use fqn for with_flattened

Signed-off-by: Sebastian Gumprich <[email protected]>

.aar_doc.yml

@@ -1,51 +0,0 @@
-output_template: |
-  <!-- BEGIN_ANSIBLE_DOCS -->
-
-  ## Supported Operating Systems
-
-  {%- for platform in metadata.galaxy_info.platforms %}
-  - {{ platform.name }}
-    {%- if "versions" in platform %}
-    - {{ platform.versions | default([]) | join(', ') }}
-    {%- endif %}
-  {%- endfor %}
-
-  ## Role Variables
-  {% for entrypoint in argument_specs.keys() %}
-  {%- set path, options=entrypoint_options[entrypoint][0] -%}
-  {%- for name, details in options.items() |sort() %}
-  - `{{ name }}`
-    - Default: `{{ details.display_default }}`
-    - Description: {{ details.display_description }}
-    - Type: {{ details.display_type }}
-    - Required: {{ details.display_required }}
-    {%- if details.choices %}
-    - Choices:
-      {%- for choice in details.choices %}
-      - {{ choice }}
-      {%- endfor %}
-    {%- endif %}
-  {%- endfor %}
-  {%- endfor %}
-
-  ## Dependencies
-
-  {%- if ("dependencies" in metadata) and (metadata.dependencies | length > 0) %}
-  {%- for dependency in metadata.dependencies %}
-  - {{ dependency }}
-  {%- endfor %}
-  {%- else %}
-
-  None.
-  {%- endif %}
-
-  ## Example Playbook
-
-  ```
-  - hosts: all
-    become: true
-    roles:
-      - name: {{ role }}
-  ```
-
-  <!-- END_ANSIBLE_DOCS -->

.config/ansible-lint.yml

@@ -4,16 +4,14 @@
 # and not relative to the CWD of execution. CLI arguments passed to the --exclude
 # option will be parsed relative to the CWD of execution.
 exclude_paths:
-  - .cache/ # implicit unless exclude_paths is defined in config
+  - .cache/  # implicit unless exclude_paths is defined in config
-  - .ansible/ # somehow someone decided that the cache directory should be renamed
+  - .yamllint
-  # add all waivers individually, since exclude_files does not support globs
+  - ../molecule/
-  - molecule/os_hardening/waivers.yaml
+  - ../.github/
-  - molecule/ssh_hardening_vm/waivers_*.yaml
+
+skip_list:
+  - fqcn-builtins
 
 mock_roles:
   - geerlingguy.git
   - nginxinc.nginx
-
-skip_list:
-  - var-naming[no-role-prefix]
-  - meta-runtime[unsupported-version]

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,49 @@
+---
+name: Bug report
+about: Create a report to help us improve
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Actual behavior**
+
+<!--- Paste verbatim command output between quotes -->
+
+```paste below
+
+```
+
+**Example Playbook**
+
+<!--- Paste an example playbook that can be used to reproduce the problem between quotes -->
+
+```paste below
+
+```
+
+**OS / Environment**
+
+<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
+
+**Ansible Version**
+
+<!--- Paste verbatim output from "ansible --version" between quotes -->
+
+```paste below
+
+```
+
+**Role Version**
+
+<!--- Paste version of the role between quotes -->
+
+```paste below
+
+```
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,97 +0,0 @@
----
-# reference: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests
-name: "Bug report"
-description: "Create a report to help us improve."
-labels: [
-  "bug"
-]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Reporting Bugs ld follow some simple rules:
-
-        - **Check**, if you can find similar bugs
-        - **Describe** what is happening and what should happen
-        - **Explain** how to reproduce the problem
-        - **Add** more details and attachments
-        - **Follow up**, if somebody is having questions or needs more details
-
-  - type: textarea
-    id: description
-    attributes:
-      label: "Description"
-      description: Describe the bug
-      placeholder: A clear and concise description of what the bug is.
-    validations:
-      required: true
-
-  - type: textarea
-    id: reprod
-    attributes:
-      label: "Reproduction steps"
-      render: Shell
-      description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, no need for backticks.
-      value: |
-        ...
-    validations:
-      required: true
-
-  - type: textarea
-    id: currentbehavior
-    attributes:
-      label: "Current Behavior"
-      description: Please describe the results you received
-      value: |
-        ...
-    validations:
-      required: true
-
-  - type: textarea
-    id: expectedbehavior
-    attributes:
-      label: "Expected Behavior"
-      description: Please describe the results you expect
-      value: |
-        ...
-    validations:
-      required: true
-
-  - type: textarea
-    id: os
-    attributes:
-      label: "OS / Environment"
-      value: |
-        Provide all relevant information below, e.g. target OS versions, network device firmware, etc.
-    validations:
-      required: true
-
-  - type: textarea
-    id: ansible
-    attributes:
-      label: "Ansible Version"
-      render: Shell
-      value: |
-        Paste verbatim output from "ansible --version" between quotes. This will be automatically formatted into code, so no need for backticks.
-    validations:
-      required: true
-
-  - type: textarea
-    id: collection
-    attributes:
-      label: "Collection Version"
-      render: Shell
-      value: |
-        Paste version of the collection. This will be automatically formatted into code, so no need for backticks.
-    validations:
-      required: true
-
-  - type: textarea
-    id: additional
-    attributes:
-      label: "Additional information"
-      description: Please add information like the used software versions, outputs of logs, OS information, screenshots, etc. to enhance the report
-      value: |
-        ...
-    validations:
-      required: false

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,16 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,55 +0,0 @@
----
-# reference: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests
-name: "Feature request"
-description: "Suggest an idea for this project."
-labels: [
-  "enhancement"
-]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Requesting a new feature or enhancement is following some simple rules:
-
-        - **Check**, if the feature is already requested
-        - **Describe** what your feature will bring to the community
-        - **Explain** the criteria to fulfill the request
-        - **Add** more details like mock ups, attachments, lists, screenshots
-        - **Follow Up** in the discussion to the feature
-
-  - type: textarea
-    id: description
-    attributes:
-      label: "Description"
-      description: Is your feature request related to a problem? Please describe.
-      placeholder: A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
-    validations:
-      required: true
-
-  - type: textarea
-    id: solution
-    attributes:
-      label: "Solution"
-      description: Describe the solution you'd like
-      placeholder: A clear and concise description of what you want to happen.
-    validations:
-      required: false
-
-  - type: textarea
-    id: alternatives
-    attributes:
-      label: "Alternatives"
-      description: Describe alternatives you've considered
-      placeholder: A clear and concise description of any alternative solutions or features you've considered.
-    validations:
-      required: false
-
-  - type: textarea
-    id: additional
-    attributes:
-      label: "Additional information"
-      description: Add any other context or screenshots about the feature request here.
-      value: |
-        ...
-    validations:
-      required: false

.github/dependabot.yml

@@ -0,0 +1,12 @@
+---
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "pip"  # See documentation for possible values
+    directory: "/"  # Location of package manifests
+    schedule:
+      interval: "daily"

.github/labeler.yml

@@ -1,30 +1,22 @@
 ---
 mysql_hardening:
-  - changed-files:
+  - 'roles/mysql_hardening/**'
-      - any-glob-to-any-file:
+  - 'molecule/mysql_hardening/**'
-          - roles/mysql_hardening/**
+  - '.github/workflows/mysql_hardening.yml'
-          - molecule/mysql_hardening/**
-          - .github/workflows/mysql_hardening.yml
 
 os_hardening:
-  - changed-files:
+  - 'roles/os_hardening/**'
-      - any-glob-to-any-file:
+  - 'molecule/os_hardening/**'
-          - roles/os_hardening/**
+  - '.github/workflows/os_hardening.yml'
-          - molecule/os_hardening/**
-          - .github/workflows/os_hardening.yml
 
 ssh_hardening:
-  - changed-files:
+  - 'roles/ssh_hardening/**'
-      - any-glob-to-any-file:
+  - 'molecule/ssh_hardening/**'
-          - roles/ssh_hardening/**
+  - 'molecule/ssh_hardening_custom_tests/**'
-          - molecule/ssh_hardening/**
+  - '.github/workflows/ssh_hardening.yml'
-          - molecule/ssh_hardening_custom_tests/**
+  - '.github/workflows/ssh_hardening_custom_tests.yml'
-          - .github/workflows/ssh_hardening.yml
-          - .github/workflows/ssh_hardening_custom_tests.yml
 
 nginx_hardening:
-  - changed-files:
+  - 'roles/nginx_hardening/**'
-      - any-glob-to-any-file:
+  - 'molecule/nginx_hardening/**'
-          - roles/nginx_hardening/**
+  - '.github/workflows/nginx_hardening.yml'
-          - molecule/nginx_hardening/**
-          - .github/workflows/nginx_hardening.yml

.github/version-drafter.yml

@@ -1,3 +0,0 @@
-major-labels: ['major']
-minor-labels: ['minor', 'enhancement']
-patch-labels: ['patch', 'bug']

.github/workflows/ansible-lint.yml

@@ -1,32 +1,58 @@
 ---
 name: Ansible Lint  # feel free to pick your own name
 
-on:  # yamllint disable-line rule:truthy
+on: [push, pull_request]   # yamllint disable-line rule:truthy
-  # Run CI against all pushes (direct commits, also merged PRs), Pull Requests
-  push:
-    branches: [master]
-    paths:
-      - 'roles/**'
-      - 'molecule/**'
-      - 'requirements.txt'
-      - '.github/workflows/ansible-lint.yml'
-      - '.config/ansible-lint.yml'
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [master]
-    paths:
-      - 'roles/**'
-      - 'molecule/**'
-      - 'requirements.txt'
-      - '.github/workflows/ansible-lint.yml'
-      - '.config/ansible-lint.yml'
 
 jobs:
   ansible-lint:
-    runs-on: ubuntu-22.04
+
+    runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      # Important: This sets up your GITHUB_WORKSPACE environment variable
+      - uses: actions/checkout@v3
 
       - name: Lint Ansible Playbook
-        uses: ansible/ansible-lint@8ba9595a4acd1b906eb75568b34f6ef592cd1528 # v26
+        # replace "master" with any valid ref
+        uses: ansible/ansible-lint-action@main
+        with:
+          # [required]
+          # Paths to ansible files (i.e., playbooks, tasks, handlers etc..)
+          # or valid Ansible directories according to the Ansible role
+          # directory structure.
+          # If you want to lint multiple ansible files, use the following syntax
+          # targets: |
+          #   playbook_1.yml
+          #   playbook_2.yml
+          targets: "roles/"
+          # [optional]
+          # Arguments to override a package and its version to be set explicitly.
+          # Must follow the example syntax.
+          # override-deps: |
+          #   ansible==2.9
+          #   ansible-lint==4.2.0
+          override-deps: |
+            rich>=9.5.1,<11.0.0
+          # [optional]
+          # Arguments to be passed to the ansible-lint
+
+          # Options:
+          #   -q                    quieter, although not silent output
+          #   -p                    parseable output in the format of pep8
+          #   --parseable-severity  parseable output including severity of rule
+          #   -r RULESDIR           specify one or more rules directories using one or
+          #                         more -r arguments. Any -r flags override the default
+          #                         rules in ansiblelint/rules, unless -R is also used.
+          #   -R                    Use default rules in ansiblelint/rules in addition to
+          #                         any extra
+          #                         rules directories specified with -r. There is no need
+          #                         to specify this if no -r flags are used
+          #   -t TAGS               only check rules whose id/tags match these values
+          #   -x SKIP_LIST          only check rules whose id/tags do not match these
+          #                         values
+          #   --nocolor             disable colored output
+          #   --exclude=EXCLUDE_PATHS
+          #                         path to directories or files to skip. This option is
+          #                         repeatable.
+          #   -c C                  Specify configuration file to use. Defaults to ".ansible-lint"
+          args: ""

.github/workflows/codespell.yml

@@ -1,14 +0,0 @@
----
-name: Codespell - Spellcheck
-
-on:  # yamllint disable-line rule:truthy
-  push:
-    branches: [master]
-  pull_request:
-    branches: [master]
-
-jobs:
-  codespell:
-    uses: "dev-sec/.github/.github/workflows/codespell.yml@37dc40b91a59d97d06824f16d11865baba5f07e1" # main
-    with:
-      ignore_words_list: "chage,BOOTUP"

.github/workflows/enforce-labels.yml

@@ -4,16 +4,10 @@ name: "Enforce PR labels"
 on:  # yamllint disable-line rule:truthy
   pull_request_target:
     types: [labeled, unlabeled, opened, edited, synchronize]
-
-permissions:
-  contents: read # to read configuration file
-  pull-requests: write # to label PRs
-
 jobs:
   enforce-label:
-    if: github.repository == 'dev-sec/ansible-collection-hardening'
+    runs-on: ubuntu-latest
-    runs-on: ubuntu-22.04
     steps:
-      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+      - uses: actions/labeler@main
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/galaxy.yml

@@ -4,37 +4,36 @@ name: Publish collection to Ansible Galaxy
 on:  # yamllint disable-line rule:truthy
   release:
     types:
-      - released
+      - published
 
 jobs:
   deploy:
-    if: github.repository == 'dev-sec/ansible-collection-hardening'
+    runs-on: ubuntu-latest
-    runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v3
 
       # deploy the collection first, because if it fails, we don't want
       # to update the galaxy.yml
       - name: Deploy the collection
-        uses: artis3n/ansible_galaxy_collection@ffbca2460a5a1c600b941bbf1536bd61de1c2227 # v3
+        uses: artis3n/ansible_galaxy_collection@v2
         with:
           api_key: ${{ secrets.GALAXY_API_KEY }}
           galaxy_version: ${{ github.event.release.tag_name }}
 
       # checkout master instead of the release-tag so we can push the galaxy.yml
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v3
         with:
           ref: master
 
       - name: update galaxy.yml with new version
-        uses: microsoft/variable-substitution@6287962da9e5b6e68778dc51e840caa03ca84495 # v1
+        uses: microsoft/variable-substitution@v1
         with:
           files: 'galaxy.yml'
         env:
           version: "${{ github.event.release.tag_name }}"
 
       - name: push galaxy.yml
-        uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
+        uses: github-actions-x/[email protected]
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           push-branch: 'master'

.github/workflows/mysql_hardening.yml

@@ -1,35 +1,20 @@
 ---
 name: "devsec.mysql_hardening"
-
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
-    branches: [master]
     paths:
       - 'roles/mysql_hardening/**'
       - 'molecule/mysql_hardening/**'
       - '.github/workflows/mysql_hardening.yml'
-      - 'requirements.txt'
   pull_request:
-    branches: [master]
     paths:
       - 'roles/mysql_hardening/**'
       - 'molecule/mysql_hardening/**'
       - '.github/workflows/mysql_hardening.yml'
-      - 'requirements.txt'
-  schedule:
-    - cron: '0 6 * * 0'
-
-concurrency:
-  group: >-
-    ${{ github.workflow }}-${{
-      github.event.pull_request.number || github.sha
-    }}
-  cancel-in-progress: true
-
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-18.04
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -37,47 +22,39 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
-          - almalinux8
+          - centos7
-          - almalinux9
-          # - almalinux10  # problem with baseline
-          - centosstream9
           - rocky8
-          - rocky9
+          - ubuntu1804
-          # - rocky10 # problem with baseline
           - ubuntu2004
-          - ubuntu2204
+          - debian9
-          - ubuntu2404
+          - debian10
-          - debian11
-          - debian12
-          - debian13
           # - amazon  # geerlingguy.mysql does not support fedora
-          # - arch  # geerlingguy.mysql does not support arch
+          # - arch  # needs to be fixed
-          - opensuse_tumbleweed
+          # - opensuse_tumbleweed  # needs to be fixed
           # - fedora  # geerlingguy.mysql does not support fedora
     steps:
       - name: Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python
+      - name: Set up Python 3.7
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@v1
         with:
-          python-version: 3.13
+          python-version: 3.7
-          cache: 'pip'
 
       - name: Install dependencies
-        run: pip install -r requirements.txt
+        run: |
+          sudo apt install git
+          python -m pip install --no-cache-dir --upgrade pip
+          pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
-      - name: Downgrade Ansible for Rocky 8 tests
+      - name: Create default collection path symlink
         run: |
-            pip install "ansible-core<2.17"
+          mkdir -p /home/runner/.ansible
-            ansible-galaxy collection install 'community.crypto:<3.0.0'
+          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
-            ansible-galaxy collection install 'community.general:<12.0.0'
-        working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
 
       # that was a hard one to fix. robert did it thankfully
       # https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212
@@ -89,19 +66,10 @@ jobs:
             sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld
         if: ${{ startsWith(matrix.molecule_distro, 'Debian') }}
 
-      # Molecule has problems detecting the proper location for installing roles
-      # https://github.com/ansible/molecule/issues/3806
-      # we do not set a custom role path, but the automatically determined install path used is not compatible with the location molecule expects the role
-      # see CI logs of this action "INFO     Set ANSIBLE_ROLES_PATH" should not be present, since we do not set a custom path
-      # we have to find a proper way to configure this
-      - name: Temporary fix for roles
-        run: |
-          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles \
-            /home/runner/.ansible/roles
-
       - name: Test with molecule
-        run: molecule test -s mysql_hardening
+        run: |
+          molecule --version
+          molecule test -s mysql_hardening
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
         working-directory: ansible_collections/devsec/hardening

.github/workflows/nginx_hardening.yml

@@ -3,32 +3,18 @@ name: "devsec.nginx_hardening"
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
-    branches: [master]
     paths:
       - 'roles/nginx_hardening/**'
       - 'molecule/nginx_hardening/**'
       - '.github/workflows/nginx_hardening.yml'
-      - 'requirements.txt'
   pull_request:
-    branches: [master]
     paths:
       - 'roles/nginx_hardening/**'
       - 'molecule/nginx_hardening/**'
       - '.github/workflows/nginx_hardening.yml'
-      - 'requirements.txt'
-  schedule:
-    - cron: '0 6 * * 1'
-
-concurrency:
-  group: >-
-    ${{ github.workflow }}-${{
-      github.event.pull_request.number || github.sha
-    }}
-  cancel-in-progress: true
-
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-18.04
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -36,61 +22,44 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
-          - almalinux8
+          - centos7
-          - almalinux9
-          - almalinux10
-          - centosstream9
           - rocky8
-          - rocky9
+          - ubuntu1804
-          - rocky10
           - ubuntu2004
-          - ubuntu2204
+          - debian9
-          - ubuntu2404
+          - debian10
-          - debian11
+          - amazon
-          - debian12
-          - debian13
-          - amazon2023
           # - arch  # needs to be fixed
           # - opensuse_tumbleweed  # needs to be fixed
           # - fedora  # no support from geerlingguy role
     steps:
       - name: Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python
+      - name: Set up Python 3.7
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@v1
         with:
-          python-version: 3.13
+          python-version: 3.7
-          cache: 'pip'
 
       - name: Install dependencies
-        run: pip install -r requirements.txt
-        working-directory: ansible_collections/devsec/hardening
-
-      - name: Downgrade Ansible for Rocky 8 tests
         run: |
-            pip install "ansible-core<2.17"
+          sudo apt install git
-            ansible-galaxy collection install 'community.crypto:<3.0.0'
+          python -m pip install --no-cache-dir --upgrade pip
-            ansible-galaxy collection install 'community.general:<12.0.0'
+          pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
 
-      # Molecule has problems detecting the proper location for installing roles
+      - name: Create default collection path symlink
-      # https://github.com/ansible/molecule/issues/3806
-      # we do not set a custom role path, but the automatically determined install path used is not compatible with the location molecule expects the role
-      # see CI logs of this action "INFO     Set ANSIBLE_ROLES_PATH" should not be present, since we do not set a custom path
-      # we have to find a proper way to configure this
-      - name: Temporary fix for roles
         run: |
           mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles \
+          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
-            /home/runner/.ansible/roles
 
       - name: Test with molecule
-        run: molecule test -s nginx_hardening
+        run: |
+          molecule --version
+          molecule test -s nginx_hardening
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
         working-directory: ansible_collections/devsec/hardening

.github/workflows/os_hardening.yml

@@ -3,89 +3,65 @@ name: "devsec.os_hardening"
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
-    branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening/**'
       - '.github/workflows/os_hardening.yml'
-      - 'requirements.txt'
   pull_request:
-    branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening/**'
       - '.github/workflows/os_hardening.yml'
-      - 'requirements.txt'
-  schedule:
-    - cron: '0 6 * * 3'
-
-concurrency:
-  group: >-
-    ${{ github.workflow }}-${{
-      github.event.pull_request.number || github.sha
-    }}
-  cancel-in-progress: true
-
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-18.04
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - molecule_distro: opensuse_tumbleweed
-            molecule_docker_command: "/usr/lib/systemd/systemd"
         molecule_distro:
-          - almalinux8
+          - centos7
-          - almalinux9
-          - almalinux10
-          - centosstream9
           - rocky8
-          - rocky9
+          - ubuntu1804
-          - rocky10
-          - fedora39
-          - fedora40
           - ubuntu2004
-          - ubuntu2204
+          - debian9
-          - ubuntu2404
+          - debian10
-          - debian11
+          - amazon
-          - debian12
+          - opensuse_tumbleweed
-          - debian13
+          # - arch  # needs to be fixed
-          - amazon2023
-          - arch
-        molecule_docker_command:
-          - "/lib/systemd/systemd"
     steps:
       - name: Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python
+      - name: Set up Python 3.7
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@v1
         with:
-          python-version: 3.13
+          python-version: 3.7
-          cache: 'pip'
 
       - name: Install dependencies
-        run: pip install -r requirements.txt
+        run: |
+          sudo apt install git
+          python -m pip install --no-cache-dir --upgrade pip
+          pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
-      - name: Downgrade Ansible for Rocky 8 tests
+      - name: Create default collection path symlink
         run: |
-            pip install "ansible-core<2.17"
+          mkdir -p /home/runner/.ansible
-            ansible-galaxy collection install 'community.crypto:<3.0.0'
+          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
-            ansible-galaxy collection install 'community.general:<12.0.0'
-        working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
 
       - name: Test with molecule
-        run: molecule test -s os_hardening
+        run: |
+          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
+            export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
+          fi
+          molecule --version
+          molecule test -s os_hardening
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
-          MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
         working-directory: ansible_collections/devsec/hardening

.github/workflows/os_hardening_vm.yml

@@ -3,31 +3,15 @@ name: "devsec.os_hardening VM"
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
-    branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening_vm/**'
       - '.github/workflows/os_hardening_vm.yml'
-      - 'requirements.txt'
-      - 'requirements-vm.txt'
   pull_request:
-    branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening_vm/**'
       - '.github/workflows/os_hardening_vm.yml'
-      - 'requirements.txt'
-      - 'requirements-vm.txt'
-  schedule:
-    - cron: '0 6 * * 2'
-
-concurrency:
-  group: >-
-    ${{ github.workflow }}-${{
-      github.event.pull_request.number || github.sha
-    }}
-  cancel-in-progress: true
-
 jobs:
   build:
     runs-on: self-hosted
@@ -38,57 +22,29 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
-          - almalinux/8
+          - centos7
-          - almalinux/9
+          - rocky8
-          # - almalinux/10  # boot loop
+          - ubuntu1804
-          - generic/centos9s
+          - ubuntu2004
-          - generic/rocky8
+          - debian9
-          - generic/rocky9
+          - debian10
-          - fedora/39-cloud-base
+          # - opensuse42  # opensuse currently cannot get an ip address
-          - fedora/40-cloud-base
+          # - arch  - arch is currently not supported by cinc-auditor
-          - generic/ubuntu2004
-          - generic/ubuntu2204
-          - alvistack/ubuntu-24.04
-          - generic/debian11
-          - generic/debian12
-          - generic/opensuse15
-          - generic/arch
     steps:
       - name: Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Install dependencies
+      - name: Create default collection path symlink
         run: |
-          source ~/.venv/ansible-collection-hardening/bin/activate
+          mkdir -p /home/runner/.ansible
-          python -m pip install --no-cache-dir --upgrade pip
+          ln -fs /opt/actions-runner/_work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections /home/runner/.ansible/collections
-          pip install -r requirements.txt
-          pip install -r requirements-vm.txt
-        working-directory: ansible_collections/devsec/hardening
-
-      - name: Downgrade Ansible for Rocky 8 tests
-        run: |
-          source ~/.venv/ansible-collection-hardening/bin/activate
-          pip install "ansible-core<2.17"
-          ansible-galaxy collection install 'community.crypto:<3.0.0'
-          ansible-galaxy collection install 'community.general:<12.0.0'
-        working-directory: ansible_collections/devsec/hardening
-        if: >
-          matrix.molecule_distro == 'generic/rocky8' ||
-          matrix.molecule_distro == 'almalinux/8' ||
-          matrix.molecule_distro == 'generic/opensuse15'
-
-      - name: Update Vagrant Box
-        run: |
-          vagrant box update --box ${{ matrix.molecule_distro }} || true
 
       - name: Test with molecule
         run: |
-          source ~/.venv/ansible-collection-hardening/bin/activate
+          molecule --version
-          # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
-          export MOLECULE_VAGRANT_PLUGIN_DIR=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')/molecule_plugins/vagrant
           molecule test -s os_hardening_vm
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}

.github/workflows/prettier-md.yml

@@ -4,23 +4,21 @@ name: Prettier markdown files
 
 on:  # yamllint disable-line rule:truthy
   push:
-    branches: [master]
     paths:
       - '**.md'
 
 jobs:
   prettier-md:
-    if: github.repository == 'dev-sec/ansible-collection-hardening'
+    runs-on: ubuntu-latest
-    runs-on: ubuntu-22.04
     timeout-minutes: 1
 
     steps:
       - name: Git checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v3
         with:
           ref: ${{ github.head_ref }}
 
       - name: Prettify code
-        uses: creyD/prettier_action@8c18391fdc98ed0d884c6345f03975edac71b8f0 # v4.6
+        uses: creyD/prettier_action@v3.1
         with:
           prettier_options: --write {**/*,*}.md

.github/workflows/release.yml

@@ -9,40 +9,39 @@ on:  # yamllint disable-line rule:truthy
 
 jobs:
   generate_changelog:
+    runs-on: ubuntu-latest
     name: create release draft
-    if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v3
         with:
           fetch-depth: 0
           ref: master
 
       - name: 'Get Previous tag'
         id: previoustag
-        uses: "WyriHaximus/github-action-get-previous-tag@61819f33034117e6c686e6a31dba995a85afc9de" # master
+        uses: "WyriHaximus/github-action-get-previous-tag@master"
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
 
       - name: calculate next version
         id: version
-        uses: patrickjahns/version-drafter-action@2076fa43abb28f31d0e8b0890253fbd1d1a966fc # v1
+        uses: patrickjahns/version-drafter-action@v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Generate changelog
-        uses: charmixer/auto-changelog-action@b25e89c9410e03189f0d48b02b3a8caad6e78015 # v1
+        uses: charmixer/auto-changelog-action@v1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           future_release: ${{ steps.version.outputs.next-version }}
           # this excludes all versions prior to the collection-release
           # since they break the changelog generation with the error:
           # "No common ancestor between ... and $version"
-          exclude_tags_regex: '^[0-6]\.\d\.\d'
+          exclude_tags_regex: '[0-6]\.\d\.\d'
           issue_line_labels: mysql_hardening,os_hardening,ssh_hardening,nginx_hardening
 
       - name: push changelog
-        uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
+        uses: github-actions-x/[email protected]
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           push-branch: 'master'
@@ -58,18 +57,18 @@ jobs:
 
       - name: Read CHANGELOG.md
         id: package
-        uses: juliangruber/read-file-action@271ff311a4947af354c6abcd696a306553b9ec18 # v1
+        uses: juliangruber/read-file-action@v1
         with:
           path: ./CHANGELOGRELEASE.md
 
       - name: Delete old drafts
-        uses: hugo19941994/delete-draft-releases@3f19a25abf2ce87850c2268938f98f14e4d3d1f1 # v3.0.0
+        uses: hugo19941994/delete-draft-releases@v1.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Create Release draft
         id: create_release
-        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1
+        uses: actions/create-release@v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # This token is provided by Actions, you do not need to create your own token
         with:

.github/workflows/roles-readme.yml

@@ -1,56 +0,0 @@
----
-name: create roles readme
-
-on:  # yamllint disable-line rule:truthy
-  push:
-    branches: [master]
-    paths:
-      - 'roles/**/meta/argument_specs.yml'
-      - 'roles/**/meta/main.yml'
-  pull_request:
-    branches: [master]
-    paths:
-      - 'roles/**/meta/argument_specs.yml'
-      - 'roles/**/meta/main.yml'
-      - 'requirements.txt'
-
-jobs:
-  readme:
-    name: create roles readme
-    runs-on: ubuntu-22.04
-    strategy:
-      matrix:
-        roles:
-          - mysql_hardening
-          - nginx_hardening
-          - os_hardening
-          - ssh_hardening
-    steps:
-      - name: Check out code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
-        with:
-          python-version: 3.13
-          cache: 'pip'
-
-      - name: Install dependencies
-        run: pip install -r requirements.txt
-
-      - name: Run aar-doc
-        run: aar-doc roles/${{ matrix.roles }} markdown
-
-      - name: Output diff
-        run: git diff roles/${{ matrix.roles }}/README.md
-
-      - name: Push README
-        if: github.event_name != 'pull_request'
-        uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: 'update ${{ matrix.roles }} readme'
-          files: roles/${{ matrix.roles }}/README.md
-          rebase: true
-          name: dev-sec CI
-          email: [email protected]

.github/workflows/ssh_hardening.yml

@@ -3,92 +3,66 @@ name: "devsec.ssh_hardening"
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
-    branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening/**'
       - '.github/workflows/ssh_hardening.yml'
-      - 'requirements.txt'
   pull_request:
-    branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening/**'
       - '.github/workflows/ssh_hardening.yml'
-      - 'requirements.txt'
-  schedule:
-    - cron: '0 6 * * 5'
-
-concurrency:
-  group: >-
-    ${{ github.workflow }}-${{
-      github.event.pull_request.number || github.sha
-    }}
-  cancel-in-progress: true
-
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-18.04
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
     strategy:
       fail-fast: false
       matrix:
-        include:
-          # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
-          # - molecule_distro: opensuse_tumbleweed
-          #   molecule_docker_command: "/usr/lib/systemd/systemd"
-          - molecule_distro: alpine
-            molecule_docker_command: "/sbin/init"
         molecule_distro:
-          - almalinux8
+          - centos7
-          - almalinux9
-          - almalinux10
-          - centosstream9
           - rocky8
-          - rocky9
+          - fedora
-          - rocky10
+          - ubuntu1804
-          - fedora39
-          - fedora40
           - ubuntu2004
-          - ubuntu2204
+          - debian9
-          - ubuntu2404
+          - debian10
-          - debian11
+          - amazon
-          - debian12
+          # - arch  # needs to be fixed
-          - debian13
+          # - opensuse_tumbleweed  # baseline is not compatible with suse
-          - amazon2023
-          - arch
-        molecule_docker_command:
-          - "/lib/systemd/systemd"
     steps:
       - name: Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python
+      - name: Set up Python 3.7
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@v1
         with:
-          python-version: 3.13
+          python-version: 3.7
-          cache: 'pip'
 
       - name: Install dependencies
-        run: pip install -r requirements.txt
+        run: |
+          sudo apt install git
+          python -m pip install --no-cache-dir --upgrade pip
+          pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
-      - name: Downgrade Ansible for Rocky 8 tests
+      - name: Create default collection path symlink
         run: |
-            pip install "ansible-core<2.17"
+          mkdir -p /home/runner/.ansible
-            ansible-galaxy collection install 'community.crypto:<3.0.0'
+          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
-            ansible-galaxy collection install 'community.general:<12.0.0'
-        working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
 
       - name: Test with molecule
-        run: molecule test -s ssh_hardening
+        run: |
+          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
+            export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
+          fi
+          molecule --version
+          molecule test -s ssh_hardening
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
-          MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
         working-directory: ansible_collections/devsec/hardening

.github/workflows/ssh_hardening_custom_tests.yml

@@ -3,92 +3,66 @@ name: "devsec.ssh_hardening with custom tests"
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
-    branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening_custom_tests/**'
       - '.github/workflows/ssh_hardening_custom_tests.yml'
-      - 'requirements.txt'
   pull_request:
-    branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening_custom_tests/**'
       - '.github/workflows/ssh_hardening_custom_tests.yml'
-      - 'requirements.txt'
-  schedule:
-    - cron: '0 6 * * 4'
-
-concurrency:
-  group: >-
-    ${{ github.workflow }}-${{
-      github.event.pull_request.number || github.sha
-    }}
-  cancel-in-progress: true
-
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-18.04
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
     strategy:
       fail-fast: false
       matrix:
-        include:
-          # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
-          # - molecule_distro: opensuse_tumbleweed
-          #   molecule_docker_command: "/usr/lib/systemd/systemd"
-          - molecule_distro: alpine
-            molecule_docker_command: "/sbin/init"
         molecule_distro:
-          - almalinux8
+          - centos7
-          - almalinux9
-          - almalinux10
-          - centosstream9
           - rocky8
-          - rocky9
+          - fedora
-          - rocky10
+          - ubuntu1804
-          - fedora39
-          - fedora40
           - ubuntu2004
-          - ubuntu2204
+          - debian9
-          - ubuntu2404
+          - debian10
-          - debian11
+          - amazon
-          - debian12
+          # - arch  # needs to be fixed
-          - debian13
+          # - opensuse_tumbleweed  # baseline is not compatible with suse
-          - amazon2023
-          - arch
-        molecule_docker_command:
-          - "/lib/systemd/systemd"
     steps:
       - name: Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python
+      - name: Set up Python 3.7
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@v1
         with:
-          python-version: 3.13
+          python-version: 3.7
-          cache: 'pip'
 
       - name: Install dependencies
-        run: pip install -r requirements.txt
+        run: |
+          sudo apt install git
+          python -m pip install --no-cache-dir --upgrade pip
+          pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
-      - name: Downgrade Ansible for Rocky 8 tests
+      - name: Create default collection path symlink
         run: |
-            pip install "ansible-core<2.17"
+          mkdir -p /home/runner/.ansible
-            ansible-galaxy collection install 'community.crypto:<3.0.0'
+          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
-            ansible-galaxy collection install 'community.general:<12.0.0'
-        working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
 
       - name: Test with molecule
-        run: molecule test -s ssh_hardening_custom_tests
+        run: |
+          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
+            export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
+          fi
+          molecule --version
+          molecule converge -s ssh_hardening_custom_tests
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
-          MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
         working-directory: ansible_collections/devsec/hardening

.github/workflows/ssh_hardening_vm.yml

@@ -1,73 +0,0 @@
----
-name: "devsec.ssh_hardening VM"
-on:  # yamllint disable-line rule:truthy
-  workflow_dispatch:
-  push:
-    branches: [master]
-    paths:
-      - 'roles/ssh_hardening/**'
-      - 'molecule/ssh_hardening_vm/**'
-      - '.github/workflows/ssh_hardening_vm.yml'
-      - 'requirements.txt'
-      - 'requirements-vm.txt'
-  pull_request:
-    branches: [master]
-    paths:
-      - 'roles/ssh_hardening/**'
-      - 'molecule/ssh_hardening_vm/**'
-      - '.github/workflows/ssh_hardening_vm.yml'
-      - 'requirements.txt'
-      - 'requirements-vm.txt'
-  schedule:
-    - cron: '0 6 * * 5'
-
-concurrency:
-  group: >-
-    ${{ github.workflow }}-${{
-      github.event.pull_request.number || github.sha
-    }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    runs-on: self-hosted
-    env:
-      PY_COLORS: 1
-      ANSIBLE_FORCE_COLOR: 1
-    strategy:
-      fail-fast: false
-      matrix:
-        molecule_distro:
-          - generic/openbsd7
-          - generic/freebsd13
-          - generic/freebsd14
-          - cloud-image/debian-13
-          - cloud-image/ubuntu-24.04
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          path: ansible_collections/devsec/hardening
-          submodules: true
-
-      - name: Install dependencies
-        run: |
-          source ~/.venv/ansible-collection-hardening/bin/activate
-          python -m pip install --no-cache-dir --upgrade pip
-          pip install -r requirements.txt
-          pip install -r requirements-vm.txt
-        working-directory: ansible_collections/devsec/hardening
-
-      - name: Update Vagrant Box
-        run: |
-          vagrant box update --box ${{ matrix.molecule_distro }} || true
-
-      - name: Test with molecule
-        run: |
-          source ~/.venv/ansible-collection-hardening/bin/activate
-          # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
-          export MOLECULE_VAGRANT_PLUGIN_DIR=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')/molecule_plugins/vagrant
-          molecule test -s ssh_hardening_vm
-        env:
-          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
-        working-directory: ansible_collections/devsec/hardening

.gitignore

@@ -1,4 +1,3 @@
 .kitchen
 hosts
 Gemfile.lock
-.venv

.yamllint

@@ -0,0 +1,26 @@
+---
+# Based on ansible-lint config
+extends: default
+
+rules:
+  braces:
+    max-spaces-inside: 1
+    level: error
+  brackets:
+    max-spaces-inside: 1
+    level: error
+  colons:
+    max-spaces-after: -1
+    level: error
+  commas:
+    max-spaces-after: -1
+    level: error
+  empty-lines:
+    max: 3
+    level: error
+  hyphens:
+    level: error
+  key-duplicates: enable
+  line-length: disable
+  new-lines:
+    type: unix

CHANGELOG.md

@@ -1,606 +1,5 @@
 # Changelog
 
-## [10.5.2](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.2) (2026-03-28)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.1...10.5.2)
-
-**Fixed bugs:**
-
-- do not update apt cache when installing libpam-passwdqc [\#939](https://github.com/dev-sec/ansible-collection-hardening/pull/939) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([eikesauer](https://github.com/eikesauer))
-
-**Merged pull requests:**
-
-- chore\(deps\): update hugo19941994/delete-draft-releases action to v3 [\#940](https://github.com/dev-sec/ansible-collection-hardening/pull/940) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): pin dependencies [\#938](https://github.com/dev-sec/ansible-collection-hardening/pull/938) ([renovate[bot]](https://github.com/apps/renovate))
-
-## [10.5.1](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.1) (2026-03-20)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.0...10.5.1)
-
-**Fixed bugs:**
-
-- fix flaky failures on Ubuntu 24.04 and newer by disabling sshd socket activation first [\#931](https://github.com/dev-sec/ansible-collection-hardening/pull/931) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([kuglimon](https://github.com/kuglimon))
-
-**Closed issues:**
-
-- SSH issue after running devsec.hardening.ssh\_hardening role [\#854](https://github.com/dev-sec/ansible-collection-hardening/issues/854)
-
-**Merged pull requests:**
-
-- chore\(deps\): update juliangruber/read-file-action digest to 271ff31 [\#937](https://github.com/dev-sec/ansible-collection-hardening/pull/937) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 8ba9595 [\#934](https://github.com/dev-sec/ansible-collection-hardening/pull/934) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update artis3n/ansible\_galaxy\_collection action to v3 [\#933](https://github.com/dev-sec/ansible-collection-hardening/pull/933) ([renovate[bot]](https://github.com/apps/renovate))
-- Improve VM based testing of SSH hardening [\#878](https://github.com/dev-sec/ansible-collection-hardening/pull/878) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
-
-## [10.5.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.0) (2026-01-22)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.4.0...10.5.0)
-
-**Implemented enhancements:**
-
-- fix: replace deprecated community.general.yaml callback plugin [\#918](https://github.com/dev-sec/ansible-collection-hardening/pull/918) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([Normo](https://github.com/Normo))
-- Consistently access facts via the ansible\_facts.\* namespace [\#917](https://github.com/dev-sec/ansible-collection-hardening/pull/917) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([Normo](https://github.com/Normo))
-- disable systemd audit logging [\#902](https://github.com/dev-sec/ansible-collection-hardening/pull/902) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([z-bsod](https://github.com/z-bsod))
-
-**Fixed bugs:**
-
-- /etc/sysctl.conf is no longer honored in Debian 13 [\#905](https://github.com/dev-sec/ansible-collection-hardening/issues/905)
-
-**Merged pull requests:**
-
-- chore\(deps\): update dependency jmespath to v1.1.0 [\#930](https://github.com/dev-sec/ansible-collection-hardening/pull/930) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/setup-python digest to a309ff8 [\#929](https://github.com/dev-sec/ansible-collection-hardening/pull/929) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint action to v26 [\#928](https://github.com/dev-sec/ansible-collection-hardening/pull/928) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update artis3n/ansible\_galaxy\_collection digest to 415a92b - autoclosed [\#927](https://github.com/dev-sec/ansible-collection-hardening/pull/927) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to a2bc8b8 [\#924](https://github.com/dev-sec/ansible-collection-hardening/pull/924) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/setup-python digest to 83679a8 [\#920](https://github.com/dev-sec/ansible-collection-hardening/pull/920) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/checkout action to v6 [\#919](https://github.com/dev-sec/ansible-collection-hardening/pull/919) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency molecule to v25.12.0 [\#914](https://github.com/dev-sec/ansible-collection-hardening/pull/914) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 40f24c2 [\#913](https://github.com/dev-sec/ansible-collection-hardening/pull/913) ([renovate[bot]](https://github.com/apps/renovate))
-- Update test environments to current Ansible version [\#909](https://github.com/dev-sec/ansible-collection-hardening/pull/909) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([schurzi](https://github.com/schurzi))
-- chore\(deps\): update ansible/ansible-lint digest to d7cd7cf [\#903](https://github.com/dev-sec/ansible-collection-hardening/pull/903) ([renovate[bot]](https://github.com/apps/renovate))
-
-## [10.4.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.4.0) (2025-10-22)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.3.1...10.4.0)
-
-**Implemented enhancements:**
-
-- Support Debian 13 [\#891](https://github.com/dev-sec/ansible-collection-hardening/issues/891)
-- Support EL10 [\#870](https://github.com/dev-sec/ansible-collection-hardening/issues/870)
-- Add support for current versions of Debian and EL [\#893](https://github.com/dev-sec/ansible-collection-hardening/pull/893) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- Add SSH config for EL/AlmaLinux 10 [\#888](https://github.com/dev-sec/ansible-collection-hardening/pull/888) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([jonathanspw](https://github.com/jonathanspw))
-
-**Fixed bugs:**
-
-- Write sysctl config to separate file [\#907](https://github.com/dev-sec/ansible-collection-hardening/pull/907) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-
-**Closed issues:**
-
-- sysctl-34 - fs.protected\_regular not set [\#536](https://github.com/dev-sec/ansible-collection-hardening/issues/536)
-
-**Merged pull requests:**
-
-- Update ArchLinux test environment before testing [\#908](https://github.com/dev-sec/ansible-collection-hardening/pull/908) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-- chore\(deps\): update actions/setup-python action to v6 [\#901](https://github.com/dev-sec/ansible-collection-hardening/pull/901) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/labeler action to v6 [\#900](https://github.com/dev-sec/ansible-collection-hardening/pull/900) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 8861a73 [\#899](https://github.com/dev-sec/ansible-collection-hardening/pull/899) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/checkout action to v5 [\#895](https://github.com/dev-sec/ansible-collection-hardening/pull/895) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency python to 3.13 [\#892](https://github.com/dev-sec/ansible-collection-hardening/pull/892) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency aar-doc to v2.3.0 [\#890](https://github.com/dev-sec/ansible-collection-hardening/pull/890) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 9765b87 [\#889](https://github.com/dev-sec/ansible-collection-hardening/pull/889) ([renovate[bot]](https://github.com/apps/renovate))
-- Improve OS support accuracy [\#887](https://github.com/dev-sec/ansible-collection-hardening/pull/887) ([jonathanspw](https://github.com/jonathanspw))
-- chore\(deps\): update hugo19941994/delete-draft-releases action to v2 [\#885](https://github.com/dev-sec/ansible-collection-hardening/pull/885) ([renovate[bot]](https://github.com/apps/renovate))
-
-## [10.3.1](https://github.com/dev-sec/ansible-collection-hardening/tree/10.3.1) (2025-07-24)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.3.0...10.3.1)
-
-**Fixed bugs:**
-
-- Readme states Ansible \>= 2.9.10, but it uses password\_expire\_warn from  2.16 [\#871](https://github.com/dev-sec/ansible-collection-hardening/issues/871)
-
-**Merged pull requests:**
-
-- Use fixed test env for BSD VMs [\#884](https://github.com/dev-sec/ansible-collection-hardening/pull/884) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
-- Downgrade community.crypto for rocky8 [\#882](https://github.com/dev-sec/ansible-collection-hardening/pull/882) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- chore\(deps\): update dependency aar-doc to v2.2.0 [\#877](https://github.com/dev-sec/ansible-collection-hardening/pull/877) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update creyd/prettier\_action action to v4.6 [\#876](https://github.com/dev-sec/ansible-collection-hardening/pull/876) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 06f616d [\#873](https://github.com/dev-sec/ansible-collection-hardening/pull/873) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency ansible-core to v2.18.6 [\#872](https://github.com/dev-sec/ansible-collection-hardening/pull/872) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update creyd/prettier\_action action to v4.5 [\#869](https://github.com/dev-sec/ansible-collection-hardening/pull/869) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(ssh\_hardening\): ansible 2.19 compatibility [\#868](https://github.com/dev-sec/ansible-collection-hardening/pull/868) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
-- chore\(deps\): update ansible/ansible-lint digest to e98f9b3 [\#867](https://github.com/dev-sec/ansible-collection-hardening/pull/867) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/setup-python digest to a26af69 [\#866](https://github.com/dev-sec/ansible-collection-hardening/pull/866) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency ansible-core to v2.18.5 [\#865](https://github.com/dev-sec/ansible-collection-hardening/pull/865) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to c16f018 [\#863](https://github.com/dev-sec/ansible-collection-hardening/pull/863) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 6a4fcdb [\#862](https://github.com/dev-sec/ansible-collection-hardening/pull/862) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency aar-doc to v2.1.0 [\#861](https://github.com/dev-sec/ansible-collection-hardening/pull/861) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency ansible-core to v2.18.4 [\#860](https://github.com/dev-sec/ansible-collection-hardening/pull/860) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/setup-python digest to 8d9ed9a [\#859](https://github.com/dev-sec/ansible-collection-hardening/pull/859) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- Fix: ForwardAgent j2 template space  [\#856](https://github.com/dev-sec/ansible-collection-hardening/pull/856) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([cod3mas0n](https://github.com/cod3mas0n))
-- chore\(deps\): update artis3n/ansible\_galaxy\_collection digest to f6110ae [\#853](https://github.com/dev-sec/ansible-collection-hardening/pull/853) ([renovate[bot]](https://github.com/apps/renovate))
-
-## [10.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.3.0) (2025-02-25)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.2.0...10.3.0)
-
-**Implemented enhancements:**
-
-- Password expiry for users without password should not block SSH key based login [\#681](https://github.com/dev-sec/ansible-collection-hardening/issues/681)
-- Set number of warning days before password expires for existing users [\#839](https://github.com/dev-sec/ansible-collection-hardening/pull/839) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Normo](https://github.com/Normo))
-- Allow to override settings for sftponly users [\#794](https://github.com/dev-sec/ansible-collection-hardening/pull/794) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([mib1185](https://github.com/mib1185))
-
-**Closed issues:**
-
-- os\_hardening & sysctl\_overwrite with host\_vars [\#837](https://github.com/dev-sec/ansible-collection-hardening/issues/837)
-
-**Merged pull requests:**
-
-- chore\(deps\): update dependency ansible-core to v2.18.3 [\#852](https://github.com/dev-sec/ansible-collection-hardening/pull/852) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 49ded6a [\#851](https://github.com/dev-sec/ansible-collection-hardening/pull/851) ([renovate[bot]](https://github.com/apps/renovate))
-- Pin runner image to specific version to decouple from GitHub updates [\#847](https://github.com/dev-sec/ansible-collection-hardening/pull/847) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- Refactor: combine multiple set\_fact into single jinja filter [\#846](https://github.com/dev-sec/ansible-collection-hardening/pull/846) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Tinyblargon](https://github.com/Tinyblargon))
-- chore\(deps\): update actions/setup-python digest to 4237552 [\#844](https://github.com/dev-sec/ansible-collection-hardening/pull/844) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency ansible-core to v2.18.2 [\#843](https://github.com/dev-sec/ansible-collection-hardening/pull/843) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency molecule to v25 [\#841](https://github.com/dev-sec/ansible-collection-hardening/pull/841) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint action to v25 [\#840](https://github.com/dev-sec/ansible-collection-hardening/pull/840) ([renovate[bot]](https://github.com/apps/renovate))
-
-## [10.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.2.0) (2024-12-23)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.1.0...10.2.0)
-
-**Implemented enhancements:**
-
-- Re-enable OpenBSD tests [\#826](https://github.com/dev-sec/ansible-collection-hardening/issues/826) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
-- Allow configuring the name\_format variable in auditd config [\#796](https://github.com/dev-sec/ansible-collection-hardening/issues/796) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
-- Modify PAM to allow SSH key based logins with locked passwords [\#835](https://github.com/dev-sec/ansible-collection-hardening/pull/835) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-- adding switch for ForwardAgent in ssh\_config [\#818](https://github.com/dev-sec/ansible-collection-hardening/pull/818) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Shizzlebix](https://github.com/Shizzlebix))
-
-**Fixed bugs:**
-
-- File system loop detected; ‘/bin/X11’ is part of the same file system loop as ‘/bin’." [\#815](https://github.com/dev-sec/ansible-collection-hardening/issues/815) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
-- Not working ssh\_hardening on Centos 7  [\#813](https://github.com/dev-sec/ansible-collection-hardening/issues/813) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
-
-**Merged pull requests:**
-
-- chore\(deps\): update dependency molecule-plugins to v23.6.0 [\#834](https://github.com/dev-sec/ansible-collection-hardening/pull/834) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 4ce8e49 [\#832](https://github.com/dev-sec/ansible-collection-hardening/pull/832) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency molecule to v24.12.0 [\#831](https://github.com/dev-sec/ansible-collection-hardening/pull/831) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency ansible-core to v2.18.1 [\#829](https://github.com/dev-sec/ansible-collection-hardening/pull/829) ([renovate[bot]](https://github.com/apps/renovate))
-- Change installation source for OpenBSD tests [\#828](https://github.com/dev-sec/ansible-collection-hardening/pull/828) ([schurzi](https://github.com/schurzi))
-- chore\(deps\): update ansible/ansible-lint digest to 44be233 [\#825](https://github.com/dev-sec/ansible-collection-hardening/pull/825) ([renovate[bot]](https://github.com/apps/renovate))
-- Bump ansible-core from 2.17.5 to 2.17.6 [\#820](https://github.com/dev-sec/ansible-collection-hardening/pull/820) ([dependabot[bot]](https://github.com/apps/dependabot))
-- chore\(deps\): update dependency ansible-core to v2.18.0 [\#819](https://github.com/dev-sec/ansible-collection-hardening/pull/819) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency aar-doc to v2.0.1 [\#817](https://github.com/dev-sec/ansible-collection-hardening/pull/817) ([renovate[bot]](https://github.com/apps/renovate))
-- Update actions/setup-python digest to 0b93645 [\#814](https://github.com/dev-sec/ansible-collection-hardening/pull/814) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/checkout digest to 11bd719 [\#812](https://github.com/dev-sec/ansible-collection-hardening/pull/812) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-
-## [10.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.1.0) (2024-10-22)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.0.0...10.1.0)
-
-**Implemented enhancements:**
-
-- Ubuntu 24.04 support [\#764](https://github.com/dev-sec/ansible-collection-hardening/issues/764)
-- Add variable to set name\_format for auditd [\#810](https://github.com/dev-sec/ansible-collection-hardening/pull/810) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-- feat\(ssh\): add alpine support [\#809](https://github.com/dev-sec/ansible-collection-hardening/pull/809) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- Provide granular noop for ssh configuration [\#789](https://github.com/dev-sec/ansible-collection-hardening/pull/789) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([seven-beep](https://github.com/seven-beep))
-
-**Fixed bugs:**
-
-- molecule scenario ssh\_hardening if failing due to missing docker image [\#790](https://github.com/dev-sec/ansible-collection-hardening/issues/790)
-- getent\_shadow empty [\#787](https://github.com/dev-sec/ansible-collection-hardening/issues/787)
-- Error: Missing privilege separation directory: /run/sshd [\#752](https://github.com/dev-sec/ansible-collection-hardening/issues/752)
-- fix\(ssh\_hardening\): test setting kex to false, remove wrong default [\#808](https://github.com/dev-sec/ansible-collection-hardening/pull/808) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-
-**Merged pull requests:**
-
-- Pin python dependencies and optimize GitHub Actions [\#811](https://github.com/dev-sec/ansible-collection-hardening/pull/811) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- fix\(cicd\): test idempotence on ssh custom tests [\#807](https://github.com/dev-sec/ansible-collection-hardening/pull/807) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- Document correct quotes for ssh\_permit\_tunnel parameter [\#806](https://github.com/dev-sec/ansible-collection-hardening/pull/806) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([vmpr](https://github.com/vmpr))
-- fix\(docs\): add 'become: true' to example playbooks. fix \#787 [\#804](https://github.com/dev-sec/ansible-collection-hardening/pull/804) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- chore\(deps\): update dependency ansible-core to v2.17.5 [\#802](https://github.com/dev-sec/ansible-collection-hardening/pull/802) ([renovate[bot]](https://github.com/apps/renovate))
-- Don't run tests if the environment is not correct [\#801](https://github.com/dev-sec/ansible-collection-hardening/pull/801) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- chore\(deps\): update actions/checkout digest to eef6144 [\#800](https://github.com/dev-sec/ansible-collection-hardening/pull/800) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- feat: Corrected package name [\#799](https://github.com/dev-sec/ansible-collection-hardening/pull/799) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([PapaPeskwo](https://github.com/PapaPeskwo))
-- Use Python venv for VM tests [\#798](https://github.com/dev-sec/ansible-collection-hardening/pull/798) ([schurzi](https://github.com/schurzi))
-- Remove unused files and variables [\#797](https://github.com/dev-sec/ansible-collection-hardening/pull/797) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-- chore\(deps\): update ansible/ansible-lint digest to 3b5bee1 [\#795](https://github.com/dev-sec/ansible-collection-hardening/pull/795) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 25f783c [\#792](https://github.com/dev-sec/ansible-collection-hardening/pull/792) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency ansible-core to v2.17.4 [\#791](https://github.com/dev-sec/ansible-collection-hardening/pull/791) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/setup-python digest to f677139 [\#788](https://github.com/dev-sec/ansible-collection-hardening/pull/788) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency ansible-core to v2.17.3 [\#786](https://github.com/dev-sec/ansible-collection-hardening/pull/786) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency ansible-core to v2.17.2 [\#756](https://github.com/dev-sec/ansible-collection-hardening/pull/756) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-
-## [10.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.0.0) (2024-08-06)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/9.0.1...10.0.0)
-
-**Implemented enhancements:**
-
-- option to disable regeneration of ssh private key [\#772](https://github.com/dev-sec/ansible-collection-hardening/issues/772)
-- Support systemd socket activation for sshd [\#763](https://github.com/dev-sec/ansible-collection-hardening/issues/763) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
-- Release 9.0.2 [\#758](https://github.com/dev-sec/ansible-collection-hardening/issues/758)
-- Make Publickey authentication configurable  [\#750](https://github.com/dev-sec/ansible-collection-hardening/issues/750)
-- Ansible Linting [\#747](https://github.com/dev-sec/ansible-collection-hardening/issues/747)
-- Make value of kernel.unprivileged\_userns\_clone depending on kernel version [\#727](https://github.com/dev-sec/ansible-collection-hardening/issues/727)
-- Ensure that ssh is installed \(cf \#771\) [\#774](https://github.com/dev-sec/ansible-collection-hardening/pull/774) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Byh0ki](https://github.com/Byh0ki))
-- ssh: explicitly enable or disable the service at boot [\#771](https://github.com/dev-sec/ansible-collection-hardening/pull/771) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Byh0ki](https://github.com/Byh0ki))
-- disable systemd socket activation [\#769](https://github.com/dev-sec/ansible-collection-hardening/pull/769) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- Add ssh\_pubkey\_authentication variable to ssh hardening [\#749](https://github.com/dev-sec/ansible-collection-hardening/pull/749) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([debbabi](https://github.com/debbabi))
-
-**Fixed bugs:**
-
-- ssh hardening role fails when `ssh_permit_root_login` var is set on ubuntu 24.04 [\#768](https://github.com/dev-sec/ansible-collection-hardening/issues/768)
-- os\_hardening fails when setting vm.mmap\_rnd\_bits [\#757](https://github.com/dev-sec/ansible-collection-hardening/issues/757)
-- `ssh_gateway_ports` is documented to accept 'clientspecified' string, but only accepts bools [\#755](https://github.com/dev-sec/ansible-collection-hardening/issues/755)
-- harden permissions for directory mount /var/log fails for minimized Ubuntu 22.04  [\#741](https://github.com/dev-sec/ansible-collection-hardening/issues/741)
-- Update Debian compatibility [\#784](https://github.com/dev-sec/ansible-collection-hardening/pull/784) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- do not force type of ssh\_gateway\_ports [\#765](https://github.com/dev-sec/ansible-collection-hardening/pull/765) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-
-**Merged pull requests:**
-
-- Update to current Fedora releases [\#783](https://github.com/dev-sec/ansible-collection-hardening/pull/783) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
-- Remove deprecated rebuild of initrd [\#782](https://github.com/dev-sec/ansible-collection-hardening/pull/782) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-- chore\(deps\): update patrickjahns/version-drafter-action digest to 2076fa4 [\#781](https://github.com/dev-sec/ansible-collection-hardening/pull/781) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 95382d3 [\#779](https://github.com/dev-sec/ansible-collection-hardening/pull/779) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/setup-python digest to 39cd149 [\#778](https://github.com/dev-sec/ansible-collection-hardening/pull/778) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- remove tests for FreeBSD12 since it's out of support [\#777](https://github.com/dev-sec/ansible-collection-hardening/pull/777) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
-- chore\(deps\): pin dependencies [\#776](https://github.com/dev-sec/ansible-collection-hardening/pull/776) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- Use best-practice preset for renovate [\#775](https://github.com/dev-sec/ansible-collection-hardening/pull/775) ([schurzi](https://github.com/schurzi))
-- Deprecate Centos Stream 8 [\#770](https://github.com/dev-sec/ansible-collection-hardening/pull/770) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- centos7 is eol, remove it [\#767](https://github.com/dev-sec/ansible-collection-hardening/pull/767) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- fix spelling [\#766](https://github.com/dev-sec/ansible-collection-hardening/pull/766) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- ci: define permissions for enforce-labels workflow  [\#760](https://github.com/dev-sec/ansible-collection-hardening/pull/760) ([fgreinacher](https://github.com/fgreinacher))
-- Update dependency ansible-core to v2.16.5 [\#754](https://github.com/dev-sec/ansible-collection-hardening/pull/754) ([renovate[bot]](https://github.com/apps/renovate))
-- Update dependency ansible-core to v2.16.4 [\#751](https://github.com/dev-sec/ansible-collection-hardening/pull/751) ([renovate[bot]](https://github.com/apps/renovate))
-- Update ansible/ansible-lint action to v24 [\#745](https://github.com/dev-sec/ansible-collection-hardening/pull/745) ([renovate[bot]](https://github.com/apps/renovate))
-- Always update Vagrant Boxes before using [\#744](https://github.com/dev-sec/ansible-collection-hardening/pull/744) ([schurzi](https://github.com/schurzi))
-- Remove Docker containers on self-hosted runner after tests [\#743](https://github.com/dev-sec/ansible-collection-hardening/pull/743) ([schurzi](https://github.com/schurzi))
-- Update dependency ansible-core to v2.16.3 [\#742](https://github.com/dev-sec/ansible-collection-hardening/pull/742) ([renovate[bot]](https://github.com/apps/renovate))
-
-## [9.0.1](https://github.com/dev-sec/ansible-collection-hardening/tree/9.0.1) (2024-01-15)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/9.0.0...9.0.1)
-
-**Implemented enhancements:**
-
-- Extend ansible-lint testing to cover our test cases [\#731](https://github.com/dev-sec/ansible-collection-hardening/issues/731)
--  Complete tests for OS hardening [\#660](https://github.com/dev-sec/ansible-collection-hardening/issues/660)
-- support restarts of audit service on Arch linux [\#722](https://github.com/dev-sec/ansible-collection-hardening/pull/722) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-
-**Fixed bugs:**
-
-- Fails to install [\#735](https://github.com/dev-sec/ansible-collection-hardening/issues/735)
-- Amazon Linux gpg check fails [\#734](https://github.com/dev-sec/ansible-collection-hardening/issues/734)
-- ssh\_hardening ipv6 [\#719](https://github.com/dev-sec/ansible-collection-hardening/issues/719)
-- boolean variable inconsistency? [\#330](https://github.com/dev-sec/ansible-collection-hardening/issues/330)
-- Restore idempotency for disabling unused filesystems with Ansible 2.16.0 [\#718](https://github.com/dev-sec/ansible-collection-hardening/pull/718) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([akikanellis](https://github.com/akikanellis))
-
-**Closed issues:**
-
-- 9.0.0 version number in galaxy.yml file is wrong [\#740](https://github.com/dev-sec/ansible-collection-hardening/issues/740)
-
-**Merged pull requests:**
-
-- restructure readme to move known limitations up top [\#739](https://github.com/dev-sec/ansible-collection-hardening/pull/739) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- release only on releases, not pre-releases [\#738](https://github.com/dev-sec/ansible-collection-hardening/pull/738) ([rndmh3ro](https://github.com/rndmh3ro))
-- Update dependency ansible-core to v2.16.2 [\#737](https://github.com/dev-sec/ansible-collection-hardening/pull/737) ([renovate[bot]](https://github.com/apps/renovate))
-- fix linting for github config [\#736](https://github.com/dev-sec/ansible-collection-hardening/pull/736) ([rndmh3ro](https://github.com/rndmh3ro))
-- Update actions/setup-python action to v5 [\#733](https://github.com/dev-sec/ansible-collection-hardening/pull/733) ([renovate[bot]](https://github.com/apps/renovate))
-- Update ansible-lint action and revise configuration to scan all Ansible code [\#732](https://github.com/dev-sec/ansible-collection-hardening/pull/732) ([schurzi](https://github.com/schurzi))
-- update labeler to new config format [\#730](https://github.com/dev-sec/ansible-collection-hardening/pull/730) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
-- Update dependency ansible-core to v2.16.1 [\#728](https://github.com/dev-sec/ansible-collection-hardening/pull/728) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- pin Ansible to always let Renovate update to the most current version in our tests [\#721](https://github.com/dev-sec/ansible-collection-hardening/pull/721) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-
-## [9.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/9.0.0) (2023-11-16)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.8.0...9.0.0)
-
-**Breaking changes:**
-
-- make it possible to configure more then yes and no for PermitTunnel [\#715](https://github.com/dev-sec/ansible-collection-hardening/pull/715) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- add role argument spec for os, ssh, mysql [\#687](https://github.com/dev-sec/ansible-collection-hardening/pull/687) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-
-**Implemented enhancements:**
-
-- Create role documentation with Automated-Ansible-Role-Documentation [\#694](https://github.com/dev-sec/ansible-collection-hardening/issues/694)
-- Minimize access user paths should be fully configurable [\#689](https://github.com/dev-sec/ansible-collection-hardening/issues/689)
-- Add support for Debian 12 [\#672](https://github.com/dev-sec/ansible-collection-hardening/issues/672)
-- add testing and support for current versions of Fedora and FreeBSD [\#709](https://github.com/dev-sec/ansible-collection-hardening/pull/709) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
-- feat: workflow for roles readme [\#705](https://github.com/dev-sec/ansible-collection-hardening/pull/705) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
-- do not try to drop roles in mysql hardening [\#649](https://github.com/dev-sec/ansible-collection-hardening/pull/649) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-
-**Fixed bugs:**
-
-- nginx conf.d directory is missing on Rocky Linux 8 [\#707](https://github.com/dev-sec/ansible-collection-hardening/issues/707)
-- Default value of `ssh_client_alive_interval` is inconsistent with what documentation says [\#701](https://github.com/dev-sec/ansible-collection-hardening/issues/701)
-- \[devsec.hardening.os\_hardening : restart-auditd\] fails [\#698](https://github.com/dev-sec/ansible-collection-hardening/issues/698)
-- sshd\_hardening role cannot be used to build system images [\#697](https://github.com/dev-sec/ansible-collection-hardening/issues/697)
-- Error: No file was found when using first\_found on Ubuntu 20.04 [\#676](https://github.com/dev-sec/ansible-collection-hardening/issues/676)
-- PUBLIC-role breaks mysql-hardening [\#648](https://github.com/dev-sec/ansible-collection-hardening/issues/648)
-- Error deploying the playbook [\#630](https://github.com/dev-sec/ansible-collection-hardening/issues/630)
-- Gather facts when os\_hardening role is executed with tags [\#708](https://github.com/dev-sec/ansible-collection-hardening/pull/708) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-
-**Closed issues:**
-
-- Add send-to-mailinglist to github release action [\#434](https://github.com/dev-sec/ansible-collection-hardening/issues/434)
-
-**Merged pull requests:**
-
-- update status badges in README [\#714](https://github.com/dev-sec/ansible-collection-hardening/pull/714) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- fix CI test for os\_hardening [\#711](https://github.com/dev-sec/ansible-collection-hardening/pull/711) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-- fix nginx CI tests [\#710](https://github.com/dev-sec/ansible-collection-hardening/pull/710) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- fix: roles-readme action default value [\#706](https://github.com/dev-sec/ansible-collection-hardening/pull/706) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
-- fix some wrong defaults and types in the readmes [\#703](https://github.com/dev-sec/ansible-collection-hardening/pull/703) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- update links to new Ansible Galaxy [\#702](https://github.com/dev-sec/ansible-collection-hardening/pull/702) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- Fix typo in login.defs.j2 [\#700](https://github.com/dev-sec/ansible-collection-hardening/pull/700) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))
-- chore\(deps\): update actions/checkout action to v4 [\#696](https://github.com/dev-sec/ansible-collection-hardening/pull/696) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- test debian12 on VM [\#695](https://github.com/dev-sec/ansible-collection-hardening/pull/695) ([rndmh3ro](https://github.com/rndmh3ro))
-- fix descriptions in readme [\#693](https://github.com/dev-sec/ansible-collection-hardening/pull/693) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- feat: customize user paths default [\#692](https://github.com/dev-sec/ansible-collection-hardening/pull/692) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([S0obi](https://github.com/S0obi))
-- disable PAM tests [\#691](https://github.com/dev-sec/ansible-collection-hardening/pull/691) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-
-## [8.8.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.8.0) (2023-08-04)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.7.0...8.8.0)
-
-**Implemented enhancements:**
-
-- Add support for Fedora 38 [\#671](https://github.com/dev-sec/ansible-collection-hardening/issues/671)
-- auditd: add possibility to override config template [\#685](https://github.com/dev-sec/ansible-collection-hardening/pull/685) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Meecr0b](https://github.com/Meecr0b))
-- add debian 12 support [\#684](https://github.com/dev-sec/ansible-collection-hardening/pull/684) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- feat: explicitly support Fedora 37 and 38 [\#682](https://github.com/dev-sec/ansible-collection-hardening/pull/682) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([nejch](https://github.com/nejch))
-- Replace ssh\_keys group with root, where applicable and use less permissive file mode [\#677](https://github.com/dev-sec/ansible-collection-hardening/pull/677) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- Add oddjob mkhomedir option rhel pam [\#675](https://github.com/dev-sec/ansible-collection-hardening/pull/675) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([imp1sh](https://github.com/imp1sh))
-
-**Fixed bugs:**
-
-- How does one set `sshd_authenticationmethods`  to include password authentication? [\#686](https://github.com/dev-sec/ansible-collection-hardening/issues/686)
-- FreeIPA environment mkhomedir fails [\#664](https://github.com/dev-sec/ansible-collection-hardening/issues/664)
-
-**Closed issues:**
-
-- What is the uscase of sysctl\_overwrite over ansible.posix.sysctl? [\#683](https://github.com/dev-sec/ansible-collection-hardening/issues/683)
--  `Ensure permissions on mysql-logfile are correct` chokes when `log_error` is set to `stderr` [\#673](https://github.com/dev-sec/ansible-collection-hardening/issues/673)
-- TASK TASK FAILED: \[devsec.hardening.os\_hardening : Set password ageing for existing regular \(non-system, non-root\) accounts\]  [\#670](https://github.com/dev-sec/ansible-collection-hardening/issues/670)
-- After os\_hardening ssh not working  [\#663](https://github.com/dev-sec/ansible-collection-hardening/issues/663)
-- Unsupported parameters for \(ansible.builtin.user\) module [\#650](https://github.com/dev-sec/ansible-collection-hardening/issues/650)
-
-**Merged pull requests:**
-
-- setting gets ignored [\#680](https://github.com/dev-sec/ansible-collection-hardening/pull/680) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- add var-naming\[no-role-prefix\] to skip-list [\#679](https://github.com/dev-sec/ansible-collection-hardening/pull/679) ([rndmh3ro](https://github.com/rndmh3ro))
-- expand on check conditions for non-file locations of logs [\#674](https://github.com/dev-sec/ansible-collection-hardening/pull/674) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([whysthatso](https://github.com/whysthatso))
-- use new molecule-plugins [\#667](https://github.com/dev-sec/ansible-collection-hardening/pull/667) ([schurzi](https://github.com/schurzi))
-- add spellchecking with codespell [\#662](https://github.com/dev-sec/ansible-collection-hardening/pull/662) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
-
-## [8.7.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.7.0) (2023-04-12)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.6.0...8.7.0)
-
-**Implemented enhancements:**
-
-- Support BSD and other operating systems CI with VM based tests [\#599](https://github.com/dev-sec/ansible-collection-hardening/issues/599)
-- add check mode to molecule tests [\#644](https://github.com/dev-sec/ansible-collection-hardening/pull/644) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- add testing for OpenBSD and FreeBSD [\#642](https://github.com/dev-sec/ansible-collection-hardening/pull/642) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
-- Only skip audit restart handler in docker [\#637](https://github.com/dev-sec/ansible-collection-hardening/pull/637) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))
-- Make action\_mail\_acct configurable in auditd [\#631](https://github.com/dev-sec/ansible-collection-hardening/pull/631) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))
-
-**Fixed bugs:**
-
-- getent task is skipped if user previously ran it with a key parameter [\#646](https://github.com/dev-sec/ansible-collection-hardening/issues/646)
-- Error running devsec.hardening.os\_hardening role [\#645](https://github.com/dev-sec/ansible-collection-hardening/issues/645)
-- devsec.hardening.mysql\_hardening - Get all users that have no authentication\_string - Hello world [\#640](https://github.com/dev-sec/ansible-collection-hardening/issues/640)
-- fixes \#646 - add another condition to getent task [\#647](https://github.com/dev-sec/ansible-collection-hardening/pull/647) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([gbolo](https://github.com/gbolo))
-
-**Closed issues:**
-
-- Invalid login.defs for RHEL6 [\#651](https://github.com/dev-sec/ansible-collection-hardening/issues/651)
-- Deprecation warnings for os\_hardening [\#638](https://github.com/dev-sec/ansible-collection-hardening/issues/638)
-- Write tests for MySQL user-deletion [\#445](https://github.com/dev-sec/ansible-collection-hardening/issues/445)
-
-**Merged pull requests:**
-
-- Update minimum required Ansible version for os\_hardening [\#657](https://github.com/dev-sec/ansible-collection-hardening/pull/657) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
-- Update test environment [\#656](https://github.com/dev-sec/ansible-collection-hardening/pull/656) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- Update dependency geerlingguy.git to v3.0.1 [\#654](https://github.com/dev-sec/ansible-collection-hardening/pull/654) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- Configure Renovate [\#653](https://github.com/dev-sec/ansible-collection-hardening/pull/653) ([renovate[bot]](https://github.com/apps/renovate))
-- simplify MySQL queries for user deletion [\#641](https://github.com/dev-sec/ansible-collection-hardening/pull/641) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([schurzi](https://github.com/schurzi))
-- Bump creyD/prettier\_action from 4.2 to 4.3 [\#639](https://github.com/dev-sec/ansible-collection-hardening/pull/639) ([dependabot[bot]](https://github.com/apps/dependabot))
-- Fix molecule tests for EL7 [\#636](https://github.com/dev-sec/ansible-collection-hardening/pull/636) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- run our CI tests periodically [\#634](https://github.com/dev-sec/ansible-collection-hardening/pull/634) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- try to fix molecule local tests [\#632](https://github.com/dev-sec/ansible-collection-hardening/pull/632) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- remove unnecessary tasks for VM based test [\#629](https://github.com/dev-sec/ansible-collection-hardening/pull/629) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-
-## [8.6.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.6.0) (2023-02-04)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.5.0...8.6.0)
-
-**Implemented enhancements:**
-
-- make number of warning days before user password expires configurable [\#628](https://github.com/dev-sec/ansible-collection-hardening/pull/628) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Normo](https://github.com/Normo))
-
-**Merged pull requests:**
-
-- Bump hugo19941994/delete-draft-releases from 1.0.0 to 1.0.1 [\#627](https://github.com/dev-sec/ansible-collection-hardening/pull/627) ([dependabot[bot]](https://github.com/apps/dependabot))
-
-## [8.5.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.5.0) (2023-01-30)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.4.0...8.5.0)
-
-**Implemented enhancements:**
-
-- Add support for /etc/auditd.conf num\_logs to go with max\_log\_file\_action [\#616](https://github.com/dev-sec/ansible-collection-hardening/issues/616)
-- password ageing not enforced [\#570](https://github.com/dev-sec/ansible-collection-hardening/issues/570)
-- Rewrite system account detection and hardening and create tests [\#621](https://github.com/dev-sec/ansible-collection-hardening/pull/621) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- Add support for /etc/auditd.conf num\_logs to go with max\_log\_file\_action [\#617](https://github.com/dev-sec/ansible-collection-hardening/pull/617) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([richardlock](https://github.com/richardlock))
-- Preserve default ownership and dir mode for /var/log on Ubuntu [\#615](https://github.com/dev-sec/ansible-collection-hardening/pull/615) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([stdtom](https://github.com/stdtom))
-- rewrite user home dir hardening [\#584](https://github.com/dev-sec/ansible-collection-hardening/pull/584) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
-- apply password age settings to existing regular users [\#582](https://github.com/dev-sec/ansible-collection-hardening/pull/582) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
-- Parametrize more auditd.conf options [\#535](https://github.com/dev-sec/ansible-collection-hardening/pull/535) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([kravietz](https://github.com/kravietz))
-
-**Fixed bugs:**
-
-- os\_hardening is setting wrong ownership for /var/log on Ubuntu [\#614](https://github.com/dev-sec/ansible-collection-hardening/issues/614)
-- \[os\_hardening\] Task for setting `initramfs` modules does not match its condition [\#590](https://github.com/dev-sec/ansible-collection-hardening/issues/590) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
-- Support for Amazon Linux 2 [\#624](https://github.com/dev-sec/ansible-collection-hardening/pull/624) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([mmitnyan](https://github.com/mmitnyan))
-
-**Deprecated:**
-
-- deprecate rebuilding of initramfs [\#618](https://github.com/dev-sec/ansible-collection-hardening/pull/618) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-
-**Closed issues:**
-
-- Ubuntu 22.04 vars file missing? [\#619](https://github.com/dev-sec/ansible-collection-hardening/issues/619)
-- SSH KexAlgorithms causes SSH daemon to fail [\#500](https://github.com/dev-sec/ansible-collection-hardening/issues/500)
-- Playbook won't run for hardening  [\#462](https://github.com/dev-sec/ansible-collection-hardening/issues/462)
-
-**Merged pull requests:**
-
-- do not let dependabot label our prs [\#626](https://github.com/dev-sec/ansible-collection-hardening/pull/626) ([rndmh3ro](https://github.com/rndmh3ro))
-- run linting only when files inside roles change [\#625](https://github.com/dev-sec/ansible-collection-hardening/pull/625) ([rndmh3ro](https://github.com/rndmh3ro))
-- cancel running tests if new commit to branch is made [\#622](https://github.com/dev-sec/ansible-collection-hardening/pull/622) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- Fixed problems with running molecule locally with cgroup v2 [\#620](https://github.com/dev-sec/ansible-collection-hardening/pull/620) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- Bump actions/setup-python from 1 to 4 [\#611](https://github.com/dev-sec/ansible-collection-hardening/pull/611) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([dependabot[bot]](https://github.com/apps/dependabot))
-- Bump creyD/prettier\_action from 3.1 to 4.2 [\#610](https://github.com/dev-sec/ansible-collection-hardening/pull/610) ([dependabot[bot]](https://github.com/apps/dependabot))
-- linting [\#603](https://github.com/dev-sec/ansible-collection-hardening/pull/603) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-
-## [8.4.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.4.0) (2022-12-17)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.3.0...8.4.0)
-
-**Implemented enhancements:**
-
-- Implement Test for MySQL systemd service [\#606](https://github.com/dev-sec/ansible-collection-hardening/issues/606)
-- Extended net hardening [\#607](https://github.com/dev-sec/ansible-collection-hardening/pull/607) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
-- Add OpenSUSE support  [\#605](https://github.com/dev-sec/ansible-collection-hardening/pull/605) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- Allow ssh\_allow\_tcp\_forwarding to be a boolean [\#600](https://github.com/dev-sec/ansible-collection-hardening/pull/600) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([crisbal](https://github.com/crisbal))
-- OpenBSD does not support GSSAPI Authentication [\#598](https://github.com/dev-sec/ansible-collection-hardening/pull/598) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([dennisse](https://github.com/dennisse))
-- add Ansible specific templates for issues [\#596](https://github.com/dev-sec/ansible-collection-hardening/pull/596) ([schurzi](https://github.com/schurzi))
-- use github templates for new issues [\#595](https://github.com/dev-sec/ansible-collection-hardening/pull/595) ([schurzi](https://github.com/schurzi))
-
-**Fixed bugs:**
-
-- os\_auth\_retries variable causes a comparison type error on pam tasks [\#593](https://github.com/dev-sec/ansible-collection-hardening/issues/593)
-- ssh\_hardening: Install selinux dependencies fails on Oracle Linux \(RHEL\) 9 [\#585](https://github.com/dev-sec/ansible-collection-hardening/issues/585)
-- OpenBSD does not set distributiuon\_major\_version [\#597](https://github.com/dev-sec/ansible-collection-hardening/pull/597) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([dennisse](https://github.com/dennisse))
-
-**Merged pull requests:**
-
-- Check for github action updates daily [\#609](https://github.com/dev-sec/ansible-collection-hardening/pull/609) ([jlosito](https://github.com/jlosito))
-- add verify-task to check if mysql is running and enabled [\#608](https://github.com/dev-sec/ansible-collection-hardening/pull/608) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- Updates handlers for new ansible syntax and deprecated options for legacy commands [\#602](https://github.com/dev-sec/ansible-collection-hardening/pull/602) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([jsievertde](https://github.com/jsievertde))
-- add notice to sign-off work to contributor guideline [\#601](https://github.com/dev-sec/ansible-collection-hardening/pull/601) ([schurzi](https://github.com/schurzi))
-
-## [8.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.3.0) (2022-10-27)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.2.0...8.3.0)
-
-**Implemented enhancements:**
-
-- add hardening of root user account\(s\) [\#579](https://github.com/dev-sec/ansible-collection-hardening/pull/579) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
-
-**Fixed bugs:**
-
-- cast expected int types in pam tasks [\#594](https://github.com/dev-sec/ansible-collection-hardening/pull/594) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([dlouzan](https://github.com/dlouzan))
-- do not manage trusted user ca keys if none exist [\#580](https://github.com/dev-sec/ansible-collection-hardening/pull/580) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([hollow](https://github.com/hollow))
-
-**Closed issues:**
-
-- Trying to run the os\_hardening on Debian 11, but fails on privilege escalation [\#587](https://github.com/dev-sec/ansible-collection-hardening/issues/587)
-- auditd increasing logfiles [\#586](https://github.com/dev-sec/ansible-collection-hardening/issues/586)
-- Path to nginx.conf should be configurable in a variable  [\#577](https://github.com/dev-sec/ansible-collection-hardening/issues/577)
-
-**Merged pull requests:**
-
-- adopt all current suggestions from ansible-lint [\#592](https://github.com/dev-sec/ansible-collection-hardening/pull/592) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
-- Support more os [\#588](https://github.com/dev-sec/ansible-collection-hardening/pull/588) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- run tests only on pushes to master or to PRs [\#581](https://github.com/dev-sec/ansible-collection-hardening/pull/581) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-
-## [8.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.2.0) (2022-09-08)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.1.0...8.2.0)
-
-**Implemented enhancements:**
-
-- Add nginx variables for config-path and owner/group [\#578](https://github.com/dev-sec/ansible-collection-hardening/pull/578) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([hagenbauer](https://github.com/hagenbauer))
-- add centos \>8 Support [\#573](https://github.com/dev-sec/ansible-collection-hardening/pull/573) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([sbaerlocher](https://github.com/sbaerlocher))
-- add always-tag to include so other tags can be used [\#569](https://github.com/dev-sec/ansible-collection-hardening/pull/569) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-
-**Closed issues:**
-
-- Bug using os\_hardening "tags" [\#567](https://github.com/dev-sec/ansible-collection-hardening/issues/567)
-
-## [8.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.1.0) (2022-08-26)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.0.0...8.1.0)
-
-**Closed issues:**
-
-- dev-sec CI bot should not update CHANGELOG.md in fork repository [\#566](https://github.com/dev-sec/ansible-collection-hardening/issues/566)
-
-**Merged pull requests:**
-
-- update supported OS in meta and fix linting [\#572](https://github.com/dev-sec/ansible-collection-hardening/pull/572) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- fix misleading comment [\#571](https://github.com/dev-sec/ansible-collection-hardening/pull/571) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
-- only run release actions on upstream-repo [\#568](https://github.com/dev-sec/ansible-collection-hardening/pull/568) ([rndmh3ro](https://github.com/rndmh3ro))
-
-## [8.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.0.0) (2022-08-22)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.16.0...8.0.0)
-
-**Breaking changes:**
-
-- change default to allow SFTP [\#564](https://github.com/dev-sec/ansible-collection-hardening/pull/564) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
-
-**Implemented enhancements:**
-
-- add possibility to keep .netrc files in users homedir [\#563](https://github.com/dev-sec/ansible-collection-hardening/pull/563) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([PhilippFunk](https://github.com/PhilippFunk))
-- rework filesystem hardening [\#555](https://github.com/dev-sec/ansible-collection-hardening/pull/555) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([divialth](https://github.com/divialth))
-
-**Closed issues:**
-
-- Error in Task 'Create sshd\_config and set permissions to root/600' [\#565](https://github.com/dev-sec/ansible-collection-hardening/issues/565) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
-- \[ssh\_hardening\] Debian 11 - Ansible cannot transfer files [\#557](https://github.com/dev-sec/ansible-collection-hardening/issues/557)
-- Add the old SFTP-Reminder to the stable ssh\_hardening role for ansible [\#521](https://github.com/dev-sec/ansible-collection-hardening/issues/521)
-
-## [7.16.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.16.0) (2022-08-16)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.15.1...7.16.0)
-
-**Implemented enhancements:**
-
-- revert debian 9 change, only one tls variable now [\#562](https://github.com/dev-sec/ansible-collection-hardening/pull/562) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- add possibility to run ssh\_hardening as unprivileged user [\#561](https://github.com/dev-sec/ansible-collection-hardening/pull/561) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
-- add basic support for ubuntu22.04 [\#554](https://github.com/dev-sec/ansible-collection-hardening/pull/554) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- Add full support for Debian 11 [\#538](https://github.com/dev-sec/ansible-collection-hardening/pull/538) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([addianto](https://github.com/addianto))
-
-**Fixed bugs:**
-
-- Replace default 2048 bits RSA keypair fails on Ubuntu 20.04 [\#459](https://github.com/dev-sec/ansible-collection-hardening/issues/459)
-
-**Closed issues:**
-
-- os-hardening: yum gpg-check fails if gpg-check already set [\#556](https://github.com/dev-sec/ansible-collection-hardening/issues/556)
-- Ubuntu 22.04 LTS [\#553](https://github.com/dev-sec/ansible-collection-hardening/issues/553)
-- Revert nginx ssl-protocol after deprecation of debian9 [\#528](https://github.com/dev-sec/ansible-collection-hardening/issues/528)
-- Support for Debian 11 [\#527](https://github.com/dev-sec/ansible-collection-hardening/issues/527)
-- Support baseline-control os-14 [\#507](https://github.com/dev-sec/ansible-collection-hardening/issues/507)
-
-## [7.15.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.15.1) (2022-07-26)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.15.0...7.15.1)
-
-**Fixed bugs:**
-
-- Fix broken mode for /var/log/audit [\#552](https://github.com/dev-sec/ansible-collection-hardening/pull/552) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([hollow](https://github.com/hollow))
-
-**Merged pull requests:**
-
-- Only run hardening if /var/log/audit exists [\#550](https://github.com/dev-sec/ansible-collection-hardening/pull/550) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([mego22](https://github.com/mego22))
-
 ## [7.15.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.15.0) (2022-07-11)
 
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.3...7.15.0)
@@ -644,7 +43,7 @@
 
 **Closed issues:**
 
-- No such file directory error triggered by the  kernel.unprivileged\_userns\_clone configuration. [\#514](https://github.com/dev-sec/ansible-collection-hardening/issues/514)
+- No such file directory error triggered by the  kernel.unpriviliged\_userns\_clone configuration. [\#514](https://github.com/dev-sec/ansible-collection-hardening/issues/514)
 
 **Merged pull requests:**
 
@@ -1083,8 +482,9 @@
 - Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-collection-hardening/pull/259) ([jaredledvina](https://github.com/jaredledvina))
 - Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-collection-hardening/pull/254) ([kravietz](https://github.com/kravietz))
 - Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-collection-hardening/pull/251) ([dustinmiller](https://github.com/dustinmiller))
-- Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
+- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
 - Make max\_log\_file\_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-collection-hardening/pull/246) ([jandd](https://github.com/jandd))
+- Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-collection-hardening/pull/240) ([ghost](https://github.com/ghost))
 - Fedora - Use new auto ansible\_python\_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-collection-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
 - add test support for CentOS8 [\#237](https://github.com/dev-sec/ansible-collection-hardening/pull/237) ([yeoldegrove](https://github.com/yeoldegrove))
 - Support configuring SELinux and default to enforcing [\#236](https://github.com/dev-sec/ansible-collection-hardening/pull/236) ([jaredledvina](https://github.com/jaredledvina))
@@ -1125,7 +525,7 @@
 - remove prelink package, control package-09 [\#135](https://github.com/dev-sec/ansible-collection-hardening/pull/135) ([rndmh3ro](https://github.com/rndmh3ro))
 - style update [\#134](https://github.com/dev-sec/ansible-collection-hardening/pull/134) ([rndmh3ro](https://github.com/rndmh3ro))
 - Remove deprecated include for static tasks and use instead import\_tasks fix \#131 [\#132](https://github.com/dev-sec/ansible-collection-hardening/pull/132) ([HelioCampos](https://github.com/HelioCampos))
-- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-collection-hardening/pull/130) ([FazleArefin](https://github.com/FazleArefin))
+- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-collection-hardening/pull/130) ([fazlearefin](https://github.com/fazlearefin))
 - install initramfs-tools [\#114](https://github.com/dev-sec/ansible-collection-hardening/pull/114) ([rndmh3ro](https://github.com/rndmh3ro))
 - omit empty variables [\#106](https://github.com/dev-sec/ansible-collection-hardening/pull/106) ([rndmh3ro](https://github.com/rndmh3ro))
 - Supports --check mode [\#93](https://github.com/dev-sec/ansible-collection-hardening/pull/93) ([conorsch](https://github.com/conorsch))
@@ -1133,7 +533,7 @@
 - Docker [\#90](https://github.com/dev-sec/ansible-collection-hardening/pull/90) ([rndmh3ro](https://github.com/rndmh3ro))
 - debian 8 support [\#88](https://github.com/dev-sec/ansible-collection-hardening/pull/88) ([rndmh3ro](https://github.com/rndmh3ro))
 - Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-collection-hardening/pull/85) ([fitz123](https://github.com/fitz123))
-- replace ignore\_errors to failed\_when to suppress ugly error warnings [\#81](https://github.com/dev-sec/ansible-collection-hardening/pull/81) ([fitz123](https://github.com/fitz123))
+- replace ignore\_errors to failed\_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-collection-hardening/pull/81) ([fitz123](https://github.com/fitz123))
 - fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-collection-hardening/pull/79) ([fitz123](https://github.com/fitz123))
 - update platforms in meta-file [\#69](https://github.com/dev-sec/ansible-collection-hardening/pull/69) ([rndmh3ro](https://github.com/rndmh3ro))
 - add webhook for ansible galaxy [\#68](https://github.com/dev-sec/ansible-collection-hardening/pull/68) ([rndmh3ro](https://github.com/rndmh3ro))
@@ -1159,7 +559,7 @@
 - \[lots of\] deprecation warnings in Ansible 2.8 [\#221](https://github.com/dev-sec/ansible-collection-hardening/issues/221)
 - `squash_actions` deprecation warning [\#218](https://github.com/dev-sec/ansible-collection-hardening/issues/218)
 - login.defs.j2 template: ENV\_PATH is missing ':' before variable substitution [\#202](https://github.com/dev-sec/ansible-collection-hardening/issues/202)
-- auditd causing v5.0 to fail on unprivileged LXC's [\#191](https://github.com/dev-sec/ansible-collection-hardening/issues/191)
+- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-collection-hardening/issues/191)
 - Setting os\_security\_users\_allow has no effect [\#175](https://github.com/dev-sec/ansible-collection-hardening/issues/175)
 - minimize\_access: maximum recursion depth exceeded on Ansible 2.5 [\#171](https://github.com/dev-sec/ansible-collection-hardening/issues/171)
 - wrong permissions passwdqc [\#170](https://github.com/dev-sec/ansible-collection-hardening/issues/170)
@@ -1192,6 +592,7 @@
 - replace module parameter fixed [\#297](https://github.com/dev-sec/ansible-collection-hardening/pull/297) ([danielkubat](https://github.com/danielkubat))
 - Addressing issue \#255 [\#258](https://github.com/dev-sec/ansible-collection-hardening/pull/258) ([ljkimmel](https://github.com/ljkimmel))
 - Fix \#247, cleanup conditions [\#248](https://github.com/dev-sec/ansible-collection-hardening/pull/248) ([fernandezcuesta](https://github.com/fernandezcuesta))
+- Fix error on applying the sysctl vars on containers [\#243](https://github.com/dev-sec/ansible-collection-hardening/pull/243) ([ghost](https://github.com/ghost))
 - Update location of NSA RHEL 5 Guide [\#235](https://github.com/dev-sec/ansible-collection-hardening/pull/235) ([jaredledvina](https://github.com/jaredledvina))
 - Fix typo [\#212](https://github.com/dev-sec/ansible-collection-hardening/pull/212) ([ruslo](https://github.com/ruslo))
 - Update modprobe to 0644 [\#211](https://github.com/dev-sec/ansible-collection-hardening/pull/211) ([joshuatalb](https://github.com/joshuatalb))
@@ -1246,7 +647,7 @@
 - adjust permissions on shadow file on suse [\#311](https://github.com/dev-sec/ansible-collection-hardening/pull/311) ([rndmh3ro](https://github.com/rndmh3ro))
 - fix fedora build [\#296](https://github.com/dev-sec/ansible-collection-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
 - do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-collection-hardening/pull/289) ([schurzi](https://github.com/schurzi))
-- move hidepid vars into defaults so they're overwritable [\#285](https://github.com/dev-sec/ansible-collection-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
+- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-collection-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
 - install procps in debian so sysctl.conf exists [\#282](https://github.com/dev-sec/ansible-collection-hardening/pull/282) ([rndmh3ro](https://github.com/rndmh3ro))
 - move defaults to os-specific vars [\#157](https://github.com/dev-sec/ansible-collection-hardening/pull/157) ([rndmh3ro](https://github.com/rndmh3ro))
 - Converts set to JSON-serializable list [\#126](https://github.com/dev-sec/ansible-collection-hardening/pull/126) ([pestaa](https://github.com/pestaa))
@@ -1298,7 +699,7 @@
 - Repair debian install script [\#8](https://github.com/dev-sec/ansible-collection-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
 - Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-collection-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
 - Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-collection-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
-- Change playbook-path to accommodate test-repo [\#4](https://github.com/dev-sec/ansible-collection-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-collection-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
 - treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-collection-hardening/pull/3) ([arlimus](https://github.com/arlimus))
 - Add Securetty-support [\#2](https://github.com/dev-sec/ansible-collection-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
 - Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-collection-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))

CONTRIBUTING.md

@@ -15,7 +15,7 @@ In order to contribute code please:
 1. Fork the project on GitHub
 2. Clone the project
 3. Add changes (and tests)
-4. Commit, sign off and push your changes
+4. Commit and push
 5. Create a merge-request
 
 To have your code merged, see the expectations listed below.
@@ -28,24 +28,6 @@ Some great guidelines can be found [here](https://wiki.openstack.org/wiki/GitCom
 
 ## Expectations
 
-## Sign off Your Work
-
-The Developer Certificate of Origin (DCO) is a lightweight way for contributors to certify that they wrote or otherwise have the right to submit the code they are contributing to the project.
-[Here is the full text of the DCO](http://developercertificate.org/).
-Contributors must sign-off that they adhere to these requirements by adding a `Signed-off-by` line to commit messages.
-
-```text
-This is my commit message
-
-Signed-off-by: Random J Developer <[email protected]>
-```
-
-Git even has a -s command line option to append this automatically to your commit message:
-
-```text
-git commit -s -m 'This is my commit message'
-```
-
 ### Don't reinvent the wheel
 
 This hardening project doesn't intend to reinvent the configuration stack for services. Aim to use official configuration projects first and provide hardening as a layer on top. The goal is remove the need for a user to configure all aspects of services and maintain security configuration. This way, the user can still configure a service using the interface provided by the official project.
@@ -93,21 +75,6 @@ We generally include test for coding guidelines:
 
 Remember: Code is generally read much more often than written.
 
-### Local testing of roles in this collection
-
-We are using Molecule to test our roles.
-If you want to execute the tests on your machine you need Docker and Molecule.
-You will also need to set the `MOLECULE_DISTRO` environment variable to execute the tests.
-To find valid values for the variable you can take a look at our GitHub Action workflows in `.github/workflows/`.
-
-Example for executing tests locally:
-
-```bash
-pip install -r requirements.txt
-export MOLECULE_DISTRO="debian12"
-molecule test -s os_hardening
-```
-
 ### Use Markdown
 
 Wherever possible, please refrain from any other formats and stick to simple markdown.

OS_HARDENING_CHANGELOG.md

@@ -26,7 +26,7 @@
 
 - fix fedora build [\#296](https://github.com/dev-sec/ansible-os-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
 - do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-os-hardening/pull/289) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([schurzi](https://github.com/schurzi))
-- move hidepid vars into defaults so they're overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))
+- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))
 
 ## [6.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/6.1.0) (2020-07-21)
 
@@ -90,7 +90,7 @@
 - Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-os-hardening/pull/259) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jaredledvina](https://github.com/jaredledvina))
 - Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-os-hardening/pull/254) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([kravietz](https://github.com/kravietz))
 - Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-os-hardening/pull/251) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
-- Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
+- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
 - Make max_log_file_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-os-hardening/pull/246) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jandd](https://github.com/jandd))
 - Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-os-hardening/pull/240) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([ghost](https://github.com/ghost))
 - Fedora - Use new auto ansible_python_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-os-hardening/pull/239) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jaredledvina](https://github.com/jaredledvina))
@@ -165,7 +165,7 @@
 
 **Fixed bugs:**
 
-- auditd causing v5.0 to fail on unprivileged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
 - Setting os_security_users_allow has no effect [\#175](https://github.com/dev-sec/ansible-os-hardening/issues/175) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
 - add /usr/bin/su to suid_guid whitelist [\#199](https://github.com/dev-sec/ansible-os-hardening/pull/199) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([ccolic](https://github.com/ccolic))
 - ensure that permissions to su-binary are not restricted to root user and group only, if os_security_users_allow contains the value change_user [\#197](https://github.com/dev-sec/ansible-os-hardening/pull/197) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([szEvEz](https://github.com/szEvEz))
@@ -346,7 +346,7 @@
 - Docker [\#90](https://github.com/dev-sec/ansible-os-hardening/pull/90) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
 - debian 8 support [\#88](https://github.com/dev-sec/ansible-os-hardening/pull/88) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-os-hardening/pull/85) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
-- replace ignore_errors to failed_when to suppress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
+- replace ignore_errors to failed_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
 - fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-os-hardening/pull/79) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
 
 **Fixed bugs:**
@@ -459,7 +459,7 @@
 - Repair debian install script [\#8](https://github.com/dev-sec/ansible-os-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
 - Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-os-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
 - Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-os-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
-- Change playbook-path to accommodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
 - treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-os-hardening/pull/3) ([arlimus](https://github.com/arlimus))
 - Add Securetty-support [\#2](https://github.com/dev-sec/ansible-os-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
 - Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-os-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))

README.md

@@ -1,26 +1,23 @@
 # Ansible Collection - devsec.hardening
 
-[![devsec.os_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml)
+![devsec.os_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening/badge.svg)
-[![devsec.os_hardening VM](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml)
+![devsec.os_hardening VM](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening%20VM/badge.svg)
-[![devsec.ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml)
+![devsec.ssh_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.ssh_hardening/badge.svg)
-[![devsec.ssh_hardening VM](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml)
+![devsec.nginx_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.nginx_hardening/badge.svg)
-[![devsec.ssh_hardening with custom tests](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml)
+![devsec.mysql_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.mysql_hardening/badge.svg)
-[![devsec.nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml)
-[![devsec.mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
 
 ## Description
 
 This collection provides battle tested hardening for:
 
 - Linux operating systems:
-  - CentOS Stream 9
+  - CentOS 7/8
-  - AlmaLinux 8/9/10
+  - Rocky Linux 8
-  - Rocky Linux 8/9/10
+  - Debian 9/10
-  - Debian 11/12/13
+  - Ubuntu 16.04/18.04/20.04
-  - Ubuntu 20.04/22.04/24.04
   - Amazon Linux (some roles supported)
   - Arch Linux (some roles supported)
-  - Fedora 39/40 (some roles supported)
+  - Fedora (some roles supported)
   - Suse Tumbleweed (some roles supported)
 - MySQL
   - MariaDB >= 5.5.65, >= 10.1.45, >= 10.3.17
@@ -41,7 +38,7 @@ The roles are now part of the hardening-collection.
 We have kept the old releases of the `os-hardening` role in this repository, so you can find the them by exploring older tags.
 The last release of the standalone role was [6.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/6.2.0).
 
-The other roles are in separate archives repositories:
+The other roles are in separate archives repositories
 
 - [apache_hardening](https://github.com/dev-sec/ansible-apache-hardening)
 - [mysql_hardening](https://github.com/dev-sec/ansible-mysql-hardening)
@@ -51,7 +48,7 @@ The other roles are in separate archives repositories:
 
 ## Minimum required Ansible-version
 
-- Ansible >= 2.16
+- Ansible >= 2.9.10
 
 ## Included content
 
@@ -89,8 +86,8 @@ See the [changelog](https://github.com/dev-sec/ansible-os-hardening/tree/master/
 
 Todos:
 
-- Work on [apache_hardening](roles/apache_hardening/) and [windows_hardening](roles/windows_hardening/)
+- Work on [apache_hardening](roles/apache_hardening/) and [windows_hardening](roles/windows_hardening/).
-- Add support for more operating systems
+- Add support for more operating systems,
 
 ## More information
 

galaxy.yml

@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 10.5.1
+version: 7.15.0
 readme: README.md
 authors:
   - dev-sec <[email protected]>
@@ -22,9 +22,6 @@ tags:
   - nginx_hardening
   - os_hardening
   - ssh_hardening
-  - database
-  - linux
-  - security
 dependencies:
   ansible.posix: '>=1.0.0'
   community.crypto: '>=1.0.0'
@@ -45,4 +42,3 @@ build_ignore:
   - .tox
   - tox.ini
   - .yamllint
-  - renovate.json

meta/runtime.yml

@@ -1,2 +1,2 @@
 ---
-requires_ansible: ">=2.9.10"
+requires_ansible: '>=2.9.10'

molecule/mysql_hardening/converge.yml

@@ -1,5 +1,5 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-mysql-hardening"
+- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
   hosts: all
   become: true
   environment:
@@ -8,30 +8,22 @@
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
-      ansible.builtin.set_fact:
+      set_fact:
-        mysql_python_package_debian: python3-pymysql
+        mysql_python_package_debian: "python3-pymysql"
       when:
         - mysql_python_package_debian is not defined
-        - ansible_facts.distribution == "Ubuntu"
+        - ansible_distribution == "Ubuntu"
-        - ansible_facts.distribution_major_version|int > 19
+        - ansible_distribution_major_version|int > 19
 
     - name: Determine required MySQL Python libraries.
-      ansible.builtin.set_fact:
+      set_fact:
-        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
+        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
       when:
         - mysql_python_package_debian is not defined
-        - ansible_facts.distribution != "Ubuntu"
+        - ansible_distribution != "Ubuntu"
-        - ansible_facts.distribution_major_version|int < 20
+        - ansible_distribution_major_version|int < 20
-
+    - include_role:
-    - name: Use Python 3 on Suse
+        name: mysql_hardening
-      ansible.builtin.set_fact:
-        ansible_python_interpreter: /usr/bin/python3
-      when:
-        - ansible_facts.os_family == 'Suse'
-
-    - name: Include mysql_hardening role
-      ansible.builtin.include_role:
-        name: devsec.hardening.mysql_hardening
   vars:
     overwrite_global_mycnf: false
     mysql_root_password: iloverandompasswordsbutthiswilldo

molecule/mysql_hardening/molecule.yml

@@ -8,23 +8,27 @@ driver:
   name: docker
 platforms:
   - name: instance
-    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
+    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
     privileged: true
-    cgroupns_mode: host
     pre_build_image: true
+    environment:
+      container: docker
+    security_opts:
+      - apparmor=unconfined
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
+      container: docker
 provisioner:
   name: ansible
-  options:
-    diff: true
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer
+      callback_whitelist: profile_tasks, timer, yaml
-      # Currently not supported by dev-sec.mysql role
-      # inject_facts_as_vars: false
 verifier:
   name: ansible
 
@@ -35,7 +39,6 @@ scenario:
     - prepare
   check_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -51,13 +54,11 @@ scenario:
     - destroy
   test_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create
     - prepare
-    - check
     - converge
-    - idempotence
+    # - idempotence  # not idempotent
     - verify
     - destroy

molecule/mysql_hardening/prepare.yml

@@ -1,74 +1,58 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-mysql-hardening"
+
+- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
   hosts: all
   become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: Run the equivalent of "apt-get update && apt-get upgrade"
+      apt:
+        name: "*"
+        state: latest
+        update_cache: true
+      when: ansible_os_family == 'Debian'
+
+    - name: install required tools on SuSE
+      community.general.zypper:
+        name: "python-xml"
+        state: present
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: create missing directory
+      file:
+        path: "/etc/mysql/conf.d"
+        state: directory
+
+    - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
+      set_fact:
+        mysql_python_package_debian: "python3-pymysql"
+      when:
+        - mysql_python_package_debian is not defined
+        - ansible_distribution == "Ubuntu"
+        - ansible_distribution_major_version|int > 19
+
+    - name: Determine required MySQL Python libraries.
+      set_fact:
+        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
+      when:
+        - mysql_python_package_debian is not defined
+        - ansible_distribution != "Ubuntu"
+        - ansible_distribution_major_version|int < 20
+
+    - include_role:
+        name: dev-sec.mysql
+
+    - name: create a user with an empty password
+      community.mysql.mysql_query:
+        query:
+          - "CREATE USER foo@bar;"
+        login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   vars:
     overwrite_global_mycnf: false
     mysql_root_password: iloverandompasswordsbutthiswilldo
     mysql_user_password: iloverandompasswordsbutthiswilldo
     mysql_config_file: /etc/mysql/mariadb.cnf
     mysql_root_password_update: true
-  tasks:
-    - name: Use Python 3 on Debian 11
-      ansible.builtin.set_fact:
-        ansible_python_interpreter: /usr/bin/python3
-      when:
-        - ansible_facts.distribution == 'Debian'
-        - ansible_facts.distribution_major_version|int >= 11
-
-    - name: Use Python 3 on Suse
-      ansible.builtin.set_fact:
-        ansible_python_interpreter: /usr/bin/python3
-      when:
-        - ansible_facts.os_family == 'Suse'
-
-    - name: Run the equivalent of "apt-get update && apt-get upgrade"
-      ansible.builtin.apt:
-        upgrade: safe
-        update_cache: true
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: Install required python packages on Suse
-      ansible.builtin.command: zypper -n install python311-rpm python311-PyMySQL
-      changed_when: false
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: Create missing directory
-      ansible.builtin.file:
-        path: /etc/mysql
-        state: directory
-        mode: "0755"
-
-    - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
-      ansible.builtin.set_fact:
-        mysql_python_package_debian: python3-pymysql
-      when:
-        - mysql_python_package_debian is not defined
-        - ansible_facts.distribution == "Ubuntu"
-        - ansible_facts.distribution_major_version|int > 19
-
-    - name: Determine required MySQL Python libraries.
-      ansible.builtin.set_fact:
-        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
-      when:
-        - mysql_python_package_debian is not defined
-        - ansible_facts.distribution != "Ubuntu"
-        - ansible_facts.distribution_major_version|int < 20
-
-    - name: Install required MySQL Python libraries on RHEL
-      ansible.builtin.dnf:
-        name: "{% if 'python3' in ansible_python_interpreter | default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
-      when:
-        - ansible_facts.os_family == "RedHat"
-        - ansible_facts.distribution_major_version == "7"
-
-    - name: Install mysql with a generic Ansible role
-      ansible.builtin.include_role:
-        name: dev-sec.mysql
-
-    - name: Include MySQL user prepare tasks
-      ansible.builtin.include_tasks: prepare_tasks/mysql_users.yml

molecule/mysql_hardening/prepare_tasks/mysql_users.yml

@@ -1,32 +0,0 @@
----
-- name: Create users for test
-  community.mysql.mysql_query:
-    query:
-      - CREATE USER 'user'@'delete';
-      - CREATE USER 'user'@'127.0.0.1';
-      - CREATE USER 'user'@'::1';
-      - CREATE USER 'user'@'%';
-      - CREATE USER 'user'@'192.168.0.%';
-      - CREATE USER 'user'@'192.168.0.1';
-      - CREATE USER    '%'@'192.168.0.1';
-      - CREATE USER 'user'@'192.168.0.2' IDENTIFIED BY 'keep';
-      - CREATE USER 'user'@'keep' IDENTIFIED BY 'keep';
-      - CREATE USER 'user'@'192.168.%' IDENTIFIED BY 'keep';
-    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
-
-- name: Detect role support on MySQL
-  community.mysql.mysql_query:
-    query: >
-      SELECT 1 FROM information_schema.COLUMNS
-                WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
-                AND COLUMN_NAME = 'is_role';
-    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
-  register: mysql_role_support
-
-- name: Create roles for test
-  community.mysql.mysql_query:
-    query:
-      - CREATE ROLE 'role_keep';
-    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
-  when:
-    - mysql_role_support.rowcount[0] > 0

molecule/mysql_hardening/requirements.yml

@@ -1,5 +1,7 @@
 ---
 roles:
+  - name: geerlingguy.git
+    version: 3.0.0
   - name: dev-sec.mysql
     version: master
 

molecule/mysql_hardening/verify.yml

@@ -6,50 +6,54 @@
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  roles:
+    - geerlingguy.git
   tasks:
-    - name: Use Python 3 on Suse
+    - name: install fake SuSE-release for cinc compatibility
-      ansible.builtin.set_fact:
+      copy:
-        ansible_python_interpreter: /usr/bin/python3
+        content: |
-      when:
+          openSUSE Faked Enterprise 2020 (x86_64)
-        - ansible_facts.os_family == 'Suse'
+          VERSION = 2020
+          CODENAME = Faked Feature
+        dest: /etc/SuSE-release
+        owner: root
+        group: root
+        mode: '0444'
+      when: ansible_facts.os_family == 'Suse'
 
-    - name: Install procps for debian systems
+    - name: install git for SuSE since geerlinguy.git does not support it
-      ansible.builtin.apt:
+      zypper:
+        name: git
+        state: present
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: install procps for debian systems
+      apt:
         name: procps
         state: present
         update_cache: true
-      when: ansible_facts.distribution == 'Debian'
+      when: ansible_distribution == 'Debian'
 
-    - name: Include tests for the service
+    - name: download cinc-auditor
-      ansible.builtin.include_tasks: verify_tasks/service.yml
+      get_url:
+        url: https://omnitruck.cinc.sh/install.sh
+        dest: /tmp/install.sh
+        mode: '0775'
 
-    - name: Include tests for MySQL user
+    - name: install cinc-auditor
-      ansible.builtin.include_tasks: verify_tasks/mysql_users.yml
+      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
 
-- name: Verify
-  hosts: localhost
-  environment:
-    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
-    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
-    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  tasks:
     - name: Execute cinc-auditor tests
-      ansible.builtin.command: >
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/mysql-baseline/archive/refs/heads/master.zip"
-        docker run
-        --volume /run/docker.sock:/run/docker.sock
-        docker.io/cincproject/auditor exec
-        -t docker://instance
-        --no-show-progress --no-color
-        --no-distinct-exit https://github.com/dev-sec/mysql-baseline/archive/refs/heads/master.zip
       register: test_results
       changed_when: false
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      ansible.builtin.debug:
+      debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      ansible.builtin.fail:
+      fail:
-        msg: Inspec failed to validate
+        msg: "Inspec failed to validate"
       when: test_results.rc != 0

molecule/mysql_hardening/verify_tasks/mysql_users.yml

@@ -1,41 +0,0 @@
----
-- name: Get all users from MySQL server
-  community.mysql.mysql_query:
-    query: >
-      SELECT CONCAT(USER, '@', HOST) AS users FROM mysql.user;
-    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
-  register: mysql_users
-
-- name: Create list of users from mysql query
-  ansible.builtin.set_fact:
-    mysql_users_list: "{{ mysql_users.query_result.0  | json_query('[*].users') | list }}"
-
-- name: Assert that only accounts with password remain
-  ansible.builtin.assert:
-    that:
-      - '"user@delete" not in mysql_users_list'
-      - '"[email protected]" not in mysql_users_list'
-      - '"user@::1" not in mysql_users_list'
-      - '"user@%" not in mysql_users_list'
-      - '"[email protected].%" not in mysql_users_list'
-      - '"[email protected]" not in mysql_users_list'
-      - '"%@192.168.0.1" not in mysql_users_list'
-      - '"[email protected]" in mysql_users_list'
-      - '"user@keep" in mysql_users_list'
-      - '"[email protected].%" in mysql_users_list'
-
-- name: Detect role support on MySQL
-  community.mysql.mysql_query:
-    query: >
-      SELECT 1 FROM information_schema.COLUMNS
-                WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
-                AND COLUMN_NAME = 'is_role';
-    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
-  register: mysql_role_support
-
-- name: Assert that roles remain
-  ansible.builtin.assert:
-    that:
-      - '"role_keep@" in mysql_users_list'
-  when:
-    - mysql_role_support.rowcount[0] > 0

molecule/mysql_hardening/verify_tasks/service.yml

@@ -1,16 +0,0 @@
----
-- name: Load variables from role to use the "mysql_daemon" variable
-  ansible.builtin.include_role:
-    name: devsec.hardening.mysql_hardening
-    apply:
-      tags:
-        - never
-
-- name: Populate service facts
-  ansible.builtin.service_facts:
-
-- name: Check if MySQL is running and enabled
-  ansible.builtin.assert:
-    that:
-      - ansible_facts.services[mysql_daemon + '.service'].state == 'running'
-      - ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'

molecule/nginx_hardening/converge.yml

@@ -1,5 +1,5 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   become: true
   hosts: all
   environment:
@@ -7,9 +7,8 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   vars:
-    nginx_ppa_use: true
+    - nginx_ppa_use: true
-    nginx_ppa_version: stable
+    - nginx_ppa_version: stable
   tasks:
-    - name: Include nginx_hardening role
+    - include_role:
-      ansible.builtin.include_role:
+        name: nginx_hardening
-        name: devsec.hardening.nginx_hardening

molecule/nginx_hardening/molecule.yml

@@ -7,23 +7,28 @@ driver:
   name: docker
 platforms:
   - name: instance
-    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
+    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
     privileged: true
-    cgroupns_mode: host
+    tmpfs:
-    pre_build_image: true
+      - /tmp
+      - /run
+    capabilities:
+      - SYS_ADMIN
+    tty: true
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
+      container: docker
 provisioner:
   name: ansible
-  options:
-    diff: true
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer
+      callback_whitelist: profile_tasks, timer, yaml
-      # Currently not supported by geerlingguy.nginx role
-      # inject_facts_as_vars: false
 verifier:
   name: ansible
 
@@ -34,7 +39,6 @@ scenario:
     - prepare
   check_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -50,12 +54,10 @@ scenario:
     - destroy
   test_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create
     - prepare
-    - check
     - converge
     - idempotence
     - verify

molecule/nginx_hardening/official-nginx-role-debian.yml

@@ -1,24 +1,24 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   hosts: localhost
   vars:
-    nginx_main_template_enable: true
+    - nginx_main_template_enable: true
-    nginx_main_template:
+    - nginx_main_template:
-      template_file: nginx.conf.j2
+        template_file: nginx.conf.j2
-      conf_file_name: nginx.conf
+        conf_file_name: nginx.conf
-      conf_file_location: /etc/nginx/
+        conf_file_location: /etc/nginx/
-      user: www-data
+        user: www-data
-      worker_processes: auto
+        worker_processes: auto
-      error_level: warn
+        error_level: warn
-      worker_connections: 1024
+        worker_connections: 1024
-      http_enable: true
+        http_enable: true
-      http_settings:
+        http_settings:
-        keepalive_timeout: 65
+          keepalive_timeout: 65
-        cache: false
+          cache: false
-        rate_limit: false
+          rate_limit: false
-        keyval: false
+          keyval: false
-      stream_enable: false
+        stream_enable: false
-      http_global_autoindex: false
+        http_global_autoindex: false
   roles:
     - nginxinc.nginx
     - nginx_hardening

molecule/nginx_hardening/official-nginx-role-redhat.yml

@@ -1,5 +1,5 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   hosts: localhost
   roles:
     - nginxinc.nginx

molecule/nginx_hardening/prepare.yml

@@ -1,5 +1,5 @@
 ---
-- name: Prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   become: true
   hosts: all
   environment:
@@ -7,17 +7,22 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: Install required packages
+    - name: install required tools on SuSE
-      ansible.builtin.package:
+      community.general.zypper:
-        name: python3-apt
+        name: "python-xml"
+        state: present
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: install required packages
+      package:
+        name: "python3-apt"
         update_cache: true
-      ignore_errors: true # noqa ignore-errors
+      ignore_errors: true  # noqa ignore-errors
 
     - name: Set correct distribution Version for Amazon Linux
-      ansible.builtin.set_fact:
+      set_fact:
         ansible_distribution_major_version: 7
-      when: ansible_facts.distribution == 'Amazon'
+      when: ansible_distribution == 'Amazon'
 
-    - name: Install nginx with a generic Ansible role
+    - include_role:
-      ansible.builtin.include_role:
         name: geerlingguy.nginx

molecule/nginx_hardening/requirements.yml

@@ -1,3 +1,4 @@
 ---
 roles:
-  - name: geerlingguy.nginx
+  - geerlingguy.git
+  - geerlingguy.nginx

molecule/nginx_hardening/verify.yml

@@ -6,38 +6,57 @@
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  roles:
+    - geerlingguy.git
   tasks:
-    - name: Install procps for debian systems
+    - name: install fake SuSE-release for cinc compatibility
-      ansible.builtin.apt:
+      copy:
-        name: procps
+        content: |
+          openSUSE Faked Enterprise 2020 (x86_64)
+          VERSION = 2020
+          CODENAME = Faked Feature
+        dest: /etc/SuSE-release
+        owner: root
+        group: root
+        mode: '0444'
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: install git for SuSE since geerlinguy.git does not support it
+      zypper:
+        name: git
         state: present
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: Run the equivalent of "apt-get update" as a separate step
+      apt:
         update_cache: true
-      when: ansible_facts.distribution == 'Debian'
+      when: ansible_facts.os_family == 'Debian'
+
+    - name: install required tools on debian
+      apt:
+        name: procps
+      when: ansible_facts.os_family == 'Debian'
+
+    - name: download cinc-auditor
+      get_url:
+        url: https://omnitruck.cinc.sh/install.sh
+        dest: /tmp/install.sh
+        mode: '0775'
+
+    - name: install cinc-auditor
+      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
 
-- name: Verify
-  hosts: localhost
-  environment:
-    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
-    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
-    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  tasks:
     - name: Execute cinc-auditor tests
-      ansible.builtin.command: >
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/nginx-baseline/archive/refs/heads/master.zip"
-        docker run
-        --volume /run/docker.sock:/run/docker.sock
-        docker.io/cincproject/auditor exec
-        -t docker://instance
-        --no-show-progress --no-color
-        --no-distinct-exit https://github.com/dev-sec/nginx-baseline/archive/refs/heads/master.zip
       register: test_results
       changed_when: false
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      ansible.builtin.debug:
+      debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      ansible.builtin.fail:
+      fail:
-        msg: Inspec failed to validate
+        msg: "Inspec failed to validate"
       when: test_results.rc != 0

molecule/os_hardening/converge.yml

@@ -1,36 +1,32 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  collections:
+    - devsec.hardening
   tasks:
-    - name: Workaround for https://github.com/ansible/ansible/issues/66304
+    - name: workaround for https://github.com/ansible/ansible/issues/66304
-      ansible.builtin.set_fact:
+      set_fact:
-        ansible_virtualization_type: docker
+        ansible_virtualization_type: "docker"
-    - name: Include os_hardening role
+    - include_role:
-      ansible.builtin.include_role:
+        name: os_hardening
-        name: devsec.hardening.os_hardening
   vars:
     os_security_users_allow: change_user
     os_security_kernel_enable_core_dump: false
-    os_auditd_enabled: false
     os_security_suid_sgid_remove_from_unknown: true
     os_auth_pam_passwdqc_enable: false
     os_auth_lockout_time: 15
-    os_env_extra_user_paths: [/home]
+    os_desktop_enable: true
+    os_env_extra_user_paths: ['/home']
     os_auth_allow_homeless: true
-    os_security_suid_sgid_blacklist: [/bin/umount]
+    os_security_suid_sgid_blacklist: ['/bin/umount']
-    os_security_suid_sgid_whitelist: [/usr/bin/rlogin]
+    os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
     os_filesystem_whitelist: []
-    os_yum_repo_file_whitelist: [foo.repo]
+    os_yum_repo_file_whitelist: ['foo.repo']
-    os_users_without_password_ageing: [pw_no_ageing]
-    os_auth_pw_warn_age: 7
-    os_netrc_enabled: false
-    os_ignore_users: [shell_sys_acc]
-    os_ignore_home_folder_users: [user_with_777_home]
     sysctl_config:
       net.ipv4.ip_forward: 0
       net.ipv6.conf.all.forwarding: 0
@@ -71,6 +67,8 @@
 # - name: wrapper playbook for kitchen testing "ansible-os-hardening"
 #  hosts: all
 #  become: true
+#  collections:
+#    - devsec.hardening
 #  vars:
 #    os_auditd_enabled: false
 #  tasks:
@@ -80,9 +78,9 @@
 #      when: ansible_facts.distribution == 'Fedora'
 #
 #    - name: Run the equivalent of "apt-get update" as a separate step
-#      ansible.builtin.apt:
+#      apt:
 #        update_cache: yes
 #      when: ansible_facts.os_family == 'Debian'
 #
 #    - include_role:
-#        name: devsec.hardening.os_hardening
+#        name: os_hardening

molecule/os_hardening/molecule.yml

@@ -1,24 +1,34 @@
 ---
+dependency:
+  name: galaxy
+  options:
+    role-file: molecule/os_hardening/requirements.yml
 driver:
   name: docker
 platforms:
   - name: instance
-    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
+    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
     privileged: true
-    cgroupns_mode: host
+    tmpfs:
-    pre_build_image: true
+      - /tmp
+      - /run
+    capabilities:
+      - SYS_ADMIN
+    tty: true
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
+      container: docker
 provisioner:
   name: ansible
-  options:
-    diff: true
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer
+      callback_whitelist: profile_tasks, timer, yaml
-      inject_facts_as_vars: false
 verifier:
   name: ansible
 
@@ -29,7 +39,6 @@ scenario:
     - prepare
   check_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -45,12 +54,10 @@ scenario:
     - destroy
   test_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create
     - prepare
-    - check
     - converge
     - idempotence
     - verify

molecule/os_hardening/prepare.yml

@@ -1,38 +1,40 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
+  collections:
+    - devsec.hardening
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: Set ansible_python_interpreter to "/usr/bin/python3" on fedora
+    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
-      ansible.builtin.set_fact:
+      set_fact:
-        ansible_python_interpreter: /usr/bin/python3
+        ansible_python_interpreter: "/usr/bin/python3"
       when: ansible_facts.distribution == 'Fedora'
 
     - name: Run the equivalent of "apt-get update && apt-get upgrade"
-      ansible.builtin.apt:
+      apt:
-        upgrade: safe
+        name: "*"
+        state: latest
         update_cache: true
-      when: ansible_facts.os_family == 'Debian'
+      when: ansible_os_family == 'Debian'
 
-    - name: Install required tools on SuSE
+    - name: install required tools on SuSE
       # cannot use zypper module, since it depends on python-xml
-      ansible.builtin.command: zypper -n install awk
+      shell: "zypper -n install python-xml"
-      changed_when: false
       when: ansible_facts.os_family == 'Suse'
 
-    - name: Install required tools on fedora
+    - name: install required tools on fedora
-      ansible.builtin.dnf:
+      dnf:
         name:
           - python
           - findutils
           - procps-ng
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: Install required tools on Arch
+    - name: install required tools on Arch
       community.general.pacman:
         name:
           - awk
@@ -40,8 +42,8 @@
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: Install required tools on RHEL # noqa ignore-errors
+    - name: install required tools on RHEL  # noqa ignore-errors
-      ansible.builtin.dnf:
+      yum:
         name:
           - openssh-clients
           - openssh
@@ -49,19 +51,10 @@
         update_cache: true
       ignore_errors: true
 
-    - name: Create recursing symlink to test minimize access
+    - name: create recursing symlink to test minimize access
-      ansible.builtin.shell: rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz
+      shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
       changed_when: false
 
-    - name: Include YUM prepare tasks
+    - name: include YUM prepare tasks
-      ansible.builtin.include_tasks: prepare_tasks/yum.yml
+      include_tasks: prepare_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'
-
-    - name: Include preparation tasks
-      ansible.builtin.include_tasks:
-        file: "{{ item }}"
-      loop:
-        - prepare_tasks/netrc.yml
-        - prepare_tasks/pw_ageing.yml
-        - prepare_tasks/sys_account_shell.yml
-        - prepare_tasks/ignore_home_folders.yml

molecule/os_hardening/prepare_tasks/ignore_home_folders.yml

@@ -1,9 +0,0 @@
----
-- name: Create user whose home-folder should not be touched
-  ansible.builtin.user:
-    name: user_with_777_home
-
-- name: Change mode of home-folder for user to 777
-  ansible.builtin.file:
-    path: /home/user_with_777_home
-    mode: "0777"

molecule/os_hardening/prepare_tasks/netrc.yml

@@ -1,9 +0,0 @@
----
-- name: create '.netrc' in /root
-  ansible.builtin.copy:
-    dest: /root/.netrc
-    mode: "0600"
-    content: |
-      machine localhost
-      login root
-      password ipsum

molecule/os_hardening/prepare_tasks/pw_ageing.yml

@@ -1,10 +0,0 @@
----
-- name: Create user those password ageing should not be changed
-  user:
-    name: pw_no_ageing
-    password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
-
-- name: Create user those password ageing should be changed
-  user:
-    name: pw_ageing
-    password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1

molecule/os_hardening/prepare_tasks/sys_account_shell.yml

@@ -1,5 +0,0 @@
----
-- name: Create system user with shell that should keep it
-  user:
-    name: shell_sys_acc
-    shell: /bin/bash

molecule/os_hardening/prepare_tasks/yum.yml

@@ -1,5 +1,5 @@
 ---
-- name: Create 'foo' repository
+- name: create 'foo' repository
   ansible.builtin.yum_repository:
     name: foo
     description: mandatory description
@@ -7,7 +7,7 @@
     enabled: false
     gpgcheck: false
 
-- name: Create 'bar' repository
+- name: create 'bar' repository
   ansible.builtin.yum_repository:
     name: bar
     description: mandatory description

molecule/os_hardening/requirements.yml

@@ -0,0 +1,3 @@
+---
+roles:
+  - geerlingguy.git

molecule/os_hardening/verify.yml

@@ -6,82 +6,79 @@
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  roles:
+    - geerlingguy.git
   tasks:
-    - name: Set ansible_python_interpreter to "/usr/bin/python3"
+    - name: install fake SuSE-release for cinc compatibility
-      ansible.builtin.set_fact:
+      copy:
-        ansible_python_interpreter: /usr/bin/python3
+        content: |
-      when: ansible_facts.distribution == 'Fedora'
+          openSUSE Faked Enterprise 2020 (x86_64)
+          VERSION = 2020
+          CODENAME = Faked Feature
+        dest: /etc/SuSE-release
+        owner: root
+        group: root
+        mode: '0444'
+      when: ansible_facts.os_family == 'Suse'
 
-    - name: Include verification tasks
+    - name: install git for SuSE since geerlinguy.git does not support it
-      ansible.builtin.include_tasks:
+      zypper:
-        file: "{{ item }}"
+        name: git
-      loop:
+        state: present
-        - verify_tasks/sys_account_shell.yml
+      when: ansible_facts.os_family == 'Suse'
-        - verify_tasks/pw_ageing.yml
-        - verify_tasks/netrc.yml
-        - verify_tasks/ignore_home_folders.yml
-        - verify_tasks/ssh_auth_locked.yml
 
-    # temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
+    - name: Run the equivalent of "apt-get update" as a separate step
-    #    - name: Include PAM tests
+      apt:
-    #      ansible.builtin.include_tasks: verify_tasks/pam.yml
+        update_cache: true
-    #      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+      when: ansible_facts.os_family == 'Debian'
 
-    - name: Include YUM tests
+    - name: install required tools on debian
-      ansible.builtin.include_tasks: verify_tasks/yum.yml
+      apt:
+        name: procps
+      when: ansible_facts.os_family == 'Debian'
+
+    - name: include PAM tests
+      include_tasks: verify_tasks/pam.yml
+      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+
+    - name: include YUM tests
+      include_tasks: verify_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'
 
-- name: Verify
+    - name: download cinc-auditor
-  hosts: localhost
+      get_url:
-  environment:
+        url: https://omnitruck.cinc.sh/install.sh
-    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+        dest: /tmp/install.sh
-    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+        mode: '0775'
-    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+
-  tasks:
+    - name: install cinc-auditor
-    - name: Execute cinc-auditor tests
+      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
-      ansible.builtin.command: >
+
-        docker run
+    - name: Execute cinc-auditor tests  # noqa ignore-errors
-        --volume /run/docker.sock:/run/docker.sock
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
-        --volume {{ playbook_dir }}/waivers.yaml:/waivers.yaml
-        docker.io/cincproject/auditor exec
-        -t docker://instance
-        --no-show-progress --no-color
-        --waiver-file /waivers.yaml
-        --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip
       register: test_results
       changed_when: false
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      ansible.builtin.debug:
+      debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      ansible.builtin.fail:
+      fail:
-        msg: Inspec failed to validate
+        msg: "Inspec failed to validate"
       when: test_results.rc != 0
 
-- name: Verify
-  hosts: all
-  become: true
-  environment:
-    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
-    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
-    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  vars:
-    os_auditd_enabled: false
-    os_env_umask: "027 #override"
-  tasks:
     # test if variable can be overridden
-    - name: Workaround for https://github.com/ansible/ansible/issues/66304
+    - name: workaround for https://github.com/ansible/ansible/issues/66304
-      ansible.builtin.set_fact:
+      set_fact:
-        ansible_virtualization_type: docker
+        ansible_virtualization_type: "docker"
+        os_env_umask: "027 #override"
 
-    - name: Include os_hardening role
+    - include_role:
-      ansible.builtin.include_role:
+        name: os_hardening
-        name: devsec.hardening.os_hardening
 
-    - name: Verify os_env_umask
+    - name: verify os_env_umask
-      ansible.builtin.command:
+      shell:
         cmd: "grep '027 #override' /etc/login.defs"
       changed_when: false

molecule/os_hardening/verify_tasks/ignore_home_folders.yml

@@ -1,10 +0,0 @@
----
-- name: Get properties of user user_with_777_home's home-folder
-  ansible.builtin.stat:
-    path: /home/user_with_777_home
-  register: stats
-
-- name: Check that the home-folder has mode 777
-  ansible.builtin.assert:
-    that:
-      - stats.stat.mode == "0777"

molecule/os_hardening/verify_tasks/netrc.yml

@@ -1,19 +0,0 @@
----
-- name: Test that .netrc in root homedir exists
-  ansible.builtin.file:
-    path: /root/.netrc
-    state: file
-  register: result_test_netrc
-
-- name: Output result if .netrc for user root exists
-  ansible.builtin.assert:
-    that:
-      - result_test_netrc.state == 'file'
-    fail_msg: .netrc in /root/ not present
-    success_msg: .netrc exists in /root/
-
-- name: Delete '.netrc' in /root
-  ansible.builtin.file:
-    path: /root/.netrc
-    state: absent
-  when: result_test_netrc.state == 'file'

molecule/os_hardening/verify_tasks/pam.yml

@@ -1,24 +1,17 @@
 ---
-- name: install pip
+- name: download pam-tester
-  package:
+  get_url:
-    name:
+    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
-      - python3-pip
+    dest: /bin/pam-tester
-      - python3-setuptools
+    mode: 0555
-    state: present
-
-- name: install pam-tester
-  ansible.builtin.pip:
-    name: pam-tester
-    state: present
-    executable: /usr/bin/pip3
 
 - name: set password for test
-  ansible.builtin.set_fact:
+  set_fact:
-    test_pw: myTest!pw
+    test_pw: "myTest!pw"
 
 - name: set locale for test
-  ansible.builtin.set_fact:
+  set_fact:
-    locale: en_US.UTF-8
+    locale: "en_US.UTF-8"
   when:
     - ansible_facts.os_family == 'RedHat'
     - ansible_facts.distribution_major_version < '8'
@@ -28,26 +21,26 @@
     name: testuser
     password: "{{ test_pw | password_hash('sha512') }}"
 
-- name: check successful login with correct password
+- name: check successfull login with correct password
-  ansible.builtin.shell:
+  shell:
-    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
     LANG: "{{ locale | default('C.UTF-8') }}"
 
-- name: check unsuccessful login with incorrect password
+- name: check unsuccessfull login with incorrect password
-  ansible.builtin.shell:
+  shell:
-    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail
+    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
     LANG: "{{ locale | default('C.UTF-8') }}"
   with_sequence: count=6
 
-- name: check unsuccessful login, with correct password (lockout)
+- name: check unsuccessfull login, with correct password (lockout)
-  ansible.builtin.shell:
+  shell:
-    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail
+    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -57,9 +50,9 @@
   pause:
     seconds: 20
 
-- name: check successful login
+- name: check successfull login
-  ansible.builtin.shell:
+  shell:
-    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"

molecule/os_hardening/verify_tasks/pw_ageing.yml

@@ -1,32 +0,0 @@
----
-- name: Get Password Expiry date for use pw_no_ageing
-  ansible.builtin.shell: chage -l pw_no_ageing | grep "Password expires" | cut -d ":" -f 2
-  changed_when: false
-  register: expiry_date
-
-- name: Check that the expiry date of pw_no_ageing is "never"
-  ansible.builtin.assert:
-    that:
-      - expiry_date.stdout | trim == 'never'
-
-- name: Get Password Expiry date for pw_ageing
-  ansible.builtin.shell: chage -l pw_ageing | grep "Password expires" | cut -d ":" -f 2
-  changed_when: false
-  register: expiry_date
-
-- name: Check that the expiry date of pw_ageing is 60 days
-  ansible.builtin.assert:
-    # this uses the date from the expire_date variable and subtracts the current date.
-    # it should be bigger that the password_expire_min of the user "pw_no_ageing"
-    that:
-      - ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_facts.date_time.date | to_datetime('%Y-%m-%d')).days == 60
-
-- name: Get Password Expiry warning days for pw_ageing
-  ansible.builtin.shell: chage -l pw_ageing | grep "warning before password expires" | cut -d ":" -f 2
-  changed_when: false
-  register: expiry_warndays
-
-- name: Check that number of days of warning before password expires is 7 days
-  ansible.builtin.assert:
-    that:
-      - expiry_warndays.stdout | trim == '7'

molecule/os_hardening/verify_tasks/ssh_auth_locked.yml

@@ -1,90 +0,0 @@
----
-- name: Install tools
-  package:
-    name: "{{ item }}"
-    state: present
-  ignore_errors: true
-  loop:
-    - sshpass
-    - openssh
-    - openssh-clients
-    - openssh-server
-
-- name: Allow password Login for sshd
-  ansible.builtin.lineinfile:
-    path: /etc/ssh/sshd_config
-    search_string: PasswordAuthentication no
-    line: PasswordAuthentication yes
-  when:
-    - ansible_facts.distribution == "Amazon"
-
-- name: Start sshd service
-  ansible.builtin.service:
-    name: "{{ item }}"
-    state: started
-  ignore_errors: true
-  loop:
-    - sshd
-    - ssh
-
-- name: Set password for test
-  ansible.builtin.set_fact:
-    test_pw: myTest!pw
-
-- name: Create locked_user
-  user:
-    name: locked_user
-    password: "{{ test_pw | password_hash('sha512') }}"
-
-- name: Create ssh-client-keypair
-  community.crypto.openssh_keypair:
-    path: /root/locked_user_id
-    type: ed25519
-    state: present
-  register: generated_key
-
-- name: Add ssh-public-key to locked_user
-  ansible.posix.authorized_key:
-    user: locked_user
-    key: "{{ generated_key.public_key }}"
-    state: present
-
-- name: Check successful login with password
-  ansible.builtin.shell:
-    cmd: sshpass -p {{ test_pw }} ssh -o StrictHostKeyChecking=no locked_user@localhost echo "success"
-
-- name: Check successful login with ssh key
-  ansible.builtin.shell:
-    cmd: ssh -i /root/locked_user_id -o StrictHostKeyChecking=no locked_user@localhost echo "success"
-
-- name: Set password change date for locked_user
-  ansible.builtin.shell:
-    cmd: chage -d 2020-01-01 locked_user
-
-- name: Check unsuccessful login with password
-  ansible.builtin.shell:
-    cmd: sshpass -p {{ test_pw }} ssh -o StrictHostKeyChecking=no locked_user@localhost echo "success"
-  register: output
-  ignore_errors: true
-
-- name: Assert check unsuccessful login
-  ansible.builtin.assert:
-    that:
-      - output.rc | int == 1
-      - "'WARNING: Your password has expired.' in output.stderr"
-      - "'success' not in output.stdout"
-  when:
-    - ansible_facts.os_family != "Suse"
-
-- name: Assert check unsuccessful login
-  ansible.builtin.assert:
-    that:
-      - output.rc | int == 5
-      - output.stderr | length == 0
-      - output.stdout | length == 0
-  when:
-    - ansible_facts.os_family == "Suse"
-
-- name: Check successful login with ssh key
-  ansible.builtin.shell:
-    cmd: ssh -i /root/locked_user_id -o StrictHostKeyChecking=no locked_user@localhost echo "success"

molecule/os_hardening/verify_tasks/sys_account_shell.yml

@@ -1,9 +0,0 @@
----
-- name: Read local linux user database
-  getent:
-    database: passwd
-
-- name: Check that shell_sys_acc's shell is still bash
-  ansible.builtin.assert:
-    that:
-      - ansible_facts.getent_passwd['shell_sys_acc'][5] == "/bin/bash"

molecule/os_hardening/verify_tasks/yum.yml

@@ -1,8 +1,8 @@
 ---
-- name: Verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
+- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
-  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
+  command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
   changed_when: false
 
-- name: Verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
+- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
-  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
+  command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
   changed_when: false

molecule/os_hardening/waivers.yaml

@@ -1,9 +0,0 @@
-os-14:
-  run: false
-  justification: "ansible does not gather all fact-mounts (e.g. mounts with tmpfs) so we cannot change these. see https://github.com/ansible/ansible/pull/79787"
-os-15:
-  run: false
-  justification: "ansible does not gather all fact-mounts (e.g. mounts with tmpfs) so we cannot change these. see https://github.com/ansible/ansible/pull/79787"
-os-16:
-  run: false
-  justification: "ansible does not gather all fact-mounts (e.g. mounts with tmpfs) so we cannot change these. see https://github.com/ansible/ansible/pull/79787"

molecule/os_hardening_vm/converge.yml

@@ -1,44 +1,23 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  collections:
+    - devsec.hardening
   tasks:
-    - name: Override for arch
+    - name: override for arch
-      ansible.builtin.set_fact:
+      set_fact: 
         os_mnt_boot_enabled: false
-        os_mnt_tmp_enabled: true
-        os_mnt_tmp_src: tmpfs
-        os_mnt_tmp_filesystem: tmpfs
       when: ansible_facts.os_family == 'Archlinux'
-
+    - include_role:
-    - name: Overrides for Fedora image
+        name: os_hardening
-      ansible.builtin.set_fact:
-        os_mnt_tmp_enabled: true
-        os_mnt_tmp_src: tmpfs
-        os_mnt_tmp_filesystem: tmpfs
-      when: ansible_facts.distribution == 'Fedora'
-
-    - name: Overrides for Fedora 40 image
-      ansible.builtin.set_fact:
-        os_mnt_var_enabled: true
-        os_mnt_var_src: UUID=282c6d73-afc2-4113-9856-c7679ad51920
-        os_mnt_var_filesystem: btrfs
-        os_mnt_var_options: rw,nosuid,nodev,compress=zstd:1,subvol=var
-      when:
-        - ansible_facts.distribution == 'Fedora'
-        - ansible_facts.distribution_major_version|int == 40
-
-    - name: Include os_hardening role
-      ansible.builtin.include_role:
-        name: devsec.hardening.os_hardening
   vars:
     os_auth_pam_passwdqc_enable: false
     os_auth_lockout_time: 15
-    os_yum_repo_file_whitelist: [foo.repo]
+    os_yum_repo_file_whitelist: ['foo.repo']
     os_mnt_boot_enabled: true
-    os_mnt_home_enabled: true
+    os_mnt_boot_src: "/dev/vda1"
-    os_mnt_boot_src: /dev/vda1

molecule/os_hardening_vm/molecule.yml

@@ -2,32 +2,24 @@
 dependency:
   name: galaxy
   options:
-    role-file: molecule/os_hardening_vm/requirements.yml
+    role-file: molecule/os_hardening/requirements.yml
 driver:
   name: vagrant
   provider:
     name: libvirt
 platforms:
-  # we need to name every instance differently to start multiple VMs on the same host (parallelization)
+  - name: instance
-  # since we also need to use different OS users to run the tests because of how molecule operates,
+    box: "generic/${MOLECULE_DISTRO}"
-  # the VM names must be predictable by OS user (to clean up canceled runs)
-  - name: ${USER}
-    box: ${MOLECULE_DISTRO}
     memory: 1024
     cpus: 2
 provisioner:
   name: ansible
-  options:
-    diff: true
   env:
     ANSIBLE_PIPELINING: "True"
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer
+      callback_whitelist: profile_tasks, timer, yaml
-      # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
-      library: "${MOLECULE_PROJECT_DIRECTORY}/plugins/modules:/usr/share/ansible:${MOLECULE_VAGRANT_PLUGIN_DIR}"
-      inject_facts_as_vars: false
 verifier:
   name: ansible
   env:
@@ -40,7 +32,6 @@ scenario:
     - prepare
   check_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -56,12 +47,10 @@ scenario:
     - destroy
   test_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create
     - prepare
-    - check
     - converge
     - idempotence
     - verify

molecule/os_hardening_vm/prepare.yml

@@ -1,87 +1,49 @@
 ---
-- name: Prepare Archliux host
+- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
-  hosts: all
-  become: true
-  gather_facts: false
-  tasks:
-    - name: Install python, since it's not installed by default
-      ansible.builtin.raw: pacman --noconfirm -Sy python
-      changed_when: false
-      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
-
-- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
+  collections:
+    - devsec.hardening
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: Set ansible_python_interpreter to "/usr/bin/python3" on fedora
+    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
-      ansible.builtin.set_fact:
+      set_fact:
-        ansible_python_interpreter: /usr/bin/python3
+        ansible_python_interpreter: "/usr/bin/python3"
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: Block update of Grub, because of error
-      ansible.builtin.dpkg_selections:
-        name: grub-pc
-        selection: hold
-      when: ansible_facts.os_family == 'Debian'
-
-    # we need to free up space, since the /boot partition in some Vagrant images is
-    # pretty small and system updates might fail
-    - name: Find all initrd.img to delete them
-      ansible.builtin.find:
-        paths: /boot
-        patterns: "initrd.img*"
-      register: find_results
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: Delete all initrd.img to free space on /boot
-      ansible.builtin.file:
-        path: "{{ item['path'] }}"
-        state: absent
-      with_items: "{{ find_results['files'] }}"
-      when: ansible_facts.os_family == 'Debian'
-
     - name: Run the equivalent of "apt-get update && apt-get upgrade"
-      ansible.builtin.apt:
+      apt:
-        upgrade: safe
+        name: "*"
+        state: latest
         update_cache: true
-      when: ansible_facts.os_family == 'Debian'
+      when: ansible_os_family == 'Debian'
 
-    - name: Install required tools on fedora
+    - name: install required tools on SuSE
-      ansible.builtin.dnf:
+      # cannot use zypper module, since it depends on python-xml
+      shell: "zypper -n install python-xml"
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: install required tools on fedora
+      dnf:
         name:
           - python
           - findutils
           - procps-ng
-          - python3-libselinux
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: Install required tools on AlmaLinux
+    - name: install required tools on Arch
-      ansible.builtin.dnf:
-        name:
-          - initscripts
-      when: ansible_facts.distribution == 'AlmaLinux'
-
-    - name: Install required tools on Arch
       community.general.pacman:
         name:
           - awk
-          - archlinux-keyring
+        state: present
-        state: latest
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: Run the equivalent of "pacman -Syu"
+    - name: install required tools on RHEL  # noqa ignore-errors
-      community.general.pacman:
+      yum:
-        update_cache: true
-        upgrade: true
-      when: ansible_facts.os_family == 'Archlinux'
-
-    - name: Install required tools on RHEL # noqa ignore-errors
-      ansible.builtin.dnf:
         name:
           - openssh-clients
           - openssh
@@ -89,15 +51,10 @@
         update_cache: true
       ignore_errors: true
 
-    - name: Create recursing symlink to test minimize access
+    - name: create recursing symlink to test minimize access
-      ansible.builtin.shell: rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz
+      shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
       changed_when: false
 
-    - name: Unmount EFI partition to get rid of vfat filesystem (qemu has no firmware image that inspec can detect)
+    - name: include YUM prepare tasks
-      ansible.posix.mount:
+      include_tasks: prepare_tasks/yum.yml
-        path: /boot/efi
-        state: unmounted
-
-    - name: Include YUM prepare tasks
-      ansible.builtin.include_tasks: prepare_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'

molecule/os_hardening_vm/prepare_tasks/yum.yml

@@ -1,5 +1,5 @@
 ---
-- name: Create 'foo' repository
+- name: create 'foo' repository
   ansible.builtin.yum_repository:
     name: foo
     description: mandatory description
@@ -7,7 +7,7 @@
     enabled: false
     gpgcheck: false
 
-- name: Create 'bar' repository
+- name: create 'bar' repository
   ansible.builtin.yum_repository:
     name: bar
     description: mandatory description

molecule/os_hardening_vm/requirements.yml

@@ -1,3 +1,3 @@
 ---
 roles:
-  - name: geerlingguy.git
+  - geerlingguy.git

molecule/os_hardening_vm/verify.yml

@@ -6,55 +6,65 @@
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  roles:
+    - geerlingguy.git
   tasks:
-    # temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
+    - name: install fake SuSE-release for cinc compatibility
-    #    - name: Include PAM tests
+      copy:
-    #      ansible.builtin.include_tasks: verify_tasks/pam.yml
+        content: |
-    #      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+          openSUSE Faked Enterprise 2020 (x86_64)
+          VERSION = 2020
+          CODENAME = Faked Feature
+        dest: /etc/SuSE-release
+        owner: root
+        group: root
+        mode: '0444'
+      when: ansible_facts.os_family == 'Suse'
 
-    - name: Include YUM tests
+    - name: install git for SuSE since geerlinguy.git does not support it
-      ansible.builtin.include_tasks: verify_tasks/yum.yml
+      zypper:
+        name: git
+        state: present
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: Run the equivalent of "apt-get update" as a separate step
+      apt:
+        update_cache: true
+      when: ansible_facts.os_family == 'Debian'
+
+    - name: install required tools on debian
+      apt:
+        name: procps
+      when: ansible_facts.os_family == 'Debian'
+
+    - name: include PAM tests
+      include_tasks: verify_tasks/pam.yml
+      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+
+    - name: include YUM tests
+      include_tasks: verify_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'
 
-- name: Verify
+    - name: download cinc-auditor
-  hosts: localhost
+      get_url:
-  environment:
+        url: https://omnitruck.cinc.sh/install.sh
-    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+        dest: /tmp/install.sh
-    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+        mode: '0775'
-    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  tasks:
-    - name: Get ssh-config
-      ansible.builtin.command:
-        cmd: vagrant ssh-config
-        chdir: "{{ molecule_ephemeral_directory }}"
-      register: ssh_config
-      changed_when: false
 
-    - name: Create ssh-config file
+    - name: install cinc-auditor
-      ansible.builtin.copy:
+      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
-        content: "{{ ssh_config.stdout_lines | join ('\n') }}"
-        dest: "{{ molecule_ephemeral_directory }}/ssh-config"
-        mode: "0400"
-      changed_when: false
 
-    - name: Execute cinc-auditor tests
+    - name: Execute cinc-auditor tests  # noqa ignore-errors
-      ansible.builtin.command: >
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
-        docker run --rm
-        --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
-        docker.io/cincproject/auditor exec
-        --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
-        -t ssh://{{ lookup('env', 'USER') }}
-        --sudo --no-show-progress --no-color
-        --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip
       register: test_results
       changed_when: false
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      ansible.builtin.debug:
+      debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      ansible.builtin.fail:
+      fail:
-        msg: Inspec failed to validate
+        msg: "Inspec failed to validate"
       when: test_results.rc != 0

molecule/os_hardening_vm/verify_tasks/pam.yml

@@ -1,23 +1,17 @@
 ---
-- name: install pip
+- name: download pam-tester
-  package:
+  get_url:
-    name:
+    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
-      - python3-pip
+    dest: /bin/pam-tester
-      - python3-setuptools
+    mode: 0555
-    state: present
-
-- name: install pam-tester
-  ansible.builtin.pip:
-    name: pam-tester
-    state: present
 
 - name: set password for test
-  ansible.builtin.set_fact:
+  set_fact:
-    test_pw: myTest!pw
+    test_pw: "myTest!pw"
 
 - name: set locale for test
-  ansible.builtin.set_fact:
+  set_fact:
-    locale: en_US.UTF-8
+    locale: "en_US.UTF-8"
   when:
     - ansible_facts.os_family == 'RedHat'
     - ansible_facts.distribution_major_version < '8'
@@ -27,26 +21,26 @@
     name: testuser
     password: "{{ test_pw | password_hash('sha512') }}"
 
-- name: check successful login with correct password
+- name: check successfull login with correct password
-  ansible.builtin.shell:
+  shell:
-    cmd: pam-tester --user testuser --password {{ test_pw }}
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
     LANG: "{{ locale | default('C.UTF-8') }}"
 
-- name: check unsuccessful login with incorrect password
+- name: check unsuccessfull login with incorrect password
-  ansible.builtin.shell:
+  shell:
-    cmd: pam-tester --user testuser --password {{ test_pw }}fail --expectfail
+    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
     LANG: "{{ locale | default('C.UTF-8') }}"
   with_sequence: count=6
 
-- name: check unsuccessful login, with correct password (lockout)
+- name: check unsuccessfull login, with correct password (lockout)
-  ansible.builtin.shell:
+  shell:
-    cmd: pam-tester --user testuser --password {{ test_pw }} --expectfail
+    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -56,9 +50,9 @@
   pause:
     seconds: 20
 
-- name: check successful login
+- name: check successfull login
-  ansible.builtin.shell:
+  shell:
-    cmd: pam-tester --user testuser --password {{ test_pw }}
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"

molecule/os_hardening_vm/verify_tasks/yum.yml

@@ -1,8 +1,8 @@
 ---
-- name: Verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
+- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
-  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
+  command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
   changed_when: false
 
-- name: Verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
+- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
-  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
+  command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
   changed_when: false

molecule/shared/prerequisites.yml

@@ -1,9 +0,0 @@
----
-- name: Verify prerequisites
-  hosts: localhost
-  tasks:
-    - name: Make sure environment variable for MOLECULE_DISTRO is set
-      ansible.builtin.assert:
-        that:
-          - "lookup('env','MOLECULE_DISTRO') | length > 0"
-        fail_msg: "You need to set MOLECULE_DISTRO to a supported image name. See CONTRIBUTING.md"

molecule/ssh_hardening/converge.yml

@@ -1,13 +1,13 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
+  become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  collections:
+    - devsec.hardening
   tasks:
-    - name: Include ssh_hardening role
+    - include_role:
-      ansible.builtin.include_role:
+        name: ssh_hardening
-        name: devsec.hardening.ssh_hardening
-  vars:
-    sftp_enabled: false

molecule/ssh_hardening/molecule.yml

@@ -1,30 +1,34 @@
 ---
+dependency:
+  name: galaxy
+  options:
+    role-file: molecule/ssh_hardening/requirements.yml
 driver:
   name: docker
 platforms:
   - name: instance
-    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
+    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
     privileged: true
-    cgroupns_mode: host
+    tmpfs:
-    pre_build_image: true
+      - /tmp
+      - /run
+    capabilities:
+      - SYS_ADMIN
+    tty: true
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
+      container: docker
 provisioner:
   name: ansible
-  options:
-    diff: true
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer
+      callback_whitelist: profile_tasks, timer, yaml
-      inject_facts_as_vars: false
-  inventory:
-    host_vars:
-      # https://molecule.readthedocs.io/en/latest/examples.html#docker-with-non-privileged-user
-      # setting for the platform instance named 'instance'
-      instance:
-        ansible_user: ansible
 verifier:
   name: ansible
 
@@ -35,7 +39,6 @@ scenario:
     - prepare
   check_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -51,12 +54,10 @@ scenario:
     - destroy
   test_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create
     - prepare
-    - check
     - converge
     - idempotence
     - verify

molecule/ssh_hardening/prepare.yml

@@ -1,5 +1,5 @@
 ---
-- name: Prepare the molecule container for the role
+- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
   become: true
   environment:
@@ -7,38 +7,33 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: Use python3
+    - name: use python3
-      ansible.builtin.set_fact:
+      set_fact:
         ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: Install dnf packages # noqa ignore-errors
+    - name: install packages  # noqa ignore-errors
-      ansible.builtin.dnf:
+      yum:
         name:
           - openssh-clients
           - openssh-server
-        state: present
-        update_cache: true
-      ignore_errors: true
-
-    - name: Install libselinux-python # noqa ignore-errors
-      ansible.builtin.dnf:
-        name:
           - libselinux-python
         state: present
         update_cache: true
       ignore_errors: true
 
-    - name: Install procps-ng # noqa ignore-errors
+    - name: install packages  # noqa ignore-errors
-      ansible.builtin.dnf:
+      dnf:
         name:
+          - openssh-clients
+          - openssh-server
           - procps-ng
         state: present
         update_cache: true
       ignore_errors: true
 
-    - name: Install apt packages # noqa ignore-errors
+    - name: install packages  # noqa ignore-errors
-      ansible.builtin.apt:
+      apt:
         name:
           - openssh-client
           - openssh-server
@@ -46,28 +41,19 @@
         update_cache: true
       ignore_errors: true
 
-    - name: Install required tools on SuSE
+    - name: install required tools on SuSE
       # cannot use zypper module, since it depends on python-xml
-      ansible.builtin.command: zypper -n install python-xml
+      shell: "zypper -n install python-xml"
-      changed_when: false
       when: ansible_facts.os_family == 'Suse'
 
-    - name: Install packages on SuSE
+    - name: install packages
-      community.general.zypper:
+      zypper:
         name:
-          - openssh
+          - "openssh"
       when: ansible_facts.os_family == 'Suse'
 
-    - name: Install required tools on Alpine
+    - name: install required tools on Arch
-      community.general.apk:
+      pacman:
-        name:
-          - openssh
-        state: present
-        update_cache: true
-      when: ansible_facts.os_family == 'Alpine'
-
-    - name: Install required tools on Arch
-      community.general.pacman:
         name:
           - openssh
           - awk
@@ -75,6 +61,16 @@
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: Create ssh host keys # noqa ignore-errors no-changed-when
+    - name: created needed directory
-      ansible.builtin.command: ssh-keygen -A
+      file:
+        path: "/var/run/sshd"
+        state: directory
+
+    - name: create ssh host keys  # noqa ignore-errors
+      command: "ssh-keygen -A"
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
+            ansible_facts.distribution == "Fedora" or
+            ansible_facts.distribution == "Amazon" or
+            ansible_facts.os_family == "Suse"
+      changed_when: false
       ignore_errors: true

molecule/ssh_hardening/requirements.yml

@@ -0,0 +1,3 @@
+---
+roles:
+  - geerlingguy.git

molecule/ssh_hardening/verify.yml

@@ -1,28 +1,57 @@
 ---
 - name: Verify
-  hosts: localhost
+  hosts: all
+  become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  roles:
+    - geerlingguy.git
   tasks:
+    - name: install fake SuSE-release for cinc compatibility
+      copy:
+        content: |
+          openSUSE Faked Enterprise 2020 (x86_64)
+          VERSION = 2020
+          CODENAME = Faked Feature
+        dest: /etc/SuSE-release
+        owner: root
+        group: root
+        mode: '0444'
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: install git for SuSE since geerlinguy.git does not support it
+      zypper:
+        name: git
+        state: present
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: install crypto compat modules on fedora
+      dnf:
+        name: libxcrypt-compat
+      when: ansible_facts.distribution == 'Fedora'
+
+    - name: download cinc-auditor
+      get_url:
+        url: https://omnitruck.cinc.sh/install.sh
+        dest: /tmp/install.sh
+        mode: '0775'
+
+    - name: install cinc-auditor
+      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
+
     - name: Execute cinc-auditor tests
-      ansible.builtin.command: >
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip"
-        docker run
-        --volume /run/docker.sock:/run/docker.sock
-        docker.io/cincproject/auditor exec
-        -t docker://instance
-        --no-show-progress --no-color
-        --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip
       register: test_results
       changed_when: false
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      ansible.builtin.debug:
+      debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      ansible.builtin.fail:
+      fail:
-        msg: Inspec failed to validate
+        msg: "Inspec failed to validate"
       when: test_results.rc != 0

molecule/ssh_hardening_custom_tests/converge.yml

@@ -1,80 +1,87 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
+- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
   hosts: all
   become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  collections:
+    - devsec.hardening
   tasks:
-    - name: Include ssh_hardening role
+    - include_role:
-      ansible.builtin.include_role:
+        name: ssh_hardening
-        name: devsec.hardening.ssh_hardening
   vars:
-    ssh_trusted_user_ca_keys_file: /etc/ssh/ca.pub
+    ssh_trusted_user_ca_keys_file: '/etc/ssh/ca.pub'
     ssh_trusted_user_ca_keys:
-      - "# ssh-rsa ..."
+      - '# ssh-rsa ...'
-    ssh_authorized_principals_file: /etc/ssh/auth_principals/%u
+    ssh_authorized_principals_file: '/etc/ssh/auth_principals/%u'
     ssh_authorized_principals:
-      - path: /etc/ssh/auth_principals/root
+      - path: "/etc/ssh/auth_principals/root"
         principals:
-          - root
+          - "root"
+        owner: "{{ ssh_owner }}"
+        group: "{{ ssh_group }}"
+        directoryowner: "{{ ssh_owner }}"
+        directorygroup: "{{ ssh_group }}"
+        directorymode: "0700"
     network_ipv6_enable: true
-    ssh_allow_tcp_forwarding: "yes"
+    ssh_allow_tcp_forwarding: 'yes'
-    ssh_gateway_ports: "clientspecified"
+    ssh_gateway_ports: true
     ssh_allow_agent_forwarding: true
-    ssh_server_permit_environment_vars: "yes"
+    ssh_server_permit_environment_vars: 'yes'
-    ssh_server_accept_env_vars: PWD HTTP_PROXY
+    ssh_server_accept_env_vars: 'PWD HTTP_PROXY'
     ssh_client_alive_interval: 100
     ssh_client_alive_count: 10
     ssh_client_password_login: true
     ssh_challengeresponseauthentication: true
     ssh_compression: true
-    ssh_allow_users: root kitchen vagrant
+    ssh_allow_users: 'root kitchen vagrant'
-    ssh_allow_groups: root kitchen vagrant
+    ssh_allow_groups: 'root kitchen vagrant'
-    ssh_deny_users: foo bar
+    ssh_deny_users: 'foo bar'
-    ssh_deny_groups: foo bar
+    ssh_deny_groups: 'foo bar'
-    ssh_authorized_keys_file: /etc/ssh/authorized_keys/%u
+    ssh_authorized_keys_file: '/etc/ssh/authorized_keys/%u'
     ssh_max_auth_retries: 10
-    ssh_permit_root_login: without-password
+    ssh_permit_root_login: "without-password"
-    ssh_permit_tunnel: "yes"
+    ssh_permit_tunnel: true
     ssh_print_motd: true
     ssh_print_last_log: true
     ssh_banner: true
     ssh_server_password_login: true
+    sftp_enabled: true
     sftp_chroot: true
     # ssh_server_enabled: false
     ssh_server_ports:
       - 22
       - 222
     ssh_server_match_address:
-      - address: 192.168.1.0/24
+      - address: '192.168.1.0/24'
         rules:
-          - AllowTcpForwarding yes
+          - 'AllowTcpForwarding yes'
-          - AllowAgentForwarding no
+          - 'AllowAgentForwarding no'
     ssh_server_match_group:
-      - group: root
+      - group: 'root'
         rules:
-          - AllowTcpForwarding yes
+          - 'AllowTcpForwarding yes'
-          - AllowAgentForwarding no
+          - 'AllowAgentForwarding no'
     ssh_server_match_user:
-      - user: root
+      - user: 'root'
         rules:
-          - AllowTcpForwarding yes
+          - 'AllowTcpForwarding yes'
-          - AllowAgentForwarding no
+          - 'AllowAgentForwarding no'
     ssh_server_match_local_port:
       - port: 222
         rules:
-          - AllowTcpForwarding yes
+          - 'AllowTcpForwarding yes'
-          - AllowAgentForwarding no
+          - 'AllowAgentForwarding no'
     ssh_remote_hosts:
-      - names: [example.com, example2.com]
+      - names: ['example.com', 'example2.com']
-        options: [Port 2222, ForwardAgent yes]
+        options: ['Port 2222', 'ForwardAgent yes']
-      - names: [example3.com]
+      - names: ['example3.com']
-        options: [StrictHostKeyChecking no]
+        options: ['StrictHostKeyChecking no']
     ssh_use_dns: true
     ssh_use_pam: true
-    ssh_max_startups: 10:30:60
+    ssh_max_startups: '10:30:60'
     ssh_host_key_algorithms:
       - ssh-ed25519
       - rsa-sha2-512
@@ -88,9 +95,10 @@
       - aes192-ctr
       - aes128-ctr
       - aes256-cbc
-    # these should not be set in the final sshd_config
+    ssh_kex:
-    ssh_kex: false
+      - diffie-hellman-group-exchange-sha256
+      - diffie-hellman-group-exchange-sha1
     ssh_custom_options:
-      - Include /etc/ssh/ssh_config.d/*
+      - "Include /etc/ssh/ssh_config.d/*"
     sshd_custom_options:
-      - AcceptEnv LANG
+      - "AcceptEnv LANG"

molecule/ssh_hardening_custom_tests/molecule.yml

@@ -1,24 +1,34 @@
 ---
+dependency:
+  name: galaxy
+  options:
+    role-file: molecule/ssh_hardening/requirements.yml
 driver:
   name: docker
 platforms:
   - name: instance
-    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
+    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
     privileged: true
-    cgroupns_mode: host
+    tmpfs:
-    pre_build_image: true
+      - /tmp
+      - /run
+    capabilities:
+      - SYS_ADMIN
+    tty: true
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
+      container: docker
 provisioner:
   name: ansible
-  options:
-    diff: true
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer
+      callback_whitelist: profile_tasks, timer, yaml
-      inject_facts_as_vars: false
 verifier:
   name: ansible
 
@@ -29,7 +39,6 @@ scenario:
     - prepare
   check_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -45,12 +54,11 @@ scenario:
     - destroy
   test_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create
     - prepare
-    - check
     - converge
     - idempotence
+    - verify
     - destroy

molecule/ssh_hardening_custom_tests/prepare.yml

@@ -1,5 +1,5 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
   become: true
   environment:
@@ -7,38 +7,33 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: Use python3
+    - name: use python3
-      ansible.builtin.set_fact:
+      set_fact:
         ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: Install dnf packages # noqa ignore-errors
+    - name: install packages  # noqa ignore-errors
-      ansible.builtin.dnf:
+      yum:
         name:
           - openssh-clients
           - openssh-server
-        state: present
-        update_cache: true
-      ignore_errors: true
-
-    - name: Install libselinux-python # noqa ignore-errors
-      ansible.builtin.dnf:
-        name:
           - libselinux-python
         state: present
         update_cache: true
       ignore_errors: true
 
-    - name: Install procps-ng # noqa ignore-errors
+    - name: install packages  # noqa ignore-errors
-      ansible.builtin.dnf:
+      dnf:
         name:
+          - openssh-clients
+          - openssh-server
           - procps-ng
         state: present
         update_cache: true
       ignore_errors: true
 
-    - name: Install apt packages # noqa ignore-errors
+    - name: install packages  # noqa ignore-errors
-      ansible.builtin.apt:
+      apt:
         name:
           - openssh-client
           - openssh-server
@@ -46,20 +41,19 @@
         update_cache: true
       ignore_errors: true
 
-    - name: Install required tools on SuSE
+    - name: install required tools on SuSE
       # cannot use zypper module, since it depends on python-xml
-      ansible.builtin.command: zypper -n install python-xml
+      shell: "zypper -n install python-xml"
-      changed_when: false
       when: ansible_facts.os_family == 'Suse'
 
-    - name: Install packages on SuSE
+    - name: install packages
-      community.general.zypper:
+      zypper:
         name:
-          - openssh
+          - "openssh"
       when: ansible_facts.os_family == 'Suse'
 
-    - name: Install required tools on Arch
+    - name: install required tools on Arch
-      community.general.pacman:
+      pacman:
         name:
           - openssh
           - awk
@@ -67,14 +61,16 @@
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: Install required tools on Alpine
+    - name: created needed directory
-      community.general.apk:
+      file:
-        name:
+        path: "/var/run/sshd"
-          - openssh
+        state: directory
-        state: present
-        update_cache: true
-      when: ansible_facts.os_family == 'Alpine'
 
-    - name: Create ssh host keys # noqa ignore-errors no-changed-when
+    - name: create ssh host keys  # noqa ignore-errors
-      ansible.builtin.command: ssh-keygen -A
+      command: "ssh-keygen -A"
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
+            ansible_facts.distribution == "Fedora" or
+            ansible_facts.distribution == "Amazon" or
+            ansible_facts.os_family == "Suse"
+      changed_when: false
       ignore_errors: true

molecule/ssh_hardening_custom_tests/requirements.yml

@@ -0,0 +1,3 @@
+---
+roles:
+  - geerlingguy.git

molecule/ssh_hardening_vm/INSTALL.rst

@@ -1,22 +0,0 @@
-*******
-Docker driver installation guide
-*******
-
-Requirements
-============
-
-* Docker Engine
-
-Install
-=======
-
-Please refer to the `Virtual environment`_ documentation for installation best
-practices. If not using a virtual environment, please consider passing the
-widely recommended `'--user' flag`_ when invoking ``pip``.
-
-.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
-.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
-
-.. code-block:: bash
-
-    $ python3 -m pip install 'molecule[docker]'

molecule/ssh_hardening_vm/converge.yml

@@ -1,13 +0,0 @@
----
-- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
-  hosts: all
-  environment:
-    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
-    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
-    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  tasks:
-    - name: Include ssh_hardening role
-      ansible.builtin.include_role:
-        name: devsec.hardening.ssh_hardening
-  vars:
-    sftp_enabled: false

molecule/ssh_hardening_vm/molecule.yml

@@ -1,63 +0,0 @@
----
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
-platforms:
-  # we need to name every instance differently to start multiple VMs on the same host (parallelization)
-  # since we also need to use different OS users to run the tests because of how molecule operates,
-  # the VM names must be predictable by OS user (to clean up canceled runs)
-  - name: ${USER}
-    box: ${MOLECULE_DISTRO}
-    memory: 1024
-    cpus: 2
-provisioner:
-  name: ansible
-  options:
-    diff: true
-  env:
-    ANSIBLE_PIPELINING: "True"
-  config_options:
-    defaults:
-      interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer
-      # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
-      library: "${MOLECULE_PROJECT_DIRECTORY}/plugins/modules:/usr/share/ansible:${MOLECULE_VAGRANT_PLUGIN_DIR}"
-      inject_facts_as_vars: false
-verifier:
-  name: ansible
-  env:
-    ANSIBLE_PIPELINING: "True"
-
-scenario:
-  create_sequence:
-    - dependency
-    - create
-    - prepare
-  check_sequence:
-    - dependency
-    - verify ../shared/prerequisites.yml
-    - destroy
-    - create
-    - prepare
-    - converge
-    - check
-    - destroy
-  converge_sequence:
-    - dependency
-    - create
-    - prepare
-    - converge
-  destroy_sequence:
-    - destroy
-  test_sequence:
-    - dependency
-    - verify ../shared/prerequisites.yml
-    - destroy
-    - syntax
-    - create
-    - prepare
-    - converge
-    - idempotence
-    - verify
-    - destroy

molecule/ssh_hardening_vm/prepare.yml

@@ -1,34 +0,0 @@
----
-- name: Prepare OpenBSD host
-  hosts: all
-  become: true
-  gather_facts: false
-  tasks:
-    - name: Change installation source
-      # temporary fix for https://github.com/lavabit/robox/issues/305
-      ansible.builtin.raw: echo "https://ftp.eu.openbsd.org/pub/OpenBSD" > /etc/installurl
-      changed_when: false
-      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
-
-    - name: Install python
-      # BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
-      ansible.builtin.raw: pkg_add -I python%3.11
-      changed_when: false
-      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
-
-- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
-  hosts: all
-  become: true
-  environment:
-    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
-    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
-    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  tasks:
-    - name: Create ssh host keys # noqa ignore-errors
-      ansible.builtin.command: ssh-keygen -A
-      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
-        or ansible_facts.distribution == "Fedora"
-        or ansible_facts.distribution == "Amazon"
-        or ansible_facts.os_family == "Suse"
-      changed_when: false
-      ignore_errors: true

molecule/ssh_hardening_vm/verify.yml

@@ -1,57 +0,0 @@
----
-- name: OpenBSD workaround - inspec detects OpenSBD as unix and not linux compatible
-  hosts: all
-  become: true
-  tasks:
-    - name: Use the type command instead of which to detect existing commands
-      ansible.builtin.file:
-        src: /usr/bin/which
-        dest: /usr/bin/type
-        state: hard
-        mode: "0770"
-      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
-
-- name: Verify
-  hosts: localhost
-  environment:
-    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
-    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
-    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  tasks:
-    - name: Get ssh-config
-      ansible.builtin.command:
-        cmd: vagrant ssh-config
-        chdir: "{{ molecule_ephemeral_directory }}"
-      register: ssh_config
-      changed_when: false
-
-    - name: Create ssh-config file
-      ansible.builtin.copy:
-        content: "{{ ssh_config.stdout_lines | join ('\n') }}"
-        dest: "{{ molecule_ephemeral_directory }}/ssh-config"
-        mode: "0400"
-      changed_when: false
-
-    - name: Execute cinc-auditor tests
-      ansible.builtin.command: >
-        docker run --rm
-        --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
-        --volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') | regex_replace('^.*/', '') }}.yaml:/waivers.yaml
-        docker.io/cincproject/auditor exec
-        --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
-        -t ssh://{{ lookup('env', 'USER') }}
-        --sudo --no-show-progress --no-color
-        --waiver-file /waivers.yaml
-        --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip
-      register: test_results
-      changed_when: false
-      ignore_errors: true
-
-    - name: Display details about the cinc-auditor results
-      ansible.builtin.debug:
-        msg: "{{ test_results.stdout_lines }}"
-
-    - name: Fail when tests fail
-      ansible.builtin.fail:
-        msg: Inspec failed to validate
-      when: test_results.rc != 0

molecule/ssh_hardening_vm/waivers_almalinux-10.yaml

@@ -1,2 +0,0 @@
----
-{}

molecule/ssh_hardening_vm/waivers_debian-13.yaml

@@ -1,2 +0,0 @@
----
-{}

molecule/ssh_hardening_vm/waivers_freebsd13.yaml

@@ -1,3 +0,0 @@
-sshd-45:
-  run: false
-  justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"

molecule/ssh_hardening_vm/waivers_freebsd14.yaml

@@ -1,3 +0,0 @@
-sshd-45:
-  run: false
-  justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"

molecule/ssh_hardening_vm/waivers_openbsd7.yaml

@@ -1,21 +0,0 @@
-ssh-17:
-  run: false
-  justification: "GSSAPIAuthentication is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
-ssh-18:
-  run: false
-  justification: "GSSAPIDelegateCredentials is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
-sshd-30:
-  run: false
-  justification: "KerberosAuthentication is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
-sshd-31:
-  run: false
-  justification: "KerberosOrLocalPasswd is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
-sshd-32:
-  run: false
-  justification: "KerberosTicketCleanup is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
-sshd-33:
-  run: false
-  justification: "GSSAPIAuthentication is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
-sshd-34:
-  run: false
-  justification: "GSSAPICleanupCredentials is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"

molecule/ssh_hardening_vm/waivers_ubuntu-24.04.yaml

@@ -1,2 +0,0 @@
----
-{}

renovate.json

@@ -1,15 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:best-practices",
-    ":gitSignOff"
-  ],
-  "dependencyDashboard": true,
-  "dependencyDashboardAutoclose": true,
-  "packageRules": [
-    {
-      "matchUpdateTypes": ["patch", "minor"],
-      "automerge": true
-    }
-  ]
-}

requirements-vm.txt

@@ -1 +0,0 @@
-molecule-plugins[vagrant]==25.8.12

requirements.txt

@@ -1,7 +1,7 @@
-molecule==25.12.0
+molecule[docker]
-molecule-plugins[docker]==25.8.12
+yamllint
-ansible-core==2.19.3
+ansible
-docker==7.1.0
+ansible-lint
-jmespath==1.1.0
+docker
-aar-doc==2.3.0
+flake8
-passlib==1.7.4
+jmespath

roles/mysql_hardening/CHANGELOG.md

@@ -91,7 +91,7 @@
 
 **Implemented enhancements:**
 
-- add follow=yes to my.cnf protect task, in case its a symlink. fixes \#20 [\#21](https://github.com/dev-sec/ansible-mysql-hardening/pull/21) ([rndmh3ro](https://github.com/rndmh3ro))
+- add follow=yes to my.cnf protect task, incase its a symlink. fixes \#20 [\#21](https://github.com/dev-sec/ansible-mysql-hardening/pull/21) ([rndmh3ro](https://github.com/rndmh3ro))
 - add changelog generator [\#7](https://github.com/dev-sec/ansible-mysql-hardening/pull/7) ([chris-rock](https://github.com/chris-rock))
 
 **Closed issues:**

roles/mysql_hardening/README.md

@@ -1,6 +1,6 @@
 # devsec.mysql_hardening
 
-[![devsec.mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
+![devsec.mysql_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.mysql_hardening/badge.svg)
 
 ## Description
 
@@ -12,132 +12,73 @@ It configures:
 - Removes anonymous users, users without a password or authentication_string and test databases
 - various hardening options inside MySQL
 
-Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.
-
-Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
-
 ## Requirements
 
-- An existing installation of MySQL or MariaDB.
+- Ansible 2.9.0
-- python-jmespath on the ansible host
+- An existing MySQL installation
 
-<!-- BEGIN_ANSIBLE_DOCS -->
+### Example playbook
 
-## Supported Operating Systems
+```yml
+- hosts: localhost
+  collections:
+    - devsec.hardening
+  roles:
+    - mysql_hardening
+```
 
-- EL
+This role expects an existing installation of MySQL or MariaDB. Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.  
-  - 8, 9, 10
+Please ensure that the following variables are set accordingly:
-- Ubuntu
+
-  - focal, jammy, noble
+- `mysql_hardening_enabled: yes` role is enabled by default and can be disabled without removing it from a playbook. You can use conditional variable, for example: `mysql_hardening_enabled: "{{ true if mysql_enabled else false }}"`
-- Debian
+- `mysql_hardening_user: 'mysql'` The user that mysql runs as.
-  - trixie, bookworm, bullseye
+- `mysql_hardening_mysql_hardening_conf_file: '/etc/mysql/conf.d/hardening.cnf'` The path to the configuration file where the hardening will be performed
-- Amazon
+- _deprecated: `mysql_datadir: '/var/lib/mysql'` The MySQL data directory_
-- opensuse
+  - `mysql_datadir` is no longer necessary, as MySQL data directory is automatically taken from `mysql_info`. But it can still be defined and will also be checked for correct permissions.
 
 ## Role Variables
 
-- `mysql_daemon_enabled`
-  - Default: `True`
-  - Description: Whether to enable the MySQL-service so it starts on boot
-  - Type: bool
-  - Required: no
 - `mysql_hardening_chroot`
-  - Default: ``
+  - Default: ""
   - Description: [chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)
-  - Type: str
-  - Required: no
-- `mysql_hardening_chroot.automatic-sp-privileges`
-  - Default: `0`
-  - Description: [automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)
-  - Type: int
-  - Required: no
-- `mysql_hardening_enabled`
-  - Default: `True`
-  - Description: Whether to run the hardening
-  - Type: bool
-  - Required: no
-- `mysql_hardening_options.allow-suspicious-udfs`
-  - Default: `0`
-  - Description: [allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)
-  - Type: int
-  - Required: no
-- `mysql_hardening_options.local-infile`
-  - Default: `0`
-  - Description: [local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)
-  - Type: int
-  - Required: no
 - `mysql_hardening_options.safe-user-create`
-  - Default: `1`
+  - Default: 1
   - Description: [safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)
-  - Type: int
-  - Required: no
 - `mysql_hardening_options.secure-auth`
-  - Default: `1`
+  - Default: 1
   - Description: [secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)
-  - Type: int
-  - Required: no
-- `mysql_hardening_options.secure-file-priv`
-  - Default: `/tmp`
-  - Description: [secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)
-  - Type: str
-  - Required: no
 - `mysql_hardening_options.skip-symbolic-links`
-  - Default: `1`
+  - Default: 1
   - Description: [skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)
-  - Type: int
-  - Required: no
-- `mysql_hardening_restart_mysql`
-  - Default: `True`
-  - Description: Restart mysql after running this role
-  - Type: bool
-  - Required: no
 - `mysql_hardening_skip_grant_tables:`
-  - Default: `False`
+  - Default: false
   - Description: [skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)
-  - Type: bool
-  - Required: no
 - `mysql_hardening_skip_show_database`
-  - Default: `1`
+  - Default: 1
   - Description: [skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)
-  - Type: int
+- `mysql_hardening_options.local-infile`
-  - Required: no
+  - Default: 0
+  - Description: [local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)
+- `mysql_hardening_options.allow-suspicious-udfs`
+  - Default: 0
+  - Description: [allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)
+- `mysql_hardening_chroot.automatic-sp-privileges`
+  - Default: 0
+  - Description: [automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)
+- `mysql_hardening_options.secure-file-priv`
+  - Default: /tmp
+  - Description: [secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)
+- `mysql_allow_remote_root`
+  - Default: false
+  - Description: delete remote root users
 - `mysql_remove_anonymous_users`
-  - Default: `True`
+  - Default: true
-  - Description: Set to `false` to keep users without authentication
+  - Description: remove users without authentication
-  - Type: bool
-  - Required: no
-- `mysql_remove_remote_root`
-  - Default: `True`
-  - Description: If `true`, root can only connect from localhost. Set to `false` to not remove remote root users.
-  - Type: bool
-  - Required: no
 - `mysql_remove_test_database`
-  - Default: `True`
+  - Default: true
-  - Description: Set to `false` to keep the test database
+  - Description: remove test database
-  - Type: bool
+- `mysql_hardening_restart_mysql`
-  - Required: no
+  - Default: true
-- `mysql_root_password`
+  - Description: Restart mysql after running this role
-  - Default: `-----====>SetR00tPa$$wordH3r3!!!<====-----`
-  - Description: The default password. Please change or overwrite it
-  - Type: str
-  - Required: no
-- `mysql_user_home`
-  - Default: `{{ ansible_env.HOME }}`
-  - Description: The path where the `.my.cnf` will be stored
-  - Type: str
-  - Required: no
 
-## Dependencies
+Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
-
-None.
-
-## Example Playbook
-
-```
-- hosts: all
-  become: true
-  roles:
-    - name: devsec.hardening.mysql_hardening
-```
-
-<!-- END_ANSIBLE_DOCS -->

roles/mysql_hardening/defaults/main.yml

@@ -6,8 +6,10 @@ mysql_daemon_enabled: true
 
 mysql_hardening_restart_mysql: true
 
+# general configuration
+mysql_hardening_mysql_hardening_conf_file: '{{ mysql_hardening_mysql_confd_dir }}/hardening.cnf'
 # You have to change this to your own strong enough mysql root password
-mysql_root_password: "-----====>SetR00tPa$$wordH3r3!!!<====-----"
+mysql_root_password: '-----====>SetR00tPa$$wordH3r3!!!<====-----'
 # There .my.cnf with mysql root credentials will be installed
 mysql_user_home: "{{ ansible_env.HOME }}"
 
@@ -46,6 +48,6 @@ mysql_hardening_options:
   automatic-sp-privileges: 0
 
   # @see https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option-mysqld-secure-file-priv
-  secure-file-priv: /tmp
+  secure-file-priv: '/tmp'
   # @see https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_user
-  user: "{{ mysql_hardening_user }}"
+  user: '{{ mysql_hardening_user }}'

roles/mysql_hardening/handlers/main.yml

@@ -1,6 +1,7 @@
 ---
+
 - name: Restart mysql
-  ansible.builtin.service:
+  service:
-    name: "{{ mysql_daemon }}"
+    name: '{{ mysql_daemon }}'
     state: restarted
   when: mysql_hardening_restart_mysql | bool