replace module parameter fixed (#297)

Signed-off-by: danielkubat <[email protected]>

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,40 @@
+---
+name: Bug report
+about: Create a report to help us improve
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Actual behavior**
+<!--- Paste verbatim command output between quotes -->
+```paste below
+
+```
+**Example Playbook**
+<!--- Paste an example playbook that can be used to reproduce the problem between quotes -->
+```paste below
+
+```
+
+**OS / Environment**
+<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
+
+**Ansible Version**
+<!--- Paste verbatim output from "ansible --version" between quotes -->
+```paste below
+
+```
+
+**Role Version**
+<!--- Paste version of the role between quotes -->
+```paste below
+
+```
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,17 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/workflows/release.yml

@@ -0,0 +1,68 @@
+name: New release
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  generate_changelog:
+    runs-on: ubuntu-latest
+    name: create release draft
+    steps:
+      - uses: actions/checkout@v1
+
+      - name: 'Get Previous tag'
+        id: previoustag
+        uses: "WyriHaximus/github-action-get-previous-tag@master"
+        env:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: calculate next version
+        id: version
+        uses: patrickjahns/version-drafter-action@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Generate changelog
+        uses: charmixer/auto-changelog-action@8095796
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          future_release: ${{ steps.version.outputs.next-version }}
+
+      - name: Generate changelog for the release
+        uses: charmixer/auto-changelog-action@8095796
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          since_tag: ${{ steps.previoustag.outputs.tag }}
+          future_release: ${{ steps.version.outputs.next-version }}
+          output: CHANGELOGRELEASE.md
+
+      - name: push changelog
+        uses: github-actions-x/[email protected]
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          push-branch: 'master'
+          commit-message: 'update changelog'
+          force-add: 'true'
+          files: CHANGELOG.md
+          name: dev-sec CI
+          email: [email protected]
+
+      - name: Read CHANGELOG.md
+        id: package
+        uses: juliangruber/read-file-action@v1
+        with:
+          path: ./CHANGELOGRELEASE.md
+
+      - name: Create Release draft
+        id: create_release
+        uses: actions/create-release@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
+        with:
+          release_name: ${{ steps.version.outputs.next-version }}
+          tag_name: ${{ steps.version.outputs.next-version }}
+          body: |
+            ${{ steps.package.outputs.content }}
+          draft: true

.kitchen.vagrant.yml

@@ -16,55 +16,58 @@ provisioner:
   require_ruby_for_busser: false
   ansible_verbose: true
   roles_path: ../ansible-os-hardening/
-  playbook: default.yml
+  playbook: tests/test.yml
   http_proxy: <%= ENV['http_proxy'] || nil %>
   https_proxy: <%= ENV['https_proxy'] || nil %>
 
 transport:
-  max_ssh_sessions: 5
+  max_ssh_sessions: 1
 
 platforms:
-- name: ubuntu-14.04
-  driver_config:
-    box: opscode-ubuntu-14.04
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-14.04_chef-provisionerless.box
 - name: ubuntu-16.04
   driver_config:
-    box: opscode-ubuntu-16.04
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-16.04_chef-provisionerless.box
-- name: centos-6.4
+    box: bento/ubuntu-16.04
+- name: ubuntu-18.04
   driver_config:
-    box: opscode-centos-6.4
-    box_url: https://opscode-vm.s3.amazonaws.com/vagrant/opscode_centos-6.4_provisionerless.box
-- name: centos-6.5
+    box: bento/ubuntu-18.04
+- name: centos-6
   driver_config:
-    box: opscode-centos-6.5
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-6.5_chef-provisionerless.box
-- name: centos-6.8
-  driver_config:
-    box: bento/centos-6.8
+    box: bento/centos-6.7
+    provision: true
+    vagrantfiles:
+      - rhel6_provision.rb
 - name: centos-7
   driver_config:
-    box: bento/centos-7.2
-- name: oracle-6.4
+    box: bento/centos-7
+- name: centos-8
   driver_config:
-    box: oracle-6.4
-    box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel64-64.box
-- name: oracle-6.5
+    box: bento/centos-8
+- name: oracle-6
   driver_config:
-    box: oracle-6.5
-    box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel65-64.box
+    box: bento/oracle-6
+    provision: true
+    vagrantfiles:
+      - rhel6_provision.rb
 - name: oracle-7
   driver_config:
-    box: boxcutter/ol72
-- name: debian-7
+    box: bento/oracle-7
+- name: debian-9
   driver_config:
-    box: debian-7
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-7.8_chef-provisionerless.box
-- name: debian-8
+    box: bento/debian-9
+- name: debian-10
   driver_config:
-    box: debian-8
-    box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-8.1_chef-provisionerless.box
+    box: bento/debian-10
+- name: amazon
+  driver_config:
+    box: bento/amazonlinux-2
+- name: opensuse_tumbleweed
+  driver_config:
+    box: opensuse/Tumbleweed.x86_64
+    provision: true
+    vagrantfiles:
+      - suse_provision.rb
+  provisioner:
+    ansible_binary_path: "/usr/local/bin"
 
 verifier:
   name: inspec

.kitchen.yml

@@ -2,12 +2,21 @@
 driver:
   name: docker
   use_sudo: false
-  privileged: true
+  cap_add:
+    - SYS_ADMIN
+  volume:
+    - /sys/fs/cgroup:/sys/fs/cgroup:ro
+  run_options:
+    tmpfs:
+      - /tmp
+      - /run
+      - /run/lock
+  run_command: /sbin/init
   http_proxy: <%= ENV['http_proxy'] || nil %>
   https_proxy: <%= ENV['https_proxy'] || nil %>
 
 transport:
-  max_ssh_sessions: 5
+  max_ssh_sessions: 1
 
 provisioner:
   name: ansible_playbook
@@ -17,55 +26,119 @@ provisioner:
   require_ruby_for_busser: false
   ansible_verbose: true
   ansible_diff: true
-  hosts: all
+
   roles_path: ../ansible-os-hardening/
   http_proxy: <%= ENV['http_proxy'] || nil %>
   https_proxy: <%= ENV['https_proxy'] || nil %>
-  playbook: default.yml
+  playbook: tests/test.yml
 
 platforms:
 - name: centos6-ansible-latest
   driver:
     image: rndmh3ro/docker-centos6-ansible:latest
     platform: centos
+    provision_command:
+      - sed -i '/loginuid/d' /etc/pam.d/sshd
+
 - name: centos7-ansible-latest
   driver:
     image: rndmh3ro/docker-centos7-ansible:latest
     platform: centos
+    provision_command:
+      - sed -i '/nologin/d' /etc/pam.d/sshd
+      - systemctl enable sshd.service
+
+- name: centos8-ansible-latest
+  driver:
+    image: rndmh3ro/docker-centos8-ansible:latest
+    platform: centos
+    provision_command:
+      - sed -i '/nologin/d' /etc/pam.d/sshd
+      - systemctl enable sshd.service
+  provisioner:
+    ansible_binary_path: "/usr/local/bin"
+
 - name: oracle6-ansible-latest
   driver:
     image: rndmh3ro/docker-oracle6-ansible:latest
     platform: centos
+    provision_command:
+      - sed -i '/loginuid/d' /etc/pam.d/sshd
+
 - name: oracle7-ansible-latest
   driver:
     image: rndmh3ro/docker-oracle7-ansible:latest
     platform: centos
-- name: ubuntu1404-ansible-latest
-  driver:
-    image: rndmh3ro/docker-ubuntu1404-ansible:latest
-    platform: ubuntu
+    provision_command:
+      - yum -y install initscripts
+      - sed -i '/nologin/d' /etc/pam.d/sshd
+      - systemctl enable sshd.service
+
 - name: ubuntu1604-ansible-latest
   driver:
     image: rndmh3ro/docker-ubuntu1604-ansible:latest
     platform: ubuntu
-- name: debian7-ansible-latest
+    provision_command:
+      - systemctl enable ssh.service
+
+- name: ubuntu1804-ansible-latest
   driver:
-    image: rndmh3ro/docker-debian7-ansible:latest
-    platform: debian
-- name: debian8-ansible-latest
-  driver:
-    image: rndmh3ro/docker-debian8-ansible:latest
-    platform: debian
+    image: rndmh3ro/docker-ubuntu1804-ansible:latest
+    platform: ubuntu
+    provision_command:
+      - systemctl enable ssh.service
+
 - name: debian9-ansible-latest
   driver:
     image: rndmh3ro/docker-debian9-ansible:latest
     platform: debian
+    provision_command:
+      - apt install -y systemd-sysv
+      - systemctl enable ssh.service
+
+- name: debian10-ansible-latest
+  driver:
+    image: rndmh3ro/docker-debian10-ansible:latest
+    platform: debian
+    provision_command:
+      - apt install -y systemd-sysv
+      - systemctl enable ssh.service
+
+- name: amazon-ansible-latest
+  driver:
+    image: rndmh3ro/docker-amazon-ansible:latest
+    platform: centos
+    provision_command:
+      - sed -i '/nologin/d' /etc/pam.d/sshd
+      - systemctl enable sshd.service
+
+- name: fedora-ansible-latest
+  driver:
+    image: rndmh3ro/docker-fedora-ansible:latest
+    platform: centos
+    provision_command:
+      - dnf install -y python
+      - sed -i '/nologin/d' /etc/pam.d/sshd
+      - systemctl enable sshd.service
+
+- name: opensuse_tumbleweed-ansible-latest
+  driver:
+    image: rndmh3ro/docker-opensuse_tumbleweed-ansible
+    platform: opensuse
+    provision_command:
+      - zypper -n install python-xml
+      - sed -i '/nologin/d' /etc/pam.d/sshd
+      - sed -i '/systemd/d' /etc/pam.d/common-session
+      - systemctl enable sshd.service
 
 verifier:
   name: inspec
   sudo: true
   inspec_tests:
-    - https://github.com/dev-sec/tests-os-hardening
+    - https://github.com/dev-sec/linux-baseline
+  controls:
+    # skip sysctl checks, since they make no sense in docker
+    - /^(?!sysctl-|package-07).+/
 
 suites:
 - name: os

.travis.yml

@@ -2,60 +2,52 @@
 services: docker
 
 env:
-  - distro: centos6
-    version: latest
-    init: /sbin/init
-
-  - distro: centos7
-    init: /usr/lib/systemd/systemd
-    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
-    version: latest
-
-  - distro: oracle6
-    version: latest
-    init: /sbin/init
-
-  - distro: oracle7
-    init: /usr/lib/systemd/systemd
-    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
-    version: latest
-
-  - distro: ubuntu1604
-    version: latest
-    init: /lib/systemd/systemd
-    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
-
-  - distro: ubuntu1404
-    version: latest
-    init: /sbin/init
-
-  - distro: debian7
-    version: latest
-    init: /sbin/init
-
-  - distro: debian8
-    version: latest
-    init: /sbin/init
-
-  - distro: debian9
-    version: latest
-    init: /lib/systemd/systemd
-    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
+  global:
+    - version=latest
+    - init=/sbin/init
+    - run_opts="--cap-add SYS_ADMIN"
+    - volume="/sys/fs/cgroup:/sys/fs/cgroup:ro"
+  jobs:
+    - distro=centos6
+      volume=":"
+      run_opts=""
+    - distro=centos7
+    - distro=centos8
+    - distro=oracle6
+      volume=":"
+      run_opts=""
+#    - distro=oracle7
+    - distro=ubuntu1604
+    - distro=ubuntu1804
+    - distro=debian9
+      init=/lib/systemd/systemd
+    - distro=debian10
+    - distro=amazon
+    - distro=fedora
+      init=/lib/systemd/systemd
+    - distro=opensuse_tumbleweed
+      run_opts="--privileged"
 
 before_install:
   # Pull container
   - 'docker pull rndmh3ro/docker-${distro}-ansible:${version}'
 
 script:
+  - pip install --user ansible-lint
+  - ansible-lint ./
+
   - container_id=$(mktemp)
   # Run container in detached state.
-  - 'docker run --detach --volume="${PWD}":/etc/ansible/roles/ansible-os-hardening:ro ${run_opts} rndmh3ro/docker-${distro}-ansible:${version} "${init}" > "${container_id}"'
+  - 'docker run --detach --volume="${volume}" --volume="${PWD}":/etc/ansible/roles/ansible-os-hardening:ro ${run_opts} rndmh3ro/docker-${distro}-ansible:${version} "${init}" > "${container_id}"'
+
+  # Output Ansible version from docker image
+  - 'docker exec "$(cat ${container_id})" ansible-playbook --version'
 
    # Test role.
-  - 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-os-hardening/default.yml --skip-tags "sysctl"'
+  - 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-os-hardening/tests/test.yml --diff'
 
    # Verify role
-  - 'inspec exec https://github.com/dev-sec/linux-baseline/ -t docker://$(cat ${container_id}) --controls=os-01 os-02 os-03 os-04 os-05 os-06 os-07 os-09 os-10 package-01 package-02 package-03 package-04 package-05 package-06 package-09'
+  - 'inspec exec https://github.com/dev-sec/linux-baseline/ -t docker://$(cat ${container_id}) --no-distinct-exit'
 
 notifications:
   webhooks: https://galaxy.ansible.com/api/v1/notifications/

CHANGELOG.md

@@ -1,11 +1,280 @@
-# Change Log
+# Changelog
+
+## [6.2.0](https://github.com/dev-sec/ansible-os-hardening/tree/6.2.0) (2020-08-16)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/6.1.0...6.2.0)
+
+**Implemented enhancements:**
+
+- Optimize and unify when clause [\#295](https://github.com/dev-sec/ansible-os-hardening/pull/295) ([Alexhha](https://github.com/Alexhha))
+- use find module instead of shell [\#294](https://github.com/dev-sec/ansible-os-hardening/pull/294) ([danielkubat](https://github.com/danielkubat))
+- improve testing [\#287](https://github.com/dev-sec/ansible-os-hardening/pull/287) ([schurzi](https://github.com/schurzi))
+
+**Fixed bugs:**
+
+- Inconsistent use of role vars/role defaults [\#284](https://github.com/dev-sec/ansible-os-hardening/issues/284)
+
+**Closed issues:**
+
+- Consider using find module instead of shell [\#293](https://github.com/dev-sec/ansible-os-hardening/issues/293)
+- Optimize logical OR in when clause [\#292](https://github.com/dev-sec/ansible-os-hardening/issues/292)
+- vfat added to dev-sec.conf, but efi is used [\#288](https://github.com/dev-sec/ansible-os-hardening/issues/288)
+- OpenSUSE Support [\#249](https://github.com/dev-sec/ansible-os-hardening/issues/249)
+
+**Merged pull requests:**
+
+- fix fedora build [\#296](https://github.com/dev-sec/ansible-os-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
+- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [6.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/6.1.0) (2020-07-21)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/6.0.3...6.1.0)
+
+**Implemented enhancements:**
+
+- Mount proc filesystem using hidepid option [\#283](https://github.com/dev-sec/ansible-os-hardening/pull/283) ([alegrey91](https://github.com/alegrey91))
+
+**Fixed bugs:**
+
+- Is it safe to use on Debian 10? The build is failing. [\#281](https://github.com/dev-sec/ansible-os-hardening/issues/281)
+
+**Closed issues:**
+
+- The state of the galaxy release [\#269](https://github.com/dev-sec/ansible-os-hardening/issues/269)
+
+**Merged pull requests:**
+
+- do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-os-hardening/pull/289) ([schurzi](https://github.com/schurzi))
+- install procps in debian so sysctl.conf exists [\#282](https://github.com/dev-sec/ansible-os-hardening/pull/282) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [6.0.3](https://github.com/dev-sec/ansible-os-hardening/tree/6.0.3) (2020-06-06)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/6.0.2...6.0.3)
+
+**Implemented enhancements:**
+
+- unify changelog and release actions [\#279](https://github.com/dev-sec/ansible-os-hardening/pull/279) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [6.0.2](https://github.com/dev-sec/ansible-os-hardening/tree/6.0.2) (2020-06-02)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/6.0.1...6.0.2)
+
+**Implemented enhancements:**
+
+- purge insecure packages [\#275](https://github.com/dev-sec/ansible-os-hardening/pull/275) ([chris-rock](https://github.com/chris-rock))
+
+## [6.0.1](https://github.com/dev-sec/ansible-os-hardening/tree/6.0.1) (2020-05-09)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/6.0.0...6.0.1)
+
+**Implemented enhancements:**
+
+- add changelog and release workflow [\#271](https://github.com/dev-sec/ansible-os-hardening/pull/271) ([rndmh3ro](https://github.com/rndmh3ro))
+- github action for changelog generation [\#270](https://github.com/dev-sec/ansible-os-hardening/pull/270) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [6.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/6.0.0) (2020-05-05)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/5.2.1...6.0.0)
+
+**Implemented enhancements:**
+
+- Configure audit=1 for more accurate auid auditing [\#253](https://github.com/dev-sec/ansible-os-hardening/issues/253)
+- Add Debian Buster support for ansible-os-hardening [\#233](https://github.com/dev-sec/ansible-os-hardening/issues/233)
+- Add CentOS 8 support for ansible-os-hardening [\#232](https://github.com/dev-sec/ansible-os-hardening/issues/232)
+- Add selinux configuration [\#154](https://github.com/dev-sec/ansible-os-hardening/issues/154)
+- Make useradd defaults in login.defs dependent on OS [\#266](https://github.com/dev-sec/ansible-os-hardening/pull/266) ([aisbergg](https://github.com/aisbergg))
+- Add kernel hardening parameters from Tails and CIS Benchmark [\#263](https://github.com/dev-sec/ansible-os-hardening/pull/263) ([kravietz](https://github.com/kravietz))
+- add ansible-lint [\#262](https://github.com/dev-sec/ansible-os-hardening/pull/262) ([rndmh3ro](https://github.com/rndmh3ro))
+- Remove trailing space [\#261](https://github.com/dev-sec/ansible-os-hardening/pull/261) ([kravietz](https://github.com/kravietz))
+- Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-os-hardening/pull/259) ([jaredledvina](https://github.com/jaredledvina))
+- Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-os-hardening/pull/254) ([kravietz](https://github.com/kravietz))
+- Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-os-hardening/pull/251) ([dustinmiller1337](https://github.com/dustinmiller1337))
+- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) ([dustinmiller1337](https://github.com/dustinmiller1337))
+- Make max\_log\_file\_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-os-hardening/pull/246) ([jandd](https://github.com/jandd))
+- Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-os-hardening/pull/240) ([ghost](https://github.com/ghost))
+- Fedora - Use new auto ansible\_python\_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-os-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
+- add test support for CentOS8 [\#237](https://github.com/dev-sec/ansible-os-hardening/pull/237) ([yeoldegrove](https://github.com/yeoldegrove))
+- Support configuring SELinux and default to enforcing [\#236](https://github.com/dev-sec/ansible-os-hardening/pull/236) ([jaredledvina](https://github.com/jaredledvina))
+- Add test support for debian buster [\#234](https://github.com/dev-sec/ansible-os-hardening/pull/234) ([123Haynes](https://github.com/123Haynes))
+- Changed local var name to a less common one [\#231](https://github.com/dev-sec/ansible-os-hardening/pull/231) ([rgarrigue](https://github.com/rgarrigue))
+- Use ansible facts for vars [\#226](https://github.com/dev-sec/ansible-os-hardening/pull/226) ([joshuatalb](https://github.com/joshuatalb))
+
+**Fixed bugs:**
+
+- /etc/login.defs alters centos 7/8 default values [\#265](https://github.com/dev-sec/ansible-os-hardening/issues/265)
+- Invalid Conditionals in user\_accounts.yml [\#255](https://github.com/dev-sec/ansible-os-hardening/issues/255)
+- `auth-system` related files are created for non-RHEL systems \(e.g. Debian\) [\#247](https://github.com/dev-sec/ansible-os-hardening/issues/247)
+- NSA website links are stale [\#227](https://github.com/dev-sec/ansible-os-hardening/issues/227)
+- Running ansible on python3 throughs "TypeError: '\<=' not supported between instances of 'str' and 'int'"  [\#223](https://github.com/dev-sec/ansible-os-hardening/issues/223)
+- \[lots of\] deprecation warnings in Ansible 2.8 [\#221](https://github.com/dev-sec/ansible-os-hardening/issues/221)
+- Add a "don't fail on error" switch ? [\#148](https://github.com/dev-sec/ansible-os-hardening/issues/148)
+- Addressing issue \#255 [\#258](https://github.com/dev-sec/ansible-os-hardening/pull/258) ([ljkimmel](https://github.com/ljkimmel))
+- Fix \#247, cleanup conditions [\#248](https://github.com/dev-sec/ansible-os-hardening/pull/248) ([fernandezcuesta](https://github.com/fernandezcuesta))
+- Fix error on applying the sysctl vars on containers [\#243](https://github.com/dev-sec/ansible-os-hardening/pull/243) ([ghost](https://github.com/ghost))
+- Update location of NSA RHEL 5 Guide [\#235](https://github.com/dev-sec/ansible-os-hardening/pull/235) ([jaredledvina](https://github.com/jaredledvina))
+
+## [5.2.1](https://github.com/dev-sec/ansible-os-hardening/tree/5.2.1) (2019-06-09)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/5.2.0...5.2.1)
+
+**Implemented enhancements:**
+
+- Fix deprecation warnings in Ansible 2.8 [\#224](https://github.com/dev-sec/ansible-os-hardening/pull/224) ([Normo](https://github.com/Normo))
+- add docs to find-task in minimize access. fix \#219 [\#220](https://github.com/dev-sec/ansible-os-hardening/pull/220) ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Fixed bugs:**
+
+- `squash\_actions` deprecation warning [\#218](https://github.com/dev-sec/ansible-os-hardening/issues/218)
+
+## [5.2.0](https://github.com/dev-sec/ansible-os-hardening/tree/5.2.0) (2019-05-04)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/5.1.0...5.2.0)
+
+**Implemented enhancements:**
+
+- Speed up "minimize access on found files" task [\#208](https://github.com/dev-sec/ansible-os-hardening/issues/208)
+- Fedora support? [\#163](https://github.com/dev-sec/ansible-os-hardening/issues/163)
+- remove eol'd OS and add new [\#217](https://github.com/dev-sec/ansible-os-hardening/pull/217) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add note about docker under warning [\#214](https://github.com/dev-sec/ansible-os-hardening/pull/214) ([ChrisMcKee](https://github.com/ChrisMcKee))
+- change minimize access tasks to speed them up [\#209](https://github.com/dev-sec/ansible-os-hardening/pull/209) ([rndmh3ro](https://github.com/rndmh3ro))
+- Added fedora support [\#206](https://github.com/dev-sec/ansible-os-hardening/pull/206) ([jonaswre](https://github.com/jonaswre))
+- Pass package list directly to apt and yum modules without using with\_items loop [\#200](https://github.com/dev-sec/ansible-os-hardening/pull/200) ([Normo](https://github.com/Normo))
+
+**Fixed bugs:**
+
+- login.defs.j2 template: ENV\_PATH is missing ':' before variable substitution [\#202](https://github.com/dev-sec/ansible-os-hardening/issues/202)
+- 'sysctl\_rhel\_config' is undefined [\#167](https://github.com/dev-sec/ansible-os-hardening/issues/167)
+- RHEL 7.4: Too many setuid bits removed [\#140](https://github.com/dev-sec/ansible-os-hardening/issues/140)
+- Fix typo [\#212](https://github.com/dev-sec/ansible-os-hardening/pull/212) ([ruslo](https://github.com/ruslo))
+- Update modprobe to 0644 [\#211](https://github.com/dev-sec/ansible-os-hardening/pull/211) ([joshuatalb](https://github.com/joshuatalb))
+- Test Kitchen Vagrant Fixes [\#210](https://github.com/dev-sec/ansible-os-hardening/pull/210) ([joshuatalb](https://github.com/joshuatalb))
+- \[readme\] Update documentation link [\#207](https://github.com/dev-sec/ansible-os-hardening/pull/207) ([pmav99](https://github.com/pmav99))
+- fix ansible lint remarks [\#204](https://github.com/dev-sec/ansible-os-hardening/pull/204) ([rndmh3ro](https://github.com/rndmh3ro))
+- add colon to user env paths - fix \#202 [\#203](https://github.com/dev-sec/ansible-os-hardening/pull/203) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix errors produced by ansible-lint [\#159](https://github.com/dev-sec/ansible-os-hardening/pull/159) ([zbrojny120](https://github.com/zbrojny120))
+
+## [5.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/5.1.0) (2018-10-17)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/5.0.0...5.1.0)
+
+**Implemented enhancements:**
+
+- add ubuntu 1804 support [\#196](https://github.com/dev-sec/ansible-os-hardening/pull/196) ([rndmh3ro](https://github.com/rndmh3ro))
+- add option to disable auditd [\#192](https://github.com/dev-sec/ansible-os-hardening/pull/192) ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Fixed bugs:**
+
+- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191)
+- Setting os\_security\_users\_allow has no effect [\#175](https://github.com/dev-sec/ansible-os-hardening/issues/175)
+- add /usr/bin/su to suid\_guid whitelist [\#199](https://github.com/dev-sec/ansible-os-hardening/pull/199) ([ccolic](https://github.com/ccolic))
+- ensure that permissions to su-binary are not restricted to root user and group only, if os\_security\_users\_allow contains the value change\_user [\#197](https://github.com/dev-sec/ansible-os-hardening/pull/197) ([szEvEz](https://github.com/szEvEz))
+
+## [5.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/5.0.0) (2018-09-02)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.3.0...5.0.0)
+
+**Implemented enhancements:**
+
+- Warning about "include" for tasks for ansible-playbook 2.4.0 \(devel f0a5854e39\) [\#131](https://github.com/dev-sec/ansible-os-hardening/issues/131)
+- fix problems with efi and vfat [\#190](https://github.com/dev-sec/ansible-os-hardening/pull/190) ([rndmh3ro](https://github.com/rndmh3ro))
+- added os\_hardening\_enabled flag [\#186](https://github.com/dev-sec/ansible-os-hardening/pull/186) ([jcheroske](https://github.com/jcheroske))
+- add amazon run opts to travis [\#183](https://github.com/dev-sec/ansible-os-hardening/pull/183) ([rndmh3ro](https://github.com/rndmh3ro))
+- use package instead of yum and apt [\#180](https://github.com/dev-sec/ansible-os-hardening/pull/180) ([rndmh3ro](https://github.com/rndmh3ro))
+- add oracle7 to travis [\#178](https://github.com/dev-sec/ansible-os-hardening/pull/178) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix wrong permissions passwdqc \#170 [\#176](https://github.com/dev-sec/ansible-os-hardening/pull/176) ([rndmh3ro](https://github.com/rndmh3ro))
+- ipv4 forwarding comment is inconsistent with example [\#174](https://github.com/dev-sec/ansible-os-hardening/pull/174) ([carchrae](https://github.com/carchrae))
+- Rename pam\_passwdqd.j2 to pam\_passwdqc.j2 [\#172](https://github.com/dev-sec/ansible-os-hardening/pull/172) ([martinbydefault](https://github.com/martinbydefault))
+- Use package state 'present' since 'installed' is deprecated [\#168](https://github.com/dev-sec/ansible-os-hardening/pull/168) ([Normo](https://github.com/Normo))
+- Update syntax to Ansible 2.4 [\#161](https://github.com/dev-sec/ansible-os-hardening/pull/161) ([thomasjpfan](https://github.com/thomasjpfan))
+- Add support for Amazon Linux [\#158](https://github.com/dev-sec/ansible-os-hardening/pull/158) ([woneill](https://github.com/woneill))
+- Remove deprecated include for static tasks and use instead import\_tasks fix \#131 [\#132](https://github.com/dev-sec/ansible-os-hardening/pull/132) ([HelioCampos](https://github.com/HelioCampos))
+
+**Fixed bugs:**
+
+- minimize\_access: maximum recursion depth exceeded on Ansible 2.5 [\#171](https://github.com/dev-sec/ansible-os-hardening/issues/171)
+- wrong permissions passwdqc [\#170](https://github.com/dev-sec/ansible-os-hardening/issues/170)
+- Update deprecated `include` statements [\#166](https://github.com/dev-sec/ansible-os-hardening/issues/166)
+- Strongly recommend against disabling vfat by default [\#162](https://github.com/dev-sec/ansible-os-hardening/issues/162)
+- System completely unresponsive after role execution [\#145](https://github.com/dev-sec/ansible-os-hardening/issues/145)
+- do not install passwdqc on amazon linux [\#189](https://github.com/dev-sec/ansible-os-hardening/pull/189) ([rndmh3ro](https://github.com/rndmh3ro))
+- add back run opts for debian 8 in travis [\#184](https://github.com/dev-sec/ansible-os-hardening/pull/184) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix core dump config file creation when core dumps are disabled [\#182](https://github.com/dev-sec/ansible-os-hardening/pull/182) ([Normo](https://github.com/Normo))
+- change minimize access method [\#181](https://github.com/dev-sec/ansible-os-hardening/pull/181) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [4.3.0](https://github.com/dev-sec/ansible-os-hardening/tree/4.3.0) (2018-01-03)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.3.1...4.3.0)
+
+**Implemented enhancements:**
+
+- Update some RH settings in this role [\#155](https://github.com/dev-sec/ansible-os-hardening/issues/155)
+- Removal of core dump hardening configuration if core dumps are allowed [\#129](https://github.com/dev-sec/ansible-os-hardening/issues/129)
+- add amazon linux testing [\#160](https://github.com/dev-sec/ansible-os-hardening/pull/160) ([rndmh3ro](https://github.com/rndmh3ro))
+- Don't create home for system accounts [\#156](https://github.com/dev-sec/ansible-os-hardening/pull/156) ([oakey-b1](https://github.com/oakey-b1))
+- Prevent disabling of filesystems via whitelist [\#153](https://github.com/dev-sec/ansible-os-hardening/pull/153) ([manuelprinz](https://github.com/manuelprinz))
+- Add kernel hardening settings from Ubuntu /etc/sysctl.d [\#150](https://github.com/dev-sec/ansible-os-hardening/pull/150) ([kravietz](https://github.com/kravietz))
+- Removal of core dump hardening configuration if core dumps are allowed [\#146](https://github.com/dev-sec/ansible-os-hardening/pull/146) ([martinbydefault](https://github.com/martinbydefault))
+- add missing sysctl parameter [\#143](https://github.com/dev-sec/ansible-os-hardening/pull/143) ([rndmh3ro](https://github.com/rndmh3ro))
+- update readme [\#139](https://github.com/dev-sec/ansible-os-hardening/pull/139) ([rndmh3ro](https://github.com/rndmh3ro))
+- add modprobe template, control os-10 [\#138](https://github.com/dev-sec/ansible-os-hardening/pull/138) ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Fixed bugs:**
+
+- bug in ufw.j2 template [\#151](https://github.com/dev-sec/ansible-os-hardening/issues/151)
+- replace single ticks with double ticks. fix \#151 [\#152](https://github.com/dev-sec/ansible-os-hardening/pull/152) ([rndmh3ro](https://github.com/rndmh3ro))
+- fixed tag [\#149](https://github.com/dev-sec/ansible-os-hardening/pull/149) ([martinbydefault](https://github.com/martinbydefault))
+
+**Closed issues:**
+
+- ansible hardening fails on ubuntu 16.04 with msg": "ERROR! 'sysctl\_rhel\_config' is undefined [\#147](https://github.com/dev-sec/ansible-os-hardening/issues/147)
+- Enhancement: Test with TestInfra and Molecule [\#128](https://github.com/dev-sec/ansible-os-hardening/issues/128)
+
+**Merged pull requests:**
+
+- move defaults to os-specific vars [\#157](https://github.com/dev-sec/ansible-os-hardening/pull/157) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [4.3.1](https://github.com/dev-sec/ansible-os-hardening/tree/4.3.1) (2017-09-13)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.2.0...4.3.1)
+
+**Fixed bugs:**
+
+- os\_security\_kernel\_enable\_sysrq is not implemented [\#115](https://github.com/dev-sec/ansible-os-hardening/issues/115)
+
+## [4.2.0](https://github.com/dev-sec/ansible-os-hardening/tree/4.2.0) (2017-08-08)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.1.0...4.2.0)
+
+**Implemented enhancements:**
+
+- install and configure auditd - fix inspec package-08 [\#144](https://github.com/dev-sec/ansible-os-hardening/pull/144) ([rndmh3ro](https://github.com/rndmh3ro))
+- new task for delete netrc files, control os-09 [\#137](https://github.com/dev-sec/ansible-os-hardening/pull/137) ([rndmh3ro](https://github.com/rndmh3ro))
+- add passwd task, control os-03 [\#136](https://github.com/dev-sec/ansible-os-hardening/pull/136) ([rndmh3ro](https://github.com/rndmh3ro))
+- remove prelink package, control package-09 [\#135](https://github.com/dev-sec/ansible-os-hardening/pull/135) ([rndmh3ro](https://github.com/rndmh3ro))
+- style update [\#134](https://github.com/dev-sec/ansible-os-hardening/pull/134) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-os-hardening/pull/130) ([fazlearefin](https://github.com/fazlearefin))
+
+**Fixed bugs:**
+
+- Why is rsync removed? [\#141](https://github.com/dev-sec/ansible-os-hardening/issues/141)
+- playbook makes OS undetectable [\#124](https://github.com/dev-sec/ansible-os-hardening/issues/124)
+- Centos7/RHEL7: Exec shield is enabled by default and not manageable anymore by sysctl.conf [\#118](https://github.com/dev-sec/ansible-os-hardening/issues/118)
+- Remove rsync from package blacklist [\#142](https://github.com/dev-sec/ansible-os-hardening/pull/142) ([duk3luk3](https://github.com/duk3luk3))
+
+**Merged pull requests:**
+
+- remove execshield sysctl-parameter on rhel7 [\#119](https://github.com/dev-sec/ansible-os-hardening/pull/119) ([rndmh3ro](https://github.com/rndmh3ro))
 
 ## [4.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/4.1.0) (2017-06-27)
+
 [Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.0.0...4.1.0)
 
 **Fixed bugs:**
 
 - Change system accounts not on the user provided ignore-list items are not JSON serializable [\#125](https://github.com/dev-sec/ansible-os-hardening/issues/125)
+- Could not find gem 'ruby \(\>= 2.1.0\)' [\#116](https://github.com/dev-sec/ansible-os-hardening/issues/116)
+- The task sysctl fails when /etc/initramfs-tools is not present [\#111](https://github.com/dev-sec/ansible-os-hardening/issues/111)
+- Deprecation warning always\_run [\#103](https://github.com/dev-sec/ansible-os-hardening/issues/103)
 
 **Closed issues:**
 
@@ -18,6 +287,7 @@
 - add more sysctl settings, allow overwriting [\#120](https://github.com/dev-sec/ansible-os-hardening/pull/120) ([rndmh3ro](https://github.com/rndmh3ro))
 
 ## [4.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/4.0.0) (2017-03-14)
+
 [Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.2.0...4.0.0)
 
 **Implemented enhancements:**
@@ -29,10 +299,6 @@
 **Fixed bugs:**
 
 - The role fails when conditionally included [\#105](https://github.com/dev-sec/ansible-os-hardening/issues/105)
-- omit empty variables [\#106](https://github.com/dev-sec/ansible-os-hardening/pull/106) ([rndmh3ro](https://github.com/rndmh3ro))
-- Could not find gem 'ruby \(\>= 2.1.0\)' [\#116](https://github.com/dev-sec/ansible-os-hardening/issues/116)
-- The task sysctl fails when /etc/initramfs-tools is not present [\#111](https://github.com/dev-sec/ansible-os-hardening/issues/111)
-- Deprecation warning always\_run [\#103](https://github.com/dev-sec/ansible-os-hardening/issues/103)
 
 **Closed issues:**
 
@@ -47,6 +313,7 @@
 - Don’t refer to this role as "playbook" in the role description [\#104](https://github.com/dev-sec/ansible-os-hardening/pull/104) ([ypid](https://github.com/ypid))
 
 ## [3.2.0](https://github.com/dev-sec/ansible-os-hardening/tree/3.2.0) (2016-10-24)
+
 [Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.1.0...3.2.0)
 
 **Fixed bugs:**
@@ -64,9 +331,11 @@
 - add rhel7 pam\_pwquality. fix \#73 [\#94](https://github.com/dev-sec/ansible-os-hardening/pull/94) ([rndmh3ro](https://github.com/rndmh3ro))
 
 ## [3.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/3.1.0) (2016-08-03)
+
 [Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.1...3.1.0)
 
 ## [3.1](https://github.com/dev-sec/ansible-os-hardening/tree/3.1) (2016-07-27)
+
 [Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.0.0...3.1)
 
 **Implemented enhancements:**
@@ -89,7 +358,6 @@
 - Permissions on /etc/shadow can lock out GUI users [\#86](https://github.com/dev-sec/ansible-os-hardening/issues/86)
 - network related sysctl rewritten by ufw in ubuntu  [\#82](https://github.com/dev-sec/ansible-os-hardening/issues/82)
 - ansible \>= 2.0 complains: Using bare variables is deprecated [\#78](https://github.com/dev-sec/ansible-os-hardening/issues/78)
-- Norm-Audit-Hardening-Audit [\#76](https://github.com/dev-sec/ansible-os-hardening/issues/76)
 
 **Merged pull requests:**
 
@@ -97,6 +365,7 @@
 - Permits overriding permissions on /etc/shadow [\#89](https://github.com/dev-sec/ansible-os-hardening/pull/89) ([conorsch](https://github.com/conorsch))
 
 ## [3.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/3.0.0) (2016-03-13)
+
 [Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/2.0.0...3.0.0)
 
 **Implemented enhancements:**
@@ -116,7 +385,6 @@
 
 - Updates "tags" parameters on includes in main.yml [\#66](https://github.com/dev-sec/ansible-os-hardening/pull/66) ([conorsch](https://github.com/conorsch))
 - Suid set def var, fix \#64 [\#63](https://github.com/dev-sec/ansible-os-hardening/pull/63) ([rndmh3ro](https://github.com/rndmh3ro))
-- ERROR! Include tasks should not specify tags in more than one way [\#60](https://github.com/dev-sec/ansible-os-hardening/pull/60) ([fitz123](https://github.com/fitz123))
 
 **Closed issues:**
 
@@ -129,6 +397,7 @@
 - Release 3.0.0 [\#75](https://github.com/dev-sec/ansible-os-hardening/pull/75) ([rndmh3ro](https://github.com/rndmh3ro))
 
 ## [2.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/2.0.0) (2015-11-28)
+
 [Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/1.0.0...2.0.0)
 
 **Closed issues:**
@@ -147,6 +416,9 @@
 - improved travis-tests to cover more cases [\#42](https://github.com/dev-sec/ansible-os-hardening/pull/42) ([rndmh3ro](https://github.com/rndmh3ro))
 
 ## [1.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/1.0.0) (2015-09-01)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/06d1464e95cad7ccc24734b934a158b16dfc5014...1.0.0)
+
 **Closed issues:**
 
 - ansible-os-hardening/tasks/minimize\_access.yml [\#38](https://github.com/dev-sec/ansible-os-hardening/issues/38)
@@ -193,4 +465,4 @@
 
 
 
-\* *This Change Log was automatically generated by [github_changelog_generator](https://github.com/skywinder/Github-Changelog-Generator)*
+\* *This Changelog was automatically generated by [github_changelog_generator](https://github.com/github-changelog-generator/github-changelog-generator)*

Gemfile

@@ -11,6 +11,7 @@ group :integration do
   gem 'kitchen-sync'
   gem 'kitchen-transport-rsync'
   gem 'kitchen-docker'
+  gem 'inspec', '~> 3'
 end
 
 group :tools do

README.md

@@ -1,12 +1,11 @@
 # os-hardening (Ansible Role)
 
 [![Build Status](http://img.shields.io/travis/dev-sec/ansible-os-hardening.svg)][1]
-[![Gitter Chat](https://badges.gitter.im/Join%20Chat.svg)][2]
 [![Ansible Galaxy](https://img.shields.io/badge/galaxy-os--hardening-660198.svg)][3]
 
 ## Description
 
-This roles provides numerous security-related configurations, providing all-round base protection.  It is intended to be compliant with the [DevSec Linux Baseline](https://github.com/dev-sec/linux-baseline).
+This role provides numerous security-related configurations, providing all-round base protection.  It is intended to be compliant with the [DevSec Linux Baseline](https://github.com/dev-sec/linux-baseline).
 
 It configures:
 
@@ -16,9 +15,10 @@ It configures:
  * Shadow password suite configuration
  * Configures system path permissions
  * Disable core dumps via soft limits
- * Restrict Root Logins to System Console
+ * Restrict root Logins to System Console
  * Set SUIDs
  * Configures kernel parameters via sysctl
+ * Install and configure auditd
 
 It will not:
 
@@ -27,7 +27,26 @@ It will not:
 
 ## Requirements
 
-* Ansible 2.2.1
+* Ansible 2.5.0
+
+## Warning
+
+If you're using inspec to test your machines after applying this role, please make sure to add the connecting user to the `os_ignore_users`-variable.
+Otherwise inspec will fail. For more information, see [issue #124](https://github.com/dev-sec/ansible-os-hardening/issues/124).
+
+If you're using Docker / Kubernetes+Docker you'll need to override the ipv4 ip forward sysctl setting.
+
+```yaml
+- hosts: localhost
+  roles:
+    - dev-sec.os-hardening
+  vars:
+    sysctl_overwrite:
+      # Enable IPv4 traffic forwarding.
+      net.ipv4.ip_forward: 1
+```
+
+
 
 ## Variables
 
@@ -46,29 +65,34 @@ It will not:
 | `os_auth_pam_passwdqc_options`| "min=disabled,disabled,16,12,8" | set to any option line (as a string) that you want to pass to passwdqc|
 | `os_security_users_allow`| [] | list of things, that a user is allowed to do. May contain `change_user`.
 | `os_security_kernel_enable_module_loading`| true | true if you want to allowed to change kernel modules once the system is running (eg `modprobe`, `rmmod`)|
-| `os_security_kernel_enable_sysrq`| false | sysrq is a 'magical' key combo you can hit which the kernel will respond to regardless of whatever else it is doing, unless it is completely locked up. |
 | `os_security_kernel_enable_core_dump`| false | kernel is crashing or otherwise misbehaving and a kernel core dump is created |
 | `os_security_suid_sgid_enforce`| true | true if you want to reduce SUID/SGID bits. There is already a list of items which are searched for configured, but you can also add your own|
 | `os_security_suid_sgid_blacklist`| [] | a list of paths which should have their SUID/SGID bits removed|
 | `os_security_suid_sgid_whitelist`| [] | a list of paths which should not have their SUID/SGID bits altered|
 | `os_security_suid_sgid_remove_from_unknown`| false | true if you want to remove SUID/SGID bits from any file, that is not explicitly configured in a `blacklist`. This will make every Ansible-run search through the mounted filesystems looking for SUID/SGID bits that are not configured in the default and user blacklist. If it finds an SUID/SGID bit, it will be removed, unless this file is in your `whitelist`.|
-| `os_security_packages_clean'`| true | removes packages with known issues. See section packages.|
+| `os_security_packages_clean`| true | removes packages with known issues. See section packages.|
+| `os_selinux_state` | enforcing | Set the SELinux state, can be either disabled, permissive, or enforcing. |
+| `os_selinux_policy` | targeted | Set the SELinux polixy. |
 | `ufw_manage_defaults` | true | true means apply all settings with `ufw_` prefix|
 | `ufw_ipt_sysctl` | '' | by default it disables IPT_SYSCTL in /etc/default/ufw. If you want to overwrite /etc/sysctl.conf values using ufw - set it to your sysctl dictionary, for example `/etc/ufw/sysctl.conf`
 | `ufw_default_input_policy` | DROP | set default input policy of ufw to `DROP` |
 | `ufw_default_output_policy` | ACCEPT | set default output policy of ufw to `ACCEPT` |
-| `ufw_default_forward_policy` | DROP| set default forward policy of ufw to `DROP` |
+| `ufw_default_forward_policy` | DROP | set default forward policy of ufw to `DROP` |
+| `os_auditd_enabled` | true | Set to false to disable installing and configuring auditd. |
+| `os_auditd_max_log_file_action` | `keep_logs` | Defines the behaviour of auditd when its log file is filled up. Possible other values are described in the auditd.conf man page. The most common alternative to the default may be `rotate`. |
+| `hidepid_option` | `2` | `0`: This is the default setting and gives you the default behaviour. `1`: With this option an normal user would not see other processes but their own about ps, top etc, but he is still able to see process IDs in /proc. `2`: Users are only able too see their own processes (like with hidepid=1), but also the other process IDs are hidden for them in /proc. |
+| `proc_mnt_options` | `rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}` | Mount proc with hardenized options, including `hidepid` with variable value. |
 
 ## Packages
 
 We remove the following packages:
 
- * xinetd ([NSA](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf), Chapter 3.2.1)
- * inetd ([NSA](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf), Chapter 3.2.1)
- * tftp-server ([NSA](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf), Chapter 3.2.5)
- * ypserv ([NSA](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf), Chapter 3.2.4)
- * telnet-server ([NSA](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf), Chapter 3.2.2)
- * rsh-server ([NSA](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf), Chapter 3.2.3)
+ * xinetd ([NSA](https://apps.nsa.gov/iaarchive/library/ia-guidance/security-configuration/operating-systems/guide-to-the-secure-configuration-of-red-hat-enterprise.cfm), Chapter 3.2.1)
+ * inetd ([NSA](https://apps.nsa.gov/iaarchive/library/ia-guidance/security-configuration/operating-systems/guide-to-the-secure-configuration-of-red-hat-enterprise.cfm), Chapter 3.2.1)
+ * tftp-server ([NSA](https://apps.nsa.gov/iaarchive/library/ia-guidance/security-configuration/operating-systems/guide-to-the-secure-configuration-of-red-hat-enterprise.cfm), Chapter 3.2.5)
+ * ypserv ([NSA](https://apps.nsa.gov/iaarchive/library/ia-guidance/security-configuration/operating-systems/guide-to-the-secure-configuration-of-red-hat-enterprise.cfm), Chapter 3.2.4)
+ * telnet-server ([NSA](https://apps.nsa.gov/iaarchive/library/ia-guidance/security-configuration/operating-systems/guide-to-the-secure-configuration-of-red-hat-enterprise.cfm), Chapter 3.2.2)
+ * rsh-server ([NSA](https://apps.nsa.gov/iaarchive/library/ia-guidance/security-configuration/operating-systems/guide-to-the-secure-configuration-of-red-hat-enterprise.cfm), Chapter 3.2.3)
  * prelink ([open-scap](https://static.open-scap.org/ssg-guides/ssg-sl7-guide-ospp-rhel7-server.html#xccdf_org.ssgproject.content_rule_disable_prelink))
 
 ## Disabled filesystems
@@ -82,30 +106,48 @@ We disable the following filesystems, because they're most likely not used:
  * "hfsplus"
  * "squashfs"
  * "udf"
- * "vfat"
+ * "vfat" # only if uefi is not in use
+
+To prevent some of the filesystems from being disabled, add them to the `os_filesystem_whitelist` variable.
+
+## Installation
+
+Install the role with ansible-galaxy:
+
+```
+ansible-galaxy install dev-sec.os-hardening
+```
 
 ## Example Playbook
 
-    - hosts: localhost
-      roles:
-        - dev-sec.os-hardening
-
+```yaml
+- hosts: localhost
+  roles:
+    - dev-sec.os-hardening
+```
 
 ## Changing sysctl variables
-+If you want to overwrite sysctl-variables, you can use the `sysctl_overwrite` variable (in older versions you had to overwrite the whole `sysctl_dict`).
-+So for example if you want to change the IPv4 traffic forwarding variable to `1`, do it like this:
 
-```
-    - hosts: localhost
-      roles:
-        - dev-sec.os-hardening
-      vars:
-        sysctl_overwrite:
-          # Disable IPv4 traffic forwarding.
-          net.ipv4.ip_forward: 1
+If you want to override sysctl-variables, you can use the `sysctl_overwrite` variable (in older versions you had to override the whole `sysctl_dict`).
+So for example if you want to change the IPv4 traffic forwarding variable to `1`, do it like this:
+
+```yaml
+- hosts: localhost
+  roles:
+    - dev-sec.os-hardening
+  vars:
+    sysctl_overwrite:
+      # Enable IPv4 traffic forwarding.
+      net.ipv4.ip_forward: 1
 ```
 
-Alternatively you can change Ansible's [hash-behaviour](https://docs.ansible.com/ansible/intro_configuration.html#hash-behaviour) to `merge`, then you only have to overwrite the single hash you need to. But please be aware that changing the hash-behaviour changes it for all your playbooks and is not recommended by Ansible.
+Alternatively you can change Ansible's [hash-behaviour](https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-hash-behaviour) to `merge`, then you only have to overwrite the single hash you need to. But please be aware that changing the hash-behaviour changes it for all your playbooks and is not recommended by Ansible.
+
+## Improving Kernel Audit logging
+
+By default, any process that starts before the `auditd` daemon will have an AUID of `4294967295`. To improve this and provide more accurate logging, it's recommended to add the kernel boot parameter `audit=1` to you configuration. Without doing this, you will find that your `auditd` logs fail to properly audit all processes. 
+
+For more information, please see this [upstream documentation](https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html) and your system's boot loader documentation for how to configure additional kernel parameters. 
 
 ## Local Testing
 
@@ -157,7 +199,7 @@ This role is mostly based on guides by:
 * [Arch Linux wiki, Sysctl hardening](https://wiki.archlinux.org/index.php/Sysctl)
 * [NSA: Guide to the Secure Configuration of Red Hat Enterprise Linux 5](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf)
 * [Ubuntu Security/Features](https://wiki.ubuntu.com/Security/Features)
-* [Deutsche Telekom, Group IT Security, Security Requirements (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si)
+* [Deutsche Telekom, Group IT Security, Security Requirements (German)](https://www.telekom.com/psa)
 
 Thanks to all of you!
 ## Contributing
@@ -166,7 +208,7 @@ See [contributor guideline](CONTRIBUTING.md).
 
 ## License and Author
 
-* Author:: Sebastian Gumprich <sebastian.gumprich@38.de>
+* Author:: Sebastian Gumprich
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

defaults/main.yml

@@ -1,6 +1,5 @@
 os_desktop_enable: false
 os_env_extra_user_paths: []
-os_env_umask: '027'
 os_auth_pw_max_age: 60
 os_auth_pw_min_age: 7 # discourage password cycling
 os_auth_retries: 5
@@ -11,12 +10,6 @@ os_auth_pam_passwdqc_enable: true
 os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8' # used in RHEL6
 os_auth_pam_pwquality_options: 'try_first_pass retry=3 type=' # used in RHEL7
 os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]
-os_auth_uid_min: 1000
-os_auth_gid_min: 1000
-os_auth_sys_uid_min: 100
-os_auth_sys_uid_max: 999
-os_auth_sys_gid_min: 100
-os_auth_sys_gid_max: 999
 
 os_chfn_restrict: ''
 # may contain: change_user
@@ -34,7 +27,7 @@ os_security_suid_sgid_remove_from_unknown: false
 
 # remove packages with known issues
 os_security_packages_clean: true
-os_security_packages_list: ['xinetd','inetd','ypserv','telnet-server','rsh-server', 'prelink']
+os_security_packages_list: ['xinetd', 'inetd', 'ypserv', 'telnet-server', 'rsh-server', 'prelink']
 
 # Allow interactive startup (rhel, centos)
 os_security_init_prompt: true
@@ -127,6 +120,7 @@ sysctl_config:
 
   # log martian packets | sysctl-17
   net.ipv4.conf.all.log_martians: 1
+  net.ipv4.conf.default.log_martians: 1
 
   # ipv6 config
   # Disable acceptance of IPv6 router solicitations messages | sysctl-21
@@ -179,6 +173,75 @@ sysctl_config:
   # Virtual memory regions protection | sysctl-32
   kernel.randomize_va_space: 2
 
+  kernel.core_uses_pid: 1
+
+  # The PTRACE system is used for debugging.  With it, a single user process
+  # can attach to any other dumpable process owned by the same user.  In the
+  # case of malicious software, it is possible to use PTRACE to access
+  # credentials that exist in memory (re-using existing SSH connections,
+  # extracting GPG agent information, etc).
+  #
+  # A PTRACE scope of "0" is the more permissive mode.  A scope of "1" limits
+  # PTRACE only to direct child processes (e.g. "gdb name-of-program" and
+  # "strace -f name-of-program" work, but gdb's "attach" and "strace -fp $PID"
+  # do not).  The PTRACE scope is ignored when a user has CAP_SYS_PTRACE, so
+  # "sudo strace -fp $PID" will work as before.  For more details see:
+  # https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening#ptrace
+  #
+  # For applications launching crash handlers that need PTRACE, exceptions can
+  # be registered by the debugee by declaring in the segfault handler
+  # specifically which process will be using PTRACE on the debugee:
+  #   prctl(PR_SET_PTRACER, debugger_pid, 0, 0, 0);
+  #
+  # In general, PTRACE is not needed for the average running Ubuntu system.
+  # To that end, the default is to set the PTRACE scope to "1".  This value
+  # may not be appropriate for developers or servers with only admin accounts.
+  # kernel.yama.ptrace_scope = 1
+  kernel.yama.ptrace_scope: 1
+
+  # Protect the zero page of memory from userspace mmap to prevent kernel
+  # NULL-dereference attacks against potential future kernel security
+  # vulnerabilities.  (Added in kernel 2.6.23.)
+  #
+  # While this default is built into the Ubuntu kernel, there is no way to
+  # restore the kernel default if the value is changed during runtime; for
+  # example via package removal (e.g. wine, dosemu).  Therefore, this value
+  # is reset to the secure default each time the sysctl values are loaded.
+  vm.mmap_min_addr: 65536
+
+  # These settings eliminate an entire class of security vulnerability:
+  # time-of-check-time-of-use cross-privilege attacks using guessable
+  # filenames (generally seen as "/tmp file race" vulnerabilities).
+  fs.protected_hardlinks: 1
+  fs.protected_symlinks: 1
+
+  # These settings are set to the maximum supported value in order to
+  # improve ASLR effectiveness for mmap, at the cost of increased
+  # address-space fragmentation. | Tail-1
+  vm.mmap_rnd_bits: 32
+  vm.mmap_rnd_compat_bits: 16
+
+  # When an attacker is trying to exploit the local kernel, it is often
+  # helpful to be able to examine where in memory the kernel, modules,
+  # and data structures live. As such, kernel addresses should be treated
+  # as sensitive information.
+  #
+  # Many files and interfaces contain these addresses (e.g. /proc/kallsyms,
+  # /proc/modules, etc), and this setting can censor the addresses. A value
+  # of "0" allows all users to see the kernel addresses. A value of "1"
+  # limits visibility to the root user, and "2" blocks even the root user.
+  #
+  # Some off-the-shelf malware exploit kernel addresses exposed
+  # via /proc/kallsyms so by not making these addresses easily available
+  # we increase the cost of such attack some what; now such malware has
+  # to check which kernel Tails is running and then fetch the corresponding
+  # kernel address map from some external source. This is not hard,
+  # but certainly not all malware has such functionality. | Tails-2
+  kernel.kptr_restrict: 2
+
+  # kexec is dangerous: it enables replacement of the running kernel. | Tails-3
+  kernel.kexec_load_disabled: 1
+
 # Do not delete the following line or otherwise the playbook will fail
 # at task 'create a combined sysctl-dict if overwrites are defined'
 sysctl_overwrite:
@@ -193,4 +256,28 @@ os_unused_filesystems:
   - "squashfs"
   - "udf"
   - "vfat"
+  # Obsolete network protocols that should be disabled
+  # per CIS Oracle Linux 6 Benchmark (2016)
+  - "tipc" # CIS 3.5.4
+  - "sctp" # CIS 3.5.2
+  - "dccp" # CIS 3.5.1
+  - "rds"  # CIS 3.5.3
 
+# whitelist for used filesystems
+os_filesystem_whitelist: []
+
+# Set to false to turn the role into a no-op. Useful when using
+# the Ansible role dependency mechanism.
+os_hardening_enabled: true
+
+# Set to false to disable installing and configuring auditd.
+os_auditd_enabled: true
+os_auditd_max_log_file_action: keep_logs
+
+# Set the SELinux state, can be either disabled, permissive, or enforcing.
+os_selinux_state: enforcing
+# Set the SELinux polixy.
+os_selinux_policy: targeted
+
+hidepid_option: '2' # allowed values: 0, 1, 2
+proc_mnt_options: 'rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}'

handlers/main.yml

@@ -0,0 +1,3 @@
+---
+- name: update-initramfs
+  command: 'update-initramfs -u'

meta/main.yml

@@ -1,24 +1,27 @@
 ---
 galaxy_info:
   author: "Sebastian Gumprich"
-  description: 'This Ansible role provides numerous security-related configurations, providing all-round base protection.'
+  description: 'This role provides numerous security-related configurations, providing all-round base protection.'
   company: Hardening Framework Team
   license: Apache License 2.0
-  min_ansible_version: '2.2.1'
+  min_ansible_version: '2.5'
   platforms:
     - name: EL
       versions:
         - 6
         - 7
+        - 8
     - name: Ubuntu
       versions:
-        - precise
-        - trusty
         - xenial
+        - bionic
     - name: Debian
       versions:
-        - wheezy
-        - jessie
+        - stretch
+        - buster
+    - name: Amazon
+    - name: Fedora
+    - name: openSUSE
   galaxy_tags:
     - system
     - security

rhel6_provision.rb

@@ -0,0 +1,7 @@
+Vagrant.configure(2) do |config|
+  config.vm.provision "shell", inline: <<-SHELL
+    rpm -i http://mirror.de.leaseweb.net/epel/6/x86_64/epel-release-6-8.noarch.rpm
+    sed -i 's/\\(mirrorlist=http\\)s/\\1/' /etc/yum.repos.d/epel.repo
+    yum install -y ansible libselinux-python
+  SHELL
+end

suse_provision.rb

@@ -0,0 +1,7 @@
+Vagrant.configure(2) do |config|
+  config.vm.provision "shell", inline: <<-SHELL
+      zypper -n install python2-setuptools
+      mkdir -p /usr/local/lib/python2.7/site-packages/
+      ln -s /usr/local/bin/pip /usr/bin/
+  SHELL
+end

tasks/apt.yml

@@ -1,8 +1,7 @@
 ---
 - name: remove deprecated or insecure packages | package-01 - package-09
   apt:
-    name: '{{ item }}'
+    name: '{{ os_security_packages_list }}'
     state: 'absent'
-  with_items:
-    - '{{ os_security_packages_list }}'
-  when: 'os_security_packages_clean'
+    purge: 'yes'
+  when: os_security_packages_clean | bool

tasks/auditd.yml

@@ -0,0 +1,13 @@
+---
+- name: install auditd package | package-08
+  package:
+    name: '{{ auditd_package }}'
+    state: 'present'
+
+- name: configure auditd | package-08
+  template:
+    src: 'etc/audit/auditd.conf.j2'
+    dest: '/etc/audit/auditd.conf'
+    owner: 'root'
+    group: 'root'
+    mode: '0640'

tasks/hardening.yml

@@ -0,0 +1,64 @@
+---
+- name: Set OS family dependent variables
+  include_vars: '{{ ansible_facts.os_family }}.yml'
+  tags: always
+
+- name: Set OS dependent variables
+  include_vars: '{{ item }}'
+  with_first_found:
+    - files:
+      - '{{ ansible_facts.distribution }}-{{ ansible_facts.distribution_major_version }}.yml'
+      - '{{ ansible_facts.distribution }}.yml'
+      - '{{ ansible_facts.os_family }}-{{ ansible_facts.distribution_major_version }}.yml'
+      skip: true
+  tags: always
+
+- import_tasks: auditd.yml
+  tags: auditd
+  when: os_auditd_enabled | bool
+
+- import_tasks: limits.yml
+  tags: limits
+
+- import_tasks: login_defs.yml
+  tags: login_defs
+
+- import_tasks: minimize_access.yml
+  tags: minimize_access
+
+- import_tasks: pam.yml
+  tags: pam
+
+- import_tasks: modprobe.yml
+  tags: modprobe
+
+- import_tasks: profile.yml
+  tags: profile
+
+- import_tasks: securetty.yml
+  tags: securetty
+
+- import_tasks: suid_sgid.yml
+  when: os_security_suid_sgid_enforce  | bool
+  tags: suid_sgid
+
+- import_tasks: sysctl.yml
+  tags: sysctl
+
+- import_tasks: user_accounts.yml
+  tags: user_accounts
+
+- import_tasks: rhosts.yml
+  tags: rhosts
+
+- import_tasks: yum.yml
+  when: ansible_facts.os_family == 'RedHat'
+  tags: yum
+
+- import_tasks: apt.yml
+  when: ansible_facts.distribution in ['Debian', 'Ubuntu']
+  tags: apt
+
+- import_tasks: selinux.yml
+  tags: selinux
+  when: ansible_facts.selinux.status == 'enabled'

tasks/limits.yml

@@ -1,19 +1,33 @@
 ---
+- block:
+  - name: create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
+    file:
+      path: '/etc/security/limits.d'
+      owner: 'root'
+      group: 'root'
+      mode: '0755'
+      state: 'directory'
 
-- name: create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
+  - name: create additional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
+    pam_limits:
+      dest: '/etc/security/limits.d/10.hardcore.conf'
+      domain: '*'
+      limit_type: hard
+      limit_item: core
+      value: '0'
+      comment: Prevent core dumps for all users. These are usually not needed and may contain sensitive information
+
+  - name: set 10.hardcore.conf perms to 0400 and root ownership
+    file:
+      path: /etc/security/limits.d/10.hardcore.conf
+      owner: 'root'
+      group: 'root'
+      mode: '0440'
+
+  when: not os_security_kernel_enable_core_dump | bool
+
+- name: remove 10.hardcore.conf config file
   file:
-    path: '/etc/security/limits.d'
-    owner: 'root'
-    group: 'root'
-    mode: '0755'
-    state: 'directory'
-  when: 'os_security_kernel_enable_core_dump'
-
-- name: create sane limits.conf | sysctl-31a, sysctl-31b
-  template:
-    src: 'limits.conf.j2'
-    dest: '/etc/security/limits.d/10.hardcore.conf'
-    owner: 'root'
-    group: 'root'
-    mode: '0440'
-  when: 'os_security_kernel_enable_core_dump'
+    path: /etc/security/limits.d/10.hardcore.conf
+    state: absent
+  when: os_security_kernel_enable_core_dump | bool

tasks/login_defs.yml

@@ -1,9 +1,8 @@
 ---
 - name: create login.defs | os-05, os-05b
   template:
-    src: 'login.defs.j2'
+    src: 'etc/login.defs.j2'
     dest: '/etc/login.defs'
     owner: 'root'
     group: 'root'
     mode: '0444'
-

tasks/main.yml

@@ -1,56 +1,3 @@
 ---
-- name: Set OS family dependent variables
-  include_vars: '{{ ansible_os_family }}.yml'
-  tags: always
-
-- name: Set OS dependent variables
-  include_vars: '{{ item }}'
-  with_first_found:
-    - files:
-      - '{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml'
-      - '{{ ansible_distribution }}.yml'
-      - '{{ ansible_os_family }}-{{ ansible_distribution_major_version }}.yml'
-      skip: true
-  tags: always
-
-- include: limits.yml
-  tags: limits
-
-- include: login_defs.yml
-  tags: login_defs
-
-- include: minimize_access.yml
-  tags: minimize_acces
-
-- include: modprobe.yml
-  tags: modprobe
-
-- include: pam.yml
-  tags: pam
-
-- include: profile.yml
-  tags: profile
-
-- include: securetty.yml
-  tags: securetty
-
-- include: suid_sgid.yml
-  when: os_security_suid_sgid_enforce
-  tags: suid_sgid
-
-- include: sysctl.yml
-  tags: sysctl
-
-- include: user_accounts.yml
-  tags: user_accounts
-
-- include: rhosts.yml
-  tags: rhosts
-
-- include: yum.yml
-  when: ansible_os_family == 'RedHat'
-  tags: yum
-
-- include: apt.yml
-  when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
-  tags: apt
+- import_tasks: hardening.yml
+  when: os_hardening_enabled | bool

tasks/minimize_access.yml

@@ -1,25 +1,31 @@
 ---
-# Using a two-pass approach for checking directories in order to support symlinks.
-- name: find directories for minimizing access
-  stat:
-    path: '{{ item }}'
-  register: minimize_access_directories
-  with_items:
+# If the find-task throws an error on /usr/bin/X11 like "File system loop detected"
+# the other files inside /usr/bin (and all other directories) are
+# still getting found and the permissions minimized in the next task.
+# This is also the reason why there's ignore_errors: true on the task.
+# also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
+- name: find files with write-permissions for group
+  shell: "find -L {{ item }} -perm /go+w -type f" # noqa 305
+  with_flattened:
     - '/usr/local/sbin'
     - '/usr/local/bin'
     - '/usr/sbin'
     - '/usr/bin'
     - '/sbin'
     - '/bin'
-    - '{{ os_env_extra_user_paths }}'
+    - "{{ os_env_extra_user_paths }}" # noqa 104
+  register: minimize_access_directories
+  ignore_errors: true
+  changed_when: false
 
-- name: minimize access
+- name: minimize access on found files
   file:
-    path: '{{ item.stat.path }}'
+    path: '{{ item.1 }}'
     mode: 'go-w'
-    recurse: 'yes'
-  when: item.stat.isdir
-  with_items: '{{ minimize_access_directories.results }}'
+    state: file
+  with_subelements:
+    - "{{ minimize_access_directories.results }}"
+    - stdout_lines
 
 - name: change shadow ownership to root and mode to 0600 | os-02
   file:
@@ -41,4 +47,12 @@
     owner: 'root'
     group: 'root'
     mode: '0750'
-  when: os_security_users_allow != None
+  when: '"change_user" not in os_security_users_allow'
+
+- name: set option hidepid for proc filesystem
+  mount:
+    path: /proc
+    src: proc
+    fstype: proc
+    opts: '{{ proc_mnt_options }}'
+    state: present

tasks/modprobe.yml

@@ -1,14 +1,31 @@
 ---
 - name: install modprobe to disable filesystems | os-10
   package:
-    name: '{{modprobe_package}}'
-    state: 'installed'
+    name: '{{ modprobe_package }}'
+    state: 'present'
+
+- name: check if efi is installed
+  stat:
+    path: "/sys/firmware/efi"
+  register: efi_installed
+
+- name: remove vfat from fs-list if efi is used
+  set_fact:
+    os_unused_filesystems: "{{ os_unused_filesystems | difference('vfat') }}"
+  when:
+    - efi_installed.stat.isdir is defined
+    - efi_installed.stat.isdir
+
+- name: remove used filesystems from fs-list
+  set_fact:
+    os_unused_filesystems: "{{ os_unused_filesystems | difference(ansible_mounts | map(attribute='fstype') | list) }}"
+  # we cannot do this on el6 and below, because these systems don't support the map function
+  when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
 
 - name: disable unused filesystems | os-10
   template:
-    src: 'modprobe.j2'
+    src: 'etc/modprobe.d/modprobe.j2'
     dest: '/etc/modprobe.d/dev-sec.conf'
     owner: 'root'
     group: 'root'
-    mode: '0640'
-
+    mode: '0644'

tasks/pam.yml

@@ -1,102 +1,135 @@
 ---
 - name: update pam on Debian systems
   command: 'pam-auth-update --package'
-  when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
+  when: ansible_facts.distribution in ['Debian', 'Ubuntu']
   changed_when: False
   environment:
     DEBIAN_FRONTEND: noninteractive
 
-- name: remove pam ccreds on Debian systems
-  apt:
+# the reason for this is so a user cannot connect to a server,
+# that isn't connected to an LDAP server anymore.
+# normally caching credentials shouldn't be necessary for most machines.
+# removing it provides some more security while not removing usability.
+- name: remove pam ccreds to disable password caching
+  package:
     name: '{{ os_packages_pam_ccreds }}'
     state: 'absent'
-  when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
-
-- name: remove pam ccreds on Redhat systems
-  yum:
-    name: '{{ os_packages_pam_ccreds }}'
-    state: 'absent'
-  when: ansible_os_family == 'RedHat'
 
 - name: remove pam_cracklib, because it does not play nice with passwdqc
   apt:
     name: '{{ os_packages_pam_cracklib }}'
     state: 'absent'
-  when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and os_auth_pam_passwdqc_enable
+  when:
+    - ansible_facts.distribution in ['Debian', 'Ubuntu']
+    - os_auth_pam_passwdqc_enable
 
 - name: install the package for strong password checking
   apt:
     name: '{{ os_packages_pam_passwdqc }}'
-    state: 'installed'
+    state: 'present'
     update_cache: 'yes'
-  when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and os_auth_pam_passwdqc_enable
+  when:
+    - ansible_facts.distribution in ['Debian', 'Ubuntu']
+    - os_auth_pam_passwdqc_enable
 
 - name: configure passwdqc
   template:
-    src: 'pam_passwdqd.j2'
+    src: 'usr/share/pam-configs/pam_passwdqd.j2'
     dest: '{{ passwdqc_path }}'
-    mode: '0640'
+    mode: '0644'
     owner: 'root'
     group: 'root'
-  when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and os_auth_pam_passwdqc_enable
+  when:
+    - ansible_facts.distribution in ['Debian', 'Ubuntu']
+    - os_auth_pam_passwdqc_enable
 
 - name: remove passwdqc
   apt:
     name: '{{ os_packages_pam_passwdqc }}'
     state: 'absent'
-  when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable
+  when:
+    - ansible_facts.distribution in ['Debian', 'Ubuntu']
+    - not os_auth_pam_passwdqc_enable
 
 - name: install tally2
   apt:
     name: 'libpam-modules'
-    state: 'installed'
-  when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable and os_auth_retries > 0
+    state: 'present'
+  when:
+    - ansible_facts.distribution in ['Debian', 'Ubuntu']
+    - not os_auth_pam_passwdqc_enable
+    - os_auth_retries > 0
 
 - name: configure tally2
   template:
-    src: 'pam_tally2.j2'
+    src: 'usr/share/pam-configs/pam_tally2.j2'
     dest: '{{ tally2_path }}'
-    mode: '0640'
+    mode: '0644'
     owner: 'root'
     group: 'root'
-  when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable and os_auth_retries > 0
+  when:
+    - ansible_facts.distribution in ['Debian', 'Ubuntu']
+    - not os_auth_pam_passwdqc_enable
+    - os_auth_retries > 0
 
 - name: delete tally2 when retries is 0
   file:
     path: '{{ tally2_path }}'
     state: 'absent'
-  when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable and os_auth_retries == 0
+  when:
+    - ansible_facts.distribution in ['Debian', 'Ubuntu']
+    - not os_auth_pam_passwdqc_enable
+    - os_auth_retries == 0
 
 - name: remove pam_cracklib, because it does not play nice with passwdqc
   yum:
     name: '{{ os_packages_pam_cracklib }}'
     state: 'absent'
-  when: (ansible_os_family == 'RedHat' and ansible_distribution_version < '7') and os_auth_pam_passwdqc_enable
+  when:
+    - ansible_facts.os_family == 'RedHat'
+    - ansible_facts.distribution_major_version|int is version('7', '<')
+    - ansible_facts.distribution != 'Amazon'
+    - os_auth_pam_passwdqc_enable
 
 - name: install the package for strong password checking
   yum:
     name: '{{ os_packages_pam_passwdqc }}'
-    state: 'installed'
-  when: (ansible_os_family == 'RedHat' and ansible_distribution_version < '7') and os_auth_pam_passwdqc_enable
+    state: 'present'
+  when:
+    - ansible_facts.os_family == 'RedHat'
+    - ansible_facts.distribution_major_version|int is version('7', '<')
+    - ansible_facts.distribution != 'Amazon'
+    - os_auth_pam_passwdqc_enable
 
 - name: remove passwdqc
   yum:
     name: '{{ os_packages_pam_passwdqc }}'
     state: 'absent'
-  when: ansible_os_family == 'RedHat' and not os_auth_pam_passwdqc_enable
+  when:
+    - ansible_facts.os_family == 'RedHat'
+    - not os_auth_pam_passwdqc_enable
 
 - name: configure passwdqc and tally via central system-auth confic
   template:
-    src: 'rhel_system_auth.j2'
+    src: 'etc/pam.d/rhel_system_auth.j2'
     dest: '/etc/pam.d/system-auth-ac'
     mode: '0640'
     owner: 'root'
     group: 'root'
+  when: ansible_facts.os_family == 'RedHat'
+
+- name: Gather package facts
+  package_facts:
+    manager: auto
+  when: ansible_facts.os_family != 'Suse'
 
 - name: NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
   template:
-    src: 'rhel_libuser.conf.j2'
+    src: 'etc/libuser.conf.j2'
     dest: '/etc/libuser.conf'
     mode: '0640'
     owner: 'root'
     group: 'root'
+  when:
+    - ansible_facts.os_family != 'Suse'
+    - "'libuser' in ansible_facts.packages"

tasks/profile.yml

@@ -1,9 +1,15 @@
 ---
-- name: create profile.conf
+- name: add pinerolo_profile.sh to profile.d
   template:
-    src: 'profile.conf.j2'
+    src: 'etc/profile.d/profile.conf.j2'
     dest: '/etc/profile.d/pinerolo_profile.sh'
     owner: 'root'
     group: 'root'
     mode: '0750'
-  when: not os_security_kernel_enable_core_dump
+  when: not os_security_kernel_enable_core_dump | bool
+
+- name: remove pinerolo_profile.sh from profile.d
+  file:
+    path: /etc/profile.d/pinerolo_profile.sh
+    state: absent
+  when: os_security_kernel_enable_core_dump | bool

tasks/rhosts.yml

@@ -3,13 +3,13 @@
   command: "awk -F: '{print $1}' /etc/passwd"
   changed_when: False
   check_mode: False
-  register: users
+  register: users_accounts
 
 - name: delete rhosts-files from system | os-09
   file:
     dest: '~{{ item }}/.rhosts'
     state: 'absent'
-  with_flattened: '{{ users.stdout_lines | default([]) }}'
+  with_flattened: '{{ users_accounts.stdout_lines | default([]) }}'
 
 - name: delete hosts.equiv from system | os-01
   file:
@@ -20,4 +20,4 @@
   file:
     dest: '~{{ item }}/.netrc'
     state: 'absent'
-  with_flattened: '{{ users.stdout_lines | default([]) }}'
+  with_flattened: '{{ users_accounts.stdout_lines | default([]) }}'

tasks/securetty.yml

@@ -1,7 +1,7 @@
 ---
 - name: create securetty
   template:
-    src: 'securetty.j2'
+    src: 'etc/securetty.j2'
     dest: '/etc/securetty'
     owner: 'root'
     group: 'root'

tasks/selinux.yml

@@ -0,0 +1,5 @@
+---
+- name: configure selinux | selinux-01
+  selinux:
+    policy: "{{ os_selinux_policy }}"
+    state: "{{ os_selinux_state }}"

tasks/suid_sgid.yml

@@ -13,13 +13,13 @@
 - name: find binaries with suid/sgid set | os-06
   shell: find / -xdev \( -perm -4000 -o -perm -2000 \) -type f ! -path '/proc/*' -print 2>/dev/null
   register: sbit_binaries
-  when: os_security_suid_sgid_remove_from_unknown
+  when: os_security_suid_sgid_remove_from_unknown | bool
   changed_when: False
 
 - name: gather files from which to remove suids/sgids and remove system white-listed files | os-06
   set_fact:
     suid: '{{ sbit_binaries.stdout_lines | difference(os_security_suid_sgid_system_whitelist) }}'
-  when: os_security_suid_sgid_remove_from_unknown
+  when: os_security_suid_sgid_remove_from_unknown | bool
 
 - name: remove suid/sgid bit from all binaries except in system and user whitelist | os-06
   file:
@@ -29,4 +29,4 @@
     follow: 'yes'
   with_flattened:
     - '{{ suid | default([]) | difference(os_security_suid_sgid_whitelist) }}'
-  when: os_security_suid_sgid_remove_from_unknown
+  when: os_security_suid_sgid_remove_from_unknown | bool

tasks/sysctl.yml

@@ -8,62 +8,71 @@
 
 - name: set Daemon umask, do config for rhel-family | NSA 2.2.4.1
   template:
-    src: 'rhel_sysconfig_init.j2'
+    src: 'etc/sysconfig/rhel_sysconfig_init.j2'
     dest: '/etc/sysconfig/init'
     owner: 'root'
     group: 'root'
     mode: '0544'
-  when: ansible_distribution == 'RedHat' or ansible_distribution == 'Fedora' or ansible_distribution == 'CentOS'
+  when: ansible_facts.distribution in ['Amazon', 'CentOS', 'Fedora', 'RedHat']
 
 - name: install initramfs-tools
   apt:
     name: 'initramfs-tools'
-    state: 'installed'
+    state: 'present'
     update_cache: true
-  when: ansible_os_family == 'Debian' and os_security_kernel_enable_module_loading
+  when:
+    - ansible_facts.os_family == 'Debian'
+    - os_security_kernel_enable_module_loading
 
 - name: rebuild initramfs with starting pack of modules, if module loading at runtime is disabled
   template:
-    src: 'modules.j2'
+    src: 'etc/initramfs-tools/modules.j2'
     dest: '/etc/initramfs-tools/modules'
     owner: 'root'
     group: 'root'
     mode: '0440'
-  when: ansible_os_family == 'Debian' and os_security_kernel_enable_module_loading
+  notify:
+    - update-initramfs
+  when:
+    - ansible_facts.os_family == 'Debian'
+    - os_security_kernel_enable_module_loading
   register: initramfs
 
-- name: update-initramfs
-  command: 'update-initramfs -u'
-  when: initramfs.changed
+- name: change sysctls
+  block:
+    - name: create a combined sysctl-dict if overwrites are defined
+      set_fact:
+        sysctl_config: '{{ sysctl_config | combine(sysctl_overwrite) }}'
+      when: sysctl_overwrite | default()
 
-- name: create a combined sysctl-dict if overwrites are defined
-  set_fact:
-    sysctl_config: '{{ sysctl_config | combine(sysctl_overwrite) }}'
-  when: sysctl_overwrite | default()
+    - name: Change various sysctl-settings, look at the sysctl-vars file for documentation
+      sysctl:
+        name: '{{ item.key }}'
+        value: '{{ item.value }}'
+        sysctl_set: yes
+        state: present
+        reload: yes
+        ignoreerrors: yes
+      with_dict: '{{ sysctl_config }}'
 
-- name: Change various sysctl-settings, look at the sysctl-vars file for documentation
-  sysctl:
-    name: '{{ item.key }}'
-    value: '{{ item.value }}'
-    sysctl_set: yes
-    state: present
-    reload: yes
-    ignoreerrors: yes
-  with_dict: '{{ sysctl_config }}'
+    - name: Change various sysctl-settings on rhel6-hosts or older, look at the sysctl-vars file for documentation
+      sysctl:
+        name: '{{ item.key }}'
+        value: '{{ item.value }}'
+        state: present
+        reload: yes
+        ignoreerrors: yes
+      with_dict: '{{ sysctl_rhel_config }}'
+      when: ((ansible_facts.distribution in ['CentOS', 'Fedora', 'RedHat']) and
+            ansible_distribution_version|int is version('7', '<')) or ansible_facts.distribution == 'Amazon'
 
-- name: Change various sysctl-settings on rhel6-hosts or older, look at the sysctl-vars file for documentation
-  sysctl:
-    name: '{{ item.key }}'
-    value: '{{ item.value }}'
-    state: present
-    reload: yes
-    ignoreerrors: yes
-  with_dict: '{{ sysctl_rhel_config }}'
-  when: (ansible_distribution == 'RedHat' or ansible_distribution == 'Fedora' or ansible_distribution == 'CentOS') and ansible_distribution_major_version < '7'
+  when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']
 
 - name: Apply ufw defaults
   template:
-    src: 'ufw.j2'
+    src: 'etc/default/ufw.j2'
     dest: '/etc/default/ufw'
-  when: ufw_manage_defaults and (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu')
+  when:
+    - ufw_manage_defaults
+    - ansible_facts.distribution in ['Debian', 'Ubuntu']
   tags: ufw

tasks/user_accounts.yml

@@ -10,17 +10,19 @@
 - name: calculate UID_MAX from UID_MIN by substracting 1
   set_fact:
     uid_max: '{{ uid_min.stdout | int - 1 }}'
-  when: uid_min is defined
+  when: uid_min.stdout|int > 0
 
 - name: set UID_MAX on Debian-systems if no login.defs exist
   set_fact:
     uid_max: '999'
-  when: ansible_os_family == 'Debian' and not uid_min
+  when:
+    - ansible_facts.os_family == 'Debian'
+    - uid_max is not defined
 
 - name: set UID_MAX on other systems if no login.defs exist
   set_fact:
     uid_max: '499'
-  when: not uid_min
+  when: uid_max is not defined
 
 - name: get all system accounts
   command: awk -F'':'' '{ if ( $3 <= {{ uid_max|quote }} ) print $1}' /etc/passwd
@@ -40,5 +42,6 @@
     name: '{{ item }}'
     shell: '{{ os_nologin_shell_path }}'
     password: '*'
+    createhome: False
   with_flattened:
     - '{{ sys_accs_cond | default([]) | difference(os_ignore_users) | list }}'

tasks/yum.yml

@@ -3,45 +3,46 @@
   file:
     name: '/etc/yum.repos.d/{{ item }}.repo'
     state: 'absent'
-  with_items:
+  loop:
     - 'CentOS-Debuginfo'
     - 'CentOS-Media'
     - 'CentOS-Vault'
-  when: os_security_packages_clean
+  when: os_security_packages_clean | bool
 
 - name: get yum-repository-files
-  shell: 'find /etc/yum.repos.d/ -type f -name *.repo'
-  changed_when: False
+  find:
+    paths: '/etc/yum.repos.d'
+    patterns: '*.repo'
   register: yum_repos
 
-- name: check if rhnplugin.conf exists
-  stat:
-    path: '/etc/yum/pluginconf.d/rhnplugin.conf'
-  register: rhnplugin_file
-
-  # for the 'default([])' see here:
-  # https://github.com/dev-sec/ansible-os-hardening/issues/99 and
-  # https://stackoverflow.com/questions/37067827/ansible-deprecation-warning-for-undefined-variable-despite-when-clause
-- name: activate gpg-check for yum-repos
+# for the 'default([])' see here:
+# https://github.com/dev-sec/ansible-os-hardening/issues/99 and
+# https://stackoverflow.com/questions/37067827/ansible-deprecation-warning-for-undefined-variable-despite-when-clause
+- name: activate gpg-check for yum-repository-files
   replace:
-    dest: '{{ item }}'
-    regexp: '^\s*gpgcheck: 0'
-    replace: 'gpgcheck: 1'
-  with_flattened:
+    path: '{{ item.path }}'
+    regexp: '^\s*gpgcheck.*'
+    replace: 'gpgcheck=1'
+  with_items:
+    - '{{ yum_repos.files | default([]) }}'
+
+# failed_when is needed because by default replace module will fail if the file doesn't exists.
+# status.rc is only defined if an error accrued and only error code (rc) 257 will be ignored.
+# All other errors will still be raised.
+- name: activate gpg-check for config files
+  replace:
+    path: '{{ item }}'
+    regexp: '^\s*gpgcheck\W.*'
+    replace: 'gpgcheck=1'
+  register: status
+  failed_when: status.rc is defined and status.rc != 257
+  loop:
     - '/etc/yum.conf'
-    - '{{ yum_repos.stdout_lines| default([]) }}'
-
-- name: activate gpg-check for yum rhn if it exists
-  replace:
-    dest: '/etc/yum/pluginconf.d/rhnplugin.conf'
-    regexp: '^\s*gpgcheck: 0'
-    replace: 'gpgcheck: 1'
-  when: rhnplugin_file.stat.exists
+    - '/etc/dnf/dnf.conf'
+    - '/etc/yum/pluginconf.d/rhnplugin.conf'
 
 - name: remove deprecated or insecure packages | package-01 - package-09
   yum:
-    name: '{{ item }}'
+    name: '{{ os_security_packages_list }}'
     state: 'absent'
-  with_items:
-    - '{{ os_security_packages_list }}'
-  when: os_security_packages_clean
+  when: os_security_packages_clean | bool

templates/etc/audit/auditd.conf.j2

@@ -0,0 +1,30 @@
+{{ ansible_managed | comment }}
+
+log_file = /var/log/audit/audit.log
+log_format = RAW
+log_group = root
+priority_boost = 4
+flush = INCREMENTAL
+freq = 20
+num_logs = 5
+disp_qos = lossy
+dispatcher = /sbin/audispd
+name_format = NONE
+##name = mydomain
+max_log_file = 6
+max_log_file_action = {{ os_auditd_max_log_file_action }}
+space_left = 75
+space_left_action = SYSLOG
+action_mail_acct = root
+admin_space_left = 50
+admin_space_left_action = SUSPEND
+disk_full_action = SUSPEND
+disk_error_action = SUSPEND
+##tcp_listen_port =
+tcp_listen_queue = 5
+tcp_max_per_addr = 1
+##tcp_client_ports = 1024-65535
+tcp_client_max_idle = 0
+enable_krb5 = no
+krb5_principal = auditd
+##krb5_key_file = /etc/audit/audit.key

templates/etc/default/ufw.j2

@@ -1,4 +1,5 @@
-# {{ ansible_managed | comment }}
+{{ ansible_managed | comment }}
+
 # /etc/default/ufw
 #
 
@@ -9,25 +10,25 @@ IPV6={{ 'no' if sysctl_config['net.ipv6.conf.all.disable_ipv6'] is defined and s
 
 # Set the default input policy to ACCEPT, DROP, or REJECT. Please note that if
 # you change this you will most likely want to adjust your rules.
-DEFAULT_INPUT_POLICY='{{ ufw_default_input_policy }}'
+DEFAULT_INPUT_POLICY="{{ ufw_default_input_policy }}"
 
 # Set the default output policy to ACCEPT, DROP, or REJECT. Please note that if
 # you change this you will most likely want to adjust your rules.
-DEFAULT_OUTPUT_POLICY='{{ ufw_default_output_policy }}'
+DEFAULT_OUTPUT_POLICY="{{ ufw_default_output_policy }}"
 
 # Set the default forward policy to ACCEPT, DROP or REJECT.  Please note that
 # if you change this you will most likely want to adjust your rules
-DEFAULT_FORWARD_POLICY='{{ ufw_default_forward_policy }}'
+DEFAULT_FORWARD_POLICY="{{ ufw_default_forward_policy }}"
 
 # Set the default application policy to ACCEPT, DROP, REJECT or SKIP. Please
 # note that setting this to ACCEPT may be a security risk. See 'man ufw' for
 # details
-DEFAULT_APPLICATION_POLICY='{{ ufw_default_application_policy }}'
+DEFAULT_APPLICATION_POLICY="{{ ufw_default_application_policy }}"
 
 # By default, ufw only touches its own chains. Set this to 'yes' to have ufw
 # manage the built-in chains too. Warning: setting this to 'yes' will break
 # non-ufw managed firewall rules
-MANAGE_BUILTINS='{{ ufw_manage_builtins }}'
+MANAGE_BUILTINS="{{ ufw_manage_builtins }}"
 
 #
 # IPT backend
@@ -42,4 +43,4 @@ MANAGE_BUILTINS='{{ ufw_manage_builtins }}'
 # nf_conntrack_pptp, nf_nat_pptp: PPTP over stateful firewall/NAT
 # nf_conntrack_ftp, nf_nat_ftp: active FTP support
 # nf_conntrack_tftp, nf_nat_tftp: TFTP support (server side)
-IPT_MODULES='{{ ufw_ipt_modules }}'
+IPT_MODULES="{{ ufw_ipt_modules }}"

templates/etc/initramfs-tools/modules.j2

@@ -1,4 +1,5 @@
-# {{ ansible_managed | comment }}
+{{ ansible_managed | comment }}
+
 # This file contains the names of kernel modules that should be loaded at boot time, one per line. Lines beginning with "#" are ignored.
 #
 # A list of all available kernel modules kann be found with `find /lib/modules/$(uname -r)/kernel/`
@@ -10,7 +11,7 @@
 #
 # Modules for certains builds, contains support modules and some CPU-specific optimizations.
 
-{% if ansible_architecture == 'x86_64' %}
+{% if ansible_facts.architecture == 'x86_64' %}
 # Optimize for x86_64 cryptographic features
 twofish-x86_64-3way
 twofish-x86_64
@@ -19,7 +20,7 @@ salsa20-x86_64
 blowfish-x86_64
 {% endif %}
 
-{% if 'amd' in ansible_processor %}
+{% if 'amd' in ansible_facts.processor %}
 # AMD-specific optimizations
 kvm-amd
 {% else %}

templates/etc/libuser.conf.j2

@@ -1,6 +1,6 @@
-# See libuser.conf(5) for more information.
+{{ ansible_managed | comment }}
 
-# {{ ansible_managed | comment }}
+# See libuser.conf(5) for more information. 
 
 # Do not modify the default module list if you care about unattended calls
 # to programs (i.e., scripts) working!

templates/etc/login.defs.j2

@@ -1,4 +1,5 @@
-# {{ ansible_managed | comment }}
+{{ ansible_managed | comment }}
+
 # Configuration control definitions for the login package.
 #
 # Three items must be defined:  `MAIL_DIR`, `ENV_SUPATH`, and `ENV_PATH`. If unspecified, some arbitrary (and possibly incorrect) value will be assumed.  All other items are optional - if not specified then the described action or option will be inhibited.
@@ -7,6 +8,7 @@
 #
 #-- Modified for Linux.  --marekm
 
+{% if os_useradd_mail_dir is defined %}
 # *REQUIRED for useradd/userdel/usermod*
 #
 # Directory where mailboxes reside, _or_ name of file, relative to the home directory.  If you _do_ define `MAIL_DIR` and `MAIL_FILE`, `MAIL_DIR` takes precedence.
@@ -19,136 +21,141 @@
 #
 # See default PAM configuration files provided for login, su, etc.
 # This is a temporary situation: setting these variables will soon move to `/etc/default/useradd` and the variables will then be no more supported
-MAIL_DIR        /var/mail
-#MAIL_FILE      .mail
+MAIL_DIR          {{ os_useradd_mail_dir }}
+{% endif %}
 
+{% if os_useradd_create_home is defined %}
+# If useradd should create home directories for users by default
+CREATE_HOME       {{ 'yes' if os_useradd_create_home else 'no' }}
+
+{% endif %}
 # Enable logging and display of `/var/log/faillog` login failure info. This option conflicts with the `pam_tally` PAM module.
-FAILLOG_ENAB		yes
+FAILLOG_ENAB      yes
 
 # Enable display of unknown usernames when login failures are recorded.
 #
 # *WARNING*: Unknown usernames may become world readable. See #290803 and #298773 for details about how this could become a security concern
-LOG_UNKFAIL_ENAB	no
+LOG_UNKFAIL_ENAB  no
 
 # Enable logging of successful logins
-LOG_OK_LOGINS		yes
+LOG_OK_LOGINS     yes
 
 # Enable "syslog" logging of su activity - in addition to sulog file logging.
-SYSLOG_SU_ENAB		yes
+SYSLOG_SU_ENAB    yes
 
 # Enable "syslog" logging of newgrp and sg.
-SYSLOG_SG_ENAB		yes
+SYSLOG_SG_ENAB    yes
 
 # If defined, all su activity is logged to this file.
-#SULOG_FILE	/var/log/sulog
+#SULOG_FILE        /var/log/sulog
 
 # If defined, file which maps tty line to `TERM` environment parameter. Each line of the file is in a format something like "vt100  tty01".
-#TTYTYPE_FILE	/etc/ttytype
+#TTYTYPE_FILE      /etc/ttytype
 
 # If defined, login failures will be logged here in a utmp format last, when invoked as lastb, will read `/var/log/btmp`, so...
-FTMP_FILE	/var/log/btmp
+FTMP_FILE         /var/log/btmp
 
 # If defined, the command name to display when running "su -".  For # example, if this is defined as "su" then a "ps" will display the command is "-su".  If not defined, then "ps" would display the name of the shell actually being run, e.g. something like "-sh".
-SU_NAME		su
+SU_NAME           su
 
 # If defined, file which inhibits all the usual chatter during the login sequence.  If a full pathname, then hushed mode will be enabled if the user's name or shell are found in the file.  If not a full pathname, then hushed mode will be enabled if the file exists in the user's home directory.
-#HUSHLOGIN_FILE /etc/hushlogins
-HUSHLOGIN_FILE	.hushlogin
+#HUSHLOGIN_FILE    /etc/hushlogins
+HUSHLOGIN_FILE    .hushlogin
 
 # *REQUIRED*: The default PATH settings, for superuser and normal users. (they are minimal, add the rest in the shell startup files)
-ENV_SUPATH	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-ENV_PATH	PATH=/usr/local/bin:/usr/bin:/bin{{ os_env_extra_user_paths| join (':') }}
+ENV_SUPATH        PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ENV_PATH          PATH=/usr/local/bin:/usr/bin:/bin:{{ os_env_extra_user_paths | join (':') }}
 
 # Terminal permissions
 # --------------------
 
 # Login tty will be assigned this group ownership.
 # If you have a "write" program which is "setgid" to a special group which owns the terminals, define `TTYGROUP` to the group number and `TTYPERM` to `0620`.  Otherwise leave `TTYGROUP` commented out and assign `TTYPERM` to either `622` or `600`.
-TTYGROUP  tty
+TTYGROUP          tty
 
 # Login tty will be set to this permission.
 # In Debian `/usr/bin/bsd-write` or similar programs are setgid tty. However, the default and recommended value for `TTYPERM` is still `0600` to not allow anyone to write to anyone else console or terminal
 # Users can still allow other people to write them by issuing the `mesg y` command.
-TTYPERM   0600
+TTYPERM           0600
 
 # Login conf initializations
 # --------------------------
 
 # Terminal ERASE character ('\010' = backspace). Only used on System V.
-ERASECHAR 0177
+ERASECHAR         0177
 
 # Terminal KILL character ('\025' = CTRL/U). Only used on System V.
-KILLCHAR  025
+KILLCHAR          025
 
 # The default umask value for `pam_umask` and is used by useradd and newusers to set the mode of the new home directories.
 # If `USERGROUPS_ENAB` is set to `yes`, that will modify this `UMASK` default value for private user groups, i. e. the uid is the same as gid, and username is the same as the primary group name: for these, the user permissions will be used as group permissions, e. g. `022` will become `002`.
 # Prefix these values with `0` to get octal, `0x` to get hexadecimal.
 # `022` is the "historical" value in Debian for UMASK
 # `027`, or even `077`, could be considered better for privacy.
-UMASK {{ os_env_umask }}
+UMASK             {{ os_env_umask }}
 
 # Enable setting of the umask group bits to be the same as owner bits (examples: `022` -> `002`, `077` -> `007`) for non-root users, if the uid is the same as gid, and username is the same as the primary group name.
 # If set to yes, userdel will remove the user´s group if it contains no more members, and useradd will create by default a group with the name of the user.
-USERGROUPS_ENAB yes
+USERGROUPS_ENAB   yes
 
 
 # Password aging controls
 # -----------------------
 
 # Maximum number of days a password may be used.
-PASS_MAX_DAYS {{ os_auth_pw_max_age }}
+PASS_MAX_DAYS     {{ os_auth_pw_max_age }}
 
 # Minimum number of days allowed between password changes.
-PASS_MIN_DAYS {{ os_auth_pw_min_age }}
+PASS_MIN_DAYS     {{ os_auth_pw_min_age }}
 
 # Number of days warning given before a password expires.
-PASS_WARN_AGE	7
+PASS_WARN_AGE     7
 
 # Min/max values for automatic uid selection in useradd
-UID_MIN			 {{ os_auth_uid_min }}
-UID_MAX			60000
+UID_MIN           {{ os_auth_uid_min }}
+UID_MAX           60000
 # System accounts
-SYS_UID_MIN		  {{ os_auth_sys_uid_min }}
-SYS_UID_MAX		  {{ os_auth_sys_uid_max }}
+SYS_UID_MIN       {{ os_auth_sys_uid_min }}
+SYS_UID_MAX       {{ os_auth_sys_uid_max }}
 
 # Min/max values for automatic gid selection in groupadd
-GID_MIN			 {{ os_auth_gid_min }}
-GID_MAX			60000
+GID_MIN           {{ os_auth_gid_min }}
+GID_MAX           60000
 # System accounts
-SYS_GID_MIN		  {{ os_auth_sys_gid_min }}
-SYS_GID_MAX		  {{ os_auth_sys_gid_max }}
+SYS_GID_MIN       {{ os_auth_sys_gid_min }}
+SYS_GID_MAX       {{ os_auth_sys_gid_max }}
 
 # Max number of login retries if password is bad. This will most likely be overriden by PAM, since the default pam_unix module has it's own built in of 3 retries. However, this is a safe fallback in case you are using an authentication module that does not enforce PAM_MAXTRIES.
-LOGIN_RETRIES		{{ os_auth_retries }}
+LOGIN_RETRIES     {{ os_auth_retries }}
 
 # Max time in seconds for login
-LOGIN_TIMEOUT		{{ os_auth_timeout }}
+LOGIN_TIMEOUT     {{ os_auth_timeout }}
 
 # Which fields may be changed by regular users using chfn - use any combination of letters "frwh" (full name, room number, work phone, home phone).  If not defined, no changes are allowed.
 # For backward compatibility, "yes" = "rwh" and "no" = "frwh".
 {% if os_chfn_restrict %}
-CHFN_RESTRICT		{{ os_chfn_restrict }}
+CHFN_RESTRICT     {{ os_chfn_restrict }}
 {% endif %}
 # Should login be allowed if we can't cd to the home directory?
-DEFAULT_HOME	{{ 'yes' if os_auth_allow_homeless else 'no' }}
+DEFAULT_HOME      {{ 'yes' if os_auth_allow_homeless else 'no' }}
 
 # If defined, this command is run when removing a user.
 # It should remove any at/cron/print jobs etc. owned by
 # the user to be removed (passed as the first argument).
-#USERDEL_CMD	/usr/sbin/userdel_local
+#USERDEL_CMD       /usr/sbin/userdel_local
 
 # Instead of the real user shell, the program specified by this parameter will be launched, although its visible name (`argv[0]`) will be the shell's. The program may do whatever it wants (logging, additional authentification, banner, ...) before running the actual shell.
-#FAKE_SHELL /bin/fakeshell
+#FAKE_SHELL        /bin/fakeshell
 
 # If defined, either full pathname of a file containing device names or a ":" delimited list of device names.  Root logins will be allowed only upon these devices.
 # This variable is used by login and su.
-#CONSOLE	/etc/consoles
-#CONSOLE	console:tty01:tty02:tty03:tty04
+#CONSOLE           /etc/consoles
+#CONSOLE           console:tty01:tty02:tty03:tty04
 
 # List of groups to add to the user's supplementary group set when logging in on the console (as determined by the `CONSOLE` setting).  Default is none.
 # Use with caution - it is possible for users to gain permanent access to these groups, even when not logged in on the console. How to do it is left as an exercise for the reader...
 # This variable is used by login and su.
-#CONSOLE_GROUPS		floppy:audio:cdrom
+#CONSOLE_GROUPS    floppy:audio:cdrom
 
 # If set to `MD5`, MD5-based algorithm will be used for encrypting password
 # If set to `SHA256`, SHA256-based algorithm will be used for encrypting password
@@ -158,15 +165,15 @@ DEFAULT_HOME	{{ 'yes' if os_auth_allow_homeless else 'no' }}
 #
 # Note: It is recommended to use a value consistent with
 # the PAM modules configuration.
-MD5_CRYPT_ENAB no
-ENCRYPT_METHOD SHA512
+MD5_CRYPT_ENAB    no
+ENCRYPT_METHOD    SHA512
 
 # Only used if `ENCRYPT_METHOD` is set to `SHA256` or `SHA512`: Define the number of SHA rounds.
 # With a lot of rounds, it is more difficult to brute forcing the password. But note also that it more CPU resources will be needed to authenticate users.
 # If not specified, the libc will choose the default number of rounds (5000). The values must be inside the 1000-999999999 range. If only one of the MIN or MAX values is set, then this value will be used.
 # If MIN > MAX, the highest value will be used.
-#SHA_CRYPT_MIN_ROUNDS 5000
-#SHA_CRYPT_MAX_ROUNDS 5000
+#SHA_CRYPT_MIN_ROUNDS    5000
+#SHA_CRYPT_MAX_ROUNDS    5000
 
 
 # Obsoleted by PAM
@@ -207,5 +214,3 @@ ENCRYPT_METHOD SHA512
 # This variable is deprecated. You should use ENCRYPT_METHOD.
 #
 #MD5_CRYPT_ENAB no
-
-

templates/etc/modprobe.d/modprobe.j2

@@ -0,0 +1,5 @@
+{{ ansible_managed | comment }}
+
+{% for fs in os_unused_filesystems | difference(os_filesystem_whitelist) %}
+install {{fs}} /bin/true
+{% endfor %}

templates/etc/pam.d/rhel_system_auth.j2

@@ -1,4 +1,4 @@
-# {{ ansible_managed | comment }}
+{{ ansible_managed | comment }}
 
 #%PAM-1.0
 {% if os_auth_retries > 0 %}
@@ -18,7 +18,7 @@ account     sufficient    pam_succeed_if.so uid < 500 quiet
 account     required      pam_permit.so
 
 {% if (os_auth_pam_passwdqc_enable|bool) %}
-  {%- if ansible_os_family == 'RedHat' and ansible_distribution_version >= '7' %}
+  {%- if ((ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_version|int is version('7', '>=')) or ansible_facts.distribution == 'Amazon') %}
 password    required      pam_pwquality.so {{ os_auth_pam_pwquality_options }}
   {%- else %}
 password    requisite     pam_passwdqc.so {{ os_auth_pam_passwdqc_options }}

templates/etc/profile.d/profile.conf.j2

@@ -1,4 +1,4 @@
-# {{ ansible_managed | comment }}
+{{ ansible_managed | comment }}
 
 # Disable core dumps via soft limits for all users. Compliance to this setting is voluntary and can be modified by users up to a hard limit. This setting is a sane default.
 ulimit -S -c 0 > /dev/null 2>&1

templates/etc/securetty.j2

@@ -1,5 +1,4 @@
-# {{ ansible_managed | comment }}
-
+{{ ansible_managed | comment }}
 
 # A list of TTYs, from which root can log in
 # see `man securetty` for reference

templates/etc/sysconfig/rhel_sysconfig_init.j2

@@ -1,4 +1,4 @@
-# {{ ansible_managed | comment }}
+{{ ansible_managed | comment }}
 
 # color => new RH6.0 bootup
 # verbose => old-style bootup

templates/limits.conf.j2

@@ -1,3 +0,0 @@
-# {{ ansible_managed | comment }}
-# Prevent core dumps for all users. These are usually only needed by developers and may contain sensitive information.
-* hard core 0

templates/modprobe.j2

@@ -1,5 +0,0 @@
-# {{ ansible_managed | comment }}
-
-{% for fs in os_unused_filesystems %}
-install {{fs}} /bin/true
-{% endfor %}

templates/usr/share/pam-configs/pam_passwdqd.j2

@@ -1,3 +1,5 @@
+{{ ansible_managed | comment }}
+
 Name: passwdqc password strength enforcement
 Default: yes
 Priority: 1024

templates/usr/share/pam-configs/pam_tally2.j2

@@ -1,3 +1,5 @@
+{{ ansible_managed | comment }}
+
 Name: tally2 lockout after failed attempts enforcement
 Default: yes
 Priority: 1024

tests/test.yml

@@ -4,13 +4,34 @@
   roles:
     - ansible-os-hardening
   pre_tasks:
+    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
+      set_fact:
+        ansible_python_interpreter: "/usr/bin/python3"
+      when: ansible_facts.distribution == 'Fedora'
+
     - name: Run the equivalent of "apt-get update" as a separate step
       apt:
         update_cache: yes
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'
+    - name: install required tools on debian
+      apt:
+        name: procps
+      when: ansible_facts.os_family == 'Debian'
+    - name: install required tools on fedora
+      dnf:
+        name:
+          - python
+          - findutils
+          - procps-ng
+      when: ansible_facts.distribution == 'Fedora'
+    - name: install required tools on SuSE
+      shell: "zypper -n install python-xml"
+      when: ansible_facts.os_family == 'Suse'
+    - name: create recursing symlink to test minimize access
+      shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
   vars:
     os_security_users_allow: change_user
-    os_security_kernel_enable_core_dump: false
+    os_security_kernel_enable_core_dump: true
     os_security_suid_sgid_remove_from_unknown: true
     os_auth_pam_passwdqc_enable: false
     os_desktop_enable: true
@@ -18,6 +39,7 @@
     os_auth_allow_homeless: true
     os_security_suid_sgid_blacklist: ['/bin/umount']
     os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
+    os_filesystem_whitelist: []
     sysctl_config:
       net.ipv4.ip_forward: 0
       net.ipv6.conf.all.forwarding: 0
@@ -49,21 +71,26 @@
       net.ipv6.conf.default.accept_ra_rtr_pref: 0
       net.ipv6.conf.default.accept_ra_pinfo: 0
       net.ipv6.conf.default.accept_ra_defrtr: 0
-      net.ipv6.conf.default.autoconf: 0
+      net.ipv6.conf.default.conf: 0
       net.ipv6.conf.default.dad_transmits: 0
       net.ipv6.conf.default.max_addresses: 1
       kernel.sysrq: 0
       fs.suid_dumpable: 0
       kernel.randomize_va_space: 2
 
-
 - name: wrapper playbook for kitchen testing "ansible-os-hardening"
   hosts: localhost
+  vars:
+    os_auditd_enabled: false
   pre_tasks:
+    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
+      set_fact:
+        ansible_python_interpreter: "/usr/bin/python3"
+      when: ansible_facts.distribution == 'Fedora'
+
     - name: Run the equivalent of "apt-get update" as a separate step
       apt:
         update_cache: yes
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'
   roles:
     - ansible-os-hardening
-

vars/Amazon.yml

@@ -0,0 +1,9 @@
+---
+# system accounts that do not get their login disabled and pasword changed
+os_always_ignore_users: ['root', 'sync', 'shutdown', 'halt', 'ec2-user']
+
+sysctl_rhel_config:
+  # ExecShield protection against buffer overflows
+  kernel.exec-shield: 1
+  # Syncookies is used to prevent SYN-flooding attacks.
+  net.ipv4.tcp_syncookies: 1

vars/Debian.yml

@@ -1,14 +1,12 @@
+---
+
 os_packages_pam_ccreds: 'libpam-ccreds'
 os_packages_pam_passwdqc: 'libpam-passwdqc'
 os_packages_pam_cracklib: 'libpam-cracklib'
-passwdqc_path: '/usr/share/pam-configs/passwdqc'
-tally2_path: '/usr/share/pam-configs/tally2'
 os_nologin_shell_path: '/usr/sbin/nologin'
 
-modprobe_package: 'kmod'
-
 # Different distros use different standards for /etc/shadow perms, e.g.
-# RHEL derivatives use root:root 0600, whereas Debian-based use root:shadow 0640.
+# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
 # You must provide key/value pairs for owner, group, and mode if overriding.
 os_shadow_perms:
   owner: root
@@ -19,3 +17,21 @@ os_passwd_perms:
   owner: root
   group: root
   mode: '0644'
+
+os_env_umask: '027'
+
+os_auth_uid_min: 1000
+os_auth_gid_min: 1000
+os_auth_sys_uid_min: 100
+os_auth_sys_uid_max: 999
+os_auth_sys_gid_min: 100
+os_auth_sys_gid_max: 999
+
+# defaults for useradd
+os_useradd_mail_dir: /var/mail
+
+modprobe_package: 'kmod'
+auditd_package: 'auditd'
+
+tally2_path: '/usr/share/pam-configs/tally2'
+passwdqc_path: '/usr/share/pam-configs/passwdqc'

vars/Fedora.yml

@@ -0,0 +1,31 @@
+---
+
+os_packages_pam_ccreds: 'pam_ccreds'
+os_packages_pam_passwdqc: 'pam_passwdqc'
+os_packages_pam_cracklib: 'pam_cracklib'
+os_nologin_shell_path: '/sbin/nologin'
+
+# Different distros use different standards for /etc/shadow perms, e.g.
+# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
+# You must provide key/value pairs for owner, group, and mode if overriding.
+os_shadow_perms:
+  owner: root
+  group: root
+  mode: '0000'
+
+os_passwd_perms:
+  owner: root
+  group: root
+  mode: '0644'
+
+os_env_umask: '027'
+
+os_auth_uid_min: 1000
+os_auth_gid_min: 1000
+os_auth_sys_uid_min: 201
+os_auth_sys_uid_max: 999
+os_auth_sys_gid_min: 201
+os_auth_sys_gid_max: 999
+
+modprobe_package: 'module-init-tools'
+auditd_package: 'audit'

vars/Oracle Linux.yml

@@ -1,17 +1,28 @@
-os_packages_pam_ccreds:  'pam_ccreds'
-os_packages_pam_passwdqc:  'pam_passwdqc'
-os_packages_pam_cracklib:  'pam_cracklib'
+---
+
+os_packages_pam_ccreds: 'pam_ccreds'
+os_packages_pam_passwdqc: 'pam_passwdqc'
+os_packages_pam_cracklib: 'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'
 
 # Different distros use different standards for /etc/shadow perms, e.g.
-# RHEL derivatives use root:root 0600, whereas Debian-based use root:shadow 0640.
+# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
 # You must provide key/value pairs for owner, group, and mode if overriding.
 os_shadow_perms:
   owner: root
   group: root
-  mode: '0600'
+  mode: '0000'
 
 os_passwd_perms:
   owner: root
   group: root
   mode: '0644'
+
+os_env_umask: '077'
+
+os_auth_uid_min: 1000
+os_auth_gid_min: 1000
+os_auth_sys_uid_min: 201
+os_auth_sys_uid_max: 999
+os_auth_sys_gid_min: 201
+os_auth_sys_gid_max: 999

vars/RedHat.yml

@@ -1,21 +1,35 @@
 ---
 
-modprobe_package: 'module-init-tools'
-
 os_packages_pam_ccreds: 'pam_ccreds'
 os_packages_pam_passwdqc: 'pam_passwdqc'
 os_packages_pam_cracklib: 'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'
 
 # Different distros use different standards for /etc/shadow perms, e.g.
-# RHEL derivatives use root:root 0600, whereas Debian-based use root:shadow 0640.
+# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
 # You must provide key/value pairs for owner, group, and mode if overriding.
 os_shadow_perms:
   owner: root
   group: root
-  mode: '0600'
+  mode: '0000'
 
 os_passwd_perms:
   owner: root
   group: root
   mode: '0644'
+
+os_env_umask: '077'
+
+os_auth_uid_min: 1000
+os_auth_gid_min: 1000
+os_auth_sys_uid_min: 201
+os_auth_sys_uid_max: 999
+os_auth_sys_gid_min: 201
+os_auth_sys_gid_max: 999
+
+# defaults for useradd
+os_useradd_mail_dir: /var/spool/mail
+os_useradd_create_home: true
+
+modprobe_package: 'module-init-tools'
+auditd_package: 'audit'

vars/Suse.yml

@@ -0,0 +1,34 @@
+---
+
+os_packages_pam_ccreds: 'pam_ccreds'
+os_packages_pam_passwdqc: 'pam_passwdqc'
+os_packages_pam_cracklib: 'cracklib'
+os_nologin_shell_path: '/sbin/nologin'
+
+# Different distros use different standards for /etc/shadow perms, e.g.
+# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
+# You must provide key/value pairs for owner, group, and mode if overriding.
+os_shadow_perms:
+  owner: root
+  group: root
+  mode: '0600'
+
+os_passwd_perms:
+  owner: root
+  group: root
+  mode: '0644'
+
+os_env_umask: '027'
+
+os_auth_uid_min: 1000
+os_auth_gid_min: 1000
+os_auth_sys_uid_min: 100
+os_auth_sys_uid_max: 499
+os_auth_sys_gid_min: 100
+os_auth_sys_gid_max: 499
+
+# defaults for useradd
+os_useradd_create_home: false
+
+modprobe_package: 'kmod-compat'
+auditd_package: 'audit'

vars/main.yml

@@ -8,7 +8,7 @@
 # adjust values for blacklist/whitelist instead, they can override system_blacklist/whitelist
 
 # list of suid/sgid entries that must be removed
-os_security_suid_sgid_system_blacklist: 
+os_security_suid_sgid_system_blacklist:
   # blacklist as provided by NSA
   - '/usr/bin/rcp'
   - '/usr/bin/rlogin'
@@ -43,6 +43,7 @@ os_security_suid_sgid_system_whitelist:
   - '/bin/mount'
   - '/bin/ping'
   - '/bin/su'
+  - '/usr/bin/su'
   - '/bin/umount'
   - '/sbin/pam_timestamp_check'
   - '/sbin/unix_chkpwd'
@@ -107,5 +108,4 @@ os_security_suid_sgid_system_whitelist:
   - '/usr/lib/libvte-2.90-9/gnome-pty-helper'                     # gnome
 
 # system accounts that do not get their login disabled and pasword changed
-os_always_ignore_users: ['root','sync','shutdown','halt']
-
+os_always_ignore_users: ['root', 'sync', 'shutdown', 'halt']