Update dependency python to 3.14

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/ansible-lint.yml

@@ -29,4 +29,4 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Lint Ansible Playbook
-        uses: ansible/ansible-lint@8ba9595a4acd1b906eb75568b34f6ef592cd1528 # v26
+        uses: ansible/ansible-lint@5fac056c45595896c973fbde871f01f6cb14d74c # v26

.github/workflows/codespell.yml

@@ -9,6 +9,6 @@ on:  # yamllint disable-line rule:truthy
 
 jobs:
   codespell:
-    uses: "dev-sec/.github/.github/workflows/codespell.yml@37dc40b91a59d97d06824f16d11865baba5f07e1" # main
+    uses: "dev-sec/.github/.github/workflows/codespell.yml@2cd00282cfdb322243d879a96d9494ce64e76119" # main
     with:
       ignore_words_list: "chage,BOOTUP"

.github/workflows/enforce-labels.yml

@@ -14,6 +14,6 @@ jobs:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/mysql_hardening.yml

@@ -44,9 +44,9 @@ jobs:
           - rocky8
           - rocky9
           # - rocky10 # problem with baseline
-          - ubuntu2004
           - ubuntu2204
           - ubuntu2404
+          # - ubuntu2604 # problem with test setup
           - debian11
           - debian12
           - debian13
@@ -64,7 +64,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: 3.13
+          python-version: 3.14
           cache: 'pip'
 
       - name: Install dependencies

.github/workflows/nginx_hardening.yml

@@ -43,9 +43,9 @@ jobs:
           - rocky8
           - rocky9
           - rocky10
-          - ubuntu2004
           - ubuntu2204
           - ubuntu2404
+          - ubuntu2604
           - debian11
           - debian12
           - debian13
@@ -63,7 +63,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: 3.13
+          python-version: 3.14
           cache: 'pip'
 
       - name: Install dependencies

.github/workflows/os_hardening.yml

@@ -46,11 +46,12 @@ jobs:
           - rocky8
           - rocky9
           - rocky10
-          - fedora39
-          - fedora40
-          - ubuntu2004
+          - fedora42
+          - fedora43
+          - fedora44
           - ubuntu2204
           - ubuntu2404
+          - ubuntu2604
           - debian11
           - debian12
           - debian13
@@ -68,7 +69,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: 3.13
+          python-version: 3.14
           cache: 'pip'
 
       - name: Install dependencies

.github/workflows/os_hardening_vm.yml

@@ -44,13 +44,14 @@ jobs:
           - generic/centos9s
           - generic/rocky8
           - generic/rocky9
-          - fedora/39-cloud-base
-          - fedora/40-cloud-base
-          - generic/ubuntu2004
+          - alvistack/fedora-42
+          # - alvistack/fedora-43 # no compatible test image
           - generic/ubuntu2204
           - alvistack/ubuntu-24.04
+          # - alvistack/ubuntu-26.04 # no compatible test image
           - generic/debian11
           - generic/debian12
+          - cloud-image/debian-13
           - generic/opensuse15
           - generic/arch
     steps:

.github/workflows/roles-readme.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: 3.13
+          python-version: 3.14
           cache: 'pip'
 
       - name: Install dependencies

.github/workflows/ssh_hardening.yml

@@ -49,11 +49,12 @@ jobs:
           - rocky8
           - rocky9
           - rocky10
-          - fedora39
-          - fedora40
-          - ubuntu2004
+          - fedora42
+          - fedora43
+          - fedora44
           - ubuntu2204
           - ubuntu2404
+          - ubuntu2604
           - debian11
           - debian12
           - debian13
@@ -71,7 +72,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: 3.13
+          python-version: 3.14
           cache: 'pip'
 
       - name: Install dependencies

.github/workflows/ssh_hardening_custom_tests.yml

@@ -49,11 +49,12 @@ jobs:
           - rocky8
           - rocky9
           - rocky10
-          - fedora39
-          - fedora40
-          - ubuntu2004
+          - fedora42
+          - fedora43
+          - fedora44
           - ubuntu2204
           - ubuntu2404
+          - ubuntu2604
           - debian11
           - debian12
           - debian13
@@ -71,7 +72,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: 3.13
+          python-version: 3.14
           cache: 'pip'
 
       - name: Install dependencies

.github/workflows/ssh_hardening_vm.yml

@@ -39,10 +39,10 @@ jobs:
       matrix:
         molecule_distro:
           - generic/openbsd7
-          - generic/freebsd13
           - generic/freebsd14
           - cloud-image/debian-13
           - cloud-image/ubuntu-24.04
+          - cloud-image/ubuntu-26.04
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [10.6.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.6.0) (2026-05-13)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.2...10.6.0)
+
+**Implemented enhancements:**
+
+- Update APT package cache before installing any package in case freshly installed system. [\#945](https://github.com/dev-sec/ansible-collection-hardening/issues/945)
+- Update supported OS versions to current Fedora \(42/43/44\) and Ubuntu \(22.04/24.04/26.04\) [\#946](https://github.com/dev-sec/ansible-collection-hardening/pull/946) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+
+**Merged pull requests:**
+
+- Update actions/labeler action to v6.1.0 [\#947](https://github.com/dev-sec/ansible-collection-hardening/pull/947) ([renovate[bot]](https://github.com/apps/renovate))
+- Update dev-sec/.github digest to 2cd0028 [\#943](https://github.com/dev-sec/ansible-collection-hardening/pull/943) ([renovate[bot]](https://github.com/apps/renovate))
+- Update ansible/ansible-lint digest to 5fac056 [\#942](https://github.com/dev-sec/ansible-collection-hardening/pull/942) ([renovate[bot]](https://github.com/apps/renovate))
+- Update dependency molecule to v26 [\#935](https://github.com/dev-sec/ansible-collection-hardening/pull/935) ([renovate[bot]](https://github.com/apps/renovate))
+- Update dependency ansible-core to v2.20.5 [\#910](https://github.com/dev-sec/ansible-collection-hardening/pull/910) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+
 ## [10.5.2](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.2) (2026-03-28)
 
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.1...10.5.2)
@@ -12,6 +29,7 @@
 
 - chore\(deps\): update hugo19941994/delete-draft-releases action to v3 [\#940](https://github.com/dev-sec/ansible-collection-hardening/pull/940) ([renovate[bot]](https://github.com/apps/renovate))
 - chore\(deps\): pin dependencies [\#938](https://github.com/dev-sec/ansible-collection-hardening/pull/938) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/checkout digest to de0fac2 [\#932](https://github.com/dev-sec/ansible-collection-hardening/pull/932) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
 
 ## [10.5.1](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.1) (2026-03-20)
 

README.md

@@ -17,10 +17,10 @@ This collection provides battle tested hardening for:
   - AlmaLinux 8/9/10
   - Rocky Linux 8/9/10
   - Debian 11/12/13
-  - Ubuntu 20.04/22.04/24.04
+  - Ubuntu 22.04/24.04/26.04
   - Amazon Linux (some roles supported)
   - Arch Linux (some roles supported)
-  - Fedora 39/40 (some roles supported)
+  - Fedora 42/43/44 (some roles supported)
   - Suse Tumbleweed (some roles supported)
 - MySQL
   - MariaDB >= 5.5.65, >= 10.1.45, >= 10.3.17

galaxy.yml

@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 10.5.1
+version: 10.5.2
 readme: README.md
 authors:
   - dev-sec <[email protected]>

molecule/mysql_hardening/converge.yml

@@ -15,14 +15,6 @@
         - ansible_facts.distribution == "Ubuntu"
         - ansible_facts.distribution_major_version|int > 19
 
-    - name: Determine required MySQL Python libraries.
-      ansible.builtin.set_fact:
-        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
-      when:
-        - mysql_python_package_debian is not defined
-        - ansible_facts.distribution != "Ubuntu"
-        - ansible_facts.distribution_major_version|int < 20
-
     - name: Use Python 3 on Suse
       ansible.builtin.set_fact:
         ansible_python_interpreter: /usr/bin/python3

molecule/mysql_hardening/prepare.yml

@@ -51,14 +51,6 @@
         - ansible_facts.distribution == "Ubuntu"
         - ansible_facts.distribution_major_version|int > 19
 
-    - name: Determine required MySQL Python libraries.
-      ansible.builtin.set_fact:
-        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
-      when:
-        - mysql_python_package_debian is not defined
-        - ansible_facts.distribution != "Ubuntu"
-        - ansible_facts.distribution_major_version|int < 20
-
     - name: Install required MySQL Python libraries on RHEL
       ansible.builtin.dnf:
         name: "{% if 'python3' in ansible_python_interpreter | default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"

molecule/mysql_hardening/prepare_tasks/mysql_users.yml

@@ -1,6 +1,6 @@
 ---
 - name: Create users for test
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query:
       - CREATE USER 'user'@'delete';
       - CREATE USER 'user'@'127.0.0.1';
@@ -15,7 +15,7 @@
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
 
 - name: Detect role support on MySQL
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query: >
       SELECT 1 FROM information_schema.COLUMNS
                 WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
@@ -24,7 +24,7 @@
   register: mysql_role_support
 
 - name: Create roles for test
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query:
       - CREATE ROLE 'role_keep';
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"

molecule/mysql_hardening/requirements.yml

@@ -2,8 +2,3 @@
 roles:
   - name: dev-sec.mysql
     version: master
-
-collections:
-  - name: https://github.com/ansible-collections/community.mysql.git
-    type: git
-    version: main

molecule/mysql_hardening/verify_tasks/mysql_users.yml

@@ -1,6 +1,6 @@
 ---
 - name: Get all users from MySQL server
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query: >
       SELECT CONCAT(USER, '@', HOST) AS users FROM mysql.user;
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
@@ -25,7 +25,7 @@
       - '"[email protected].%" in mysql_users_list'
 
 - name: Detect role support on MySQL
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query: >
       SELECT 1 FROM information_schema.COLUMNS
                 WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'

molecule/os_hardening/prepare_tasks/pw_ageing.yml

@@ -3,8 +3,10 @@
   user:
     name: pw_no_ageing
     password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
+    password_expire_max: "-1"
 
 - name: Create user those password ageing should be changed
   user:
     name: pw_ageing
     password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
+    password_expire_max: "-1"

molecule/os_hardening/verify_tasks/ssh_auth_locked.yml

@@ -80,7 +80,7 @@
   ansible.builtin.assert:
     that:
       - output.rc | int == 5
-      - output.stderr | length == 0
+      - "'(password expired)' in output.stderr"
       - output.stdout | length == 0
   when:
     - ansible_facts.os_family == "Suse"

molecule/os_hardening_vm/converge.yml

@@ -32,6 +32,15 @@
         - ansible_facts.distribution == 'Fedora'
         - ansible_facts.distribution_major_version|int == 40
 
+    - name: Overrides for Debian 13 image
+      ansible.builtin.set_fact:
+        os_mnt_tmp_enabled: true
+        os_mnt_tmp_src: tmpfs
+        os_mnt_tmp_filesystem: tmpfs
+      when:
+        - ansible_facts.distribution == 'Debian'
+        - ansible_facts.distribution_major_version|int == 13
+
     - name: Include os_hardening role
       ansible.builtin.include_role:
         name: devsec.hardening.os_hardening

molecule/os_hardening_vm/prepare.yml

@@ -4,6 +4,16 @@
   become: true
   gather_facts: false
   tasks:
+    - name: Update keyring
+      ansible.builtin.raw: pacman --noconfirm -Sy archlinux-keyring
+      changed_when: false
+      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
+
+    - name: Update OS
+      ansible.builtin.raw: pacman --noconfirm -Suy
+      changed_when: false
+      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
+
     - name: Install python, since it's not installed by default
       ansible.builtin.raw: pacman --noconfirm -Sy python
       changed_when: false

molecule/ssh_hardening_vm/waivers_almalinux-10.yaml

@@ -1,2 +1,3 @@
----
-{}
+unrelated:
+  run: false
+  justification: "cinc-auditor needs at least one waived control"

molecule/ssh_hardening_vm/waivers_debian-13.yaml

@@ -1,2 +1,3 @@
----
-{}
+unrelated:
+  run: false
+  justification: "cinc-auditor needs at least one waived control"

molecule/ssh_hardening_vm/waivers_freebsd13.yaml

@@ -1,3 +0,0 @@
-sshd-45:
-  run: false
-  justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"

molecule/ssh_hardening_vm/waivers_ubuntu-24.04.yaml

@@ -1,2 +1,3 @@
----
-{}
+unrelated:
+  run: false
+  justification: "cinc-auditor needs at least one waived control"

molecule/ssh_hardening_vm/waivers_ubuntu-26.04.yaml

@@ -0,0 +1,3 @@
+unrelated:
+  run: false
+  justification: "cinc-auditor needs at least one waived control"

requirements.txt

@@ -1,6 +1,6 @@
-molecule==25.12.0
+molecule==26.4.0
 molecule-plugins[docker]==25.8.12
-ansible-core==2.19.3
+ansible-core==2.20.5
 docker==7.1.0
 jmespath==1.1.0
 aar-doc==2.3.0

roles/mysql_hardening/README.md

@@ -24,11 +24,10 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
 <!-- BEGIN_ANSIBLE_DOCS -->
 
 ## Supported Operating Systems
-
 - EL
   - 8, 9, 10
 - Ubuntu
-  - focal, jammy, noble
+  - jammy, noble
 - Debian
   - trixie, bookworm, bullseye
 - Amazon

roles/mysql_hardening/meta/main.yml

@@ -13,7 +13,6 @@ galaxy_info:
         - "10"
     - name: Ubuntu
       versions:
-        - focal
         - jammy
         - noble
     - name: Debian

roles/mysql_hardening/tasks/configure.yml

@@ -14,7 +14,7 @@
     state: directory
     owner: "{{ mysql_hardening_user }}"
     group: "{{ mysql_hardening_user }}"
-    mode: "0750"
+    mode: '{{ mysql_hardening_datadir_permissions | default("0750") }}'
   when: item is defined and item != ""
   loop:
     - "{{ mysql_settings.settings.datadir }}"

roles/mysql_hardening/tasks/main.yml

@@ -39,13 +39,13 @@
   when: not mysql_distribution is defined
 
 - name: Check which MySQL/MariaDB version is used
-  community.mysql.mysql_info:
+  ansible.mysql.mysql_info:
     filter: version
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   register: mysql_version
 
 - name: Check MySQL/MariaDB settings
-  community.mysql.mysql_info:
+  ansible.mysql.mysql_info:
     filter: settings
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   register: mysql_settings

roles/mysql_hardening/tasks/mysql_secure_installation.yml

@@ -5,7 +5,7 @@
   when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'
 
 - name: Ensure that the root password is present
-  community.mysql.mysql_user:
+  ansible.mysql.mysql_user:
     name: root
     host_all: true
     password: "{{ mysql_root_password | mandatory }}"
@@ -20,14 +20,14 @@
   tags: my_cnf
 
 - name: Ensure that the test database is absent
-  community.mysql.mysql_db:
+  ansible.mysql.mysql_db:
     name: test
     state: absent
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   when: mysql_remove_test_database
 
 - name: Ensure that anonymous users are absent
-  community.mysql.mysql_user:
+  ansible.mysql.mysql_user:
     name: ""
     state: absent
     host_all: true
@@ -35,7 +35,7 @@
   when: mysql_remove_anonymous_users
 
 - name: Ensure that root can only login from localhost
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query: >
       DELETE
       FROM mysql.user
@@ -47,7 +47,7 @@
   when: mysql_remove_remote_root
 
 - name: Detect role support on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query: >
       SELECT 1 FROM information_schema.COLUMNS
                 WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
@@ -57,7 +57,7 @@
   check_mode: false
 
 - name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query: >
       SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
       FROM mysql.user
@@ -76,7 +76,7 @@
     is version('10.4.0', '>='))
 
 - name: Get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query: >
       SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
       FROM mysql.user
@@ -97,7 +97,7 @@
     version('10.4.0', '<'))
 
 - name: Ensure that there are no users without password or authentication_string
-  community.mysql.mysql_query:
+  ansible.mysql.mysql_query:
     query:
       - DROP USER {{ item.user }}
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"

roles/mysql_hardening/vars/Suse.yml

@@ -6,5 +6,7 @@ mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
 mysql_cnf_owner: 'root'  # owner of /etc/my.cnf.d/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/my.cnf.d/*.cnf files
 
+mysql_hardening_datadir_permissions: "0700"
+
 mysql_hardening_group: 'mysql'
 login_unix_socket: '/run/mysql/mysql.sock'

roles/nginx_hardening/README.md

@@ -17,11 +17,10 @@ It works with the following nginx-roles, including, but not limited to:
 <!-- BEGIN_ANSIBLE_DOCS -->
 
 ## Supported Operating Systems
-
 - EL
   - 8, 9, 10
 - Ubuntu
-  - focal, jammy, noble
+  - jammy, noble, resolute
 - Debian
   - trixie, bookworm, bullseye
 - Amazon

roles/nginx_hardening/meta/main.yml

@@ -13,9 +13,9 @@ galaxy_info:
         - "10"
     - name: Ubuntu
       versions:
-        - focal
         - jammy
         - noble
+        - resolute
     - name: Debian
       versions:
         - trixie

roles/os_hardening/README.md

@@ -157,11 +157,10 @@ This role is mostly based on guides by:
 <!-- BEGIN_ANSIBLE_DOCS -->
 
 ## Supported Operating Systems
-
 - EL
   - 8, 9, 10
 - Ubuntu
-  - focal, jammy, noble
+  - jammy, noble, resolute
 - Debian
   - trixie, bookworm, bullseye
 - Amazon

roles/os_hardening/meta/main.yml

@@ -13,9 +13,9 @@ galaxy_info:
         - "10"
     - name: Ubuntu
       versions:
-        - focal
         - jammy
         - noble
+        - resolute
     - name: Debian
       versions:
         - trixie

roles/os_hardening/templates/etc/login.defs.j2

@@ -5,7 +5,7 @@
 #
 # Three items must be defined:  `MAIL_DIR`, `ENV_SUPATH`, and `ENV_PATH`. If unspecified, some arbitrary (and possibly incorrect) value will be assumed.  All other items are optional - if not specified then the described action or option will be inhibited.
 #
-# Comment lines (lines beginning with `#`) and blank lines are ignored.
+# Comment lines and blank lines are ignored.
 #
 #-- Modified for Linux.  --marekm
 
@@ -35,7 +35,7 @@ FAILLOG_ENAB      yes
 
 # Enable display of unknown usernames when login failures are recorded.
 #
-# *WARNING*: Unknown usernames may become world readable. See #290803 and #298773 for details about how this could become a security concern
+# *WARNING*: Unknown usernames may become world readable. See 290803 and 298773 for details about how this could become a security concern
 LOG_UNKFAIL_ENAB  no
 
 # Enable logging of successful logins
@@ -56,7 +56,7 @@ SYSLOG_SG_ENAB    yes
 # If defined, login failures will be logged here in a utmp format last, when invoked as lastb, will read `/var/log/btmp`, so...
 FTMP_FILE         /var/log/btmp
 
-# If defined, the command name to display when running "su -".  For # example, if this is defined as "su" then a "ps" will display the command is "-su".  If not defined, then "ps" would display the name of the shell actually being run, e.g. something like "-sh".
+# If defined, the command name to display when running "su -".  For example, if this is defined as "su" then a "ps" will display the command is "-su".  If not defined, then "ps" would display the name of the shell actually being run, e.g. something like "-sh".
 SU_NAME           su
 
 # If defined, file which inhibits all the usual chatter during the login sequence.  If a full pathname, then hushed mode will be enabled if the user's name or shell are found in the file.  If not a full pathname, then hushed mode will be enabled if the file exists in the user's home directory.
@@ -96,7 +96,7 @@ KILLCHAR          025
 UMASK             {{ os_env_umask }}
 
 # Enable setting of the umask group bits to be the same as owner bits (examples: `022` -> `002`, `077` -> `007`) for non-root users, if the uid is the same as gid, and username is the same as the primary group name.
-# If set to yes, userdel will remove the user´s group if it contains no more members, and useradd will create by default a group with the name of the user.
+# If set to yes, userdel will remove the user's group if it contains no more members, and useradd will create by default a group with the name of the user.
 USERGROUPS_ENAB   yes
 
 

roles/ssh_hardening/README.md

@@ -46,11 +46,10 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
 <!-- BEGIN_ANSIBLE_DOCS -->
 
 ## Supported Operating Systems
-
 - EL
   - 8, 9, 10
 - Ubuntu
-  - focal, jammy, noble
+  - jammy, noble, resolute
 - Debian
   - trixie, bookworm, bullseye
 - Alpine
@@ -59,7 +58,7 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
 - ArchLinux
 - SmartOS
 - FreeBSD
-  - 13.2, 14.0
+  - 14.0
 - OpenBSD
   - 7.0
 

roles/ssh_hardening/meta/main.yml

@@ -13,9 +13,9 @@ galaxy_info:
         - "10"
     - name: Ubuntu
       versions:
-        - focal
         - jammy
         - noble
+        - resolute
     - name: Debian
       versions:
         - trixie
@@ -28,7 +28,6 @@ galaxy_info:
     - name: SmartOS
     - name: FreeBSD
       versions:
-        - "13.2"
         - "14.0"
     - name: OpenBSD
       versions: