update to 5.2.1

Fix deprecation warnings in Ansible 2.8

.gitattributes

@@ -0,0 +1,35 @@
+# These files are text and should be normalized (Convert crlf => lf)
+*.php text eol=lf
+*.css text eol=lf
+*.js text eol=lf
+*.htm text eol=lf
+*.html text eol=lf
+*.xml text eol=lf
+*.txt text eol=lf
+*.ini text eol=lf
+*.inc text eol=lf
+.htaccess text eol=lf
+*.pp text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.sh text eol=lf
+
+# These files are binary and should be left untouched
+# (binary is a macro for -text -diff)
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.mov binary
+*.mp4 binary
+*.mp3 binary
+*.flv binary
+*.fla binary
+*.swf binary
+*.gz binary
+*.zip binary
+*.7z binary
+*.ttf binary
+*.rpm binary
+

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,40 @@
+---
+name: Bug report
+about: Create a report to help us improve
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Actual behavior**
+<!--- Paste verbatim command output between quotes -->
+```paste below
+
+```
+**Example Playbook**
+<!--- Paste an example playbook that can be used to reproduce the problem between quotes -->
+```paste below
+
+```
+
+**OS / Environment**
+<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
+
+**Ansible Version**
+<!--- Paste verbatim output from "ansible --version" between quotes -->
+```paste below
+
+```
+
+**Role Version**
+<!--- Paste version of the role between quotes -->
+```paste below
+
+```
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,17 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.kitchen.vagrant.yml

@@ -16,7 +16,7 @@ provisioner:
   require_ruby_for_busser: false
   ansible_verbose: true
   roles_path: ../ansible-os-hardening/
-  playbook: default.yml
+  playbook: tests/test.yml
   http_proxy: <%= ENV['http_proxy'] || nil %>
   https_proxy: <%= ENV['https_proxy'] || nil %>
 
@@ -24,51 +24,30 @@ transport:
   max_ssh_sessions: 5
 
 platforms:
-- name: ubuntu-12.04
-  driver_config:
-    box: opscode-ubuntu-12.04
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-12.04_chef-provisionerless.box
-- name: ubuntu-14.04
-  driver_config:
-    box: opscode-ubuntu-14.04
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-14.04_chef-provisionerless.box
 - name: ubuntu-16.04
   driver_config:
-    box: opscode-ubuntu-16.04
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-16.04_chef-provisionerless.box
-- name: centos-6.4
+    box: bento/ubuntu-16.04
+- name: ubuntu-18.04
   driver_config:
-    box: opscode-centos-6.4
-    box_url: https://opscode-vm.s3.amazonaws.com/vagrant/opscode_centos-6.4_provisionerless.box
-- name: centos-6.5
+    box: bento/ubuntu-18.04
+- name: centos-6
   driver_config:
-    box: opscode-centos-6.5
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-6.5_chef-provisionerless.box
-- name: centos-6.8
-  driver_config:
-    box: bento/centos-6.8
+    box: bento/centos-6.7
 - name: centos-7
   driver_config:
-    box: bento/centos-7.2
-- name: oracle-6.4
+    box: bento/centos-7
+- name: oracle-6
   driver_config:
-    box: oracle-6.4
-    box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel64-64.box
-- name: oracle-6.5
-  driver_config:
-    box: oracle-6.5
-    box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel65-64.box
+    box: bento/oracle-6
 - name: oracle-7
   driver_config:
-    box: boxcutter/ol72
-- name: debian-7
+    box: bento/oracle-7
+- name: debian-9
   driver_config:
-    box: debian-7
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-7.8_chef-provisionerless.box
-- name: debian-8
+    box: bento/debian-9
+- name: amazon
   driver_config:
-    box: debian-8
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-8.1_chef-provisionerless.box
+    box: bento/amazonlinux-2
 
 verifier:
   name: inspec

.kitchen.yml

@@ -17,13 +17,11 @@ provisioner:
   require_ruby_for_busser: false
   ansible_verbose: true
   ansible_diff: true
-  hosts: all
+
   roles_path: ../ansible-os-hardening/
   http_proxy: <%= ENV['http_proxy'] || nil %>
   https_proxy: <%= ENV['https_proxy'] || nil %>
-  playbook: default.yml
-  ansible_extra_flags:
-    - "--skip-tags=sysctl"
+  playbook: tests/test.yml
 
 platforms:
 - name: centos6-ansible-latest
@@ -34,6 +32,10 @@ platforms:
   driver:
     image: rndmh3ro/docker-centos7-ansible:latest
     platform: centos
+    run_command: /sbin/init
+    provision_command:
+      - sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
+      - systemctl enable sshd.service
 - name: oracle6-ansible-latest
   driver:
     image: rndmh3ro/docker-oracle6-ansible:latest
@@ -41,31 +43,50 @@ platforms:
 - name: oracle7-ansible-latest
   driver:
     image: rndmh3ro/docker-oracle7-ansible:latest
+    run_command: /sbin/init
     platform: centos
-- name: ubuntu1204-ansible-latest
-  driver:
-    image: rndmh3ro/docker-ubuntu1204-ansible:latest
-    platform: ubuntu
-- name: ubuntu1404-ansible-latest
-  driver:
-    image: rndmh3ro/docker-ubuntu1404-ansible:latest
-    platform: ubuntu
+    provision_command:
+      - sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
+      - systemctl enable sshd.service
 - name: ubuntu1604-ansible-latest
   driver:
     image: rndmh3ro/docker-ubuntu1604-ansible:latest
     platform: ubuntu
-- name: debian7-ansible-latest
+    run_command: /sbin/init
+    provision_command:
+      - systemctl enable ssh.service
+- name: ubuntu1804-ansible-latest
   driver:
-    image: rndmh3ro/docker-debian7-ansible:latest
-    platform: debian
-- name: debian8-ansible-latest
-  driver:
-    image: rndmh3ro/docker-debian8-ansible:latest
-    platform: debian
+    image: rndmh3ro/docker-ubuntu1804-ansible:latest
+    platform: ubuntu
+    run_command: /sbin/init
+    provision_command:
+      - systemctl enable ssh.service
 - name: debian9-ansible-latest
   driver:
     image: rndmh3ro/docker-debian9-ansible:latest
     platform: debian
+    run_command: /sbin/init
+    provision_command:
+      - apt install -y systemd-sysv
+      - systemctl enable ssh.service
+- name: amazon-ansible-latest
+  driver:
+    image: rndmh3ro/docker-amazon-ansible:latest
+    platform: centos
+    run_command: /sbin/init
+    provision_command:
+      - sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
+      - systemctl enable sshd.service
+- name: fedora-ansible-latest
+  driver:
+    image: rndmh3ro/docker-fedora-ansible:latest
+    platform: centos
+    run_command: /sbin/init
+    provision_command:
+      - dnf install -y python
+      - sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
+      - systemctl enable sshd.service
 
 verifier:
   name: inspec

.travis.yml

@@ -7,7 +7,12 @@ env:
     init: /sbin/init
 
   - distro: centos7
-    init: /usr/lib/systemd/systemd
+    init: /lib/systemd/systemd
+    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
+    version: latest
+
+  - distro: fedora
+    init: /lib/systemd/systemd
     run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
     version: latest
 
@@ -15,37 +20,31 @@ env:
     version: latest
     init: /sbin/init
 
-  - distro: oracle7
-    init: /usr/lib/systemd/systemd
-    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
-    version: latest
+#  - distro: oracle7
+#    init: /lib/systemd/systemd
+#    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
+#    version: latest
 
   - distro: ubuntu1604
     version: latest
     init: /lib/systemd/systemd
     run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
 
-  - distro: ubuntu1404
+  - distro: ubuntu1804
     version: latest
-    init: /sbin/init
-
-  - distro: ubuntu1204
-    version: latest
-    init: /sbin/init
-
-  - distro: debian7
-    version: latest
-    init: /sbin/init
-
-  - distro: debian8
-    version: latest
-    init: /sbin/init
+    init: /lib/systemd/systemd
+    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
 
   - distro: debian9
     version: latest
     init: /lib/systemd/systemd
     run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
 
+  - distro: amazon
+    init: /lib/systemd/systemd
+    version: latest
+    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
+
 before_install:
   # Pull container
   - 'docker pull rndmh3ro/docker-${distro}-ansible:${version}'
@@ -55,11 +54,11 @@ script:
   # Run container in detached state.
   - 'docker run --detach --volume="${PWD}":/etc/ansible/roles/ansible-os-hardening:ro ${run_opts} rndmh3ro/docker-${distro}-ansible:${version} "${init}" > "${container_id}"'
 
-  # Test role.
-  - 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-os-hardening/default.yml --skip-tags "sysctl"'
+   # Test role.
+  - 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-os-hardening/tests/test.yml --diff --skip-tags "sysctl"'
 
-  # Verify role
-  - 'inspec exec https://github.com/dev-sec/linux-baseline/ -t docker://$(cat ${container_id}) --controls=os-01 os-02 os-03 os-04 os-05 os-06 os-07 package-01 package-02 package-03 package-04 package-05 package-06'
+   # Verify role
+  - 'inspec exec https://github.com/dev-sec/linux-baseline/ -t docker://$(cat ${container_id}) --controls=os-01 os-02 os-03 os-04 os-05 os-05b os-06 os-07 os-09 os-10 os-11 package-01 package-02 package-03 package-05 package-06 package-08 package-09 --no-distinct-exit'
 
 notifications:
   webhooks: https://galaxy.ansible.com/api/v1/notifications/

CHANGELOG.md

@@ -1,6 +1,206 @@
-# Change Log
+# Changelog
+
+## [5.2.1](https://github.com/dev-sec/ansible-os-hardening/tree/5.2.1) (2019-06-09)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/5.2.0...5.2.1)
+
+**Implemented enhancements:**
+
+- Fix deprecation warnings in Ansible 2.8 [\#224](https://github.com/dev-sec/ansible-os-hardening/pull/224) ([Normo](https://github.com/Normo))
+- add docs to find-task in minimize access. fix \#219 [\#220](https://github.com/dev-sec/ansible-os-hardening/pull/220) ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Fixed bugs:**
+
+- `squash\_actions` deprecation warning [\#218](https://github.com/dev-sec/ansible-os-hardening/issues/218)
+
+## [5.2.0](https://github.com/dev-sec/ansible-os-hardening/tree/5.2.0) (2019-05-04)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/5.1.0...5.2.0)
+
+**Implemented enhancements:**
+
+- Speed up "minimize access on found files" task [\#208](https://github.com/dev-sec/ansible-os-hardening/issues/208)
+- Fedora support? [\#163](https://github.com/dev-sec/ansible-os-hardening/issues/163)
+- remove eol'd OS and add new [\#217](https://github.com/dev-sec/ansible-os-hardening/pull/217) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add note about docker under warning [\#214](https://github.com/dev-sec/ansible-os-hardening/pull/214) ([ChrisMcKee](https://github.com/ChrisMcKee))
+- change minimize access tasks to speed them up [\#209](https://github.com/dev-sec/ansible-os-hardening/pull/209) ([rndmh3ro](https://github.com/rndmh3ro))
+- Added fedora support [\#206](https://github.com/dev-sec/ansible-os-hardening/pull/206) ([jonaswre](https://github.com/jonaswre))
+- Pass package list directly to apt and yum modules without using with\_items loop [\#200](https://github.com/dev-sec/ansible-os-hardening/pull/200) ([Normo](https://github.com/Normo))
+
+**Fixed bugs:**
+
+- login.defs.j2 template: ENV\_PATH is missing ':' before variable substitution [\#202](https://github.com/dev-sec/ansible-os-hardening/issues/202)
+- 'sysctl\_rhel\_config' is undefined [\#167](https://github.com/dev-sec/ansible-os-hardening/issues/167)
+- RHEL 7.4: Too many setuid bits removed [\#140](https://github.com/dev-sec/ansible-os-hardening/issues/140)
+- Fix typo [\#212](https://github.com/dev-sec/ansible-os-hardening/pull/212) ([ruslo](https://github.com/ruslo))
+- Update modprobe to 0644 [\#211](https://github.com/dev-sec/ansible-os-hardening/pull/211) ([joshuatalb](https://github.com/joshuatalb))
+- Test Kitchen Vagrant Fixes [\#210](https://github.com/dev-sec/ansible-os-hardening/pull/210) ([joshuatalb](https://github.com/joshuatalb))
+- \[readme\] Update documentation link [\#207](https://github.com/dev-sec/ansible-os-hardening/pull/207) ([pmav99](https://github.com/pmav99))
+- fix ansible lint remarks [\#204](https://github.com/dev-sec/ansible-os-hardening/pull/204) ([rndmh3ro](https://github.com/rndmh3ro))
+- add colon to user env paths - fix \#202 [\#203](https://github.com/dev-sec/ansible-os-hardening/pull/203) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix errors produced by ansible-lint [\#159](https://github.com/dev-sec/ansible-os-hardening/pull/159) ([zbrojny120](https://github.com/zbrojny120))
+
+## [5.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/5.1.0) (2018-10-17)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/5.0.0...5.1.0)
+
+**Implemented enhancements:**
+
+- add ubuntu 1804 support [\#196](https://github.com/dev-sec/ansible-os-hardening/pull/196) ([rndmh3ro](https://github.com/rndmh3ro))
+- add option to disable auditd [\#192](https://github.com/dev-sec/ansible-os-hardening/pull/192) ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Fixed bugs:**
+
+- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191)
+- Setting os\_security\_users\_allow has no effect [\#175](https://github.com/dev-sec/ansible-os-hardening/issues/175)
+- add /usr/bin/su to suid\_guid whitelist [\#199](https://github.com/dev-sec/ansible-os-hardening/pull/199) ([ccolic](https://github.com/ccolic))
+- ensure that permissions to su-binary are not restricted to root user and group only, if os\_security\_users\_allow contains the value change\_user [\#197](https://github.com/dev-sec/ansible-os-hardening/pull/197) ([szEvEz](https://github.com/szEvEz))
+
+## [5.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/5.0.0) (2018-09-02)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.3.0...5.0.0)
+
+**Implemented enhancements:**
+
+- Warning about "include" for tasks for ansible-playbook 2.4.0 \(devel f0a5854e39\) [\#131](https://github.com/dev-sec/ansible-os-hardening/issues/131)
+- fix problems with efi and vfat [\#190](https://github.com/dev-sec/ansible-os-hardening/pull/190) ([rndmh3ro](https://github.com/rndmh3ro))
+- added os\_hardening\_enabled flag [\#186](https://github.com/dev-sec/ansible-os-hardening/pull/186) ([jcheroske](https://github.com/jcheroske))
+- add amazon run opts to travis [\#183](https://github.com/dev-sec/ansible-os-hardening/pull/183) ([rndmh3ro](https://github.com/rndmh3ro))
+- use package instead of yum and apt [\#180](https://github.com/dev-sec/ansible-os-hardening/pull/180) ([rndmh3ro](https://github.com/rndmh3ro))
+- add oracle7 to travis [\#178](https://github.com/dev-sec/ansible-os-hardening/pull/178) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix wrong permissions passwdqc \#170 [\#176](https://github.com/dev-sec/ansible-os-hardening/pull/176) ([rndmh3ro](https://github.com/rndmh3ro))
+- ipv4 forwarding comment is inconsistent with example [\#174](https://github.com/dev-sec/ansible-os-hardening/pull/174) ([carchrae](https://github.com/carchrae))
+- Rename pam\_passwdqd.j2 to pam\_passwdqc.j2 [\#172](https://github.com/dev-sec/ansible-os-hardening/pull/172) ([martinbydefault](https://github.com/martinbydefault))
+- Use package state 'present' since 'installed' is deprecated [\#168](https://github.com/dev-sec/ansible-os-hardening/pull/168) ([Normo](https://github.com/Normo))
+- Update syntax to Ansible 2.4 [\#161](https://github.com/dev-sec/ansible-os-hardening/pull/161) ([thomasjpfan](https://github.com/thomasjpfan))
+- add amazon linux testing [\#160](https://github.com/dev-sec/ansible-os-hardening/pull/160) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add support for Amazon Linux [\#158](https://github.com/dev-sec/ansible-os-hardening/pull/158) ([woneill](https://github.com/woneill))
+- install and configure auditd - fix inspec package-08 [\#144](https://github.com/dev-sec/ansible-os-hardening/pull/144) ([rndmh3ro](https://github.com/rndmh3ro))
+- Remove deprecated include for static tasks and use instead import\_tasks fix \#131 [\#132](https://github.com/dev-sec/ansible-os-hardening/pull/132) ([HelioCampos](https://github.com/HelioCampos))
+
+**Fixed bugs:**
+
+- minimize\_access: maximum recursion depth exceeded on Ansible 2.5 [\#171](https://github.com/dev-sec/ansible-os-hardening/issues/171)
+- wrong permissions passwdqc [\#170](https://github.com/dev-sec/ansible-os-hardening/issues/170)
+- Update deprecated `include` statements [\#166](https://github.com/dev-sec/ansible-os-hardening/issues/166)
+- Strongly recommend against disabling vfat by default [\#162](https://github.com/dev-sec/ansible-os-hardening/issues/162)
+- System completely unresponsive after role execution [\#145](https://github.com/dev-sec/ansible-os-hardening/issues/145)
+- do not install passwdqc on amazon linux [\#189](https://github.com/dev-sec/ansible-os-hardening/pull/189) ([rndmh3ro](https://github.com/rndmh3ro))
+- add back run opts for debian 8 in travis [\#184](https://github.com/dev-sec/ansible-os-hardening/pull/184) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix core dump config file creation when core dumps are disabled [\#182](https://github.com/dev-sec/ansible-os-hardening/pull/182) ([Normo](https://github.com/Normo))
+- change minimize access method [\#181](https://github.com/dev-sec/ansible-os-hardening/pull/181) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [4.3.0](https://github.com/dev-sec/ansible-os-hardening/tree/4.3.0) (2018-01-03)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.3.1...4.3.0)
+
+**Implemented enhancements:**
+
+- Update some RH settings in this role [\#155](https://github.com/dev-sec/ansible-os-hardening/issues/155)
+- Removal of core dump hardening configuration if core dumps are allowed [\#129](https://github.com/dev-sec/ansible-os-hardening/issues/129)
+- Don't create home for system accounts [\#156](https://github.com/dev-sec/ansible-os-hardening/pull/156) ([oakey-b1](https://github.com/oakey-b1))
+- Prevent disabling of filesystems via whitelist [\#153](https://github.com/dev-sec/ansible-os-hardening/pull/153) ([manuelprinz](https://github.com/manuelprinz))
+- Add kernel hardening settings from Ubuntu /etc/sysctl.d [\#150](https://github.com/dev-sec/ansible-os-hardening/pull/150) ([kravietz](https://github.com/kravietz))
+- Removal of core dump hardening configuration if core dumps are allowed [\#146](https://github.com/dev-sec/ansible-os-hardening/pull/146) ([martinbydefault](https://github.com/martinbydefault))
+- add missing sysctl parameter [\#143](https://github.com/dev-sec/ansible-os-hardening/pull/143) ([rndmh3ro](https://github.com/rndmh3ro))
+- update readme [\#139](https://github.com/dev-sec/ansible-os-hardening/pull/139) ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Fixed bugs:**
+
+- bug in ufw.j2 template [\#151](https://github.com/dev-sec/ansible-os-hardening/issues/151)
+- replace single ticks with double ticks. fix \#151 [\#152](https://github.com/dev-sec/ansible-os-hardening/pull/152) ([rndmh3ro](https://github.com/rndmh3ro))
+- fixed tag [\#149](https://github.com/dev-sec/ansible-os-hardening/pull/149) ([martinbydefault](https://github.com/martinbydefault))
+
+**Closed issues:**
+
+- ansible hardening fails on ubuntu 16.04 with msg": "ERROR! 'sysctl\_rhel\_config' is undefined [\#147](https://github.com/dev-sec/ansible-os-hardening/issues/147)
+- Enhancement: Test with TestInfra and Molecule [\#128](https://github.com/dev-sec/ansible-os-hardening/issues/128)
+
+**Merged pull requests:**
+
+- move defaults to os-specific vars [\#157](https://github.com/dev-sec/ansible-os-hardening/pull/157) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [4.3.1](https://github.com/dev-sec/ansible-os-hardening/tree/4.3.1) (2017-09-13)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.2.0...4.3.1)
+
+**Fixed bugs:**
+
+- os\_security\_kernel\_enable\_sysrq is not implemented [\#115](https://github.com/dev-sec/ansible-os-hardening/issues/115)
+
+## [4.2.0](https://github.com/dev-sec/ansible-os-hardening/tree/4.2.0) (2017-08-08)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.1.0...4.2.0)
+
+**Implemented enhancements:**
+
+- add modprobe template, control os-10 [\#138](https://github.com/dev-sec/ansible-os-hardening/pull/138) ([rndmh3ro](https://github.com/rndmh3ro))
+- new task for delete netrc files, control os-09 [\#137](https://github.com/dev-sec/ansible-os-hardening/pull/137) ([rndmh3ro](https://github.com/rndmh3ro))
+- add passwd task, control os-03 [\#136](https://github.com/dev-sec/ansible-os-hardening/pull/136) ([rndmh3ro](https://github.com/rndmh3ro))
+- remove prelink package, control package-09 [\#135](https://github.com/dev-sec/ansible-os-hardening/pull/135) ([rndmh3ro](https://github.com/rndmh3ro))
+- style update [\#134](https://github.com/dev-sec/ansible-os-hardening/pull/134) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-os-hardening/pull/130) ([fazlearefin](https://github.com/fazlearefin))
+
+**Fixed bugs:**
+
+- Why is rsync removed? [\#141](https://github.com/dev-sec/ansible-os-hardening/issues/141)
+- playbook makes OS undetectable [\#124](https://github.com/dev-sec/ansible-os-hardening/issues/124)
+- Centos7/RHEL7: Exec shield is enabled by default and not manageable anymore by sysctl.conf [\#118](https://github.com/dev-sec/ansible-os-hardening/issues/118)
+- Remove rsync from package blacklist [\#142](https://github.com/dev-sec/ansible-os-hardening/pull/142) ([duk3luk3](https://github.com/duk3luk3))
+
+**Merged pull requests:**
+
+- remove execshield sysctl-parameter on rhel7 [\#119](https://github.com/dev-sec/ansible-os-hardening/pull/119) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [4.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/4.1.0) (2017-06-27)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.0.0...4.1.0)
+
+**Fixed bugs:**
+
+- Change system accounts not on the user provided ignore-list items are not JSON serializable [\#125](https://github.com/dev-sec/ansible-os-hardening/issues/125)
+- Could not find gem 'ruby \(\>= 2.1.0\)' [\#116](https://github.com/dev-sec/ansible-os-hardening/issues/116)
+- The task sysctl fails when /etc/initramfs-tools is not present [\#111](https://github.com/dev-sec/ansible-os-hardening/issues/111)
+- Deprecation warning always\_run [\#103](https://github.com/dev-sec/ansible-os-hardening/issues/103)
+
+**Closed issues:**
+
+- Enhancement: Pin python dependencies for development and testing [\#127](https://github.com/dev-sec/ansible-os-hardening/issues/127)
+- Update readme to include baselines [\#122](https://github.com/dev-sec/ansible-os-hardening/issues/122)
+
+**Merged pull requests:**
+
+- Converts set to JSON-serializable list [\#126](https://github.com/dev-sec/ansible-os-hardening/pull/126) ([pestaa](https://github.com/pestaa))
+- add more sysctl settings, allow overwriting [\#120](https://github.com/dev-sec/ansible-os-hardening/pull/120) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [4.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/4.0.0) (2017-03-14)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.2.0...4.0.0)
+
+**Implemented enhancements:**
+
+- Description of the Ansible roles of dev-sec says "This Ansible playbook" [\#97](https://github.com/dev-sec/ansible-os-hardening/issues/97)
+- install initramfs-tools [\#114](https://github.com/dev-sec/ansible-os-hardening/pull/114) ([rndmh3ro](https://github.com/rndmh3ro))
+- omit empty variables [\#106](https://github.com/dev-sec/ansible-os-hardening/pull/106) ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Fixed bugs:**
+
+- The role fails when conditionally included [\#105](https://github.com/dev-sec/ansible-os-hardening/issues/105)
+
+**Closed issues:**
+
+- Error running on RHEL 7 due to syntax issues [\#112](https://github.com/dev-sec/ansible-os-hardening/issues/112)
+- disable password age [\#109](https://github.com/dev-sec/ansible-os-hardening/issues/109)
+
+**Merged pull requests:**
+
+- change shadow owner in debian systems [\#117](https://github.com/dev-sec/ansible-os-hardening/pull/117) ([rndmh3ro](https://github.com/rndmh3ro))
+- Rhel7 [\#113](https://github.com/dev-sec/ansible-os-hardening/pull/113) ([tyrken](https://github.com/tyrken))
+- use new Docker images [\#110](https://github.com/dev-sec/ansible-os-hardening/pull/110) ([rndmh3ro](https://github.com/rndmh3ro))
+- Don’t refer to this role as "playbook" in the role description [\#104](https://github.com/dev-sec/ansible-os-hardening/pull/104) ([ypid](https://github.com/ypid))
 
 ## [3.2.0](https://github.com/dev-sec/ansible-os-hardening/tree/3.2.0) (2016-10-24)
+
 [Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.1.0...3.2.0)
 
 **Fixed bugs:**
@@ -18,9 +218,11 @@
 - add rhel7 pam\_pwquality. fix \#73 [\#94](https://github.com/dev-sec/ansible-os-hardening/pull/94) ([rndmh3ro](https://github.com/rndmh3ro))
 
 ## [3.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/3.1.0) (2016-08-03)
+
 [Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.1...3.1.0)
 
 ## [3.1](https://github.com/dev-sec/ansible-os-hardening/tree/3.1) (2016-07-27)
+
 [Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.0.0...3.1)
 
 **Implemented enhancements:**
@@ -43,7 +245,6 @@
 - Permissions on /etc/shadow can lock out GUI users [\#86](https://github.com/dev-sec/ansible-os-hardening/issues/86)
 - network related sysctl rewritten by ufw in ubuntu  [\#82](https://github.com/dev-sec/ansible-os-hardening/issues/82)
 - ansible \>= 2.0 complains: Using bare variables is deprecated [\#78](https://github.com/dev-sec/ansible-os-hardening/issues/78)
-- Norm-Audit-Hardening-Audit [\#76](https://github.com/dev-sec/ansible-os-hardening/issues/76)
 
 **Merged pull requests:**
 
@@ -51,6 +252,7 @@
 - Permits overriding permissions on /etc/shadow [\#89](https://github.com/dev-sec/ansible-os-hardening/pull/89) ([conorsch](https://github.com/conorsch))
 
 ## [3.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/3.0.0) (2016-03-13)
+
 [Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/2.0.0...3.0.0)
 
 **Implemented enhancements:**
@@ -70,7 +272,6 @@
 
 - Updates "tags" parameters on includes in main.yml [\#66](https://github.com/dev-sec/ansible-os-hardening/pull/66) ([conorsch](https://github.com/conorsch))
 - Suid set def var, fix \#64 [\#63](https://github.com/dev-sec/ansible-os-hardening/pull/63) ([rndmh3ro](https://github.com/rndmh3ro))
-- ERROR! Include tasks should not specify tags in more than one way [\#60](https://github.com/dev-sec/ansible-os-hardening/pull/60) ([fitz123](https://github.com/fitz123))
 
 **Closed issues:**
 
@@ -83,6 +284,7 @@
 - Release 3.0.0 [\#75](https://github.com/dev-sec/ansible-os-hardening/pull/75) ([rndmh3ro](https://github.com/rndmh3ro))
 
 ## [2.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/2.0.0) (2015-11-28)
+
 [Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/1.0.0...2.0.0)
 
 **Closed issues:**
@@ -101,6 +303,9 @@
 - improved travis-tests to cover more cases [\#42](https://github.com/dev-sec/ansible-os-hardening/pull/42) ([rndmh3ro](https://github.com/rndmh3ro))
 
 ## [1.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/1.0.0) (2015-09-01)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/06d1464e95cad7ccc24734b934a158b16dfc5014...1.0.0)
+
 **Closed issues:**
 
 - ansible-os-hardening/tasks/minimize\_access.yml [\#38](https://github.com/dev-sec/ansible-os-hardening/issues/38)
@@ -147,4 +352,4 @@
 
 
 
-\* *This Change Log was automatically generated by [github_changelog_generator](https://github.com/skywinder/Github-Changelog-Generator)*
+\* *This Changelog was automatically generated by [github_changelog_generator](https://github.com/github-changelog-generator/github-changelog-generator)*

Gemfile

@@ -11,6 +11,7 @@ group :integration do
   gem 'kitchen-sync'
   gem 'kitchen-transport-rsync'
   gem 'kitchen-docker'
+  gem 'inspec', '~> 3'
 end
 
 group :tools do

README.md

@@ -6,7 +6,7 @@
 
 ## Description
 
-This roles provides numerous security-related configurations, providing all-round base protection.
+This role provides numerous security-related configurations, providing all-round base protection.  It is intended to be compliant with the [DevSec Linux Baseline](https://github.com/dev-sec/linux-baseline).
 
 It configures:
 
@@ -16,9 +16,10 @@ It configures:
  * Shadow password suite configuration
  * Configures system path permissions
  * Disable core dumps via soft limits
- * Restrict Root Logins to System Console
+ * Restrict root Logins to System Console
  * Set SUIDs
  * Configures kernel parameters via sysctl
+ * Install and configure auditd
 
 It will not:
 
@@ -27,7 +28,26 @@ It will not:
 
 ## Requirements
 
-* Ansible 2.2.1
+* Ansible 2.5.0
+
+## Warning
+
+If you're using inspec to test your machines after applying this role, please make sure to add the connecting user to the `os_ignore_users`-variable.
+Otherwise inspec will fail. For more information, see [issue #124](https://github.com/dev-sec/ansible-os-hardening/issues/124).
+
+If you're using Docker / Kubernetes+Docker you'll need to override the ipv4 ip forward sysctl setting.
+
+```yaml
+- hosts: localhost
+  roles:
+    - dev-sec.os-hardening
+  vars:
+    sysctl_overwrite:
+      # Enable IPv4 traffic forwarding.
+      net.ipv4.ip_forward: 1
+```
+
+
 
 ## Variables
 
@@ -46,18 +66,18 @@ It will not:
 | `os_auth_pam_passwdqc_options`| "min=disabled,disabled,16,12,8" | set to any option line (as a string) that you want to pass to passwdqc|
 | `os_security_users_allow`| [] | list of things, that a user is allowed to do. May contain `change_user`.
 | `os_security_kernel_enable_module_loading`| true | true if you want to allowed to change kernel modules once the system is running (eg `modprobe`, `rmmod`)|
-| `os_security_kernel_enable_sysrq`| false | sysrq is a 'magical' key combo you can hit which the kernel will respond to regardless of whatever else it is doing, unless it is completely locked up. |
 | `os_security_kernel_enable_core_dump`| false | kernel is crashing or otherwise misbehaving and a kernel core dump is created |
 | `os_security_suid_sgid_enforce`| true | true if you want to reduce SUID/SGID bits. There is already a list of items which are searched for configured, but you can also add your own|
 | `os_security_suid_sgid_blacklist`| [] | a list of paths which should have their SUID/SGID bits removed|
 | `os_security_suid_sgid_whitelist`| [] | a list of paths which should not have their SUID/SGID bits altered|
 | `os_security_suid_sgid_remove_from_unknown`| false | true if you want to remove SUID/SGID bits from any file, that is not explicitly configured in a `blacklist`. This will make every Ansible-run search through the mounted filesystems looking for SUID/SGID bits that are not configured in the default and user blacklist. If it finds an SUID/SGID bit, it will be removed, unless this file is in your `whitelist`.|
-| `os_security_packages_clean'`| true | removes packages with known issues. See section packages.|
+| `os_security_packages_clean`| true | removes packages with known issues. See section packages.|
 | `ufw_manage_defaults` | true | true means apply all settings with `ufw_` prefix|
 | `ufw_ipt_sysctl` | '' | by default it disables IPT_SYSCTL in /etc/default/ufw. If you want to overwrite /etc/sysctl.conf values using ufw - set it to your sysctl dictionary, for example `/etc/ufw/sysctl.conf`
 | `ufw_default_input_policy` | DROP | set default input policy of ufw to `DROP` |
 | `ufw_default_output_policy` | ACCEPT | set default output policy of ufw to `ACCEPT` |
-| `ufw_default_forward_policy` | DROP| set default forward policy of ufw to `DROP` |
+| `ufw_default_forward_policy` | DROP | set default forward policy of ufw to `DROP` |
+| `os_auditd_enabled` | true | Set to false to disable installing and configuring auditd. |
 
 ## Packages
 
@@ -69,71 +89,55 @@ We remove the following packages:
  * ypserv ([NSA](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf), Chapter 3.2.4)
  * telnet-server ([NSA](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf), Chapter 3.2.2)
  * rsh-server ([NSA](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf), Chapter 3.2.3)
+ * prelink ([open-scap](https://static.open-scap.org/ssg-guides/ssg-sl7-guide-ospp-rhel7-server.html#xccdf_org.ssgproject.content_rule_disable_prelink))
+
+## Disabled filesystems
+
+We disable the following filesystems, because they're most likely not used:
+
+ * "cramfs"
+ * "freevxfs"
+ * "jffs2"
+ * "hfs"
+ * "hfsplus"
+ * "squashfs"
+ * "udf"
+ * "vfat" # only if uefi is not in use
+
+To prevent some of the filesystems from being disabled, add them to the `os_filesystem_whitelist` variable.
+
+## Installation
+
+Install the role with ansible-galaxy:
+
+```
+ansible-galaxy install dev-sec.os-hardening
+```
 
 ## Example Playbook
 
-    - hosts: localhost
-      roles:
-        - dev-sec.os-hardening
-
+```yaml
+- hosts: localhost
+  roles:
+    - dev-sec.os-hardening
+```
 
 ## Changing sysctl variables
 
-If you want to overwrite sysctl-variables, you have to overwrite the *whole* dict, or else only the single overwritten will be actually used.
-So for example if you want to change the IPv4 traffic forwarding variable to `1`, you must pass the whole dict like this:
+If you want to override sysctl-variables, you can use the `sysctl_overwrite` variable (in older versions you had to override the whole `sysctl_dict`).
+So for example if you want to change the IPv4 traffic forwarding variable to `1`, do it like this:
 
-```
-    - hosts: localhost
-      roles:
-        - dev-sec.os-hardening
-      vars:
-        sysctl_config:
-          # Disable IPv4 traffic forwarding.
-          net.ipv4.ip_forward: 1
-
-          # Disable IPv6 traffic forwarding.
-          net.ipv6.conf.all.forwarding: 0
-
-          # ignore RAs on Ipv6.
-          net.ipv6.conf.all.accept_ra: 0
-          net.ipv6.conf.default.accept_ra: 0
-
-          # Enable RFC-recommended source validation feature.
-          net.ipv4.conf.all.rp_filter: 1
-          net.ipv4.conf.default.rp_filter: 1
-
-          # Reduce the surface on SMURF attacks.
-          # Make sure to ignore ECHO broadcasts, which are only required in broad network analysis.
-          net.ipv4.icmp_echo_ignore_broadcasts: 1
-
-          # There is no reason to accept bogus error responses from ICMP, so ignore them instead.
-          net.ipv4.icmp_ignore_bogus_error_responses: 1
-
-          # Limit the amount of traffic the system uses for ICMP.
-          net.ipv4.icmp_ratelimit: 100
-
-          # Adjust the ICMP ratelimit to include ping, dst unreachable,
-          # source quench, ime exceed, param problem, timestamp reply, information reply
-          net.ipv4.icmp_ratemask: 88089
-
-          # Disable IPv6
-          net.ipv6.conf.all.disable_ipv6: 1
-
-          # Protect against wrapping sequence numbers at gigabit speeds
-          net.ipv4.tcp_timestamps: 0
-
-          # Define restriction level for announcing the local source IP
-          net.ipv4.conf.all.arp_ignore: 1
-
-          # Define mode for sending replies in response to
-          # received ARP requests that resolve local target IP addresses
-          net.ipv4.conf.all.arp_announce: 2
-
-          # RFC 1337 fix F1
-          net.ipv4.tcp_rfc1337: 1
+```yaml
+- hosts: localhost
+  roles:
+    - dev-sec.os-hardening
+  vars:
+    sysctl_overwrite:
+      # Enable IPv4 traffic forwarding.
+      net.ipv4.ip_forward: 1
 ```
 
-Alternatively you can change Ansible's [hash-behaviour](https://docs.ansible.com/ansible/intro_configuration.html#hash-behaviour) to `merge`, then you only have to overwrite the single hash you need to. But please be aware that changing the hash-behaviour changes it for all your playbooks and is not recommended by Ansible.
+Alternatively you can change Ansible's [hash-behaviour](https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-hash-behaviour) to `merge`, then you only have to overwrite the single hash you need to. But please be aware that changing the hash-behaviour changes it for all your playbooks and is not recommended by Ansible.
 
 ## Local Testing
 
@@ -152,27 +156,27 @@ bundle install
 ### Testing with Docker
 ```
 # fast test on one machine
-bundle exec kitchen test default-ubuntu-1204
+bundle exec kitchen test default-ubuntu-1404
 
 # test on all machines
 bundle exec kitchen test
 
 # for development
-bundle exec kitchen create default-ubuntu-1204
-bundle exec kitchen converge default-ubuntu-1204
+bundle exec kitchen create default-ubuntu-1404
+bundle exec kitchen converge default-ubuntu-1404
 ```
 
 ### Testing with Virtualbox
 ```
 # fast test on one machine
-KITCHEN_YAML=".kitchen.vagrant.yml" bundle exec kitchen test default-ubuntu-1204
+KITCHEN_YAML=".kitchen.vagrant.yml" bundle exec kitchen test default-ubuntu-1404
 
 # test on all machines
 KITCHEN_YAML=".kitchen.vagrant.yml" bundle exec kitchen test
 
 # for development
-KITCHEN_YAML=".kitchen.vagrant.yml" bundle exec kitchen create default-ubuntu-1204
-KITCHEN_YAML=".kitchen.vagrant.yml" bundle exec kitchen converge default-ubuntu-1204
+KITCHEN_YAML=".kitchen.vagrant.yml" bundle exec kitchen create default-ubuntu-1404
+KITCHEN_YAML=".kitchen.vagrant.yml" bundle exec kitchen converge default-ubuntu-1404
 ```
 For more information see [test-kitchen](http://kitchen.ci/docs/getting-started)
 
@@ -185,7 +189,7 @@ This role is mostly based on guides by:
 * [Arch Linux wiki, Sysctl hardening](https://wiki.archlinux.org/index.php/Sysctl)
 * [NSA: Guide to the Secure Configuration of Red Hat Enterprise Linux 5](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf)
 * [Ubuntu Security/Features](https://wiki.ubuntu.com/Security/Features)
-* [Deutsche Telekom, Group IT Security, Security Requirements (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si)
+* [Deutsche Telekom, Group IT Security, Security Requirements (German)](https://www.telekom.com/psa)
 
 Thanks to all of you!
 ## Contributing
@@ -194,7 +198,7 @@ See [contributor guideline](CONTRIBUTING.md).
 
 ## License and Author
 
-* Author:: Sebastian Gumprich <sebastian.gumprich@38.de>
+* Author:: Sebastian Gumprich
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

ansible.cfg

@@ -8,8 +8,9 @@
 # finds first
 
 [defaults]
-ansible_managed = Ansible managed: {file} modified on %Y-%m-%d by {uid} on {host}
-
+ansible_managed = Ansible managed: {file} modified by {uid} on {host}
 # additional paths to search for roles in, colon separated
 roles_path    = ../
 
+[ssh_connection]
+scp_if_ssh = True

default.yml

@@ -1,20 +0,0 @@
----
-- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
-  hosts: localhost
-  roles:
-    - ansible-os-hardening
-  vars:
-    os_security_users_allow: change_user
-    os_security_kernel_enable_core_dump: false
-    os_security_suid_sgid_remove_from_unknown: true
-    os_auth_pam_passwdqc_enable: false
-    os_desktop_enable: true
-    os_env_extra_user_paths: ['/home']
-    os_auth_allow_homeless: true
-    os_security_suid_sgid_blacklist: ['/bin/umount']
-    os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
-
-- name: wrapper playbook for kitchen testing "ansible-os-hardening"
-  hosts: localhost
-  roles:
-    - ansible-os-hardening

defaults/main.yml

@@ -1,6 +1,5 @@
 os_desktop_enable: false
 os_env_extra_user_paths: []
-os_env_umask: '027'
 os_auth_pw_max_age: 60
 os_auth_pw_min_age: 7 # discourage password cycling
 os_auth_retries: 5
@@ -11,18 +10,12 @@ os_auth_pam_passwdqc_enable: true
 os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8' # used in RHEL6
 os_auth_pam_pwquality_options: 'try_first_pass retry=3 type=' # used in RHEL7
 os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]
-os_auth_uid_min: 1000
-os_auth_gid_min: 1000
-os_auth_sys_uid_min: 100
-os_auth_sys_uid_max: 999
-os_auth_sys_gid_min: 100
-os_auth_sys_gid_max: 999
 
 os_chfn_restrict: ''
 # may contain: change_user
 os_security_users_allow: []
 # specify system accounts those login should not be disabled and password not changed
-os_ignore_users: ['vagrant']
+os_ignore_users: ['vagrant', 'kitchen']
 os_security_kernel_enable_module_loading: true
 os_security_kernel_enable_core_dump: false
 os_security_suid_sgid_enforce: true
@@ -34,7 +27,7 @@ os_security_suid_sgid_remove_from_unknown: false
 
 # remove packages with known issues
 os_security_packages_clean: true
-os_security_packages_list: ['xinetd','inetd','ypserv','telnet-server','rsh-server','rsync']
+os_security_packages_list: ['xinetd', 'inetd', 'ypserv', 'telnet-server', 'rsh-server', 'prelink']
 
 # Allow interactive startup (rhel, centos)
 os_security_init_prompt: true
@@ -58,61 +51,202 @@ ufw_default_application_policy: 'SKIP'
 ufw_manage_builtins: 'no'
 ufw_ipt_modules: 'nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns'
 
-# CAUTION
-# If you want to overwrite sysctl-variables,
-# you have to overwrite the *whole* dict, or else only the single overwritten will be actually used.
-
 sysctl_config:
-  # Disable IPv4 traffic forwarding.
+  # Disable IPv4 traffic forwarding. | sysctl-01
   net.ipv4.ip_forward: 0
 
-  # Disable IPv6 traffic forwarding.
+  # Disable IPv6 traffic forwarding. | sysctl-19
   net.ipv6.conf.all.forwarding: 0
 
-  # ignore RAs on Ipv6.
+  # ignore RAs on Ipv6. | sysctl-25
   net.ipv6.conf.all.accept_ra: 0
   net.ipv6.conf.default.accept_ra: 0
 
-  # Enable RFC-recommended source validation feature.
+  # Enable RFC-recommended source validation feature. | sysctl-02
   net.ipv4.conf.all.rp_filter: 1
   net.ipv4.conf.default.rp_filter: 1
 
-  # Reduce the surface on SMURF attacks.
+  # Reduce the surface on SMURF attacks. | sysctl-04
   # Make sure to ignore ECHO broadcasts, which are only required in broad network analysis.
   net.ipv4.icmp_echo_ignore_broadcasts: 1
 
-  # There is no reason to accept bogus error responses from ICMP, so ignore them instead.
+  # There is no reason to accept bogus error responses from ICMP, so ignore them instead. | sysctl-03
   net.ipv4.icmp_ignore_bogus_error_responses: 1
 
-  # Limit the amount of traffic the system uses for ICMP.
+  # Limit the amount of traffic the system uses for ICMP. | sysctl-05
   net.ipv4.icmp_ratelimit: 100
 
   # Adjust the ICMP ratelimit to include ping, dst unreachable,
-  # source quench, ime exceed, param problem, timestamp reply, information reply
+  # source quench, ime exceed, param problem, timestamp reply, information reply | sysctl-06
   net.ipv4.icmp_ratemask: 88089
 
-  # Disable IPv6
+  # Disable IPv6 | sysctl-18
   net.ipv6.conf.all.disable_ipv6: 1
 
-  # Protect against wrapping sequence numbers at gigabit speeds
+  # Protect against wrapping sequence numbers at gigabit speeds | sysctl-07
   net.ipv4.tcp_timestamps: 0
 
-  # Define restriction level for announcing the local source IP
+  # Define restriction level for announcing the local source IP | sysctl-08
   net.ipv4.conf.all.arp_ignore: 1
 
   # Define mode for sending replies in response to
-  # received ARP requests that resolve local target IP addresses
+  # received ARP requests that resolve local target IP addresses | sysctl-09
   net.ipv4.conf.all.arp_announce: 2
 
-  # RFC 1337 fix F1
+  # RFC 1337 fix F1 | sysctl-10
   net.ipv4.tcp_rfc1337: 1
 
-# CAUTION
-# If you want to overwrite sysctl-variables,
-# you have to overwrite the *whole* dict, or else only the single overwritten will be actually used.
+  # Send(router) or accept(host) RFC1620 shared media redirects | sysctl-12
+  net.ipv4.conf.all.shared_media: 1
+  net.ipv4.conf.default.shared_media: 1
 
-sysctl_rhel_config:
-  # ExecShield protection against buffer overflows
-  kernel.exec-shield: 1
-  # Syncookies is used to prevent SYN-flooding attacks.
-  net.ipv4.tcp_syncookies: 1
+  # Accepting source route can lead to malicious networking behavior,
+  # so disable it if not needed. | sysctl-13
+  net.ipv4.conf.all.accept_source_route: 0
+  net.ipv4.conf.default.accept_source_route: 0
+
+  # Accepting redirects can lead to malicious networking behavior, so disable
+  # it if not needed. | sysctl-13 | sysctl-14 | sysctl-15 | sysctl-20
+  net.ipv4.conf.default.accept_redirects: 0
+  net.ipv4.conf.all.accept_redirects: 0
+  net.ipv4.conf.all.secure_redirects: 0
+  net.ipv4.conf.default.secure_redirects: 0
+  net.ipv6.conf.default.accept_redirects: 0
+  net.ipv6.conf.all.accept_redirects: 0
+
+  # For non-routers: don't send redirects, these settings are 0 | sysctl-16
+  net.ipv4.conf.all.send_redirects: 0
+  net.ipv4.conf.default.send_redirects: 0
+
+  # log martian packets | sysctl-17
+  net.ipv4.conf.all.log_martians: 1
+  net.ipv4.conf.default.log_martians: 1
+
+  # ipv6 config
+  # Disable acceptance of IPv6 router solicitations messages | sysctl-21
+  net.ipv6.conf.default.router_solicitations: 0
+
+  # Disable Accept Router Preference from router advertisement | sysctl-22
+  net.ipv6.conf.default.accept_ra_rtr_pref: 0
+
+  # Disable learning Prefix Information from router advertisement | sysctl-23
+  net.ipv6.conf.default.accept_ra_pinfo: 0
+
+  # Disable learning Hop limit from router advertisement | sysctl-24
+  net.ipv6.conf.default.accept_ra_defrtr: 0
+
+  # Disable IPv6 autoconfiguration | sysctl-26
+  net.ipv6.conf.default.autoconf: 0
+
+  # Disable neighbor solicitations to send out per address | sysctl-27
+  net.ipv6.conf.default.dad_transmits: 0
+
+  # Assign one global unicast IPv6 addresses to each interface | sysctl-28
+  net.ipv6.conf.default.max_addresses: 1
+
+  # This settings controls how the kernel behaves towards module changes at
+  # runtime. Setting to 1 will disable module loading at runtime.
+  # Setting it to 0 is actually never supported. | sysctl-29
+  # kernel.modules_disabled: 1
+
+  # Magic Sysrq should be disabled, but can also be set to a safe value if so
+  # desired for physical machines. It can allow a safe reboot if the system hangs
+  # and is a 'cleaner' alternative to hitting the reset button. | sysctl-30
+  # The following values are permitted:
+  # * **0**   - disable sysrq
+  # * **1**   - enable sysrq completely
+  # * **>1**  - bitmask of enabled sysrq functions:
+  # * **2**   - control of console logging level
+  # * **4**   - control of keyboard (SAK, unraw)
+  # * **8**   - debugging dumps of processes etc.
+  # * **16**  - sync command
+  # * **32**  - remount read-only
+  # * **64**  - signalling of processes (term, kill, oom-kill)
+  # * **128** - reboot/poweroff
+  # * **256** - nicing of all RT tasks
+  kernel.sysrq: 0
+
+  # Prevent core dumps with SUID. These are usually only
+  # needed by developers and may contain sensitive information. | sysctl-31
+  fs.suid_dumpable: 0
+
+  # Virtual memory regions protection | sysctl-32
+  kernel.randomize_va_space: 2
+
+  kernel.core_uses_pid: 1
+
+  # When an attacker is trying to exploit the local kernel, it is often
+  # helpful to be able to examine where in memory the kernel, modules,
+  # and data structures live. As such, kernel addresses should be treated
+  # as sensitive information.
+  #
+  # Many files and interfaces contain these addresses (e.g. /proc/kallsyms,
+  # /proc/modules, etc), and this setting can censor the addresses. A value
+  # of "0" allows all users to see the kernel addresses. A value of "1"
+  # limits visibility to the root user, and "2" blocks even the root user.
+  kernel.kptr_restrict: 1
+
+  # The PTRACE system is used for debugging.  With it, a single user process
+  # can attach to any other dumpable process owned by the same user.  In the
+  # case of malicious software, it is possible to use PTRACE to access
+  # credentials that exist in memory (re-using existing SSH connections,
+  # extracting GPG agent information, etc).
+  #
+  # A PTRACE scope of "0" is the more permissive mode.  A scope of "1" limits
+  # PTRACE only to direct child processes (e.g. "gdb name-of-program" and
+  # "strace -f name-of-program" work, but gdb's "attach" and "strace -fp $PID"
+  # do not).  The PTRACE scope is ignored when a user has CAP_SYS_PTRACE, so
+  # "sudo strace -fp $PID" will work as before.  For more details see:
+  # https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening#ptrace
+  #
+  # For applications launching crash handlers that need PTRACE, exceptions can
+  # be registered by the debugee by declaring in the segfault handler
+  # specifically which process will be using PTRACE on the debugee:
+  #   prctl(PR_SET_PTRACER, debugger_pid, 0, 0, 0);
+  #
+  # In general, PTRACE is not needed for the average running Ubuntu system.
+  # To that end, the default is to set the PTRACE scope to "1".  This value
+  # may not be appropriate for developers or servers with only admin accounts.
+  # kernel.yama.ptrace_scope = 1
+  kernel.yama.ptrace_scope: 1
+
+  # Protect the zero page of memory from userspace mmap to prevent kernel
+  # NULL-dereference attacks against potential future kernel security
+  # vulnerabilities.  (Added in kernel 2.6.23.)
+  #
+  # While this default is built into the Ubuntu kernel, there is no way to
+  # restore the kernel default if the value is changed during runtime; for
+  # example via package removal (e.g. wine, dosemu).  Therefore, this value
+  # is reset to the secure default each time the sysctl values are loaded.
+  vm.mmap_min_addr: 65536
+
+  # These settings eliminate an entire class of security vulnerability:
+  # time-of-check-time-of-use cross-privilege attacks using guessable
+  # filenames (generally seen as "/tmp file race" vulnerabilities).
+  fs.protected_hardlinks: 1
+  fs.protected_symlinks: 1
+
+# Do not delete the following line or otherwise the playbook will fail
+# at task 'create a combined sysctl-dict if overwrites are defined'
+sysctl_overwrite:
+
+# disable unused filesystems
+os_unused_filesystems:
+  - "cramfs"
+  - "freevxfs"
+  - "jffs2"
+  - "hfs"
+  - "hfsplus"
+  - "squashfs"
+  - "udf"
+  - "vfat"
+
+# whitelist for used filesystems
+os_filesystem_whitelist: []
+
+# Set to false to turn the role into a no-op. Useful when using
+# the Ansible role dependency mechanism.
+os_hardening_enabled: true
+
+# Set to false to disable installing and configuring auditd.
+os_auditd_enabled: true

handlers/main.yml

@@ -0,0 +1,3 @@
+---
+- name: update-initramfs
+  command: 'update-initramfs -u'

meta/main.yml

@@ -1,10 +1,10 @@
 ---
 galaxy_info:
   author: "Sebastian Gumprich"
-  description: 'This Ansible role provides numerous security-related configurations, providing all-round base protection.'
+  description: 'This role provides numerous security-related configurations, providing all-round base protection.'
   company: Hardening Framework Team
   license: Apache License 2.0
-  min_ansible_version: '2.2.1'
+  min_ansible_version: '2.5'
   platforms:
     - name: EL
       versions:
@@ -12,13 +12,13 @@ galaxy_info:
         - 7
     - name: Ubuntu
       versions:
-        - precise
-        - trusty
         - xenial
+        - bionic
     - name: Debian
       versions:
-        - wheezy
         - jessie
+    - name: Amazon
+    - name: Fedora
   galaxy_tags:
     - system
     - security

tasks/apt.yml

@@ -1,6 +1,6 @@
 ---
-- name: remove packages
-  apt: name='{{item}}' state=removed
-  with_items:
-    - "{{os_security_packages_list}}"
-  when: os_security_packages_clean
+- name: remove deprecated or insecure packages | package-01 - package-09
+  apt:
+    name: '{{ os_security_packages_list }}'
+    state: 'absent'
+  when: os_security_packages_clean | bool

tasks/auditd.yml

@@ -0,0 +1,14 @@
+---
+
+- name: install auditd package | package-08
+  package:
+    name: '{{ auditd_package }}'
+    state: 'present'
+
+- name: configure auditd | package-08
+  template:
+    src: 'etc/audit/auditd.conf.j2'
+    dest: '/etc/audit/auditd.conf'
+    owner: 'root'
+    group: 'root'
+    mode: '0640'

tasks/hardening.yml

@@ -0,0 +1,60 @@
+---
+- name: Set OS family dependent variables
+  include_vars: '{{ ansible_os_family }}.yml'
+  tags: always
+
+- name: Set OS dependent variables
+  include_vars: '{{ item }}'
+  with_first_found:
+    - files:
+      - '{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml'
+      - '{{ ansible_distribution }}.yml'
+      - '{{ ansible_os_family }}-{{ ansible_distribution_major_version }}.yml'
+      skip: true
+  tags: always
+
+- import_tasks: auditd.yml
+  tags: auditd
+  when: os_auditd_enabled | bool
+
+- import_tasks: limits.yml
+  tags: limits
+
+- import_tasks: login_defs.yml
+  tags: login_defs
+
+- import_tasks: minimize_access.yml
+  tags: minimize_access
+
+- import_tasks: pam.yml
+  tags: pam
+
+- import_tasks: modprobe.yml
+  tags: modprobe
+
+- import_tasks: profile.yml
+  tags: profile
+
+- import_tasks: securetty.yml
+  tags: securetty
+
+- import_tasks: suid_sgid.yml
+  when: os_security_suid_sgid_enforce  | bool
+  tags: suid_sgid
+
+- import_tasks: sysctl.yml
+  tags: sysctl
+
+- import_tasks: user_accounts.yml
+  tags: user_accounts
+
+- import_tasks: rhosts.yml
+  tags: rhosts
+
+- import_tasks: yum.yml
+  when: ansible_os_family == 'RedHat'
+  tags: yum
+
+- import_tasks: apt.yml
+  when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
+  tags: apt

tasks/limits.yml

@@ -1,9 +1,34 @@
 ---
 
-- name: create limits.d-directory if it does not exist
-  file: path='/etc/security/limits.d' owner=root group=root mode=0755 state=directory
-  when: os_security_kernel_enable_core_dump
+- block:
+  - name: create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
+    file:
+      path: '/etc/security/limits.d'
+      owner: 'root'
+      group: 'root'
+      mode: '0755'
+      state: 'directory'
 
-- name: create sane limits.conf
-  template: src='limits.conf.j2' dest='/etc/security/limits.d/10.hardcore.conf' owner=root group=root mode=0440
-  when: os_security_kernel_enable_core_dump
+  - name: create additional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
+    pam_limits:
+      dest: '/etc/security/limits.d/10.hardcore.conf'
+      domain: '*'
+      limit_type: hard
+      limit_item: core
+      value: '0'
+      comment: Prevent core dumps for all users. These are usually not needed and may contain sensitive information
+
+  - name: set 10.hardcore.conf perms to 0400 and root ownership
+    file:
+      path: /etc/security/limits.d/10.hardcore.conf
+      owner: 'root'
+      group: 'root'
+      mode: '0440'
+
+  when: not os_security_kernel_enable_core_dump | bool
+
+- name: remove 10.hardcore.conf config file
+  file:
+    path: /etc/security/limits.d/10.hardcore.conf
+    state: absent
+  when: os_security_kernel_enable_core_dump | bool

tasks/login_defs.yml

@@ -1,4 +1,8 @@
 ---
-- name: create login.defs
-  template: src='login.defs.j2' dest='/etc/login.defs' owner=root group=root mode=0444
-
+- name: create login.defs | os-05, os-05b
+  template:
+    src: 'etc/login.defs.j2'
+    dest: '/etc/login.defs'
+    owner: 'root'
+    group: 'root'
+    mode: '0444'

tasks/main.yml

@@ -1,43 +1,4 @@
 ---
-- name: add the OS specific variables
-  include_vars: "{{ ansible_os_family }}.yml"
-  tags: always
 
-- include: limits.yml
-  tags: limits
-
-- include: login_defs.yml
-  tags: login_defs
-
-- include: minimize_access.yml
-  tags: minimize_acces
-
-- include: pam.yml
-  tags: pam
-
-- include: profile.yml
-  tags: profile
-
-- include: securetty.yml
-  tags: securetty
-
-- include: suid_sgid.yml
-  when: os_security_suid_sgid_enforce
-  tags: suid_sgid
-
-- include: sysctl.yml
-  tags: sysctl
-
-- include: user_accounts.yml
-  tags: user_accounts
-
-- include: rhosts.yml
-  tags: rhosts
-
-- include: yum.yml
-  when: ansible_os_family == 'RedHat'
-  tags: yum
-
-- include: apt.yml
-  when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
-  tags: apt
+- import_tasks: hardening.yml
+  when: os_hardening_enabled | bool

tasks/minimize_access.yml

@@ -1,26 +1,50 @@
 ---
-# Using a two-pass approach for checking directories in order to support symlinks.
-- name: find directories for minimizing access
-  stat:
-    path: "{{ item }}"
-  register: minimize_access_directories
-  with_items:
+# If the find-task throws an error on /usr/bin/X11 like "File system loop detected"
+# the other files inside /usr/bin (and all other directories) are
+# still getting found and the permissions minimized in the next task.
+# This is also the reason why there's ignore_errors: true on the task.
+# also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
+- name: find files with write-permissions for group
+  shell: "find -L {{ item }} -perm /go+w -type f" # noqa 305
+  with_flattened:
     - '/usr/local/sbin'
     - '/usr/local/bin'
     - '/usr/sbin'
     - '/usr/bin'
     - '/sbin'
     - '/bin'
-    - '{{os_env_extra_user_paths}}'
+    - "{{ os_env_extra_user_paths }}" # noqa 104
+  register: minimize_access_directories
+  ignore_errors: true
+  changed_when: false
 
-- name: minimize access
-  file: path='{{item.stat.path}}' mode='go-w' recurse=yes
-  when: item.stat.isdir
-  with_items: "{{ minimize_access_directories.results }}"
+- name: minimize access on found files
+  file:
+    path: '{{ item.1 }}'
+    mode: 'go-w'
+    state: file
+  with_subelements:
+    - "{{ minimize_access_directories.results }}"
+    - stdout_lines
 
-- name: change shadow ownership to root and mode to 0600 | DTAG SEC Req 3.21-7
-  file: dest='/etc/shadow' owner={{ os_shadow_perms.owner }} group={{ os_shadow_perms.group }} mode={{ os_shadow_perms.mode }}
+- name: change shadow ownership to root and mode to 0600 | os-02
+  file:
+    dest: '/etc/shadow'
+    owner: '{{ os_shadow_perms.owner }}'
+    group: '{{ os_shadow_perms.group }}'
+    mode: '{{ os_shadow_perms.mode }}'
+
+- name: change passwd ownership to root and mode to 0644 | os-03
+  file:
+    dest: '/etc/passwd'
+    owner: '{{ os_passwd_perms.owner }}'
+    group: '{{ os_passwd_perms.group }}'
+    mode: '{{ os_passwd_perms.mode }}'
 
 - name: change su-binary to only be accessible to user and group root
-  file: dest='/bin/su' owner=root group=root mode=0750
-  when: os_security_users_allow != None
+  file:
+    dest: '/bin/su'
+    owner: 'root'
+    group: 'root'
+    mode: '0750'
+  when: '"change_user" not in os_security_users_allow'

tasks/modprobe.yml

@@ -0,0 +1,23 @@
+---
+- name: install modprobe to disable filesystems | os-10
+  package:
+    name: '{{ modprobe_package }}'
+    state: 'present'
+
+- name: check if efi is installed
+  stat:
+    path: "/sys/firmware/efi"
+  register: efi_installed
+
+- name: remove vfat from fs-list if efi is used
+  set_fact:
+    os_unused_filesystems: "{{ os_unused_filesystems | difference('vfat') }}"
+  when: efi_installed.stat.isdir is defined and efi_installed.stat.isdir
+
+- name: disable unused filesystems | os-10
+  template:
+    src: 'etc/modprobe.d/modprobe.j2'
+    dest: '/etc/modprobe.d/dev-sec.conf'
+    owner: 'root'
+    group: 'root'
+    mode: '0644'

tasks/pam.yml

@@ -6,56 +6,99 @@
   environment:
     DEBIAN_FRONTEND: noninteractive
 
-- name: remove pam ccreds on Debian systems
-  apt: name='{{os_packages_pam_ccreds}}' state=absent
-  when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
-
-- name: remove pam ccreds on Redhat systems
-  yum: name='{{os_packages_pam_ccreds}}' state=absent
-  when: ansible_os_family == 'RedHat'
+# the reason for this is so a user cannot connect to a server,
+# that isn't connected to an LDAP server anymore.
+# normally caching credentials shouldn't be necessary for most machines.
+# removing it provides some more security while not removing usability.
+- name: remove pam ccreds to disable password caching
+  package:
+    name: '{{ os_packages_pam_ccreds }}'
+    state: 'absent'
 
 - name: remove pam_cracklib, because it does not play nice with passwdqc
-  apt: name='{{os_packages_pam_cracklib}}' state=absent
+  apt:
+    name: '{{ os_packages_pam_cracklib }}'
+    state: 'absent'
   when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and os_auth_pam_passwdqc_enable
 
 - name: install the package for strong password checking
-  apt: name='{{os_packages_pam_passwdqc}}' state='installed' update_cache='yes'
+  apt:
+    name: '{{ os_packages_pam_passwdqc }}'
+    state: 'present'
+    update_cache: 'yes'
   when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and os_auth_pam_passwdqc_enable
 
 - name: configure passwdqc
-  template: src='pam_passwdqd.j2' mode=0640 owner=root group=root dest='{{passwdqc_path}}'
+  template:
+    src: 'usr/share/pam-configs/pam_passwdqd.j2'
+    dest: '{{ passwdqc_path }}'
+    mode: '0644'
+    owner: 'root'
+    group: 'root'
   when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and os_auth_pam_passwdqc_enable
 
 - name: remove passwdqc
-  apt: name='{{os_packages_pam_passwdqc}}' state='absent'
+  apt:
+    name: '{{ os_packages_pam_passwdqc }}'
+    state: 'absent'
   when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable
 
 - name: install tally2
-  apt: name='libpam-modules' state='installed'
-  when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable and os_auth_retries > 0
+  apt:
+    name: 'libpam-modules'
+    state: 'present'
+  when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and
+        not os_auth_pam_passwdqc_enable and os_auth_retries > 0
 
 - name: configure tally2
-  template: src='pam_tally2.j2' dest='{{tally2_path}}' mode=0640 owner=root group=root
-  when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable and os_auth_retries > 0
+  template:
+    src: 'usr/share/pam-configs/pam_tally2.j2'
+    dest: '{{ tally2_path }}'
+    mode: '0644'
+    owner: 'root'
+    group: 'root'
+  when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and
+        not os_auth_pam_passwdqc_enable and os_auth_retries > 0
 
 - name: delete tally2 when retries is 0
-  file: path='{{tally2_path}}' state=absent
-  when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable and os_auth_retries == 0
+  file:
+    path: '{{ tally2_path }}'
+    state: 'absent'
+  when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and
+        not os_auth_pam_passwdqc_enable and os_auth_retries == 0
 
 - name: remove pam_cracklib, because it does not play nice with passwdqc
-  yum: name='{{os_packages_pam_cracklib}}' state='absent'
-  when: (ansible_os_family == 'RedHat' and ansible_distribution_version < '7') and os_auth_pam_passwdqc_enable
+  yum:
+    name: '{{ os_packages_pam_cracklib }}'
+    state: 'absent'
+  when: (ansible_os_family == 'RedHat' and ansible_distribution_version is version_compare('7', '<') and not ansible_distribution == 'Amazon')
+        and os_auth_pam_passwdqc_enable
 
 - name: install the package for strong password checking
-  yum: name='{{os_packages_pam_passwdqc}}' state='installed'
-  when: (ansible_os_family == 'RedHat' and ansible_distribution_version < '7') and os_auth_pam_passwdqc_enable
+  yum:
+    name: '{{ os_packages_pam_passwdqc }}'
+    state: 'present'
+  when: (ansible_os_family == 'RedHat' and ansible_distribution_version is version_compare('7', '<') and not ansible_distribution == 'Amazon')
+        and os_auth_pam_passwdqc_enable
 
 - name: remove passwdqc
-  yum: name='{{os_packages_pam_passwdqc}}' state='absent'
+  yum:
+    name: '{{ os_packages_pam_passwdqc }}'
+    state: 'absent'
   when: ansible_os_family == 'RedHat' and not os_auth_pam_passwdqc_enable
 
 - name: configure passwdqc and tally via central system-auth confic
-  template: src='rhel_system_auth.j2' dest='/etc/pam.d/system-auth-ac' mode=0640 owner=root group=root
+  template:
+    src: 'etc/pam.d/rhel_system_auth.j2'
+    dest: '/etc/pam.d/system-auth-ac'
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
 
 - name: NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
-  template: src='rhel_libuser.conf.j2' dest='/etc/libuser.conf' mode=0640 owner=root group=root
+  template:
+    src: 'etc/rhel_libuser.conf.j2'
+    dest: '/etc/libuser.conf'
+    mode: '0640'
+    owner: 'root'
+    group: 'root'

tasks/profile.yml

@@ -1,4 +1,15 @@
 ---
-- name: create profile.conf
-  template: src='profile.conf.j2' dest='/etc/profile.d/pinerolo_profile.sh' owner=root group=root mode=0750
-  when: not os_security_kernel_enable_core_dump
+- name: add pinerolo_profile.sh to profile.d
+  template:
+    src: 'etc/profile.d/profile.conf.j2'
+    dest: '/etc/profile.d/pinerolo_profile.sh'
+    owner: 'root'
+    group: 'root'
+    mode: '0750'
+  when: not os_security_kernel_enable_core_dump | bool
+
+- name: remove pinerolo_profile.sh from profile.d
+  file:
+    path: /etc/profile.d/pinerolo_profile.sh
+    state: absent
+  when: os_security_kernel_enable_core_dump | bool

tasks/rhosts.yml

@@ -1,13 +1,23 @@
 ---
-- name: Get user accounts | DTAG SEC Req 3.21-4
+- name: Get user accounts | os-09
   command: "awk -F: '{print $1}' /etc/passwd"
   changed_when: False
-  check_mode: no
+  check_mode: False
   register: users
 
-- name: delete rhosts-files from system | DTAG SEC Req 3.21-4
-  file: dest='~{{ item }}/.rhosts' state=absent
-  with_items: '{{ users.stdout_lines | default(omit) }}'
+- name: delete rhosts-files from system | os-09
+  file:
+    dest: '~{{ item }}/.rhosts'
+    state: 'absent'
+  with_flattened: '{{ users.stdout_lines | default([]) }}'
 
-- name: delete hosts.equiv from system | DTAG SEC Req 3.21-4
-  file: dest='/etc/hosts.equiv' state=absent
+- name: delete hosts.equiv from system | os-01
+  file:
+    dest: '/etc/hosts.equiv'
+    state: 'absent'
+
+- name: delete .netrc-files from system | os-09
+  file:
+    dest: '~{{ item }}/.netrc'
+    state: 'absent'
+  with_flattened: '{{ users.stdout_lines | default([]) }}'

tasks/securetty.yml

@@ -1,3 +1,8 @@
 ---
 - name: create securetty
-  template: src='securetty.j2' dest='/etc/securetty' owner=root group=root mode=0400
+  template:
+    src: 'etc/securetty.j2'
+    dest: '/etc/securetty'
+    owner: 'root'
+    group: 'root'
+    mode: '0400'

tasks/suid_sgid.yml

@@ -1,24 +1,32 @@
 ---
-- name: remove suid/sgid bit from binaries in blacklist
-  file: path='{{item}}' mode='a-s' state=file follow=yes
+- name: remove suid/sgid bit from binaries in blacklist | os-06
+  file:
+    path: '{{ item }}'
+    mode: 'a-s'
+    state: 'file'
+    follow: 'yes'
   failed_when: false
-  with_items:
+  with_flattened:
     - '{{ os_security_suid_sgid_system_blacklist }}'
     - '{{ os_security_suid_sgid_blacklist }}'
 
-- name: find binaries with suid/sgid set
+- name: find binaries with suid/sgid set | os-06
   shell: find / -xdev \( -perm -4000 -o -perm -2000 \) -type f ! -path '/proc/*' -print 2>/dev/null
   register: sbit_binaries
-  when: os_security_suid_sgid_remove_from_unknown
+  when: os_security_suid_sgid_remove_from_unknown | bool
   changed_when: False
 
-- name: gather files from which to remove suids/sgids and remove system white-listed files
+- name: gather files from which to remove suids/sgids and remove system white-listed files | os-06
   set_fact:
     suid: '{{ sbit_binaries.stdout_lines | difference(os_security_suid_sgid_system_whitelist) }}'
-  when: os_security_suid_sgid_remove_from_unknown
+  when: os_security_suid_sgid_remove_from_unknown | bool
 
-- name: remove suid/sgid bit from all binaries except in system and user whitelist
-  file: path='{{item}}' mode='a-s' state=file follow=yes
-  with_items:
-    - '{{ suid | default(omit) | difference(os_security_suid_sgid_whitelist) }}'
-  when: os_security_suid_sgid_remove_from_unknown
+- name: remove suid/sgid bit from all binaries except in system and user whitelist | os-06
+  file:
+    path: '{{ item }}'
+    mode: 'a-s'
+    state: 'file'
+    follow: 'yes'
+  with_flattened:
+    - '{{ suid | default([]) | difference(os_security_suid_sgid_whitelist) }}'
+  when: os_security_suid_sgid_remove_from_unknown | bool

tasks/sysctl.yml

@@ -1,23 +1,44 @@
 ---
 - name: protect sysctl.conf
-  file: path='/etc/sysctl.conf' owner=root group=root mode=0440
+  file:
+    path: '/etc/sysctl.conf'
+    owner: 'root'
+    group: 'root'
+    mode: '0440'
 
-- name: NSA 2.2.4.1 Set Daemon umask, do config for rhel-family
-  template: src='rhel_sysconfig_init.j2' dest='/etc/sysconfig/init' owner=root group=root mode=0544
-  when: ansible_distribution == 'RedHat' or ansible_distribution == 'Fedora' or ansible_distribution == 'CentOS'
+- name: set Daemon umask, do config for rhel-family | NSA 2.2.4.1
+  template:
+    src: 'etc/sysconfig/rhel_sysconfig_init.j2'
+    dest: '/etc/sysconfig/init'
+    owner: 'root'
+    group: 'root'
+    mode: '0544'
+  when: ansible_distribution == 'RedHat' or ansible_distribution == 'Fedora' or
+        ansible_distribution == 'CentOS' or ansible_distribution == 'Amazon'
 
 - name: install initramfs-tools
-  apt: name='initramfs-tools' state=installed update_cache=true
+  apt:
+    name: 'initramfs-tools'
+    state: 'present'
+    update_cache: true
   when: ansible_os_family == 'Debian' and os_security_kernel_enable_module_loading
 
 - name: rebuild initramfs with starting pack of modules, if module loading at runtime is disabled
-  template: src='modules.j2' dest='/etc/initramfs-tools/modules' owner=root group=root mode=0440
+  template:
+    src: 'etc/initramfs-tools/modules.j2'
+    dest: '/etc/initramfs-tools/modules'
+    owner: 'root'
+    group: 'root'
+    mode: '0440'
+  notify:
+    - update-initramfs
   when: ansible_os_family == 'Debian' and os_security_kernel_enable_module_loading
   register: initramfs
 
-- name: update-initramfs
-  command: 'update-initramfs -u'
-  when: initramfs.changed
+- name: create a combined sysctl-dict if overwrites are defined
+  set_fact:
+    sysctl_config: '{{ sysctl_config | combine(sysctl_overwrite) }}'
+  when: sysctl_overwrite | default()
 
 - name: Change various sysctl-settings, look at the sysctl-vars file for documentation
   sysctl:
@@ -29,7 +50,7 @@
     ignoreerrors: yes
   with_dict: '{{ sysctl_config }}'
 
-- name: Change various sysctl-settings on rhel-hosts, look at the sysctl-vars file for documentation
+- name: Change various sysctl-settings on rhel6-hosts or older, look at the sysctl-vars file for documentation
   sysctl:
     name: '{{ item.key }}'
     value: '{{ item.value }}'
@@ -37,9 +58,12 @@
     reload: yes
     ignoreerrors: yes
   with_dict: '{{ sysctl_rhel_config }}'
-  when: ansible_distribution == 'RedHat' or ansible_distribution == 'Fedora' or ansible_distribution == 'CentOS'
+  when: ((ansible_distribution == 'RedHat' or ansible_distribution == 'Fedora' or ansible_distribution == 'CentOS') and
+        ansible_distribution_major_version is version_compare('7', '<')) or ansible_distribution == 'Amazon'
 
 - name: Apply ufw defaults
-  template: src="ufw.j2" dest=/etc/default/ufw
+  template:
+    src: 'etc/default/ufw.j2'
+    dest: '/etc/default/ufw'
   when: ufw_manage_defaults and (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu')
   tags: ufw

tasks/user_accounts.yml

@@ -1,35 +1,45 @@
 ---
-
 - name: get UID_MIN from login.defs
-  shell: awk '/^\s*UID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs removes=/etc/login.defs
+  shell: awk '/^\s*UID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs
+  args:
+    removes: /etc/login.defs
   register: uid_min
-  check_mode: no
+  check_mode: False
   changed_when: False
 
 - name: calculate UID_MAX from UID_MIN by substracting 1
-  set_fact: uid_max='{{ uid_min.stdout | int - 1 }}'
+  set_fact:
+    uid_max: '{{ uid_min.stdout | int - 1 }}'
   when: uid_min is defined
 
 - name: set UID_MAX on Debian-systems if no login.defs exist
-  set_fact: uid_max='999'
+  set_fact:
+    uid_max: '999'
   when: ansible_os_family == 'Debian' and not uid_min
 
 - name: set UID_MAX on other systems if no login.defs exist
-  set_fact: uid_max='499'
+  set_fact:
+    uid_max: '499'
   when: not uid_min
 
 - name: get all system accounts
-  command: awk -F'':'' '{ if ( $3 <= {{uid_max|quote}} ) print $1}' /etc/passwd removes=/etc/passwd
+  command: awk -F'':'' '{ if ( $3 <= {{ uid_max|quote }} ) print $1}' /etc/passwd
+  args:
+    removes: /etc/passwd
   changed_when: False
-  check_mode: no
+  check_mode: False
   register: sys_accs
 
 - name: remove always ignored system accounts from list
   set_fact:
-    sys_accs_cond: '{{sys_accs.stdout_lines | difference(os_always_ignore_users) }}'
-  check_mode: no
+    sys_accs_cond: '{{ sys_accs.stdout_lines | difference(os_always_ignore_users) }}'
+  check_mode: False
 
 - name: change system accounts not on the user provided ignore-list
-  user: name='{{item}}' shell='{{os_nologin_shell_path}}' password='*'
-  with_items:
-    - '{{sys_accs_cond | default(omit) | difference(os_ignore_users) }}'
+  user:
+    name: '{{ item }}'
+    shell: '{{ os_nologin_shell_path }}'
+    password: '*'
+    createhome: False
+  with_flattened:
+    - '{{ sys_accs_cond | default([]) | difference(os_ignore_users) | list }}'

tasks/yum.yml

@@ -1,36 +1,41 @@
 ---
 - name: remove unused repositories
-  file: name='/etc/yum.repos.d/{{item}}.repo' state=absent
+  file:
+    name: '/etc/yum.repos.d/{{ item }}.repo'
+    state: 'absent'
   with_items:
     - 'CentOS-Debuginfo'
     - 'CentOS-Media'
     - 'CentOS-Vault'
-  when: os_security_packages_clean
+  when: os_security_packages_clean | bool
 
 - name: get yum-repository-files
   shell: 'find /etc/yum.repos.d/ -type f -name *.repo'
   changed_when: False
   register: yum_repos
 
-- name: check if rhnplugin.conf exists
-  stat: path='/etc/yum/pluginconf.d/rhnplugin.conf'
-  register: rhnplugin_file
-
-  # for the "default([])" see here:
+  # for the 'default([])' see here:
   # https://github.com/dev-sec/ansible-os-hardening/issues/99 and
   # https://stackoverflow.com/questions/37067827/ansible-deprecation-warning-for-undefined-variable-despite-when-clause
-- name: activate gpg-check for yum-repos
-  replace: dest='{{item}}' regexp='^\s*gpgcheck=0' replace='gpgcheck=1'
-  with_items:
+  #
+  # failed_when is needed because by default replace module will fail if the file doesn't exists.
+  # status.rc is only defined if an error accrued and only error code (rc) 257 will be ignored.
+  # All other errors will still be raised.
+- name: activate gpg-check for config files
+  replace:
+    dest: '{{ item }}'
+    regexp: '^\s*gpgcheck: 0'
+    replace: 'gpgcheck: 1'
+  register: status
+  failed_when: status.rc is defined and status.rc != 257
+  with_flattened:
     - '/etc/yum.conf'
-    - '{{ yum_repos.stdout_lines| default([]) }}'
+    - '/etc/dnf/dnf.conf'
+    - '{{ yum_repos.stdout_lines| default([]) }}' # noqa 104
+    - '/etc/yum/pluginconf.d/rhnplugin.conf'
 
-- name: activate gpg-check for yum rhn if it exists
-  replace: dest='/etc/yum/pluginconf.d/rhnplugin.conf' regexp='^\s*gpgcheck=0' replace='gpgcheck=1'
-  when: rhnplugin_file.stat.exists
-
-- name: remove packages
-  yum: name='{{item}}' state=removed
-  with_items:
-    - "{{os_security_packages_list}}"
-  when: os_security_packages_clean
+- name: remove deprecated or insecure packages | package-01 - package-09
+  yum:
+    name: '{{ os_security_packages_list }}'
+    state: 'absent'
+  when: os_security_packages_clean | bool

templates/etc/audit/auditd.conf.j2

@@ -0,0 +1,28 @@
+log_file = /var/log/audit/audit.log
+log_format = RAW
+log_group = root
+priority_boost = 4
+flush = INCREMENTAL
+freq = 20
+num_logs = 5
+disp_qos = lossy
+dispatcher = /sbin/audispd
+name_format = NONE
+##name = mydomain
+max_log_file = 6
+max_log_file_action = keep_logs
+space_left = 75
+space_left_action = SYSLOG
+action_mail_acct = root
+admin_space_left = 50
+admin_space_left_action = SUSPEND
+disk_full_action = SUSPEND
+disk_error_action = SUSPEND
+##tcp_listen_port =
+tcp_listen_queue = 5
+tcp_max_per_addr = 1
+##tcp_client_ports = 1024-65535
+tcp_client_max_idle = 0
+enable_krb5 = no
+krb5_principal = auditd
+##krb5_key_file = /etc/audit/audit.key

templates/etc/default/ufw.j2

@@ -1,3 +1,4 @@
+# {{ ansible_managed | comment }}
 # /etc/default/ufw
 #
 

templates/etc/initramfs-tools/modules.j2

@@ -1,4 +1,4 @@
-# {{ ansible_managed }}
+# {{ ansible_managed | comment }}
 # This file contains the names of kernel modules that should be loaded at boot time, one per line. Lines beginning with "#" are ignored.
 #
 # A list of all available kernel modules kann be found with `find /lib/modules/$(uname -r)/kernel/`

templates/etc/login.defs.j2

@@ -1,21 +1,22 @@
+# {{ ansible_managed | comment }}
 # Configuration control definitions for the login package.
-# 
+#
 # Three items must be defined:  `MAIL_DIR`, `ENV_SUPATH`, and `ENV_PATH`. If unspecified, some arbitrary (and possibly incorrect) value will be assumed.  All other items are optional - if not specified then the described action or option will be inhibited.
-# 
+#
 # Comment lines (lines beginning with `#`) and blank lines are ignored.
 #
 #-- Modified for Linux.  --marekm
 
 # *REQUIRED for useradd/userdel/usermod*
-# 
+#
 # Directory where mailboxes reside, _or_ name of file, relative to the home directory.  If you _do_ define `MAIL_DIR` and `MAIL_FILE`, `MAIL_DIR` takes precedence.
 # Essentially:
-# 
+#
 # * `MAIL_DIR` defines the location of users mail spool files (for mbox use) by appending the username to `MAIL_DIR` as defined below.
 # * `MAIL_FILE` defines the location of the users mail spool files as the fully-qualified filename obtained by prepending the user home directory before `$MAIL_FILE`
 #
 # *NOTE*: This is no more used for setting up users MAIL environment variable which is, starting from shadow 4.0.12-1 in Debian, entirely the job of the pam_mail PAM modules.
-# 
+#
 # See default PAM configuration files provided for login, su, etc.
 # This is a temporary situation: setting these variables will soon move to `/etc/default/useradd` and the variables will then be no more supported
 MAIL_DIR        /var/mail
@@ -25,7 +26,7 @@ MAIL_DIR        /var/mail
 FAILLOG_ENAB		yes
 
 # Enable display of unknown usernames when login failures are recorded.
-# 
+#
 # *WARNING*: Unknown usernames may become world readable. See #290803 and #298773 for details about how this could become a security concern
 LOG_UNKFAIL_ENAB	no
 
@@ -56,7 +57,7 @@ HUSHLOGIN_FILE	.hushlogin
 
 # *REQUIRED*: The default PATH settings, for superuser and normal users. (they are minimal, add the rest in the shell startup files)
 ENV_SUPATH	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-ENV_PATH	PATH=/usr/local/bin:/usr/bin:/bin{{ os_env_extra_user_paths| join (':') }}
+ENV_PATH	PATH=/usr/local/bin:/usr/bin:/bin:{{ os_env_extra_user_paths| join (':') }}
 
 # Terminal permissions
 # --------------------
@@ -84,7 +85,7 @@ KILLCHAR  025
 # Prefix these values with `0` to get octal, `0x` to get hexadecimal.
 # `022` is the "historical" value in Debian for UMASK
 # `027`, or even `077`, could be considered better for privacy.
-UMASK {{os_env_umask}}
+UMASK {{ os_env_umask }}
 
 # Enable setting of the umask group bits to be the same as owner bits (examples: `022` -> `002`, `077` -> `007`) for non-root users, if the uid is the same as gid, and username is the same as the primary group name.
 # If set to yes, userdel will remove the user´s group if it contains no more members, and useradd will create by default a group with the name of the user.
@@ -95,33 +96,33 @@ USERGROUPS_ENAB yes
 # -----------------------
 
 # Maximum number of days a password may be used.
-PASS_MAX_DAYS {{os_auth_pw_max_age}}
+PASS_MAX_DAYS {{ os_auth_pw_max_age }}
 
 # Minimum number of days allowed between password changes.
-PASS_MIN_DAYS {{os_auth_pw_min_age}}
+PASS_MIN_DAYS {{ os_auth_pw_min_age }}
 
 # Number of days warning given before a password expires.
 PASS_WARN_AGE	7
 
 # Min/max values for automatic uid selection in useradd
-UID_MIN			 {{os_auth_uid_min}}
+UID_MIN			 {{ os_auth_uid_min }}
 UID_MAX			60000
 # System accounts
-SYS_UID_MIN		  {{os_auth_sys_uid_min}}
-SYS_UID_MAX		  {{os_auth_sys_uid_max}}
+SYS_UID_MIN		  {{ os_auth_sys_uid_min }}
+SYS_UID_MAX		  {{ os_auth_sys_uid_max }}
 
 # Min/max values for automatic gid selection in groupadd
-GID_MIN			 {{os_auth_gid_min}}
+GID_MIN			 {{ os_auth_gid_min }}
 GID_MAX			60000
 # System accounts
-SYS_GID_MIN		  {{os_auth_sys_gid_min}}
-SYS_GID_MAX		  {{os_auth_sys_gid_max}}
+SYS_GID_MIN		  {{ os_auth_sys_gid_min }}
+SYS_GID_MAX		  {{ os_auth_sys_gid_max }}
 
 # Max number of login retries if password is bad. This will most likely be overriden by PAM, since the default pam_unix module has it's own built in of 3 retries. However, this is a safe fallback in case you are using an authentication module that does not enforce PAM_MAXTRIES.
-LOGIN_RETRIES		{{os_auth_retries}}
+LOGIN_RETRIES		{{ os_auth_retries }}
 
 # Max time in seconds for login
-LOGIN_TIMEOUT		{{os_auth_timeout}}
+LOGIN_TIMEOUT		{{ os_auth_timeout }}
 
 # Which fields may be changed by regular users using chfn - use any combination of letters "frwh" (full name, room number, work phone, home phone).  If not defined, no changes are allowed.
 # For backward compatibility, "yes" = "rwh" and "no" = "frwh".

templates/etc/modprobe.d/modprobe.j2

@@ -0,0 +1,5 @@
+{{ ansible_managed | comment }}
+
+{% for fs in os_unused_filesystems | difference(os_filesystem_whitelist) %}
+install {{fs}} /bin/true
+{% endfor %}

templates/etc/pam.d/rhel_system_auth.j2

@@ -1,9 +1,8 @@
-# {{ ansible_managed }}
-#---
+# {{ ansible_managed | comment }}
 
 #%PAM-1.0
 {% if os_auth_retries > 0 %}
-auth        required      pam_tally2.so deny={{os_auth_retries}} onerr=fail unlock_time={{os_auth_lockout_time}}
+auth        required      pam_tally2.so deny={{ os_auth_retries }} onerr=fail unlock_time={{ os_auth_lockout_time }}
 {% endif %}
 auth        required      pam_env.so
 auth        sufficient    pam_unix.so nullok try_first_pass
@@ -18,11 +17,11 @@ account     sufficient    pam_localuser.so
 account     sufficient    pam_succeed_if.so uid < 500 quiet
 account     required      pam_permit.so
 
-{% if os_auth_pam_passwdqc_enable %}
-  {%- if ansible_os_family == 'RedHat' and ansible_distribution_version >= '7' %}
-password    required      pam_pwquality.so {{os_auth_pam_pwquality_options}}
+{% if (os_auth_pam_passwdqc_enable|bool) %}
+  {%- if ((ansible_os_family == 'RedHat' and ansible_distribution_version is version_compare('7', '>=')) or ansible_distribution == 'Amazon') %}
+password    required      pam_pwquality.so {{ os_auth_pam_pwquality_options }}
   {%- else %}
-password    requisite     pam_passwdqc.so {{os_auth_pam_passwdqc_options}}
+password    requisite     pam_passwdqc.so {{ os_auth_pam_passwdqc_options }}
   {%- endif %}
 {% else %}
 password    requisite     pam_cracklib.so try_first_pass retry=3 type=

templates/etc/profile.d/profile.conf.j2

@@ -1,4 +1,4 @@
-# {{ ansible_managed }}
+# {{ ansible_managed | comment }}
 
 # Disable core dumps via soft limits for all users. Compliance to this setting is voluntary and can be modified by users up to a hard limit. This setting is a sane default.
 ulimit -S -c 0 > /dev/null 2>&1

templates/etc/rhel_libuser.conf.j2

@@ -1,6 +1,6 @@
 # See libuser.conf(5) for more information.
 
-# {{ ansible_managed }}
+# {{ ansible_managed | comment }}
 
 # Do not modify the default module list if you care about unattended calls
 # to programs (i.e., scripts) working!

templates/etc/securetty.j2

@@ -1,4 +1,4 @@
-# {{ ansible_managed }}
+# {{ ansible_managed | comment }}
 
 
 # A list of TTYs, from which root can log in

templates/etc/sysconfig/rhel_sysconfig_init.j2

@@ -1,4 +1,4 @@
-# {{ ansible_managed }}
+# {{ ansible_managed | comment }}
 
 # color => new RH6.0 bootup
 # verbose => old-style bootup
@@ -18,7 +18,7 @@ SETCOLOR_WARNING="echo -en \\033[0;33m"
 # terminal sequence to reset to the default color.
 SETCOLOR_NORMAL="echo -en \\033[0;39m"
 # Set to anything other than 'no' to allow hotkey interactive startup...
-PROMPT={{ 'yes' if os_security_init_prompt else 'no' }}
+PROMPT={{ 'yes' if (os_security_init_prompt|bool) else 'no' }}
 # Set to 'yes' to allow probing for devices with swap signatures
 AUTOSWAP=no
 # What ttys should gettys be started on?

templates/limits.conf.j2

@@ -1,3 +0,0 @@
-# {{ansible_managed}}
-# Prevent core dumps for all users. These are usually only needed by developers and may contain sensitive information.
-* hard core 0

templates/usr/share/pam-configs/pam_passwdqd.j2

@@ -4,4 +4,4 @@ Priority: 1024
 Conflicts: cracklib
 Password-Type: Primary
 Password:
-  requisite     pam_passwdqc.so {{os_auth_pam_passwdqc_options}}
+  requisite     pam_passwdqc.so {{ os_auth_pam_passwdqc_options }}

templates/usr/share/pam-configs/pam_tally2.j2

@@ -4,7 +4,7 @@ Priority: 1024
 Conflicts: cracklib
 Auth-Type: Primary
 Auth-Initial:
-  required      pam_tally2.so deny={{os_auth_retries}} onerr=fail unlock_time={{os_auth_lockout_time}}
+  required      pam_tally2.so deny={{ os_auth_retries }} onerr=fail unlock_time={{ os_auth_lockout_time }}
 Account-Type: Primary
 Account-Initial:
   required      pam_tally2.so

tests/test.yml

@@ -0,0 +1,79 @@
+---
+- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+  hosts: localhost
+  roles:
+    - ansible-os-hardening
+  pre_tasks:
+    - name: Run the equivalent of "apt-get update" as a separate step
+      apt:
+        update_cache: yes
+      when: ansible_os_family == 'Debian'
+    - name: install required tools on fedora
+      dnf:
+        name:
+          - python
+          - findutils
+          - procps-ng
+      when: ansible_distribution == 'Fedora'
+    - name: create recursing symlink to test minimize access
+      shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
+  vars:
+    os_security_users_allow: change_user
+    os_security_kernel_enable_core_dump: true
+    os_security_suid_sgid_remove_from_unknown: true
+    os_auth_pam_passwdqc_enable: false
+    os_desktop_enable: true
+    os_env_extra_user_paths: ['/home']
+    os_auth_allow_homeless: true
+    os_security_suid_sgid_blacklist: ['/bin/umount']
+    os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
+    os_filesystem_whitelist: []
+    sysctl_config:
+      net.ipv4.ip_forward: 0
+      net.ipv6.conf.all.forwarding: 0
+      net.ipv6.conf.all.accept_ra: 0
+      net.ipv6.conf.default.accept_ra: 0
+      net.ipv4.conf.all.rp_filter: 1
+      net.ipv4.conf.default.rp_filter: 1
+      net.ipv4.icmp_echo_ignore_broadcasts: 1
+      net.ipv4.icmp_ignore_bogus_error_responses: 1
+      net.ipv4.icmp_ratelimit: 100
+      net.ipv4.icmp_ratemask: 88089
+      net.ipv6.conf.all.disable_ipv6: 1
+      net.ipv4.conf.all.arp_ignore: 1
+      net.ipv4.conf.all.arp_announce: 2
+      net.ipv4.conf.all.shared_media: 1
+      net.ipv4.conf.default.shared_media: 1
+      net.ipv4.conf.all.accept_source_route: 0
+      net.ipv4.conf.default.accept_source_route: 0
+      net.ipv4.conf.default.accept_redirects: 0
+      net.ipv4.conf.all.accept_redirects: 0
+      net.ipv4.conf.all.secure_redirects: 0
+      net.ipv4.conf.default.secure_redirects: 0
+      net.ipv6.conf.default.accept_redirects: 0
+      net.ipv6.conf.all.accept_redirects: 0
+      net.ipv4.conf.all.send_redirects: 0
+      net.ipv4.conf.default.send_redirects: 0
+      net.ipv4.conf.all.log_martians: 1
+      net.ipv6.conf.default.router_solicitations: 0
+      net.ipv6.conf.default.accept_ra_rtr_pref: 0
+      net.ipv6.conf.default.accept_ra_pinfo: 0
+      net.ipv6.conf.default.accept_ra_defrtr: 0
+      net.ipv6.conf.default.autoconf: 0
+      net.ipv6.conf.default.dad_transmits: 0
+      net.ipv6.conf.default.max_addresses: 1
+      kernel.sysrq: 0
+      fs.suid_dumpable: 0
+      kernel.randomize_va_space: 2
+
+- name: wrapper playbook for kitchen testing "ansible-os-hardening"
+  hosts: localhost
+  vars:
+    - os_auditd_enabled: false
+  pre_tasks:
+    - name: Run the equivalent of "apt-get update" as a separate step
+      apt:
+        update_cache: yes
+      when: ansible_os_family == 'Debian'
+  roles:
+    - ansible-os-hardening

vars/Amazon.yml

@@ -0,0 +1,9 @@
+---
+# system accounts that do not get their login disabled and pasword changed
+os_always_ignore_users: ['root', 'sync', 'shutdown', 'halt', 'ec2-user']
+
+sysctl_rhel_config:
+  # ExecShield protection against buffer overflows
+  kernel.exec-shield: 1
+  # Syncookies is used to prevent SYN-flooding attacks.
+  net.ipv4.tcp_syncookies: 1

vars/Debian.yml

@@ -5,10 +5,27 @@ passwdqc_path: '/usr/share/pam-configs/passwdqc'
 tally2_path: '/usr/share/pam-configs/tally2'
 os_nologin_shell_path: '/usr/sbin/nologin'
 
+auditd_package: 'auditd'
+modprobe_package: 'kmod'
+
 # Different distros use different standards for /etc/shadow perms, e.g.
-# RHEL derivatives use root:root 0600, whereas Debian-based use root:shadow 0640.
+# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
 # You must provide key/value pairs for owner, group, and mode if overriding.
 os_shadow_perms:
   owner: root
   group: shadow
-  mode: "0640"
+  mode: '0640'
+
+os_passwd_perms:
+  owner: root
+  group: root
+  mode: '0644'
+
+os_env_umask: '027'
+
+os_auth_uid_min: 1000
+os_auth_gid_min: 1000
+os_auth_sys_uid_min: 100
+os_auth_sys_uid_max: 999
+os_auth_sys_gid_min: 100
+os_auth_sys_gid_max: 999

vars/Fedora.yml

@@ -0,0 +1,31 @@
+---
+
+modprobe_package: 'module-init-tools'
+auditd_package: 'audit'
+
+os_packages_pam_ccreds: 'pam_ccreds'
+os_packages_pam_passwdqc: 'pam_passwdqc'
+os_packages_pam_cracklib: 'pam_cracklib'
+os_nologin_shell_path: '/sbin/nologin'
+
+# Different distros use different standards for /etc/shadow perms, e.g.
+# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
+# You must provide key/value pairs for owner, group, and mode if overriding.
+os_shadow_perms:
+  owner: root
+  group: root
+  mode: '0000'
+
+os_passwd_perms:
+  owner: root
+  group: root
+  mode: '0644'
+
+os_env_umask: '027'
+
+os_auth_uid_min: 1000
+os_auth_gid_min: 1000
+os_auth_sys_uid_min: 201
+os_auth_sys_uid_max: 999
+os_auth_sys_gid_min: 201
+os_auth_sys_gid_max: 999

vars/Oracle Linux.yml

@@ -4,9 +4,23 @@ os_packages_pam_cracklib:  'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'
 
 # Different distros use different standards for /etc/shadow perms, e.g.
-# RHEL derivatives use root:root 0600, whereas Debian-based use root:shadow 0640.
+# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
 # You must provide key/value pairs for owner, group, and mode if overriding.
 os_shadow_perms:
   owner: root
   group: root
-  mode: "0600"
+  mode: '0000'
+
+os_passwd_perms:
+  owner: root
+  group: root
+  mode: '0644'
+
+os_env_umask: '077'
+
+os_auth_uid_min: 1000
+os_auth_gid_min: 1000
+os_auth_sys_uid_min: 201
+os_auth_sys_uid_max: 999
+os_auth_sys_gid_min: 201
+os_auth_sys_gid_max: 999

vars/RedHat-6.yml

@@ -0,0 +1,7 @@
+---
+
+sysctl_rhel_config:
+  # ExecShield protection against buffer overflows
+  kernel.exec-shield: 1
+  # Syncookies is used to prevent SYN-flooding attacks.
+  net.ipv4.tcp_syncookies: 1

vars/RedHat.yml

@@ -1,12 +1,31 @@
+---
+
+modprobe_package: 'module-init-tools'
+auditd_package: 'audit'
+
 os_packages_pam_ccreds: 'pam_ccreds'
 os_packages_pam_passwdqc: 'pam_passwdqc'
 os_packages_pam_cracklib: 'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'
 
 # Different distros use different standards for /etc/shadow perms, e.g.
-# RHEL derivatives use root:root 0600, whereas Debian-based use root:shadow 0640.
+# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
 # You must provide key/value pairs for owner, group, and mode if overriding.
 os_shadow_perms:
   owner: root
   group: root
-  mode: "0600"
+  mode: '0000'
+
+os_passwd_perms:
+  owner: root
+  group: root
+  mode: '0644'
+
+os_env_umask: '077'
+
+os_auth_uid_min: 1000
+os_auth_gid_min: 1000
+os_auth_sys_uid_min: 201
+os_auth_sys_uid_max: 999
+os_auth_sys_gid_min: 201
+os_auth_sys_gid_max: 999

vars/main.yml

@@ -8,7 +8,7 @@
 # adjust values for blacklist/whitelist instead, they can override system_blacklist/whitelist
 
 # list of suid/sgid entries that must be removed
-os_security_suid_sgid_system_blacklist: 
+os_security_suid_sgid_system_blacklist:
   # blacklist as provided by NSA
   - '/usr/bin/rcp'
   - '/usr/bin/rlogin'
@@ -43,6 +43,7 @@ os_security_suid_sgid_system_whitelist:
   - '/bin/mount'
   - '/bin/ping'
   - '/bin/su'
+  - '/usr/bin/su'
   - '/bin/umount'
   - '/sbin/pam_timestamp_check'
   - '/sbin/unix_chkpwd'
@@ -107,5 +108,4 @@ os_security_suid_sgid_system_whitelist:
   - '/usr/lib/libvte-2.90-9/gnome-pty-helper'                     # gnome
 
 # system accounts that do not get their login disabled and pasword changed
-os_always_ignore_users: ['root','sync','shutdown','halt']
-
+os_always_ignore_users: ['root', 'sync', 'shutdown', 'halt']