql.mysql_user:
    name: ""
    state: absent
    host_all: true
@@ -35,7 +35,7 @@
  when: mysql_remove_anonymous_users

 - name: Ensure that root can only login from localhost
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
    query: >
      DELETE
      FROM mysql.user
@@ -47,7 +47,7 @@
  when: mysql_remove_remote_root

 - name: Detect role support on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
    query: >
      SELECT 1 FROM information_schema.COLUMNS
                WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
@@ -57,7 +57,7 @@
  check_mode: false

 - name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
    query: >
      SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
      FROM mysql.user
@@ -76,7 +76,7 @@
    is version('10.4.0', '>='))

 - name: Get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
    query: >
      SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
      FROM mysql.user
@@ -97,7 +97,7 @@
    version('10.4.0', '<'))

 - name: Ensure that there are no users without password or authentication_string
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
    query:
      - DROP USER {{ item.user }}
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
@@ -6,5 +6,7 @@ mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
 mysql_cnf_owner: 'root'  # owner of /etc/my.cnf.d/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/my.cnf.d/*.cnf files

+mysql_hardening_datadir_permissions: "0700"
+
 mysql_hardening_group: 'mysql'
 login_unix_socket: '/run/mysql/mysql.sock'
@@ -20,7 +20,7 @@ It works with the following nginx-roles, including, but not limited to:
 - EL
  - 8, 9, 10
 - Ubuntu
-  - focal, jammy, noble
+  - jammy, noble, resolute
 - Debian
  - trixie, bookworm, bullseye
 - Amazon
@@ -13,9 +13,9 @@ galaxy_info:
        - "10"
    - name: Ubuntu
      versions:
-        - focal
        - jammy
        - noble
+        - resolute
    - name: Debian
      versions:
        - trixie
@@ -160,7 +160,7 @@ This role is mostly based on guides by:
 - EL
  - 8, 9, 10
 - Ubuntu
-  - focal, jammy, noble
+  - jammy, noble, resolute
 - Debian
  - trixie, bookworm, bullseye
 - Amazon
@@ -13,9 +13,9 @@ galaxy_info:
        - "10"
    - name: Ubuntu
      versions:
-        - focal
        - jammy
        - noble
+        - resolute
    - name: Debian
      versions:
        - trixie
@@ -3,7 +3,6 @@
  ansible.builtin.apt:
    name: libpam-passwdqc
    state: present
-    update_cache: true
  when:
    - os_auth_pam_passwdqc_enable

@@ -5,7 +5,7 @@
 #
 # Three items must be defined:  `MAIL_DIR`, `ENV_SUPATH`, and `ENV_PATH`. If unspecified, some arbitrary (and possibly incorrect) value will be assumed.  All other items are optional - if not specified then the described action or option will be inhibited.
 #
-# Comment lines (lines beginning with `#`) and blank lines are ignored.
+# Comment lines and blank lines are ignored.
 #
 #-- Modified for Linux.  --marekm

@@ -35,7 +35,7 @@ FAILLOG_ENAB      yes

 # Enable display of unknown usernames when login failures are recorded.
 #
-# *WARNING*: Unknown usernames may become world readable. See #290803 and #298773 for details about how this could become a security concern
+# *WARNING*: Unknown usernames may become world readable. See 290803 and 298773 for details about how this could become a security concern
 LOG_UNKFAIL_ENAB  no

 # Enable logging of successful logins
@@ -56,7 +56,7 @@ SYSLOG_SG_ENAB    yes
 # If defined, login failures will be logged here in a utmp format last, when invoked as lastb, will read `/var/log/btmp`, so...
 FTMP_FILE         /var/log/btmp

-# If defined, the command name to display when running "su -".  For # example, if this is defined as "su" then a "ps" will display the command is "-su".  If not defined, then "ps" would display the name of the shell actually being run, e.g. something like "-sh".
+# If defined, the command name to display when running "su -".  For example, if this is defined as "su" then a "ps" will display the command is "-su".  If not defined, then "ps" would display the name of the shell actually being run, e.g. something like "-sh".
 SU_NAME           su

 # If defined, file which inhibits all the usual chatter during the login sequence.  If a full pathname, then hushed mode will be enabled if the user's name or shell are found in the file.  If not a full pathname, then hushed mode will be enabled if the file exists in the user's home directory.
@@ -96,7 +96,7 @@ KILLCHAR          025
 UMASK             {{ os_env_umask }}

 # Enable setting of the umask group bits to be the same as owner bits (examples: `022` -> `002`, `077` -> `007`) for non-root users, if the uid is the same as gid, and username is the same as the primary group name.
-# If set to yes, userdel will remove the user´s group if it contains no more members, and useradd will create by default a group with the name of the user.
+# If set to yes, userdel will remove the user's group if it contains no more members, and useradd will create by default a group with the name of the user.
 USERGROUPS_ENAB   yes


@@ -1,7 +1,7 @@
 # dev-sec.ssh_hardening

 [![devsec.ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml)
-[![devsec.ssh_hardening BSD](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml)
+[![devsec.ssh_hardening VM](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml)
 [![devsec.ssh_hardening with custom tests](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml)

 ## Description
@@ -49,7 +49,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
 - EL
  - 8, 9, 10
 - Ubuntu
-  - focal, jammy, noble
+  - jammy, noble, resolute
 - Debian
  - trixie, bookworm, bullseye
 - Alpine
@@ -58,7 +58,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
 - ArchLinux
 - SmartOS
 - FreeBSD
-  - 13.2, 14.0
+  - 14.0
 - OpenBSD
  - 7.0

@@ -13,9 +13,9 @@ galaxy_info:
        - "10"
    - name: Ubuntu
      versions:
-        - focal
        - jammy
        - noble
+        - resolute
    - name: Debian
      versions:
        - trixie
@@ -28,7 +28,6 @@ galaxy_info:
    - name: SmartOS
    - name: FreeBSD
      versions:
-        - "13.2"
        - "14.0"
    - name: OpenBSD
      versions:
@@ -1,4 +1,11 @@
 ---
+- name: Disable systemd-socket activation
+  ansible.builtin.systemd:
+    name: ssh.socket
+    state: stopped
+    enabled: false
+    masked: true
+
 - name: Remove ssh service systemd-socket file
  ansible.builtin.file:
    path: "{{ item }}"
@@ -8,9 +15,8 @@
    - /etc/systemd/system/ssh.service.requires/ssh.socket
    - /etc/systemd/system/sockets.target.wants/ssh.socket

- name: Disable systemd-socket activation
+- name: Ensure ssh service is started after disabling socket activation
  ansible.builtin.systemd:
-    name: ssh.socket
-    state: stopped
-    enabled: false
-    masked: true
+    name: "{{ sshd_service_name }}"
+    state: started
+    enabled: true
Author	SHA1	Message	Date
renovate[bot]	e21cb1647b	Update dependency ubuntu to v24 Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-05-14 17:11:43 +00:00
dev-sec CI	c21ff3d2c3	update changelog	2026-05-13 07:44:08 +00:00
renovate[bot]	1fb77e4c9c	Update dev-sec/.github digest to 2cd0028 (#943 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-05-13 09:43:08 +02:00
renovate[bot]	02d583a01d	Update dependency molecule to v26 (#935 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-05-13 09:42:53 +02:00
dev-sec CI	4d436b0697	update changelog	2026-05-12 22:14:21 +00:00
renovate[bot]	c801b54cf8	Update dependency ansible-core to v2.20.5 (#910 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-05-12 22:10:07 +00:00
dev-sec CI	41320ed028	update os_hardening readme	2026-05-12 13:35:56 +00:00
dev-sec CI	3a6e3fedb2	update nginx_hardening readme	2026-05-12 13:35:06 +00:00
dev-sec CI	a72d4da2ef	update mysql_hardening readme	2026-05-12 13:34:08 +00:00
dev-sec CI	1d856393e0	update ssh_hardening readme	2026-05-12 13:31:57 +00:00
dev-sec CI	2d9e7028ba	update changelog	2026-05-12 13:28:19 +00:00
Martin Schurz	38791f0199	Update supported OS versions to current Fedora (42/43/44) and Ubuntu (22.04/24.04/26.04) (#946 ) * Update testing and remove old, unsupported OS versions Signed-off-by: Martin Schurz <[email protected]> * Update Arch OS Signed-off-by: Martin Schurz <[email protected]> * Fix SuSE login.defs issues Signed-off-by: Martin Schurz <[email protected]> * Debug ... Signed-off-by: Martin Schurz <[email protected]> * Fix SuSE stuff Signed-off-by: Martin Schurz <[email protected]> * Fix SuSE stuff Signed-off-by: Martin Schurz <[email protected]> * Update OS Support Signed-off-by: Martin Schurz <[email protected]> * Use Ansible mysql module Signed-off-by: Martin Schurz <[email protected]> * Update OS Support Signed-off-by: Martin Schurz <[email protected]> * Use existing Fedora images Signed-off-by: Martin Schurz <[email protected]> * Fix VM tests Signed-off-by: Martin Schurz <[email protected]> * fix last errors Signed-off-by: Martin Schurz <[email protected]> * Final fixes Signed-off-by: Martin Schurz <[email protected]> --------- Signed-off-by: Martin Schurz <[email protected]>	2026-05-12 15:25:57 +02:00
dev-sec CI	6c0d54cbe5	update changelog	2026-05-06 08:44:51 +00:00
renovate[bot]	1830c8df23	Update actions/labeler action to v6.1.0 (#947 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-05-06 08:43:30 +00:00
dev-sec CI	a506cc63f5	update changelog	2026-04-16 07:52:30 +00:00
renovate[bot]	f24952f110	chore(deps): update ansible/ansible-lint digest to 5fac056 (#942 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-04-16 09:50:53 +02:00
dev-sec CI	1199cbd8ee	update galaxy.yml with new version	2026-03-28 21:29:36 +00:00
dev-sec CI	13515e3fe2	update changelog	2026-03-28 20:37:44 +00:00
renovate[bot]	882637dd13	chore(deps): update actions/checkout digest to de0fac2 (#932 )	2026-03-28 21:36:28 +01:00
dev-sec CI	0f0761fb7e	update changelog	2026-03-28 19:44:38 +00:00
renovate[bot]	dec15ae057	chore(deps): pin dependencies (#938 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-03-28 20:43:21 +01:00
renovate[bot]	f174f69e9e	chore(deps): update hugo19941994/delete-draft-releases action to v3 (#940 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-03-28 20:42:51 +01:00
dev-sec CI	13444e5e9b	update changelog	2026-03-28 19:29:07 +00:00
Eike SauerandEike Sauer	f68429cff0	do not update apt cache when installing libpam-passwdqc (#939 ) * updating apt is not in the scope of a libpam-passwdqc task, IMHO --------- Signed-off-by: Eike Sauer <[email protected]> Co-authored-by: Eike Sauer <[email protected]>	2026-03-28 20:27:51 +01:00
dev-sec CI	7c2168bd21	update galaxy.yml with new version	2026-03-20 22:10:01 +00:00
dev-sec CI	70da85de4d	update changelog	2026-03-20 21:26:29 +00:00
schurzi	a62b40e6b0	Prettified Code!	2026-03-20 21:25:18 +00:00
Martin Schurz	9bbae051d6	Improve VM based testing of SSH hardening (#878 )	2026-03-20 22:24:57 +01:00
dev-sec CI	c89fe9e5e4	update changelog	2026-03-20 14:11:16 +00:00
Tatu Argillander	d7487032d2	disable sshd socket activation first (#931 ) Ansible can open multiple connections and it's possible for a new socket to open before activation is fully disabled, leaving a zombie sshd process. At least that is the guess. Ubuntu 24.04 suffers from this. Reload the configuration after disabling socket activation to not enable it again. Signed-off-by: Tatu Argillander <[email protected]>	2026-03-20 15:06:59 +01:00
dev-sec CI	7b1052db3a	update changelog	2026-03-14 10:53:31 +00:00
renovate[bot]	7d80c0cdc5	chore(deps): update artis3n/ansible_galaxy_collection action to v3 (#933 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-03-14 11:51:58 +01:00
renovate[bot]	56af318f67	chore(deps): update juliangruber/read-file-action digest to 271ff31 (#937 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-03-14 11:51:31 +01:00
renovate[bot]	af19631274	chore(deps): update ansible/ansible-lint digest to 8ba9595 (#934 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-03-14 11:51:03 +01:00
dev-sec CI	90568a27a8	update galaxy.yml with new version	2026-01-22 22:12:05 +00:00
dev-sec CI	01121abab4	update changelog	2026-01-22 21:31:25 +00:00