Merge pull request #421 from schurzi/imprel

Improve Release Action
checkout master between
2021-03-16 11:26:21 +01:00 · 2021-03-16 11:07:21 +01:00 · 2021-03-16 11:00:40 +01:00 · 2021-03-16 10:56:17 +01:00 · 2021-03-16 09:26:22 +00:00 · 2021-03-16 10:14:03 +01:00
87 changed files with 1874 additions and 663 deletions
@@ -0,0 +1,11 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "pip" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "daily"
@@ -1,7 +1,7 @@
 name: "Enforce PR labels"

 on:
-  pull_request:
+  pull_request_target:
    types: [labeled, unlabeled, opened, edited, synchronize]
 jobs:
  enforce-label:
@@ -20,6 +20,11 @@ jobs:
          api_key: ${{ secrets.GALAXY_API_KEY }}
          galaxy_version: ${{ github.event.release.tag_name }}

+      # checkout master instead of the release-tag so we can push the galaxy.yml
+      - uses: actions/checkout@v2
+        with:
+          ref: master
+
      - name: update galaxy.yml with new version
        uses: microsoft/variable-substitution@v1
        with:
@@ -2,6 +2,7 @@
 name: New release

 on:  # yamllint disable-line rule:truthy
+  workflow_dispatch:
  push:
    branches:
      - master
@@ -11,7 +12,9 @@ jobs:
    runs-on: ubuntu-latest
    name: create release draft
    steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v2.3.4
+        with:
+          fetch-depth: 0

      - name: 'Get Previous tag'
        id: previoustag
@@ -26,18 +29,14 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate changelog
-        uses: charmixer/auto-changelog-action@8095796
+        uses: charmixer/auto-changelog-action@v1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          future_release: ${{ steps.version.outputs.next-version }}
-
-      - name: Generate changelog for the release
-        uses: charmixer/auto-changelog-action@8095796
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          since_tag: ${{ steps.previoustag.outputs.tag }}
-          future_release: ${{ steps.version.outputs.next-version }}
-          output: CHANGELOGRELEASE.md
+          # this excludes all versions prior to the collection-release
+          # since they break the changelog generation with the error:
+          # "No common ancestor between ... and $version"
+          exclude_tags_regex: '[0-6]\.\d\.\d'

      - name: push changelog
        uses: github-actions-x/[email protected]
@@ -50,6 +49,16 @@ jobs:
          name: dev-sec CI
          email: [email protected]

+      # do a second checkout to prevent race situation
+      # changelog gets updated but action works on old commit id
+      - uses: actions/[email protected]
+        with:
+          ref: master
+
+      - name: Generate changelog for the release
+        run: |
+          sed '/## \[${{ steps.previoustag.outputs.tag }}\]/Q' CHANGELOG.md > CHANGELOGRELEASE.md
+
      - name: Read CHANGELOG.md
        id: package
        uses: juliangruber/read-file-action@v1
@@ -67,4 +67,3 @@ jobs:
        env:
          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
        working-directory: ansible_collections/devsec/hardening
-
@@ -0,0 +1 @@
+CHANGELOG.md
@@ -0,0 +1,169 @@
+# Changelog
+
+## [7.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.3.0) (2021-03-16)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.2.0...7.3.0)
+
+**Implemented enhancements:**
+
+- pam\_tally2 is deprecated in RHEL8 and pam\_faillock should be used in EL7 and EL8 instead. [\#377](https://github.com/dev-sec/ansible-collection-hardening/issues/377)
+- Replace pam\_tally2 with pam\_faillock in Redhat [\#273](https://github.com/dev-sec/ansible-collection-hardening/issues/273)
+- Extend GSSAPI configuration support to ssh\_config [\#403](https://github.com/dev-sec/ansible-collection-hardening/pull/403) ([wzzrd](https://github.com/wzzrd))
+- add restart handler variable for mysql role [\#399](https://github.com/dev-sec/ansible-collection-hardening/pull/399) ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Fixed bugs:**
+
+- Not able to use `sudo` command for user authenticated via ActiveDirectory [\#278](https://github.com/dev-sec/ansible-collection-hardening/issues/278)
+- You shouldn't touch /etc/pam.d/system-auth-ac in RedHat/CentOS [\#252](https://github.com/dev-sec/ansible-collection-hardening/issues/252)
+
+**Closed issues:**
+
+- Netdata monitoring of docker in docker no longer possible [\#412](https://github.com/dev-sec/ansible-collection-hardening/issues/412)
+- Unable to connect with SSH \(Permission denied \(publickey\)\) [\#411](https://github.com/dev-sec/ansible-collection-hardening/issues/411)
+- TASK \[os\_hardening : configure auditd | package-08\] [\#410](https://github.com/dev-sec/ansible-collection-hardening/issues/410)
+- Collection throws undefined ansible\_role\_name error in auditd task [\#409](https://github.com/dev-sec/ansible-collection-hardening/issues/409)
+- Ensure permissions on /etc/crontab are configured [\#375](https://github.com/dev-sec/ansible-collection-hardening/issues/375)
+- Documentation should be updated [\#361](https://github.com/dev-sec/ansible-collection-hardening/issues/361)
+
+**Merged pull requests:**
+
+- remove FQCN from roles in examples [\#420](https://github.com/dev-sec/ansible-collection-hardening/pull/420) ([schurzi](https://github.com/schurzi))
+- Ensure permissions on /etc/crontab are configured [\#405](https://github.com/dev-sec/ansible-collection-hardening/pull/405) ([joubbi](https://github.com/joubbi))
+- remove FQCN from roles in examples [\#404](https://github.com/dev-sec/ansible-collection-hardening/pull/404) ([schurzi](https://github.com/schurzi))
+- do not install mysql python package on target host [\#401](https://github.com/dev-sec/ansible-collection-hardening/pull/401) ([rndmh3ro](https://github.com/rndmh3ro))
+- make wrong password fail task [\#400](https://github.com/dev-sec/ansible-collection-hardening/pull/400) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.2.0) (2021-02-10)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.1.1...7.2.0)
+
+**Implemented enhancements:**
+
+- Add variable to specify SSH host RSA key size [\#394](https://github.com/dev-sec/ansible-collection-hardening/pull/394) ([Normo](https://github.com/Normo))
+- Set default for ssh host key files only when hardening the server [\#393](https://github.com/dev-sec/ansible-collection-hardening/pull/393) ([Normo](https://github.com/Normo))
+
+**Fixed bugs:**
+
+- A reason why instance would go in rescue mode ?  [\#267](https://github.com/dev-sec/ansible-collection-hardening/issues/267)
+- fix galaxy action to update local galaxy.yml [\#395](https://github.com/dev-sec/ansible-collection-hardening/pull/395) ([Normo](https://github.com/Normo))
+
+**Closed issues:**
+
+- Updating version in galaxy.yml should be part of the release process [\#396](https://github.com/dev-sec/ansible-collection-hardening/issues/396)
+- ssh\_hardening fail on keypair generation  [\#388](https://github.com/dev-sec/ansible-collection-hardening/issues/388)
+- The system must display the date and time of the last successful account logon upon an SSH logon. [\#362](https://github.com/dev-sec/ansible-collection-hardening/issues/362)
+- Error in "root password is present" step [\#326](https://github.com/dev-sec/ansible-collection-hardening/issues/326)
+
+**Merged pull requests:**
+
+- update ansible-lint to version 5 [\#397](https://github.com/dev-sec/ansible-collection-hardening/pull/397) ([schurzi](https://github.com/schurzi))
+- fix minimum required ansible version in docs [\#390](https://github.com/dev-sec/ansible-collection-hardening/pull/390) ([schurzi](https://github.com/schurzi))
+
+## [7.1.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.1.1) (2021-02-05)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.1.0...7.1.1)
+
+**Fixed bugs:**
+
+- use fqcn for community.crypto.openssh\_keypair module [\#389](https://github.com/dev-sec/ansible-collection-hardening/pull/389) ([schurzi](https://github.com/schurzi))
+
+**Closed issues:**
+
+- AnsibleUndefinedVariable: 'ansible\_role\_name' is undefined with 7.1.0 [\#387](https://github.com/dev-sec/ansible-collection-hardening/issues/387)
+
+## [7.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.1.0) (2021-02-02)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.0.0...7.1.0)
+
+**Implemented enhancements:**
+
+- Default value for ssh\_max\_startups should be changed [\#366](https://github.com/dev-sec/ansible-collection-hardening/issues/366)
+- Comment in configuration files should state which collection was there [\#345](https://github.com/dev-sec/ansible-collection-hardening/issues/345)
+- Error on applying the sysctl vars on Debian Jessy [\#230](https://github.com/dev-sec/ansible-collection-hardening/issues/230)
+- restructure PAM handling and update for currently supported Linux distributions [\#392](https://github.com/dev-sec/ansible-collection-hardening/pull/392) ([schurzi](https://github.com/schurzi))
+- add Support for OpenSSH HostCertificate config option [\#380](https://github.com/dev-sec/ansible-collection-hardening/pull/380) ([mpraeger](https://github.com/mpraeger))
+- Syncookie [\#372](https://github.com/dev-sec/ansible-collection-hardening/pull/372) ([joubbi](https://github.com/joubbi))
+- Sorted sysctl values and lists in READMEs alphabetically \(No functional changes\). [\#371](https://github.com/dev-sec/ansible-collection-hardening/pull/371) ([joubbi](https://github.com/joubbi))
+- make auditd 'max\_log\_file' configurable [\#370](https://github.com/dev-sec/ansible-collection-hardening/pull/370) ([tgueldner-mms](https://github.com/tgueldner-mms))
+- reduce maximum unauthenticated ssh sessions [\#368](https://github.com/dev-sec/ansible-collection-hardening/pull/368) ([schurzi](https://github.com/schurzi))
+- add a runtime.yml to declare minimum ansible version [\#363](https://github.com/dev-sec/ansible-collection-hardening/pull/363) ([rndmh3ro](https://github.com/rndmh3ro))
+- change inclusion of os specific defaults [\#353](https://github.com/dev-sec/ansible-collection-hardening/pull/353) ([schurzi](https://github.com/schurzi))
+- make the os\_env\_umask variable usable [\#351](https://github.com/dev-sec/ansible-collection-hardening/pull/351) ([sprat](https://github.com/sprat))
+- Fix \#348: make ssh configuration files paths configurable [\#350](https://github.com/dev-sec/ansible-collection-hardening/pull/350) ([sprat](https://github.com/sprat))
+- Removed Protocol statement in later versions of sshd, since the code … [\#342](https://github.com/dev-sec/ansible-collection-hardening/pull/342) ([joubbi](https://github.com/joubbi))
+- Improvements of comments in opensshd.conf.j2  \#338 [\#339](https://github.com/dev-sec/ansible-collection-hardening/pull/339) ([joubbi](https://github.com/joubbi))
+
+**Fixed bugs:**
+
+- Comments in opensshd.conf.j2 should be improved [\#338](https://github.com/dev-sec/ansible-collection-hardening/issues/338)
+- check for correct cpu vendor in initramfs-tools [\#374](https://github.com/dev-sec/ansible-collection-hardening/pull/374) ([schurzi](https://github.com/schurzi))
+- set hidepid=0 on RHEL/CentOS 7 [\#369](https://github.com/dev-sec/ansible-collection-hardening/pull/369) ([schurzi](https://github.com/schurzi))
+
+**Closed issues:**
+
+- initramfs-tools modules.j2 does not seem to be able to detect AMD CPUs [\#373](https://github.com/dev-sec/ansible-collection-hardening/issues/373)
+- How do i install this on Centos 8? [\#367](https://github.com/dev-sec/ansible-collection-hardening/issues/367)
+- hidepid=2 gives error when running systemctl on EL7 [\#364](https://github.com/dev-sec/ansible-collection-hardening/issues/364)
+- Allow putting the ssh/sshd config in alternative files [\#348](https://github.com/dev-sec/ansible-collection-hardening/issues/348)
+- os\_env\_umask has no effect [\#344](https://github.com/dev-sec/ansible-collection-hardening/issues/344)
+- Don't modify /etc/sysctl.conf [\#343](https://github.com/dev-sec/ansible-collection-hardening/issues/343)
+
+**Merged pull requests:**
+
+- use version tag for changelog action [\#386](https://github.com/dev-sec/ansible-collection-hardening/pull/386) ([schurzi](https://github.com/schurzi))
+- make release workflow manually runnable [\#384](https://github.com/dev-sec/ansible-collection-hardening/pull/384) ([schurzi](https://github.com/schurzi))
+- run labeler workflow with higher privileges [\#383](https://github.com/dev-sec/ansible-collection-hardening/pull/383) ([schurzi](https://github.com/schurzi))
+- remove issue labels from changelog [\#382](https://github.com/dev-sec/ansible-collection-hardening/pull/382) ([schurzi](https://github.com/schurzi))
+- Added comment on top of templates about which role manages the file [\#378](https://github.com/dev-sec/ansible-collection-hardening/pull/378) ([joubbi](https://github.com/joubbi))
+- Regenerate RSA key with size 4096 bits [\#376](https://github.com/dev-sec/ansible-collection-hardening/pull/376) ([ssttehrani](https://github.com/ssttehrani))
+- fix second changelog generation task, too [\#349](https://github.com/dev-sec/ansible-collection-hardening/pull/349) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix changelog generation [\#341](https://github.com/dev-sec/ansible-collection-hardening/pull/341) ([rndmh3ro](https://github.com/rndmh3ro))
+- Improve README for ssh\_hardening [\#335](https://github.com/dev-sec/ansible-collection-hardening/pull/335) ([szEvEz](https://github.com/szEvEz))
+
+## [7.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.0.0) (2020-11-11)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/6.2.0...7.0.0)
+
+**Breaking changes:**
+
+- Move all roles to one single collection [\#332](https://github.com/dev-sec/ansible-collection-hardening/pull/332) ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Implemented enhancements:**
+
+- Breaking change in ansible-lint - set file permissions explicitly [\#299](https://github.com/dev-sec/ansible-collection-hardening/issues/299)
+- Improve Documentation [\#315](https://github.com/dev-sec/ansible-collection-hardening/pull/315) ([schurzi](https://github.com/schurzi))
+- Arch support [\#303](https://github.com/dev-sec/ansible-collection-hardening/pull/303) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix linting for molecule [\#301](https://github.com/dev-sec/ansible-collection-hardening/pull/301) ([schurzi](https://github.com/schurzi))
+- file permissions explicitly defined [\#300](https://github.com/dev-sec/ansible-collection-hardening/pull/300) ([danielkubat](https://github.com/danielkubat))
+- Optimize and unify when clause [\#295](https://github.com/dev-sec/ansible-collection-hardening/pull/295) ([Alexhha](https://github.com/Alexhha))
+- use find module instead of shell [\#294](https://github.com/dev-sec/ansible-collection-hardening/pull/294) ([danielkubat](https://github.com/danielkubat))
+- improve testing [\#287](https://github.com/dev-sec/ansible-collection-hardening/pull/287) ([schurzi](https://github.com/schurzi))
+- Mount proc filesystem using hidepid option [\#283](https://github.com/dev-sec/ansible-collection-hardening/pull/283) ([alegrey91](https://github.com/alegrey91))
+- unify changelog and release actions [\#279](https://github.com/dev-sec/ansible-collection-hardening/pull/279) ([rndmh3ro](https://github.com/rndmh3ro))
+- purge insecure packages [\#275](https://github.com/dev-sec/ansible-collection-hardening/pull/275) ([chris-rock](https://github.com/chris-rock))
+- add changelog and release workflow [\#271](https://github.com/dev-sec/ansible-collection-hardening/pull/271) ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Fixed bugs:**
+
+- Task "set 10.hardcore.conf perms to 0400 and root ownership" fails in check mode [\#313](https://github.com/dev-sec/ansible-collection-hardening/issues/313)
+- use touch for 10.hardcore.conf to avoid problems with dry-run [\#314](https://github.com/dev-sec/ansible-collection-hardening/pull/314) ([schurzi](https://github.com/schurzi))
+- use touch with no date changes [\#310](https://github.com/dev-sec/ansible-collection-hardening/pull/310) ([rndmh3ro](https://github.com/rndmh3ro))
+- do not touch sysctl file to avoid idempotency problems [\#309](https://github.com/dev-sec/ansible-collection-hardening/pull/309) ([rndmh3ro](https://github.com/rndmh3ro))
+- replace module parameter fixed [\#297](https://github.com/dev-sec/ansible-collection-hardening/pull/297) ([danielkubat](https://github.com/danielkubat))
+
+**Closed issues:**
+
+- Any planned support for RHEL/CentOS 8? [\#298](https://github.com/dev-sec/ansible-collection-hardening/issues/298)
+
+**Merged pull requests:**
+
+- prettier markdown files action added [\#322](https://github.com/dev-sec/ansible-collection-hardening/pull/322) ([danielkubat](https://github.com/danielkubat))
+- adjust permissions on shadow file on suse [\#311](https://github.com/dev-sec/ansible-collection-hardening/pull/311) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix fedora build [\#296](https://github.com/dev-sec/ansible-collection-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
+- do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-collection-hardening/pull/289) ([schurzi](https://github.com/schurzi))
+- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-collection-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
+- install procps in debian so sysctl.conf exists [\#282](https://github.com/dev-sec/ansible-collection-hardening/pull/282) ([rndmh3ro](https://github.com/rndmh3ro))
+
+
+
+\* *This Changelog was automatically generated by [github_changelog_generator](https://github.com/github-changelog-generator/github-changelog-generator)*
@@ -0,0 +1,467 @@
+# Changelog
+
+## [6.2.0](https://github.com/dev-sec/ansible-os-hardening/tree/6.2.0) (2020-08-17)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/6.1.0...6.2.0)
+
+**Implemented enhancements:**
+
+- Optimize and unify when clause [\#295](https://github.com/dev-sec/ansible-os-hardening/pull/295) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([Alexhha](https://github.com/Alexhha))
+- use find module instead of shell [\#294](https://github.com/dev-sec/ansible-os-hardening/pull/294) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([danielkubat](https://github.com/danielkubat))
+- improve testing [\#287](https://github.com/dev-sec/ansible-os-hardening/pull/287) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] [[minor](https://github.com/dev-sec/ansible-os-hardening/labels/minor)] ([schurzi](https://github.com/schurzi))
+
+**Fixed bugs:**
+
+- Inconsistent use of role vars/role defaults [\#284](https://github.com/dev-sec/ansible-os-hardening/issues/284) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- replace module parameter fixed [\#297](https://github.com/dev-sec/ansible-os-hardening/pull/297) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([danielkubat](https://github.com/danielkubat))
+
+**Closed issues:**
+
+- Consider using find module instead of shell [\#293](https://github.com/dev-sec/ansible-os-hardening/issues/293)
+- Optimize logical OR in when clause [\#292](https://github.com/dev-sec/ansible-os-hardening/issues/292)
+- vfat added to dev-sec.conf, but efi is used [\#288](https://github.com/dev-sec/ansible-os-hardening/issues/288)
+- OpenSUSE Support [\#249](https://github.com/dev-sec/ansible-os-hardening/issues/249)
+
+**Merged pull requests:**
+
+- fix fedora build [\#296](https://github.com/dev-sec/ansible-os-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
+- do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-os-hardening/pull/289) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([schurzi](https://github.com/schurzi))
+- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [6.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/6.1.0) (2020-07-21)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/6.0.3...6.1.0)
+
+**Implemented enhancements:**
+
+- Mount proc filesystem using hidepid option [\#283](https://github.com/dev-sec/ansible-os-hardening/pull/283) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] [[minor](https://github.com/dev-sec/ansible-os-hardening/labels/minor)] ([alegrey91](https://github.com/alegrey91))
+
+**Fixed bugs:**
+
+- Is it safe to use on Debian 10? The build is failing. [\#281](https://github.com/dev-sec/ansible-os-hardening/issues/281) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+
+**Closed issues:**
+
+- The state of the galaxy release [\#269](https://github.com/dev-sec/ansible-os-hardening/issues/269)
+
+**Merged pull requests:**
+
+- install procps in debian so sysctl.conf exists [\#282](https://github.com/dev-sec/ansible-os-hardening/pull/282) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [6.0.3](https://github.com/dev-sec/ansible-os-hardening/tree/6.0.3) (2020-06-06)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/6.0.2...6.0.3)
+
+**Implemented enhancements:**
+
+- unify changelog and release actions [\#279](https://github.com/dev-sec/ansible-os-hardening/pull/279) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [6.0.2](https://github.com/dev-sec/ansible-os-hardening/tree/6.0.2) (2020-06-02)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/6.0.1...6.0.2)
+
+**Implemented enhancements:**
+
+- purge insecure packages [\#275](https://github.com/dev-sec/ansible-os-hardening/pull/275) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] [[minor](https://github.com/dev-sec/ansible-os-hardening/labels/minor)] ([chris-rock](https://github.com/chris-rock))
+
+## [6.0.1](https://github.com/dev-sec/ansible-os-hardening/tree/6.0.1) (2020-05-09)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/6.0.0...6.0.1)
+
+**Implemented enhancements:**
+
+- add changelog and release workflow [\#271](https://github.com/dev-sec/ansible-os-hardening/pull/271) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))
+- github action for changelog generation [\#270](https://github.com/dev-sec/ansible-os-hardening/pull/270) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [6.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/6.0.0) (2020-05-05)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/5.2.1...6.0.0)
+
+**Implemented enhancements:**
+
+- Configure audit=1 for more accurate auid auditing [\#253](https://github.com/dev-sec/ansible-os-hardening/issues/253) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)]
+- Add Debian Buster support for ansible-os-hardening [\#233](https://github.com/dev-sec/ansible-os-hardening/issues/233) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] [[hacktoberfest](https://github.com/dev-sec/ansible-os-hardening/labels/hacktoberfest)]
+- Add CentOS 8 support for ansible-os-hardening [\#232](https://github.com/dev-sec/ansible-os-hardening/issues/232) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] [[hacktoberfest](https://github.com/dev-sec/ansible-os-hardening/labels/hacktoberfest)]
+- Add selinux configuration [\#154](https://github.com/dev-sec/ansible-os-hardening/issues/154) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] [[hacktoberfest](https://github.com/dev-sec/ansible-os-hardening/labels/hacktoberfest)] [[help wanted](https://github.com/dev-sec/ansible-os-hardening/labels/help%20wanted)]
+- Make useradd defaults in login.defs dependent on OS [\#266](https://github.com/dev-sec/ansible-os-hardening/pull/266) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([aisbergg](https://github.com/aisbergg))
+- Add kernel hardening parameters from Tails and CIS Benchmark [\#263](https://github.com/dev-sec/ansible-os-hardening/pull/263) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([kravietz](https://github.com/kravietz))
+- add ansible-lint [\#262](https://github.com/dev-sec/ansible-os-hardening/pull/262) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Remove trailing space [\#261](https://github.com/dev-sec/ansible-os-hardening/pull/261) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([kravietz](https://github.com/kravietz))
+- Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-os-hardening/pull/259) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jaredledvina](https://github.com/jaredledvina))
+- Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-os-hardening/pull/254) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([kravietz](https://github.com/kravietz))
+- Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-os-hardening/pull/251) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
+- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
+- Make max_log_file_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-os-hardening/pull/246) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jandd](https://github.com/jandd))
+- Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-os-hardening/pull/240) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([ghost](https://github.com/ghost))
+- Fedora - Use new auto ansible_python_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-os-hardening/pull/239) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jaredledvina](https://github.com/jaredledvina))
+- add test support for CentOS8 [\#237](https://github.com/dev-sec/ansible-os-hardening/pull/237) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([yeoldegrove](https://github.com/yeoldegrove))
+- Support configuring SELinux and default to enforcing [\#236](https://github.com/dev-sec/ansible-os-hardening/pull/236) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jaredledvina](https://github.com/jaredledvina))
+- Add test support for debian buster [\#234](https://github.com/dev-sec/ansible-os-hardening/pull/234) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([123Haynes](https://github.com/123Haynes))
+- Changed local var name to a less common one [\#231](https://github.com/dev-sec/ansible-os-hardening/pull/231) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rgarrigue](https://github.com/rgarrigue))
+- Use ansible facts for vars [\#226](https://github.com/dev-sec/ansible-os-hardening/pull/226) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([joshuatalb](https://github.com/joshuatalb))
+
+**Fixed bugs:**
+
+- /etc/login.defs alters centos 7/8 default values [\#265](https://github.com/dev-sec/ansible-os-hardening/issues/265) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] [[help wanted](https://github.com/dev-sec/ansible-os-hardening/labels/help%20wanted)]
+- Invalid Conditionals in user_accounts.yml [\#255](https://github.com/dev-sec/ansible-os-hardening/issues/255) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- `auth-system` related files are created for non-RHEL systems \(e.g. Debian\) [\#247](https://github.com/dev-sec/ansible-os-hardening/issues/247) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- NSA website links are stale [\#227](https://github.com/dev-sec/ansible-os-hardening/issues/227) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] [[hacktoberfest](https://github.com/dev-sec/ansible-os-hardening/labels/hacktoberfest)] [[help wanted](https://github.com/dev-sec/ansible-os-hardening/labels/help%20wanted)]
+- Running ansible on python3 throughs "TypeError: '\<=' not supported between instances of 'str' and 'int'" [\#223](https://github.com/dev-sec/ansible-os-hardening/issues/223) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- \[lots of\] deprecation warnings in Ansible 2.8 [\#221](https://github.com/dev-sec/ansible-os-hardening/issues/221) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] [[help wanted](https://github.com/dev-sec/ansible-os-hardening/labels/help%20wanted)]
+- Add a "don't fail on error" switch ? [\#148](https://github.com/dev-sec/ansible-os-hardening/issues/148) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- Addressing issue \#255 [\#258](https://github.com/dev-sec/ansible-os-hardening/pull/258) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([ljkimmel](https://github.com/ljkimmel))
+- Fix \#247, cleanup conditions [\#248](https://github.com/dev-sec/ansible-os-hardening/pull/248) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([fernandezcuesta](https://github.com/fernandezcuesta))
+- Fix error on applying the sysctl vars on containers [\#243](https://github.com/dev-sec/ansible-os-hardening/pull/243) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([ghost](https://github.com/ghost))
+- Update location of NSA RHEL 5 Guide [\#235](https://github.com/dev-sec/ansible-os-hardening/pull/235) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([jaredledvina](https://github.com/jaredledvina))
+
+## [5.2.1](https://github.com/dev-sec/ansible-os-hardening/tree/5.2.1) (2019-06-09)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/5.2.0...5.2.1)
+
+**Implemented enhancements:**
+
+- Fix deprecation warnings in Ansible 2.8 [\#224](https://github.com/dev-sec/ansible-os-hardening/pull/224) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([Normo](https://github.com/Normo))
+- add docs to find-task in minimize access. fix \#219 [\#220](https://github.com/dev-sec/ansible-os-hardening/pull/220) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Fixed bugs:**
+
+- `squash_actions` deprecation warning [\#218](https://github.com/dev-sec/ansible-os-hardening/issues/218) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] [[help wanted](https://github.com/dev-sec/ansible-os-hardening/labels/help%20wanted)]
+
+## [5.2.0](https://github.com/dev-sec/ansible-os-hardening/tree/5.2.0) (2019-05-04)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/5.1.0...5.2.0)
+
+**Implemented enhancements:**
+
+- Speed up "minimize access on found files" task [\#208](https://github.com/dev-sec/ansible-os-hardening/issues/208) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)]
+- Fedora support? [\#163](https://github.com/dev-sec/ansible-os-hardening/issues/163) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] [[help wanted](https://github.com/dev-sec/ansible-os-hardening/labels/help%20wanted)]
+- remove eol'd OS and add new [\#217](https://github.com/dev-sec/ansible-os-hardening/pull/217) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Add note about docker under warning [\#214](https://github.com/dev-sec/ansible-os-hardening/pull/214) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([ChrisMcKee](https://github.com/ChrisMcKee))
+- change minimize access tasks to speed them up [\#209](https://github.com/dev-sec/ansible-os-hardening/pull/209) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Added fedora support [\#206](https://github.com/dev-sec/ansible-os-hardening/pull/206) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jonaswre](https://github.com/jonaswre))
+- Pass package list directly to apt and yum modules without using with_items loop [\#200](https://github.com/dev-sec/ansible-os-hardening/pull/200) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([Normo](https://github.com/Normo))
+
+**Fixed bugs:**
+
+- login.defs.j2 template: ENV_PATH is missing ':' before variable substitution [\#202](https://github.com/dev-sec/ansible-os-hardening/issues/202) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- 'sysctl_rhel_config' is undefined [\#167](https://github.com/dev-sec/ansible-os-hardening/issues/167) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- RHEL 7.4: Too many setuid bits removed [\#140](https://github.com/dev-sec/ansible-os-hardening/issues/140) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] [[help wanted](https://github.com/dev-sec/ansible-os-hardening/labels/help%20wanted)]
+- Fix typo [\#212](https://github.com/dev-sec/ansible-os-hardening/pull/212) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([ruslo](https://github.com/ruslo))
+- Update modprobe to 0644 [\#211](https://github.com/dev-sec/ansible-os-hardening/pull/211) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([joshuatalb](https://github.com/joshuatalb))
+- Test Kitchen Vagrant Fixes [\#210](https://github.com/dev-sec/ansible-os-hardening/pull/210) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([joshuatalb](https://github.com/joshuatalb))
+- \[readme\] Update documentation link [\#207](https://github.com/dev-sec/ansible-os-hardening/pull/207) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([pmav99](https://github.com/pmav99))
+- fix ansible lint remarks [\#204](https://github.com/dev-sec/ansible-os-hardening/pull/204) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add colon to user env paths - fix \#202 [\#203](https://github.com/dev-sec/ansible-os-hardening/pull/203) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix errors produced by ansible-lint [\#159](https://github.com/dev-sec/ansible-os-hardening/pull/159) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([zbrojny120](https://github.com/zbrojny120))
+
+## [5.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/5.1.0) (2018-10-17)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/5.0.0...5.1.0)
+
+**Implemented enhancements:**
+
+- add ubuntu 1804 support [\#196](https://github.com/dev-sec/ansible-os-hardening/pull/196) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add option to disable auditd [\#192](https://github.com/dev-sec/ansible-os-hardening/pull/192) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Fixed bugs:**
+
+- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- Setting os_security_users_allow has no effect [\#175](https://github.com/dev-sec/ansible-os-hardening/issues/175) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- add /usr/bin/su to suid_guid whitelist [\#199](https://github.com/dev-sec/ansible-os-hardening/pull/199) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([ccolic](https://github.com/ccolic))
+- ensure that permissions to su-binary are not restricted to root user and group only, if os_security_users_allow contains the value change_user [\#197](https://github.com/dev-sec/ansible-os-hardening/pull/197) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([szEvEz](https://github.com/szEvEz))
+
+## [5.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/5.0.0) (2018-09-02)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.3.0...5.0.0)
+
+**Implemented enhancements:**
+
+- Warning about "include" for tasks for ansible-playbook 2.4.0 \(devel f0a5854e39\) [\#131](https://github.com/dev-sec/ansible-os-hardening/issues/131) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)]
+- fix problems with efi and vfat [\#190](https://github.com/dev-sec/ansible-os-hardening/pull/190) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- added os_hardening_enabled flag [\#186](https://github.com/dev-sec/ansible-os-hardening/pull/186) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jcheroske](https://github.com/jcheroske))
+- add amazon run opts to travis [\#183](https://github.com/dev-sec/ansible-os-hardening/pull/183) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- use package instead of yum and apt [\#180](https://github.com/dev-sec/ansible-os-hardening/pull/180) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add oracle7 to travis [\#178](https://github.com/dev-sec/ansible-os-hardening/pull/178) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- fix wrong permissions passwdqc \#170 [\#176](https://github.com/dev-sec/ansible-os-hardening/pull/176) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- ipv4 forwarding comment is inconsistent with example [\#174](https://github.com/dev-sec/ansible-os-hardening/pull/174) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([carchrae](https://github.com/carchrae))
+- Rename pam_passwdqd.j2 to pam_passwdqc.j2 [\#172](https://github.com/dev-sec/ansible-os-hardening/pull/172) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([martinbydefault](https://github.com/martinbydefault))
+- Use package state 'present' since 'installed' is deprecated [\#168](https://github.com/dev-sec/ansible-os-hardening/pull/168) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([Normo](https://github.com/Normo))
+- Update syntax to Ansible 2.4 [\#161](https://github.com/dev-sec/ansible-os-hardening/pull/161) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([thomasjpfan](https://github.com/thomasjpfan))
+- add amazon linux testing [\#160](https://github.com/dev-sec/ansible-os-hardening/pull/160) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Add support for Amazon Linux [\#158](https://github.com/dev-sec/ansible-os-hardening/pull/158) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([woneill](https://github.com/woneill))
+- install and configure auditd - fix inspec package-08 [\#144](https://github.com/dev-sec/ansible-os-hardening/pull/144) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Remove deprecated include for static tasks and use instead import_tasks fix \#131 [\#132](https://github.com/dev-sec/ansible-os-hardening/pull/132) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([HelioCampos](https://github.com/HelioCampos))
+
+**Fixed bugs:**
+
+- minimize_access: maximum recursion depth exceeded on Ansible 2.5 [\#171](https://github.com/dev-sec/ansible-os-hardening/issues/171) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- wrong permissions passwdqc [\#170](https://github.com/dev-sec/ansible-os-hardening/issues/170) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- Update deprecated `include` statements [\#166](https://github.com/dev-sec/ansible-os-hardening/issues/166) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- Strongly recommend against disabling vfat by default [\#162](https://github.com/dev-sec/ansible-os-hardening/issues/162) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- System completely unresponsive after role execution [\#145](https://github.com/dev-sec/ansible-os-hardening/issues/145) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- do not install passwdqc on amazon linux [\#189](https://github.com/dev-sec/ansible-os-hardening/pull/189) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add back run opts for debian 8 in travis [\#184](https://github.com/dev-sec/ansible-os-hardening/pull/184) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix core dump config file creation when core dumps are disabled [\#182](https://github.com/dev-sec/ansible-os-hardening/pull/182) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([Normo](https://github.com/Normo))
+- change minimize access method [\#181](https://github.com/dev-sec/ansible-os-hardening/pull/181) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [4.3.0](https://github.com/dev-sec/ansible-os-hardening/tree/4.3.0) (2018-01-03)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.3.1...4.3.0)
+
+**Implemented enhancements:**
+
+- Update some RH settings in this role [\#155](https://github.com/dev-sec/ansible-os-hardening/issues/155) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)]
+- Removal of core dump hardening configuration if core dumps are allowed [\#129](https://github.com/dev-sec/ansible-os-hardening/issues/129) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] [[help wanted](https://github.com/dev-sec/ansible-os-hardening/labels/help%20wanted)]
+- Don't create home for system accounts [\#156](https://github.com/dev-sec/ansible-os-hardening/pull/156) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([oakey-b1](https://github.com/oakey-b1))
+- Prevent disabling of filesystems via whitelist [\#153](https://github.com/dev-sec/ansible-os-hardening/pull/153) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([manuelprinz](https://github.com/manuelprinz))
+- Add kernel hardening settings from Ubuntu /etc/sysctl.d [\#150](https://github.com/dev-sec/ansible-os-hardening/pull/150) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([kravietz](https://github.com/kravietz))
+- Removal of core dump hardening configuration if core dumps are allowed [\#146](https://github.com/dev-sec/ansible-os-hardening/pull/146) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([martinbydefault](https://github.com/martinbydefault))
+- add missing sysctl parameter [\#143](https://github.com/dev-sec/ansible-os-hardening/pull/143) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] [[in progress](https://github.com/dev-sec/ansible-os-hardening/labels/in%20progress)] ([rndmh3ro](https://github.com/rndmh3ro))
+- update readme [\#139](https://github.com/dev-sec/ansible-os-hardening/pull/139) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Fixed bugs:**
+
+- bug in ufw.j2 template [\#151](https://github.com/dev-sec/ansible-os-hardening/issues/151) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- replace single ticks with double ticks. fix \#151 [\#152](https://github.com/dev-sec/ansible-os-hardening/pull/152) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([rndmh3ro](https://github.com/rndmh3ro))
+- fixed tag [\#149](https://github.com/dev-sec/ansible-os-hardening/pull/149) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([martinbydefault](https://github.com/martinbydefault))
+
+**Closed issues:**
+
+- ansible hardening fails on ubuntu 16.04 with msg": "ERROR! 'sysctl_rhel_config' is undefined [\#147](https://github.com/dev-sec/ansible-os-hardening/issues/147)
+- Enhancement: Test with TestInfra and Molecule [\#128](https://github.com/dev-sec/ansible-os-hardening/issues/128)
+
+**Merged pull requests:**
+
+- move defaults to os-specific vars [\#157](https://github.com/dev-sec/ansible-os-hardening/pull/157) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [4.3.1](https://github.com/dev-sec/ansible-os-hardening/tree/4.3.1) (2017-09-13)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.2.0...4.3.1)
+
+**Fixed bugs:**
+
+- os_security_kernel_enable_sysrq is not implemented [\#115](https://github.com/dev-sec/ansible-os-hardening/issues/115) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+
+## [4.2.0](https://github.com/dev-sec/ansible-os-hardening/tree/4.2.0) (2017-08-08)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.1.0...4.2.0)
+
+**Implemented enhancements:**
+
+- add modprobe template, control os-10 [\#138](https://github.com/dev-sec/ansible-os-hardening/pull/138) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- new task for delete netrc files, control os-09 [\#137](https://github.com/dev-sec/ansible-os-hardening/pull/137) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add passwd task, control os-03 [\#136](https://github.com/dev-sec/ansible-os-hardening/pull/136) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- remove prelink package, control package-09 [\#135](https://github.com/dev-sec/ansible-os-hardening/pull/135) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- style update [\#134](https://github.com/dev-sec/ansible-os-hardening/pull/134) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-os-hardening/pull/130) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fazlearefin](https://github.com/fazlearefin))
+
+**Fixed bugs:**
+
+- Why is rsync removed? [\#141](https://github.com/dev-sec/ansible-os-hardening/issues/141) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- playbook makes OS undetectable [\#124](https://github.com/dev-sec/ansible-os-hardening/issues/124) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- Centos7/RHEL7: Exec shield is enabled by default and not manageable anymore by sysctl.conf [\#118](https://github.com/dev-sec/ansible-os-hardening/issues/118) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- Remove rsync from package blacklist [\#142](https://github.com/dev-sec/ansible-os-hardening/pull/142) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([duk3luk3](https://github.com/duk3luk3))
+
+**Merged pull requests:**
+
+- remove execshield sysctl-parameter on rhel7 [\#119](https://github.com/dev-sec/ansible-os-hardening/pull/119) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [4.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/4.1.0) (2017-06-27)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/4.0.0...4.1.0)
+
+**Fixed bugs:**
+
+- Change system accounts not on the user provided ignore-list items are not JSON serializable [\#125](https://github.com/dev-sec/ansible-os-hardening/issues/125) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- Could not find gem 'ruby \(\>= 2.1.0\)' [\#116](https://github.com/dev-sec/ansible-os-hardening/issues/116) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- The task sysctl fails when /etc/initramfs-tools is not present [\#111](https://github.com/dev-sec/ansible-os-hardening/issues/111) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- Deprecation warning always_run [\#103](https://github.com/dev-sec/ansible-os-hardening/issues/103) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+
+**Closed issues:**
+
+- Enhancement: Pin python dependencies for development and testing [\#127](https://github.com/dev-sec/ansible-os-hardening/issues/127)
+- Update readme to include baselines [\#122](https://github.com/dev-sec/ansible-os-hardening/issues/122)
+
+**Merged pull requests:**
+
+- Converts set to JSON-serializable list [\#126](https://github.com/dev-sec/ansible-os-hardening/pull/126) ([pestaa](https://github.com/pestaa))
+- add more sysctl settings, allow overwriting [\#120](https://github.com/dev-sec/ansible-os-hardening/pull/120) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [4.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/4.0.0) (2017-03-14)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.2.0...4.0.0)
+
+**Implemented enhancements:**
+
+- Description of the Ansible roles of dev-sec says "This Ansible playbook" [\#97](https://github.com/dev-sec/ansible-os-hardening/issues/97) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)]
+- install initramfs-tools [\#114](https://github.com/dev-sec/ansible-os-hardening/pull/114) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- omit empty variables [\#106](https://github.com/dev-sec/ansible-os-hardening/pull/106) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Fixed bugs:**
+
+- The role fails when conditionally included [\#105](https://github.com/dev-sec/ansible-os-hardening/issues/105) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+
+**Closed issues:**
+
+- Error running on RHEL 7 due to syntax issues [\#112](https://github.com/dev-sec/ansible-os-hardening/issues/112)
+- disable password age [\#109](https://github.com/dev-sec/ansible-os-hardening/issues/109)
+
+**Merged pull requests:**
+
+- change shadow owner in debian systems [\#117](https://github.com/dev-sec/ansible-os-hardening/pull/117) ([rndmh3ro](https://github.com/rndmh3ro))
+- Rhel7 [\#113](https://github.com/dev-sec/ansible-os-hardening/pull/113) ([tyrken](https://github.com/tyrken))
+- use new Docker images [\#110](https://github.com/dev-sec/ansible-os-hardening/pull/110) ([rndmh3ro](https://github.com/rndmh3ro))
+- Don’t refer to this role as "playbook" in the role description [\#104](https://github.com/dev-sec/ansible-os-hardening/pull/104) ([ypid](https://github.com/ypid))
+
+## [3.2.0](https://github.com/dev-sec/ansible-os-hardening/tree/3.2.0) (2016-10-24)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.1.0...3.2.0)
+
+**Fixed bugs:**
+
+- CentOS 7 selinux dependencies [\#102](https://github.com/dev-sec/ansible-os-hardening/issues/102) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- ubuntu xenial warning during activate gpg-check for yum-repos [\#99](https://github.com/dev-sec/ansible-os-hardening/issues/99) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- rhel_system_auth.j2 is still using pam_passwdqc.so for CentOS 7 [\#98](https://github.com/dev-sec/ansible-os-hardening/issues/98) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- Enable pam_pwquality in rhel-family \> 7 [\#73](https://github.com/dev-sec/ansible-os-hardening/issues/73) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] [[help wanted](https://github.com/dev-sec/ansible-os-hardening/labels/help%20wanted)]
+- "irc" user always changed after reboot [\#53](https://github.com/dev-sec/ansible-os-hardening/issues/53) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] [[help wanted](https://github.com/dev-sec/ansible-os-hardening/labels/help%20wanted)]
+
+**Merged pull requests:**
+
+- update template [\#101](https://github.com/dev-sec/ansible-os-hardening/pull/101) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix deprecation warning for undefined error. \#99 [\#100](https://github.com/dev-sec/ansible-os-hardening/pull/100) ([rndmh3ro](https://github.com/rndmh3ro))
+- add rhel7 pam_pwquality. fix \#73 [\#94](https://github.com/dev-sec/ansible-os-hardening/pull/94) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [3.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/3.1.0) (2016-08-03)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.1...3.1.0)
+
+## [3.1](https://github.com/dev-sec/ansible-os-hardening/tree/3.1) (2016-07-27)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/3.0.0...3.1)
+
+**Implemented enhancements:**
+
+- Supports --check mode [\#93](https://github.com/dev-sec/ansible-os-hardening/pull/93) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([conorsch](https://github.com/conorsch))
+- Adds support for CentOS 7 [\#91](https://github.com/dev-sec/ansible-os-hardening/pull/91) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([conorsch](https://github.com/conorsch))
+- Docker [\#90](https://github.com/dev-sec/ansible-os-hardening/pull/90) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- debian 8 support [\#88](https://github.com/dev-sec/ansible-os-hardening/pull/88) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-os-hardening/pull/85) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
+- replace ignore_errors to failed_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
+- fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-os-hardening/pull/79) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
+
+**Fixed bugs:**
+
+- Centos 7.1 fails at \[Change various sysctl-settings on rhel-hosts...\] [\#74](https://github.com/dev-sec/ansible-os-hardening/issues/74) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- Hardening fails on Centos 7.1 at task 'minimize access' [\#71](https://github.com/dev-sec/ansible-os-hardening/issues/71) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] [[help wanted](https://github.com/dev-sec/ansible-os-hardening/labels/help%20wanted)]
+
+**Closed issues:**
+
+- Permissions on /etc/shadow can lock out GUI users [\#86](https://github.com/dev-sec/ansible-os-hardening/issues/86)
+- network related sysctl rewritten by ufw in ubuntu [\#82](https://github.com/dev-sec/ansible-os-hardening/issues/82)
+- ansible \>= 2.0 complains: Using bare variables is deprecated [\#78](https://github.com/dev-sec/ansible-os-hardening/issues/78)
+
+**Merged pull requests:**
+
+- Fix a formatting issue in readme. [\#92](https://github.com/dev-sec/ansible-os-hardening/pull/92) ([vivekagr](https://github.com/vivekagr))
+- Permits overriding permissions on /etc/shadow [\#89](https://github.com/dev-sec/ansible-os-hardening/pull/89) ([conorsch](https://github.com/conorsch))
+
+## [3.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/3.0.0) (2016-03-13)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/2.0.0...3.0.0)
+
+**Implemented enhancements:**
+
+- update platforms in meta-file [\#69](https://github.com/dev-sec/ansible-os-hardening/pull/69) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add webhook for ansible galaxy [\#68](https://github.com/dev-sec/ansible-os-hardening/pull/68) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Move sysctl vars to defaults [\#67](https://github.com/dev-sec/ansible-os-hardening/pull/67) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- make sys_uid and sys_gid configurable [\#62](https://github.com/dev-sec/ansible-os-hardening/pull/62) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Ansible 2.0 support [\#59](https://github.com/dev-sec/ansible-os-hardening/pull/59) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- use inspec as test framework [\#58](https://github.com/dev-sec/ansible-os-hardening/pull/58) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([chris-rock](https://github.com/chris-rock))
+- Packages as attributes [\#57](https://github.com/dev-sec/ansible-os-hardening/pull/57) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Change categories to tags for upcoming ansible 2.0 [\#56](https://github.com/dev-sec/ansible-os-hardening/pull/56) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Add SINGLE and PROMPT parameters. [\#55](https://github.com/dev-sec/ansible-os-hardening/pull/55) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add changelog generator [\#54](https://github.com/dev-sec/ansible-os-hardening/pull/54) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([chris-rock](https://github.com/chris-rock))
+
+**Fixed bugs:**
+
+- Updates "tags" parameters on includes in main.yml [\#66](https://github.com/dev-sec/ansible-os-hardening/pull/66) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([conorsch](https://github.com/conorsch))
+- Suid set def var, fix \#64 [\#63](https://github.com/dev-sec/ansible-os-hardening/pull/63) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Closed issues:**
+
+- Hardening fails on Centos 7.1 at task 'remove suid/sgid bit from all binaries except in system and user whitelist' [\#72](https://github.com/dev-sec/ansible-os-hardening/issues/72)
+- ansible 2.0 | "remove suid/sgid" task fails [\#64](https://github.com/dev-sec/ansible-os-hardening/issues/64)
+- Custom sysctl [\#50](https://github.com/dev-sec/ansible-os-hardening/issues/50)
+
+**Merged pull requests:**
+
+- Release 3.0.0 [\#75](https://github.com/dev-sec/ansible-os-hardening/pull/75) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [2.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/2.0.0) (2015-11-28)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/1.0.0...2.0.0)
+
+**Closed issues:**
+
+- Fix directory structure. [\#48](https://github.com/dev-sec/ansible-os-hardening/issues/48)
+- pam auth update error [\#47](https://github.com/dev-sec/ansible-os-hardening/issues/47)
+
+**Merged pull requests:**
+
+- Add explicit role-path to kitchen.yml [\#52](https://github.com/dev-sec/ansible-os-hardening/pull/52) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix pam passwdqc template [\#51](https://github.com/dev-sec/ansible-os-hardening/pull/51) ([rndmh3ro](https://github.com/rndmh3ro))
+- New dir layout [\#49](https://github.com/dev-sec/ansible-os-hardening/pull/49) ([rndmh3ro](https://github.com/rndmh3ro))
+- remove duplicate "update pam" task [\#46](https://github.com/dev-sec/ansible-os-hardening/pull/46) ([fitz123](https://github.com/fitz123))
+- Fix stuck in case pam files was updated before by force update [\#45](https://github.com/dev-sec/ansible-os-hardening/pull/45) ([fitz123](https://github.com/fitz123))
+- Fix nologin shell path [\#44](https://github.com/dev-sec/ansible-os-hardening/pull/44) ([fitz123](https://github.com/fitz123))
+- improved travis-tests to cover more cases [\#42](https://github.com/dev-sec/ansible-os-hardening/pull/42) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [1.0.0](https://github.com/dev-sec/ansible-os-hardening/tree/1.0.0) (2015-09-01)
+
+[Full Changelog](https://github.com/dev-sec/ansible-os-hardening/compare/a9591764206b79a4ed324bb8576151ebac0127b1...1.0.0)
+
+**Closed issues:**
+
+- ansible-os-hardening/tasks/minimize_access.yml [\#38](https://github.com/dev-sec/ansible-os-hardening/issues/38)
+- Role configuration. vars/main.yml? [\#34](https://github.com/dev-sec/ansible-os-hardening/issues/34)
+- Sysctl reloading [\#18](https://github.com/dev-sec/ansible-os-hardening/issues/18)
+- Add conditions for disabling of ip forwarding [\#15](https://github.com/dev-sec/ansible-os-hardening/issues/15)
+- Disable System Accounts [\#6](https://github.com/dev-sec/ansible-os-hardening/issues/6)
+
+**Merged pull requests:**
+
+- Update kitchen-ansible, remove separate debian install [\#40](https://github.com/dev-sec/ansible-os-hardening/pull/40) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add mode to su-binary task. Fix \#38 [\#39](https://github.com/dev-sec/ansible-os-hardening/pull/39) ([rndmh3ro](https://github.com/rndmh3ro))
+- update common kitchen.yml platforms \(ansible\), kitchen_debian.yml platforms \(ansible\) [\#37](https://github.com/dev-sec/ansible-os-hardening/pull/37) ([chris-rock](https://github.com/chris-rock))
+- Change oneliner if-statements to be more readable [\#36](https://github.com/dev-sec/ansible-os-hardening/pull/36) ([rndmh3ro](https://github.com/rndmh3ro))
+- Separate system-vars from editable vars. Fix \#34 [\#35](https://github.com/dev-sec/ansible-os-hardening/pull/35) ([rndmh3ro](https://github.com/rndmh3ro))
+- Create limits.d-directory if it does not exist. [\#33](https://github.com/dev-sec/ansible-os-hardening/pull/33) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add correct CONTRIB-file [\#32](https://github.com/dev-sec/ansible-os-hardening/pull/32) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add Ansible Galaxy badge [\#31](https://github.com/dev-sec/ansible-os-hardening/pull/31) ([rndmh3ro](https://github.com/rndmh3ro))
+- Update readme, todo, changelog, vars [\#30](https://github.com/dev-sec/ansible-os-hardening/pull/30) ([rndmh3ro](https://github.com/rndmh3ro))
+- List-cleanup and follow symlinks added [\#29](https://github.com/dev-sec/ansible-os-hardening/pull/29) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add module configuration [\#28](https://github.com/dev-sec/ansible-os-hardening/pull/28) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix two sysctl-settings [\#27](https://github.com/dev-sec/ansible-os-hardening/pull/27) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add meta-files for Ansible Galaxy [\#26](https://github.com/dev-sec/ansible-os-hardening/pull/26) ([rndmh3ro](https://github.com/rndmh3ro))
+- Disable System Accounts. Fix \#6 [\#25](https://github.com/dev-sec/ansible-os-hardening/pull/25) ([rndmh3ro](https://github.com/rndmh3ro))
+- Use changed_when to avoid changed tasks [\#24](https://github.com/dev-sec/ansible-os-hardening/pull/24) ([rndmh3ro](https://github.com/rndmh3ro))
+- Delete authconfig-task on rhel-systems [\#23](https://github.com/dev-sec/ansible-os-hardening/pull/23) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add missing rhosts-include task [\#21](https://github.com/dev-sec/ansible-os-hardening/pull/21) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change sysctl-task. Fix \#18 [\#20](https://github.com/dev-sec/ansible-os-hardening/pull/20) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add travis-support [\#17](https://github.com/dev-sec/ansible-os-hardening/pull/17) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add conditions for various tasks. Fix \#15 [\#16](https://github.com/dev-sec/ansible-os-hardening/pull/16) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix configuration of playbook path [\#14](https://github.com/dev-sec/ansible-os-hardening/pull/14) ([chris-rock](https://github.com/chris-rock))
+- Make tasks clearer [\#13](https://github.com/dev-sec/ansible-os-hardening/pull/13) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add remove suid/sgid function [\#12](https://github.com/dev-sec/ansible-os-hardening/pull/12) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add task to remove unused repos and pkgs [\#11](https://github.com/dev-sec/ansible-os-hardening/pull/11) ([rndmh3ro](https://github.com/rndmh3ro))
+- Edit README to fit to os-hardening [\#10](https://github.com/dev-sec/ansible-os-hardening/pull/10) ([rndmh3ro](https://github.com/rndmh3ro))
+- ignore RAs on Ipv6 [\#9](https://github.com/dev-sec/ansible-os-hardening/pull/9) ([rndmh3ro](https://github.com/rndmh3ro))
+- Repair debian install script [\#8](https://github.com/dev-sec/ansible-os-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
+- Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-os-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
+- Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-os-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-os-hardening/pull/3) ([arlimus](https://github.com/arlimus))
+- Add Securetty-support [\#2](https://github.com/dev-sec/ansible-os-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-os-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))
+
+\* _This Changelog was automatically generated by [github_changelog_generator](https://github.com/github-changelog-generator/github-changelog-generator)_
@@ -7,49 +7,55 @@

 ## Description

-This collections provides battle tested hardening for:
+This collection provides battle tested hardening for:

 - Linux operating systems:
  - CentOS 7/8
-  - Ubuntu 16.04/18.04/20.04
  - Debian 9/10
-  - Arch Linux (some roles supported)
-  - Suse Tumbleweed (some roles supported)
-  - Fedora (some roles supported)
+  - Ubuntu 16.04/18.04/20.04
  - Amazon Linux (some roles supported)
- OpenSSH 5.3 and later
- Nginx 1.0.16 or later
+  - Arch Linux (some roles supported)
+  - Fedora (some roles supported)
+  - Suse Tumbleweed (some roles supported)
 - MySQL
-  - MySQL >= 5.7.31, >= 8.0.3
  - MariaDB >= 5.5.65, >= 10.1.45, >= 10.3.17
+  - MySQL >= 5.7.31, >= 8.0.3
+- Nginx 1.0.16 or later
+- OpenSSH 5.3 and later

 The hardening is intended to be compliant with the Inspec DevSec Baselines:

 - https://github.com/dev-sec/linux-baseline
- https://github.com/dev-sec/ssh-baseline
- https://github.com/dev-sec/nginx-baseline
 - https://github.com/dev-sec/mysql-baseline
+- https://github.com/dev-sec/nginx-baseline
+- https://github.com/dev-sec/ssh-baseline

 ## Looking for the old ansible-os-hardening role?

 This role is now part of the hardening-collection. You can find the old role in the branch `legacy`.

-## Tested with Ansible
+## Minimum required Ansible-version

-2.10
+- Ansible >= 2.9.10

 ## Included content

 - [os_hardening](roles/os_hardening/)
- [ssh_hardening](roles/ssh_hardening/)
 - [mysql_hardening](roles/mysql_hardening/)
 - [nginx_hardening](roles/nginx_hardening/)
+- [ssh_hardening](roles/ssh_hardening/)

 In progress, not working:

 - [apache_hardening](roles/apache_hardening/)
 - [windows_hardening](roles/windows_hardening/)

+## Installation
+
+Install the collection via ansible-galaxy:
+
+`ansible-galaxy collection install devsec.hardening`
+
 ## Using this collection

 Please refer to the examples in the readmes of the role.
@@ -1,36 +1,13 @@
-# The namespace of the collection. This can be a company/brand/organization or product namespace under which all
-# content lives. May only contain alphanumeric lowercase characters and underscores. Namespaces cannot start with
-# underscores or numbers and cannot contain consecutive underscores
 namespace: devsec
-
-# The name of the collection. Has the same character restrictions as 'namespace'
 name: hardening
-
-# The version of the collection. Must be compatible with semantic versioning
-version: 7.0.0
-
-# The path to the Markdown (.md) readme file. This path is relative to the root of the collection
+version: 7.2.0
 readme: README.md
-
-# A list of the collection's content authors. Can be just the name or in the format 'Full Name <email> (url)
-# @nicks:irc/im.site#channel'
 authors:
- dev-sec <[email protected]>
-
-# A short summary description of the collection
-description: This collection provides battle tested hardening for Linux, SSH, nginx, MySQL
-
-# Either a single license or a list of licenses for content inside of a collection. Ansible Galaxy currently only
-# accepts L(SPDX,https://spdx.org/licenses/) licenses. This key is mutually exclusive with 'license_file'
+  - dev-sec <[email protected]>
+description: 'This collection provides battle tested hardening for Linux, SSH, nginx, MySQL'
 license:
- GPL-2.0-or-later
-
-# The path to the license file for the collection. This path is relative to the root of the collection. This key is
-# mutually exclusive with 'license'
+  - GPL-2.0-or-later
 license_file: ''
-
-# A list of tags you want to associate with the collection for indexing/searching. A tag name has the same character
-# requirements as 'namespace' and 'name'
 tags:
  - devsec
  - hardening
@@ -40,23 +17,11 @@ tags:
  - nginx
  - mysql
  - openssh
-
-# Collections that this collection requires to be installed for it to be usable. The key of the dict is the
-# collection label 'namespace.name'. The value is a version range
-# L(specifiers,https://python-semanticversion.readthedocs.io/en/latest/#requirement-specification). Multiple version
-# range specifiers can be set and are separated by ','
-dependencies: {}
-
-# The URL of the originating SCM repository
-repository: https://github.com/dev-sec/ansible-os-hardening
-
-# The URL to the homepage of the collection/project
-homepage: https://dev-sec.io/
-
-# The URL to the collection issue tracker
-issues: https://github.com/dev-sec/ansible-os-hardening/issues
-
-# ignore files not needed for release
+dependencies:
+  community.crypto: '>=1.0.0'
+repository: 'https://github.com/dev-sec/ansible-os-hardening'
+homepage: 'https://dev-sec.io/'
+issues: 'https://github.com/dev-sec/ansible-os-hardening/issues'
 build_ignore:
  - codecov.yml
  - .github
@@ -0,0 +1,2 @@
+---
+requires_ansible: '>=2.9.10'
@@ -60,4 +60,3 @@ scenario:
    # - idempotence  # not idempotent
    - verify
    - destroy
-
@@ -63,4 +63,3 @@ scenario:
    - idempotence
    - verify
    - destroy
-
@@ -15,6 +15,7 @@
    os_security_kernel_enable_core_dump: true
    os_security_suid_sgid_remove_from_unknown: true
    os_auth_pam_passwdqc_enable: false
+    os_auth_lockout_time: 15
    os_desktop_enable: true
    os_env_extra_user_paths: ['/home']
    os_auth_allow_homeless: true
@@ -63,4 +63,3 @@ scenario:
    - idempotence
    - verify
    - destroy
-
@@ -33,6 +33,10 @@
        name: procps
      when: ansible_facts.os_family == 'Debian'

+    - name: include PAM tests
+      include: verify_pam.yml
+      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+
    - name: download cinc-auditor
      get_url:
        url: https://omnitruck.cinc.sh/install.sh
@@ -56,3 +60,17 @@
      fail:
        msg: "Inspec failed to validate"
      when: test_results.rc != 0
+
+    # test if variable can be overridden
+    - name: workaround for https://github.com/ansible/ansible/issues/66304
+      set_fact:
+        ansible_virtualization_type: "docker"
+        os_env_umask: "027 #override"
+
+    - include_role:
+        name: os_hardening
+
+    - name: verify os_env_umask
+      shell:
+        cmd: "grep '027 #override' /etc/login.defs"
+      changed_when: false
@@ -0,0 +1,59 @@
+---
+- name: download pam-tester
+  get_url:
+    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
+    dest: /bin/pam-tester
+    mode: 0555
+
+- name: set password for test
+  set_fact:
+    test_pw: "myTest!pw"
+
+- name: set locale for test
+  set_fact:
+    locale: "en_US.UTF-8"
+  when:
+    - ansible_facts.os_family == 'RedHat'
+    - ansible_facts.distribution_major_version < '8'
+
+- name: create testuser
+  user:
+    name: testuser
+    password: "{{ test_pw | password_hash('sha512') }}"
+
+- name: check successfull login with correct password
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
+
+- name: check unsuccessfull login with incorrect password
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
+  with_sequence: count=6
+
+- name: check unsuccessfull login, with correct password (lockout)
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
+
+- name: wait for account to unlock
+  pause:
+    seconds: 20
+
+- name: check successfull login
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
@@ -63,4 +63,3 @@ scenario:
    - idempotence
    - verify
    - destroy
-
@@ -1,5 +1,6 @@
 molecule[docker]
 yamllint
+ansible
 ansible-lint
 docker
 flake8
@@ -24,7 +24,7 @@ It configures:
  collections:
    - devsec.hardening
  roles:
-    - devsec.hardening.mysql_hardening
+    - mysql_hardening
 ```

 This role expects an existing installation of MySQL or MariaDB. Please ensure that the following variables are set accordingly:
@@ -75,5 +75,8 @@ This role expects an existing installation of MySQL or MariaDB. Please ensure th
 - `mysql_remove_test_database`
  - Default: true
  - Description: remove test database
+- `mysql_hardening_restart_mysql`
+  - Default: true
+  - Description: Restart mysql after running this role

 Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
@@ -4,6 +4,8 @@ mysql_hardening_enabled: true

 mysql_daemon_enabled: true

+mysql_hardening_restart_mysql: true
+
 # general configuration
 mysql_datadir: '/var/lib/mysql'
 mysql_hardening_mysql_hardening_conf_file: '{{mysql_hardening_mysql_confd_dir}}/hardening.cnf'
@@ -1,4 +1,7 @@
 ---

 - name: restart mysql
-  service: name='{{ mysql_daemon }}' state=restarted
+  service:
+    name: '{{ mysql_daemon }}'
+    state: restarted
+  when: mysql_hardening_restart_mysql | bool
@@ -1,13 +1,26 @@
 ---
- name: set OS dependent variables
-  include_vars: '{{ item }}'
+- name: Fetch OS dependent variables
+  include_vars:
+    file: '{{ item }}'
+    name: 'os_vars'
  with_first_found:
-    - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
-    - '{{ ansible_facts.distribution }}.yml'
-    - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
-    - '{{ ansible_facts.os_family }}.yml'
+    - files:
+        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - '{{ ansible_facts.distribution }}.yml'
+        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - '{{ ansible_facts.os_family }}.yml'
+      skip: true
  tags: always

+# we only override variables with our default if they have not been specified already.
+# by default the lookup functions finds all varnames containing the string, therefore
+# we add ^ and $ to denote start and end of string, so this returns only exact maches.
+- name: Set OS dependent variables, if not already defined by user
+  set_fact:
+    '{{ item.key }}': '{{ item.value }}'
+  when: "not lookup('varnames', '^' + item.key + '$')"
+  with_dict: '{{ os_vars }}'
+
 - include: configure.yml
  when: mysql_hardening_enabled | bool
  tags:
@@ -1,11 +1,7 @@
 ---
- name: Install mysqld python libary for Ansible
-  package:
-    name: '{{ mysql_python_package }}'
-    state: present
-
- debug:
-    msg: 'WARNING - you have to change default mysql_root_password'
+- name: fail the role if the mysql root password was not set
+  fail:
+    msg: 'ERROR - you have to change default mysql_root_password'
  when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'

 - name: root password is present
@@ -43,4 +39,4 @@
    query:
      - DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1')
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
-  when: mysql_remove_remote_root
+  when: mysql_remove_remote_root
@@ -1,3 +1,6 @@
+{{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}
+
 [mysqld]
 {% if mysql_hardening_skip_show_database -%}
 skip-show-database
@@ -1,3 +1,6 @@
+{{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}
+
 [client]
 user=root
 password='{{ mysql_root_password | mandatory }}'
@@ -10,5 +10,3 @@ mysql_hardening_group: 'adm'

 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_python_package: "python3-pymysql"
@@ -5,8 +5,6 @@ mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'

 mysql_hardening_log_file: '/var/log/mariadb/mariadb.log'

-mysql_python_package: 'MySQL-python'
-
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files

@@ -4,8 +4,6 @@ mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
 mysql_hardening_log_file: '/var/log/mariadb/mariadb.log'

-mysql_python_package: 'python3-mysqlclient'
-
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files

@@ -10,5 +10,3 @@ mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files

 mysql_hardening_group: 'adm'
-
-mysql_python_package: "python-mysqldb"
@@ -10,5 +10,3 @@ mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files

 mysql_hardening_group: 'adm'
-
-mysql_python_package: "python-mysqldb"
@@ -10,5 +10,3 @@ mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files

 mysql_hardening_group: 'adm'
-
-mysql_python_package: "python3-mysqldb"
@@ -83,7 +83,7 @@ It works with the following nginx-roles, including, but not limited to:
  collections:
    - devsec.hardening
  roles:
-    - devsec.hardening.nginx_hardening
+    - nginx_hardening
 ```

 [nginx_client_body_buffer_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size
@@ -1,4 +1,5 @@
 # {{ ansible_managed|comment }}
+# Generated by Ansible role {{ ansible_role_name }}
 # Additional configuration for Nginx.

 client_header_buffer_size   {{ nginx_client_header_buffer_size }};
@@ -12,11 +12,11 @@ This role provides numerous security-related configurations, providing all-round

 It configures:

- Remove unused yum repositories and enable GPG key-checking
- Remove packages with known issues
+- Removes unused yum repositories and enables GPG key-checking
+- Removes packages with known issues
 - Configures pam for strong password checks
 - Installs and configures auditd
- Disable core dumps via soft limits
+- Disables core dumps via soft limits
 - sets a restrictive umask
 - Configures execute permissions of files in system paths
 - Hardens access to shadow and passwd files
@@ -25,7 +25,7 @@ It configures:
 - Configures secure ttys
 - Configures kernel parameters via sysctl
 - Enables selinux on EL-based systems
- Remove SUIDs and GUIDs
+- Removes SUIDs and GUIDs
 - Configures login and passwords of system accounts

 It will not:
@@ -55,6 +55,18 @@ If you're using Docker / Kubernetes+Docker you'll need to override the ipv4 ip f
      net.ipv4.ip_forward: 1
 ```

+### hidepid on RHEL/CentOS 7
+
+When having `polkit-0.112-18.el7` (and later) installed and `/proc` mounted with `hidepid=2`, everytime someone uses `systemctl` the following error is displayed, but systemctl runs successfully.
+
+```
+Error registering authentication agent: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: Cannot determine user of subject (polkit-error-quark, 0)
+```
+
+We decided to set `hidepid=0` to remove the error message, if you want to use the other proposed workaround, you have to setup the user yourself and set our option to `hidepid_option: 2` via Ansible vars.
+
+For further details see [RedHat: "GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: Cannot determine user of subject" seen when executing systemctl command](https://access.redhat.com/solutions/5005111) or [#364: hidepid=2 gives error when running systemctl on EL7](https://github.com/dev-sec/ansible-collection-hardening/issues/364)
+
 ### sysctl - vm.mmap_rnd_bits

 We are setting this sysctl to a default of `32`, some systems only support smaller values and this will generate an error. Unfortunately we cannot determine the correct applicable maximum. If you encounter this error you have to override this sysctl in your playbook.
@@ -81,55 +93,58 @@ We know that this is the case on Raspberry Pi.

 - `os_desktop_enable`
  - Default: `false`
-  - Description: true if this is a desktop system, ie Xorg, KDE/GNOME/Unity/etc
+  - Description: true if this is a desktop system, ie Xorg, KDE/GNOME/Unity/etc.
 - `os_env_extra_user_paths`
  - Default: `[]`
  - Description: add additional paths to the user's `PATH` variable (default is empty).
 - `os_env_umask`
-  - Default: `027`
-  - Description: set default permissions for new files to `750`
+  - Default: `027` or `077` depending on the platform.
+  - Description: set default permissions for new files to `750` or `700`.
 - `os_auth_pw_max_age`
  - Default: `60`
-  - Description: maximum password age (set to `99999` to effectively disable it)
+  - Description: maximum password age (set to `99999` to effectively disable it).
 - `os_auth_pw_min_age`
  - Default: `7`
-  - Description: minimum password age (before allowing any other password change)
+  - Description: minimum password age (before allowing any other password change).
 - `os_auth_retries`
  - Default: `5`
-  - Description: the maximum number of authentication attempts, before the account is locked for some time
+  - Description: the maximum number of authentication attempts, before the account is locked for some time.
 - `os_auth_lockout_time`
  - Default: `600`
-  - Description: time in seconds that needs to pass, if the account was locked due to too many failed authentication attempts
+  - Description: time in seconds that needs to pass, if the account was locked due to too many failed authentication attempts.
 - `os_auth_timeout`
  - Default: `60`
-  - Description: authentication timeout in seconds, so login will exit if this time passes
+  - Description: authentication timeout in seconds, so login will exit if this time passes.
 - `os_auth_allow_homeless`
  - Default: `false`
-  - Description: true if to allow users without home to login
+  - Description: true if to allow users without home to login.
 - `os_auth_pam_passwdqc_enable`
  - Default: `true`
-  - Description: true if you want to use strong password checking in PAM using passwdqc
+  - Description: true if you want to use strong password checking in PAM using passwdqc.
 - `os_auth_pam_passwdqc_options`
  - Default: `min=disabled,disabled,16,12,8`
-  - Description: set to any option line (as a string) that you want to pass to passwdqc
+  - Description: set to any option line (as a string) that you want to pass to passwdqc.
+- `os_auth_pam_sssd_enable`
+  - Default: `false` (on RHEL8/CentOS8/Fedora `true`)
+  - Description: activate PAM auth support for sssd
 - `os_security_users_allow`
  - Default: `[]`
  - Description: list of things, that a user is allowed to do. May contain `change_user`.
 - `os_security_kernel_enable_module_loading`
  - Default: `true`
-  - Description: true if you want to allowed to change kernel modules once the system is running (eg `modprobe`, `rmmod`)
+  - Description: true if you want to allowed to change kernel modules once the system is running (eg `modprobe`, `rmmod`).
 - `os_security_kernel_enable_core_dump`
  - Default: `false`
-  - Description: kernel is crashing or otherwise misbehaving and a kernel core dump is created
+  - Description: kernel is crashing or otherwise misbehaving and a kernel core dump is created.
 - `os_security_suid_sgid_enforce`
  - Default: `true`
-  - Description: true if you want to reduce SUID/SGID bits. There is already a list of items which are searched for configured, but you can also add your own
+  - Description: true if you want to reduce SUID/SGID bits. There is already a list of items which are searched for configured, but you can also add your own.
 - `os_security_suid_sgid_blacklist`
  - Default: `[]`
-  - Description: a list of paths which should have their SUID/SGID bits removed
+  - Description: a list of paths which should have their SUID/SGID bits removed.
 - `os_security_suid_sgid_whitelist`
  - Default: `[]`
-  - Description: a list of paths which should not have their SUID/SGID bits altered
+  - Description: a list of paths which should not have their SUID/SGID bits altered.
 - `os_security_suid_sgid_remove_from_unknown`
  - Default: `false`
  - Description: true if you want to remove SUID/SGID bits from any file, that is not explicitly configured in a `blacklist`. This will make every Ansible-run search through the mounted filesystems looking for SUID/SGID bits that are not configured in the default and user blacklist. If it finds an SUID/SGID bit, it will be removed, unless this file is in your `whitelist`.
@@ -144,27 +159,30 @@ We know that this is the case on Raspberry Pi.
  - Description: Set the SELinux polixy.
 - `ufw_manage_defaults`
  - Default: `true`
-  - Description: true means apply all settings with `ufw_` prefix
+  - Description: true means apply all settings with `ufw_` prefix.
 - `ufw_ipt_sysctl`
  - Default: `''`
-  - Description: by default it disables IPT_SYSCTL in /etc/default/ufw. If you want to overwrite /etc/sysctl.conf values using ufw - set it to your sysctl dictionary, for example `/etc/ufw/sysctl.conf`
+  - Description: by default it disables IPT_SYSCTL in /etc/default/ufw. If you want to overwrite /etc/sysctl.conf values using ufw - set it to your sysctl dictionary, for example `/etc/ufw/sysctl.conf`.
 - `ufw_default_input_policy`
  - Default: `DROP`
-  - Description: set default input policy of ufw to `DROP`
+  - Description: set default input policy of ufw to `DROP`.
 - `ufw_default_output_policy`
  - Default: `ACCEPT`
-  - Description: set default output policy of ufw to `ACCEPT`
+  - Description: set default output policy of ufw to `ACCEPT`.
 - `ufw_default_forward_policy`
  - Default: `DROP`
-  - Description: set default forward policy of ufw to `DROP`
+  - Description: set default forward policy of ufw to `DROP`.
 - `os_auditd_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring auditd.
 - `os_auditd_max_log_file_action`
  - Default: `keep_logs`
  - Description: Defines the behaviour of auditd when its log file is filled up. Possible other values are described in the auditd.conf man page. The most common alternative to the default may be `rotate`.
+- `os_auditd_max_log_file`
+  - Default: `6`
+  - Description: This keyword specifies the maximum file size in megabytes. When this limit is reached, it will trigger a configurable action. The value given must be numeric.
 - `hidepid_option`
-  - Default: `2`
+  - Default: `2` (on RHEL/CentOS7 `0`, see known limitations)
  - Description: `0`: This is the default setting and gives you the default behaviour. `1`: With this option an normal user would not see other processes but their own about ps, top etc, but he is still able to see process IDs in /proc. `2`: Users are only able too see their own processes (like with hidepid=1), but also the other process IDs are hidden for them in /proc.
 - `proc_mnt_options`
  - Default: `rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}`
@@ -204,7 +222,7 @@ To prevent some of the filesystems from being disabled, add them to the `os_file
  collections:
    - devsec.hardening
  roles:
-    - devsec.hardening.os_hardening
+    - os_hardening
 ```

 ## Changing sysctl variables
@@ -217,7 +235,7 @@ So for example if you want to change the IPv4 traffic forwarding variable to `1`
  collections:
    - devsec.hardening
  roles:
-    - devsec.hardening.os_hardening
+    - os_hardening
  vars:
    sysctl_overwrite:
      # Enable IPv4 traffic forwarding.
@@ -234,6 +252,13 @@ For more information, please see this [upstream documentation](https://www.kerne

 ## More information

+We use specific PAM configuration for every linux distribution. This is a very diverse area, since every vendor seems to push their own system for managing PAM. We used following guides and sources for our configuration.
+
+- on Debian/Ubuntu we use [pam-config-framework](https://wiki.ubuntu.com/PAMConfigFrameworkSpec)
+- RHEL8 and compatible use information from [authselect](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_authentication_and_authorization_in_rhel/configuring-user-authentication-using-authselect_configuring-authentication-and-authorization-in-rhel), but our setup disables the configuration from authselect
+- RHEL 6/7 and compatible use [authconfig](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/authconfig-install), but our setup disables the configuration from authconfig
+- for RHEL 6/7 we also use information from [Desktop Security](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-hardening_your_system_with_tools_and_services#sec-Desktop_Security)
+
 This role is mostly based on guides by:

 - [Arch Linux wiki, Sysctl hardening](https://wiki.archlinux.org/index.php/Sysctl)
@@ -53,99 +53,42 @@ ufw_manage_builtins: 'no'
 ufw_ipt_modules: 'nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns'

 sysctl_config:
-  # Disable IPv4 traffic forwarding. | sysctl-01
-  net.ipv4.ip_forward: 0
+  # These settings eliminate an entire class of security vulnerabilities:
+  # time-of-check-time-of-use cross-privilege attacks using guessable
+  # filenames (generally seen as "/tmp file race" vulnerabilities).
+  fs.protected_hardlinks: 1
+  fs.protected_symlinks: 1

-  # Disable IPv6 traffic forwarding. | sysctl-19
-  net.ipv6.conf.all.forwarding: 0
+  # Prevent core dumps with SUID. These are usually only
+  # needed by developers and may contain sensitive information. | sysctl-31
+  fs.suid_dumpable: 0

-  # ignore RAs on Ipv6. | sysctl-25
-  net.ipv6.conf.all.accept_ra: 0
-  net.ipv6.conf.default.accept_ra: 0
+  # Controls whether core dumps will append the PID to the core filename
+  # Useful for debugging multi-threaded applications
+  kernel.core_uses_pid: 1

-  # Enable RFC-recommended source validation feature. | sysctl-02
-  net.ipv4.conf.all.rp_filter: 1
-  net.ipv4.conf.default.rp_filter: 1
+  # When an attacker is trying to exploit the local kernel, it is often
+  # helpful to be able to examine where in memory the kernel, modules,
+  # and data structures live. As such, kernel addresses should be treated
+  # as sensitive information.
+  #
+  # Many files and interfaces contain these addresses (e.g. /proc/kallsyms,
+  # /proc/modules, etc), and this setting can censor the addresses. A value
+  # of "0" allows all users to see the kernel addresses. A value of "1"
+  # limits visibility to the root user, and "2" blocks even the root user.
+  #
+  # Some off-the-shelf malware exploit kernel addresses exposed
+  # via /proc/kallsyms so by not making these addresses easily available
+  # we increase the cost of such attack some what; now such malware has
+  # to check which kernel Tails is running and then fetch the corresponding
+  # kernel address map from some external source. This is not hard,
+  # but certainly not all malware has such functionality. | Tails-2
+  kernel.kptr_restrict: 2

-  # Reduce the surface on SMURF attacks. | sysctl-04
-  # Make sure to ignore ECHO broadcasts, which are only required in broad network analysis.
-  net.ipv4.icmp_echo_ignore_broadcasts: 1
+  # kexec is dangerous: it enables replacement of the running kernel. | Tails-3
+  kernel.kexec_load_disabled: 1

-  # There is no reason to accept bogus error responses from ICMP, so ignore them instead. | sysctl-03
-  net.ipv4.icmp_ignore_bogus_error_responses: 1
-
-  # Limit the amount of traffic the system uses for ICMP. | sysctl-05
-  net.ipv4.icmp_ratelimit: 100
-
-  # Adjust the ICMP ratelimit to include ping, dst unreachable,
-  # source quench, ime exceed, param problem, timestamp reply, information reply | sysctl-06
-  net.ipv4.icmp_ratemask: 88089
-
-  # Disable IPv6 | sysctl-18
-  net.ipv6.conf.all.disable_ipv6: 1
-
-  # Protect against wrapping sequence numbers at gigabit speeds | sysctl-07
-  net.ipv4.tcp_timestamps: 0
-
-  # Define restriction level for announcing the local source IP | sysctl-08
-  net.ipv4.conf.all.arp_ignore: 1
-
-  # Define mode for sending replies in response to
-  # received ARP requests that resolve local target IP addresses | sysctl-09
-  net.ipv4.conf.all.arp_announce: 2
-
-  # RFC 1337 fix F1 | sysctl-10
-  net.ipv4.tcp_rfc1337: 1
-
-  # Send(router) or accept(host) RFC1620 shared media redirects | sysctl-12
-  net.ipv4.conf.all.shared_media: 1
-  net.ipv4.conf.default.shared_media: 1
-
-  # Accepting source route can lead to malicious networking behavior,
-  # so disable it if not needed. | sysctl-13
-  net.ipv4.conf.all.accept_source_route: 0
-  net.ipv4.conf.default.accept_source_route: 0
-
-  # Accepting redirects can lead to malicious networking behavior, so disable
-  # it if not needed. | sysctl-13 | sysctl-14 | sysctl-15 | sysctl-20
-  net.ipv4.conf.default.accept_redirects: 0
-  net.ipv4.conf.all.accept_redirects: 0
-  net.ipv4.conf.all.secure_redirects: 0
-  net.ipv4.conf.default.secure_redirects: 0
-  net.ipv6.conf.default.accept_redirects: 0
-  net.ipv6.conf.all.accept_redirects: 0
-
-  # For non-routers: don't send redirects, these settings are 0 | sysctl-16
-  net.ipv4.conf.all.send_redirects: 0
-  net.ipv4.conf.default.send_redirects: 0
-
-  # log martian packets | sysctl-17
-  net.ipv4.conf.all.log_martians: 1
-  net.ipv4.conf.default.log_martians: 1
-
-  # ipv6 config
-  # Disable acceptance of IPv6 router solicitations messages | sysctl-21
-  net.ipv6.conf.default.router_solicitations: 0
-
-  # Disable Accept Router Preference from router advertisement | sysctl-22
-  net.ipv6.conf.default.accept_ra_rtr_pref: 0
-
-  # Disable learning Prefix Information from router advertisement | sysctl-23
-  net.ipv6.conf.default.accept_ra_pinfo: 0
-
-  # Disable learning Hop limit from router advertisement | sysctl-24
-  net.ipv6.conf.default.accept_ra_defrtr: 0
-
-  # Disable IPv6 autoconfiguration | sysctl-26
-  net.ipv6.conf.default.autoconf: 0
-
-  # Disable neighbor solicitations to send out per address | sysctl-27
-  net.ipv6.conf.default.dad_transmits: 0
-
-  # Assign one global unicast IPv6 addresses to each interface | sysctl-28
-  net.ipv6.conf.default.max_addresses: 1
-
-  # This settings controls how the kernel behaves towards module changes at
+  # This setting controls how the kernel behaves towards module changes at
  # runtime. Setting to 1 will disable module loading at runtime.
  # Setting it to 0 is actually never supported. | sysctl-29
  # kernel.modules_disabled: 1
@@ -167,15 +110,9 @@ sysctl_config:
  # * **256** - nicing of all RT tasks
  kernel.sysrq: 0

-  # Prevent core dumps with SUID. These are usually only
-  # needed by developers and may contain sensitive information. | sysctl-31
-  fs.suid_dumpable: 0
-
  # Virtual memory regions protection | sysctl-32
  kernel.randomize_va_space: 2

-  kernel.core_uses_pid: 1
-
  # The PTRACE system is used for debugging.  With it, a single user process
  # can attach to any other dumpable process owned by the same user.  In the
  # case of malicious software, it is possible to use PTRACE to access
@@ -200,6 +137,105 @@ sysctl_config:
  # kernel.yama.ptrace_scope = 1
  kernel.yama.ptrace_scope: 1

+  # Disable IPv4 traffic forwarding. | sysctl-01
+  net.ipv4.ip_forward: 0
+
+  # Enable RFC-recommended source validation feature. | sysctl-02
+  net.ipv4.conf.all.rp_filter: 1
+  net.ipv4.conf.default.rp_filter: 1
+
+  # Reduce the surface on SMURF attacks. | sysctl-04
+  # Make sure to ignore ECHO broadcasts, which are only required in broad network analysis.
+  net.ipv4.icmp_echo_ignore_broadcasts: 1
+
+  # There is no reason to accept bogus error responses from ICMP, so ignore them instead. | sysctl-03
+  net.ipv4.icmp_ignore_bogus_error_responses: 1
+
+  # Limit the amount of traffic the system uses for ICMP. | sysctl-05
+  net.ipv4.icmp_ratelimit: 100
+
+  # Adjust the ICMP ratelimit to include ping, dst unreachable,
+  # source quench, ime exceed, param problem, timestamp reply, information reply | sysctl-06
+  net.ipv4.icmp_ratemask: 88089
+
+  # Protect against wrapping sequence numbers at gigabit speeds | sysctl-07
+  net.ipv4.tcp_timestamps: 0
+
+  # Define restriction level for announcing the local source IP | sysctl-08
+  net.ipv4.conf.all.arp_ignore: 1
+
+  # Define mode for sending replies in response to
+  # received ARP requests that resolve local target IP addresses | sysctl-09
+  net.ipv4.conf.all.arp_announce: 2
+
+  # RFC 1337 fix F1 | sysctl-10
+  net.ipv4.tcp_rfc1337: 1
+
+  # Attackers use SYN flood attacks to perform a denial of service attack on a system
+  # by sending many SYN packets without completing the three way handshake.
+  # This will quickly use up slots in the kernel's half-open connection queue and
+  # prevent legitimate connections from succeeding.
+  # SYN cookies allow the system to keep accepting valid connections, even if
+  # under a denial of service attack. CIS Distro Independent 3.2.8.
+  net.ipv4.tcp_syncookies: 1
+
+  # Send(router) or accept(host) RFC1620 shared media redirects | sysctl-12
+  net.ipv4.conf.all.shared_media: 1
+  net.ipv4.conf.default.shared_media: 1
+
+  # Accepting source route can lead to malicious networking behavior,
+  # so disable it if not needed. | sysctl-13
+  net.ipv4.conf.all.accept_source_route: 0
+  net.ipv4.conf.default.accept_source_route: 0
+
+  # For non-routers: don't send redirects, these settings are 0 | sysctl-16
+  net.ipv4.conf.all.send_redirects: 0
+  net.ipv4.conf.default.send_redirects: 0
+
+  # log martian packets | sysctl-17
+  net.ipv4.conf.all.log_martians: 1
+  net.ipv4.conf.default.log_martians: 1
+
+  # Accepting redirects can lead to malicious networking behavior, so disable
+  # it if not needed. | sysctl-13 | sysctl-14 | sysctl-15 | sysctl-20
+  net.ipv4.conf.default.accept_redirects: 0
+  net.ipv4.conf.all.accept_redirects: 0
+  net.ipv4.conf.all.secure_redirects: 0
+  net.ipv4.conf.default.secure_redirects: 0
+  net.ipv6.conf.default.accept_redirects: 0
+  net.ipv6.conf.all.accept_redirects: 0
+
+  # Disable IPv6 | sysctl-18
+  net.ipv6.conf.all.disable_ipv6: 1
+
+  # Disable IPv6 traffic forwarding. | sysctl-19
+  net.ipv6.conf.all.forwarding: 0
+
+  # ignore RAs on Ipv6. | sysctl-25
+  net.ipv6.conf.all.accept_ra: 0
+  net.ipv6.conf.default.accept_ra: 0
+
+  # Disable acceptance of IPv6 router solicitations messages | sysctl-21
+  net.ipv6.conf.default.router_solicitations: 0
+
+  # Disable Accept Router Preference from router advertisement | sysctl-22
+  net.ipv6.conf.default.accept_ra_rtr_pref: 0
+
+  # Disable learning Prefix Information from router advertisement | sysctl-23
+  net.ipv6.conf.default.accept_ra_pinfo: 0
+
+  # Disable learning Hop limit from router advertisement | sysctl-24
+  net.ipv6.conf.default.accept_ra_defrtr: 0
+
+  # Disable IPv6 autoconfiguration | sysctl-26
+  net.ipv6.conf.default.autoconf: 0
+
+  # Disable neighbor solicitations to send out per address | sysctl-27
+  net.ipv6.conf.default.dad_transmits: 0
+
+  # Assign one global unicast IPv6 addresses to each interface | sysctl-28
+  net.ipv6.conf.default.max_addresses: 1
+
  # Protect the zero page of memory from userspace mmap to prevent kernel
  # NULL-dereference attacks against potential future kernel security
  # vulnerabilities.  (Added in kernel 2.6.23.)
@@ -210,39 +246,12 @@ sysctl_config:
  # is reset to the secure default each time the sysctl values are loaded.
  vm.mmap_min_addr: 65536

-  # These settings eliminate an entire class of security vulnerability:
-  # time-of-check-time-of-use cross-privilege attacks using guessable
-  # filenames (generally seen as "/tmp file race" vulnerabilities).
-  fs.protected_hardlinks: 1
-  fs.protected_symlinks: 1
-
  # These settings are set to the maximum supported value in order to
  # improve ASLR effectiveness for mmap, at the cost of increased
  # address-space fragmentation. | Tail-1
  vm.mmap_rnd_bits: 32
  vm.mmap_rnd_compat_bits: 16

-  # When an attacker is trying to exploit the local kernel, it is often
-  # helpful to be able to examine where in memory the kernel, modules,
-  # and data structures live. As such, kernel addresses should be treated
-  # as sensitive information.
-  #
-  # Many files and interfaces contain these addresses (e.g. /proc/kallsyms,
-  # /proc/modules, etc), and this setting can censor the addresses. A value
-  # of "0" allows all users to see the kernel addresses. A value of "1"
-  # limits visibility to the root user, and "2" blocks even the root user.
-  #
-  # Some off-the-shelf malware exploit kernel addresses exposed
-  # via /proc/kallsyms so by not making these addresses easily available
-  # we increase the cost of such attack some what; now such malware has
-  # to check which kernel Tails is running and then fetch the corresponding
-  # kernel address map from some external source. This is not hard,
-  # but certainly not all malware has such functionality. | Tails-2
-  kernel.kptr_restrict: 2
-
-  # kexec is dangerous: it enables replacement of the running kernel. | Tails-3
-  kernel.kexec_load_disabled: 1
-
 # Do not delete the following line or otherwise the playbook will fail
 # at task 'create a combined sysctl-dict if overwrites are defined'
 sysctl_overwrite:
@@ -259,10 +268,10 @@ os_unused_filesystems:
  - "vfat"
  # Obsolete network protocols that should be disabled
  # per CIS Oracle Linux 6 Benchmark (2016)
-  - "tipc"  # CIS 3.5.4
-  - "sctp"  # CIS 3.5.2
  - "dccp"  # CIS 3.5.1
  - "rds"   # CIS 3.5.3
+  - "sctp"  # CIS 3.5.2
+  - "tipc"  # CIS 3.5.4

 # whitelist for used filesystems
 os_filesystem_whitelist: []
@@ -273,6 +282,7 @@ os_hardening_enabled: true

 # Set to false to disable installing and configuring auditd.
 os_auditd_enabled: true
+os_auditd_max_log_file: 6
 os_auditd_max_log_file_action: keep_logs

 # Set the SELinux state, can be either disabled, permissive, or enforcing.
@@ -280,5 +290,4 @@ os_selinux_state: enforcing
 # Set the SELinux polixy.
 os_selinux_policy: targeted

-hidepid_option: '2'  # allowed values: 0, 1, 2
 proc_mnt_options: 'rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}'
@@ -0,0 +1,28 @@
+---
+# Granting write access to this directory for non-privileged users could provide
+# them the means for gaining unauthorized elevated privileges.
+# Granting read access to this directory could give an unprivileged user insight
+# in how to gain elevated privileges or circumvent auditing controls.
+# CIS 5.1.2 - CIS 5.1.7
+#
+- name: Find cron files and directories
+  find:
+    paths:
+      - /etc
+    patterns:
+      - cron.hourly
+      - cron.daily
+      - cron.weekly
+      - cron.monthly
+      - cron.d
+      - crontab
+    file_type: any
+  register: cron_directories
+
+- name: Ensure permissions on cron files and directories are configured
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    owner: root
+    group: root
+    mode: og-rwx
+  with_items: "{{ cron_directories.files }}"
@@ -1,22 +1,33 @@
 ---
- name: Set OS family dependent variables
-  include_vars: '{{ ansible_facts.os_family }}.yml'
-  tags: always
-
- name: Set OS dependent variables
-  include_vars: '{{ item }}'
+- name: Fetch OS dependent variables
+  include_vars:
+    file: '{{ item }}'
+    name: 'os_vars'
  with_first_found:
    - files:
-        - '{{ ansible_facts.distribution }}-{{ ansible_facts.distribution_major_version }}.yml'
+        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
        - '{{ ansible_facts.distribution }}.yml'
-        - '{{ ansible_facts.os_family }}-{{ ansible_facts.distribution_major_version }}.yml'
+        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - '{{ ansible_facts.os_family }}.yml'
      skip: true
  tags: always

+# we only override variables with our default, if they have not been specified already
+# by default the lookup functions finds all varnames containing the string, therefore
+# we add ^ and $ to denote start and end of string, so this returns only exact maches
+- name: Set OS dependent variables, if not already defined by user
+  set_fact:
+    '{{ item.key }}': '{{ item.value }}'
+  when: "not lookup('varnames', '^' + item.key + '$')"
+  with_dict: '{{ os_vars }}'
+
 - import_tasks: auditd.yml
  tags: auditd
  when: os_auditd_enabled | bool

+- import_tasks: cron.yml
+  tags: cron
+
 - import_tasks: limits.yml
  tags: limits

@@ -5,7 +5,7 @@
 # This is also the reason why there's ignore_errors: true on the task.
 # also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
 - name: find files with write-permissions for group
-  shell: "find -L {{ item }} -perm /go+w -type f"  # noqa 305
+  shell: "find -L {{ item }} -perm /go+w -type f"  # noqa command-instead-of-shell
  with_flattened:
    - '/usr/local/sbin'
    - '/usr/local/bin'
@@ -13,7 +13,7 @@
    - '/usr/bin'
    - '/sbin'
    - '/bin'
-    - "{{ os_env_extra_user_paths }}"  # noqa 104
+    - "{{ os_env_extra_user_paths }}"  # noqa deprecated-bare-vars
  register: minimize_access_directories
  ignore_errors: true
  changed_when: false
@@ -1,10 +1,10 @@
 ---
- name: update pam on Debian systems
-  command: 'pam-auth-update --package'
-  when: ansible_facts.distribution in ['Debian', 'Ubuntu']
-  changed_when: false
-  environment:
-    DEBIAN_FRONTEND: noninteractive
+- name: Gather package facts
+  package_facts:
+    manager: auto
+  when:
+    - ansible_facts.os_family != 'Suse'
+    - ansible_facts.os_family != 'Archlinux'

 # the reason for this is so a user cannot connect to a server,
 # that isn't connected to an LDAP server anymore.
@@ -17,115 +17,13 @@
  when:
    - ansible_facts.os_family != 'Archlinux'

- name: remove pam_cracklib, because it does not play nice with passwdqc
-  apt:
-    name: '{{ os_packages_pam_cracklib }}'
-    state: 'absent'
+- import_tasks: pam_debian.yml
  when:
    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - os_auth_pam_passwdqc_enable

- name: install the package for strong password checking
-  apt:
-    name: '{{ os_packages_pam_passwdqc }}'
-    state: 'present'
-    update_cache: 'yes'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - os_auth_pam_passwdqc_enable
-
- name: configure passwdqc
-  template:
-    src: 'usr/share/pam-configs/pam_passwdqd.j2'
-    dest: '{{ passwdqc_path }}'
-    mode: '0644'
-    owner: 'root'
-    group: 'root'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - os_auth_pam_passwdqc_enable
-
- name: remove passwdqc
-  apt:
-    name: '{{ os_packages_pam_passwdqc }}'
-    state: 'absent'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-
- name: install tally2
-  apt:
-    name: 'libpam-modules'
-    state: 'present'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-    - os_auth_retries > 0
-
- name: configure tally2
-  template:
-    src: 'usr/share/pam-configs/pam_tally2.j2'
-    dest: '{{ tally2_path }}'
-    mode: '0644'
-    owner: 'root'
-    group: 'root'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-    - os_auth_retries > 0
-
- name: delete tally2 when retries is 0
-  file:
-    path: '{{ tally2_path }}'
-    state: 'absent'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-    - os_auth_retries == 0
-
- name: remove pam_cracklib, because it does not play nice with passwdqc
-  yum:
-    name: '{{ os_packages_pam_cracklib }}'
-    state: 'absent'
+- import_tasks: pam_rhel.yml
  when:
    - ansible_facts.os_family == 'RedHat'
-    - ansible_facts.distribution_major_version|int is version('7', '<')
-    - ansible_facts.distribution != 'Amazon'
-    - os_auth_pam_passwdqc_enable
-
- name: install the package for strong password checking
-  yum:
-    name: '{{ os_packages_pam_passwdqc }}'
-    state: 'present'
-  when:
-    - ansible_facts.os_family == 'RedHat'
-    - ansible_facts.distribution_major_version|int is version('7', '<')
-    - ansible_facts.distribution != 'Amazon'
-    - os_auth_pam_passwdqc_enable
-
- name: remove passwdqc
-  yum:
-    name: '{{ os_packages_pam_passwdqc }}'
-    state: 'absent'
-  when:
-    - ansible_facts.os_family == 'RedHat'
-    - not os_auth_pam_passwdqc_enable
-
- name: configure passwdqc and tally via central system-auth confic
-  template:
-    src: 'etc/pam.d/rhel_system_auth.j2'
-    dest: '/etc/pam.d/system-auth-ac'
-    mode: '0640'
-    owner: 'root'
-    group: 'root'
-  when: ansible_facts.os_family == 'RedHat'
-
- name: Gather package facts
-  package_facts:
-    manager: auto
-  when:
-    - ansible_facts.os_family != 'Suse'
-    - ansible_facts.os_family != 'Archlinux'

 - name: NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
  template:
@@ -0,0 +1,120 @@
+---
+- name: install the package for strong password checking
+  apt:
+    name: 'libpam-passwdqc'
+    state: 'present'
+    update_cache: 'yes'
+  when:
+    - os_auth_pam_passwdqc_enable
+
+- name: configure passwdqc
+  template:
+    src: 'usr/share/pam-configs/pam_passwdqc.j2'
+    dest: '{{ passwdqc_path }}'
+    mode: '0644'
+    owner: 'root'
+    group: 'root'
+  when:
+    - os_auth_pam_passwdqc_enable
+
+- name: install tally2
+  apt:
+    name: 'libpam-modules'
+    state: 'present'
+  when:
+    - os_auth_retries > 0
+
+- name: manage tally on Debian stable
+  block:
+    - name: configure tally2
+      template:
+        src: 'usr/share/pam-configs/pam_tally2.j2'
+        dest: '{{ tally2_path }}'
+        mode: '0644'
+        owner: 'root'
+        group: 'root'
+      when:
+        - os_auth_retries > 0
+
+    - name: delete tally2 when retries is 0
+      file:
+        path: '{{ tally2_path }}'
+        state: 'absent'
+      when:
+        - os_auth_retries == 0
+  when:
+    - "'libpam-modules' in ansible_facts.packages"
+    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '<')"
+
+- name: manage tally/faillock on Debian unstable
+  block:
+    - name: delete tally2
+      file:
+        path: '{{ tally2_path }}'
+        state: 'absent'
+
+    - name:  create tally directory
+      file:
+        path: '/var/run/faillock'
+        state: 'directory'
+        mode: '0755'
+        owner: 'root'
+        group: 'root'
+
+    - name: configure faillock
+      template:
+        src: 'etc/security/faillock.conf.j2'
+        dest: '/etc/security/faillock.conf'
+        mode: '0644'
+        owner: 'root'
+        group: 'root'
+
+    - name: configure faillock pam
+      template:
+        src: 'usr/share/pam-configs/pam_faillock.j2'
+        dest: '/usr/share/pam-configs/faillock'
+        mode: '0644'
+        owner: 'root'
+        group: 'root'
+      when:
+        - os_auth_retries > 0
+
+    - name: configure faillock pam authfail
+      template:
+        src: 'usr/share/pam-configs/pam_faillock_authfail.j2'
+        dest: '/usr/share/pam-configs/faillock_authfail'
+        mode: '0644'
+        owner: 'root'
+        group: 'root'
+      when:
+        - os_auth_retries > 0
+
+    - name: delete faillock when retries is 0
+      file:
+        path: '/usr/share/pam-configs/faillock'
+        state: 'absent'
+      when:
+        - os_auth_retries == 0
+
+    - name: delete faillock authfail when retries is 0
+      file:
+        path: '/usr/share/pam-configs/faillock_authfail'
+        state: 'absent'
+      when:
+        - os_auth_retries == 0
+  when:
+    - "'libpam-modules' in ansible_facts.packages"
+    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '>=')"
+
+- name: update pam on Debian systems
+  command: 'pam-auth-update --package'
+  environment:
+    DEBIAN_FRONTEND: noninteractive
+  changed_when: false
+
+- name: remove passwdqc
+  apt:
+    name: 'libpam-passwdqc'
+    state: 'absent'
+  when:
+    - not os_auth_pam_passwdqc_enable
@@ -0,0 +1,43 @@
+---
+- name: install sssd-clients
+  yum:
+    name: sssd-client
+    state: 'present'
+  when:
+    - os_auth_pam_sssd_enable | bool
+
+- name: configure passwdqc and faillock via central system-auth config
+  template:
+    src: 'etc/pam.d/rhel_auth.j2'
+    dest: '/etc/pam.d/system-auth-local'
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
+
+- name: enable our config for system-auth
+  file:
+    src: /etc/pam.d/system-auth-local
+    dest: /etc/pam.d/system-auth
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
+    state: link
+    force: true
+
+- name: configure passwdqc and faillock via central password-auth config
+  template:
+    src: 'etc/pam.d/rhel_auth.j2'
+    dest: '/etc/pam.d/password-auth-local'
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
+
+- name: enable our config for password-auth
+  file:
+    src: /etc/pam.d/password-auth-local
+    dest: /etc/pam.d/password-auth
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
+    state: link
+    force: true
@@ -1,4 +1,5 @@
 {{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}

 log_file = /var/log/audit/audit.log
 log_format = RAW
@@ -11,7 +12,7 @@ disp_qos = lossy
 dispatcher = /sbin/audispd
 name_format = NONE
 ##name = mydomain
-max_log_file = 6
+max_log_file = {{ os_auditd_max_log_file }}
 max_log_file_action = {{ os_auditd_max_log_file_action }}
 space_left = 75
 space_left_action = SYSLOG
@@ -1,4 +1,5 @@
 {{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}

 # /etc/default/ufw
 #
@@ -1,4 +1,5 @@
 {{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}

 # This file contains the names of kernel modules that should be loaded at boot time, one per line. Lines beginning with "#" are ignored.
 #
@@ -20,7 +21,7 @@ salsa20-x86_64
 blowfish-x86_64
 {% endif %}

-{% if 'amd' in ansible_facts.processor %}
+{% if 'AuthenticAMD' in ansible_facts.processor %}
 # AMD-specific optimizations
 kvm-amd
 {% else %}
@@ -1,4 +1,5 @@
 {{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}

 # See libuser.conf(5) for more information. 

@@ -1,4 +1,5 @@
 {{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}

 # Configuration control definitions for the login package.
 #
@@ -1,4 +1,5 @@
 {{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}

 {% for fs in os_unused_filesystems | difference(os_filesystem_whitelist) %}
 install {{fs}} /bin/true
@@ -0,0 +1,53 @@
+{{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}
+
+#%PAM-1.0
+auth        required      pam_env.so
+auth        required      pam_faildelay.so delay=2000000
+{% if os_auth_retries > 0 %}
+auth        required      pam_faillock.so preauth silent audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
+{% endif %}
+{% if (os_auth_pam_sssd_enable | bool) %}
+auth        [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
+auth        [default=1 ignore=ignore success=ok] pam_localuser.so
+{% endif %}
+auth        sufficient    pam_unix.so nullok try_first_pass
+{% if (os_auth_pam_sssd_enable | bool) %}
+auth        [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
+auth        sufficient    pam_sss.so forward_pass
+{% endif %}
+{% if os_auth_retries > 0 %}
+auth        required      pam_faillock.so authfail audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
+{% endif %}
+auth        required      pam_deny.so
+
+{% if os_auth_retries > 0 %}
+account     required      pam_faillock.so
+{% endif %}
+account     required      pam_unix.so
+account     sufficient    pam_localuser.so
+account     sufficient    pam_succeed_if.so uid < 1000 quiet
+{% if (os_auth_pam_sssd_enable | bool) %}
+account     [default=bad success=ok user_unknown=ignore] pam_sss.so
+{% endif %}
+account     required      pam_permit.so
+
+{% if (os_auth_pam_passwdqc_enable | bool) %}
+password    required      pam_pwquality.so {{ os_auth_pam_pwquality_options }}
+{% endif %}
+# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
+# NSA 2.3.3.6 Limit Password Reuse
+password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
+{% if (os_auth_pam_sssd_enable | bool) %}
+password    sufficient    pam_sss.so use_authtok
+{% endif %}
+password    required      pam_deny.so
+
+session     optional      pam_keyinit.so revoke
+session     required      pam_limits.so
+-session    optional      pam_systemd.so
+session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+session     required      pam_unix.so
+{% if (os_auth_pam_sssd_enable | bool) %}
+session     optional      pam_sss.so
+{% endif %}
@@ -1,39 +0,0 @@
-{{ ansible_managed | comment }}
-
-#%PAM-1.0
-{% if os_auth_retries > 0 %}
-auth        required      pam_tally2.so deny={{ os_auth_retries }} onerr=fail unlock_time={{ os_auth_lockout_time }}
-{% endif %}
-auth        required      pam_env.so
-auth        sufficient    pam_unix.so nullok try_first_pass
-auth        requisite     pam_succeed_if.so uid >= 500 quiet
-auth        required      pam_deny.so
-
-{% if os_auth_retries > 0 %}
-account     required      pam_tally2.so
-{% endif %}
-account     required      pam_unix.so
-account     sufficient    pam_localuser.so
-account     sufficient    pam_succeed_if.so uid < 500 quiet
-account     required      pam_permit.so
-
-{% if (os_auth_pam_passwdqc_enable|bool) %}
-  {%- if ((ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_version|int is version('7', '>=')) or ansible_facts.distribution == 'Amazon') %}
-password    required      pam_pwquality.so {{ os_auth_pam_pwquality_options }}
-  {%- else %}
-password    requisite     pam_passwdqc.so {{ os_auth_pam_passwdqc_options }}
-  {%- endif %}
-{% else %}
-password    requisite     pam_cracklib.so try_first_pass retry=3 type=
-{% endif %}
-
-
-# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
-# NSA 2.3.3.6 Limit Password Reuse
-password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
-password    required      pam_deny.so
-
-session     optional      pam_keyinit.so revoke
-session     required      pam_limits.so
-session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
-session     required      pam_unix.so
@@ -1,4 +1,5 @@
 {{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}

 # Disable core dumps via soft limits for all users. Compliance to this setting is voluntary and can be modified by users up to a hard limit. This setting is a sane default.
 ulimit -S -c 0 > /dev/null 2>&1
@@ -1,4 +1,5 @@
 {{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}

 # A list of TTYs, from which root can log in
 # see `man securetty` for reference
@@ -0,0 +1,65 @@
+{{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}
+#
+# Configuration for locking the user after multiple failed
+# authentication attempts.
+#
+# The directory where the user files with the failure records are kept.
+# The default is /var/run/faillock.
+# dir = /var/run/faillock
+#
+# Will log the user name into the system log if the user is not found.
+# Enabled if option is present.
+# audit
+#
+# Don't print informative messages.
+# Enabled if option is present.
+# silent
+#
+# Don't log informative messages via syslog.
+# Enabled if option is present.
+# no_log_info
+#
+# Only track failed user authentications attempts for local users
+# in /etc/passwd and ignore centralized (AD, IdM, LDAP, etc.) users.
+# The `faillock` command will also no longer track user failed
+# authentication attempts. Enabling this option will prevent a
+# double-lockout scenario where a user is locked out locally and
+# in the centralized mechanism.
+# Enabled if option is present.
+# local_users_only
+#
+# Deny access if the number of consecutive authentication failures
+# for this user during the recent interval exceeds n tries.
+# The default is 3.
+deny = {{ os_auth_retries }}
+#
+# The length of the interval during which the consecutive
+# authentication failures must happen for the user account
+# lock out is <replaceable>n</replaceable> seconds.
+# The default is 900 (15 minutes).
+# fail_interval = 900
+#
+# The access will be re-enabled after n seconds after the lock out.
+# The value 0 has the same meaning as value `never` - the access
+# will not be re-enabled without resetting the faillock
+# entries by the `faillock` command.
+# The default is 600 (10 minutes).
+unlock_time = {{ os_auth_lockout_time }}
+#
+# Root account can become locked as well as regular accounts.
+# Enabled if option is present.
+even_deny_root
+#
+# This option implies the `even_deny_root` option.
+# Allow access after n seconds to root account after the
+# account is locked. In case the option is not specified
+# the value is the same as of the `unlock_time` option.
+# root_unlock_time = 900
+#
+# If a group name is specified with this option, members
+# of the group will be handled by this module the same as
+# the root account (the options `even_deny_root>` and
+# `root_unlock_time` will apply to them.
+# By default, the option is not set.
+# admin_group = <admin_group_name>
@@ -1,4 +1,5 @@
 {{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}

 # color => new RH6.0 bootup
 # verbose => old-style bootup
@@ -0,0 +1,12 @@
+{{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}
+
+Name: faillock boilerplate
+Default: yes
+Priority: 1024
+Auth-Type: Primary
+Auth:
+  required           pam_faillock.so preauth
+Account-Type: Primary
+Account:
+  required           pam_faillock.so
@@ -0,0 +1,10 @@
+{{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}
+
+Name: faillock lockout after failed attempts enforcement
+Default: yes
+Priority: 0
+Auth-Type: Primary
+Auth:
+  required           pam_faillock.so authfail
+
@@ -1,4 +1,5 @@
 {{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}

 Name: passwdqc password strength enforcement
 Default: yes
@@ -1,4 +1,5 @@
 {{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}

 Name: tally2 lockout after failed attempts enforcement
 Default: yes
@@ -1,9 +1,44 @@
 ---
+
+os_packages_pam_ccreds: 'pam_ccreds'
+os_nologin_shell_path: '/sbin/nologin'
+
+# Different distros use different standards for /etc/shadow perms, e.g.
+# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
+# You must provide key/value pairs for owner, group, and mode if overriding.
+os_shadow_perms:
+  owner: root
+  group: root
+  mode: '0000'
+
+os_passwd_perms:
+  owner: root
+  group: root
+  mode: '0644'
+
+os_env_umask: '077'
+
+os_auth_uid_min: 1000
+os_auth_gid_min: 1000
+os_auth_sys_uid_min: 201
+os_auth_sys_uid_max: 999
+os_auth_sys_gid_min: 201
+os_auth_sys_gid_max: 999
+
+os_auth_pam_sssd_enable: false
+
+# defaults for useradd
+os_useradd_mail_dir: /var/spool/mail
+os_useradd_create_home: true
+
+modprobe_package: 'module-init-tools'
+auditd_package: 'audit'
+
 # system accounts that do not get their login disabled and pasword changed
 os_always_ignore_users: ['root', 'sync', 'shutdown', 'halt', 'ec2-user']

 sysctl_rhel_config:
  # ExecShield protection against buffer overflows
  kernel.exec-shield: 1
-  # Syncookies is used to prevent SYN-flooding attacks.
-  net.ipv4.tcp_syncookies: 1
+
+hidepid_option: '2'  # allowed values: 0, 1, 2
@@ -23,3 +23,5 @@ os_auth_sys_gid_max: 999

 modprobe_package: 'kmod'
 auditd_package: 'audit'
+
+hidepid_option: '2'  # allowed values: 0, 1, 2
@@ -1,8 +1,6 @@
 ---

 os_packages_pam_ccreds: 'libpam-ccreds'
-os_packages_pam_passwdqc: 'libpam-passwdqc'
-os_packages_pam_cracklib: 'libpam-cracklib'
 os_nologin_shell_path: '/usr/sbin/nologin'

 # Different distros use different standards for /etc/shadow perms, e.g.
@@ -35,3 +33,5 @@ auditd_package: 'auditd'

 tally2_path: '/usr/share/pam-configs/tally2'
 passwdqc_path: '/usr/share/pam-configs/passwdqc'
+
+hidepid_option: '2'  # allowed values: 0, 1, 2
@@ -1,8 +1,6 @@
 ---

 os_packages_pam_ccreds: 'pam_ccreds'
-os_packages_pam_passwdqc: 'pam_passwdqc'
-os_packages_pam_cracklib: 'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'

 # Different distros use different standards for /etc/shadow perms, e.g.
@@ -27,5 +25,13 @@ os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999

+os_auth_pam_sssd_enable: true
+
+# defaults for useradd
+os_useradd_mail_dir: /var/spool/mail
+os_useradd_create_home: true
+
 modprobe_package: 'module-init-tools'
 auditd_package: 'audit'
+
+hidepid_option: '2'  # allowed values: 0, 1, 2
@@ -1,7 +0,0 @@
---
-
-sysctl_rhel_config:
-  # ExecShield protection against buffer overflows
-  kernel.exec-shield: 1
-  # Syncookies is used to prevent SYN-flooding attacks.
-  net.ipv4.tcp_syncookies: 1
@@ -1,8 +1,6 @@
 ---

 os_packages_pam_ccreds: 'pam_ccreds'
-os_packages_pam_passwdqc: 'pam_passwdqc'
-os_packages_pam_cracklib: 'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'

 # Different distros use different standards for /etc/shadow perms, e.g.
@@ -27,9 +25,13 @@ os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999

+os_auth_pam_sssd_enable: false
+
 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
 os_useradd_create_home: true

 modprobe_package: 'module-init-tools'
 auditd_package: 'audit'
+
+hidepid_option: '2'  # allowed values: 0, 1, 2
@@ -0,0 +1,37 @@
+---
+
+os_packages_pam_ccreds: 'pam_ccreds'
+os_nologin_shell_path: '/sbin/nologin'
+
+# Different distros use different standards for /etc/shadow perms, e.g.
+# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
+# You must provide key/value pairs for owner, group, and mode if overriding.
+os_shadow_perms:
+  owner: root
+  group: root
+  mode: '0000'
+
+os_passwd_perms:
+  owner: root
+  group: root
+  mode: '0644'
+
+os_env_umask: '077'
+
+os_auth_uid_min: 1000
+os_auth_gid_min: 1000
+os_auth_sys_uid_min: 201
+os_auth_sys_uid_max: 999
+os_auth_sys_gid_min: 201
+os_auth_sys_gid_max: 999
+
+os_auth_pam_sssd_enable: false
+
+# defaults for useradd
+os_useradd_mail_dir: /var/spool/mail
+os_useradd_create_home: true
+
+modprobe_package: 'module-init-tools'
+auditd_package: 'audit'
+
+hidepid_option: '0'  # allowed values: 0, 1, 2
@@ -1,8 +1,6 @@
 ---

 os_packages_pam_ccreds: 'pam_ccreds'
-os_packages_pam_passwdqc: 'pam_passwdqc'
-os_packages_pam_cracklib: 'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'

 # Different distros use different standards for /etc/shadow perms, e.g.
@@ -26,3 +24,14 @@ os_auth_sys_uid_min: 201
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
+
+os_auth_pam_sssd_enable: true
+
+# defaults for useradd
+os_useradd_mail_dir: /var/spool/mail
+os_useradd_create_home: true
+
+modprobe_package: 'module-init-tools'
+auditd_package: 'audit'
+
+hidepid_option: '2'  # allowed values: 0, 1, 2
@@ -1,8 +1,6 @@
 ---

 os_packages_pam_ccreds: 'pam_ccreds'
-os_packages_pam_passwdqc: 'pam_passwdqc'
-os_packages_pam_cracklib: 'cracklib'
 os_nologin_shell_path: '/sbin/nologin'

 # Different distros use different standards for /etc/shadow perms, e.g.
@@ -32,3 +30,5 @@ os_useradd_create_home: false

 modprobe_package: 'kmod-compat'
 auditd_package: 'audit'
+
+hidepid_option: '2'  # allowed values: 0, 1, 2
@@ -15,140 +15,149 @@ Warning: This role disables root-login on the target server! Please make sure yo
 ## Role Variables

 - `network_ipv6_enable`
-  - Default: false
+  - Default: `false`
  - Description: true if IPv6 is needed. `ssh_listen_to` must also be set to listen to IPv6 addresses (for example `[::]`).
+- `ssh_client_config_file`
+  - Default: `'/etc/ssh/ssh_config'`
+  - Description: path of the ssh client configuration file, e.g. `/etc/ssh/ssh_config.d/custom.conf`.
+- `ssh_server_config_file`
+  - Default: `'/etc/ssh/sshd_config'`
+  - Description: path of the ssh server configuration file, e.g. `/etc/ssh/sshd_config.d/custom.conf`.
 - `ssh_server_ports`
-  - Default: ['22']
-  - Description: ports on which ssh-server should listen
+  - Default: `['22']`
+  - Description: ports on which ssh-server should listen.
 - `ssh_client_port`
-  - Default: '22'
-  - Description: port to which ssh-client should connect
+  - Default: `'22'`
+  - Description: Specifies the port number to connect on the remote host.
 - `ssh_listen_to`
-  - Default: ['0.0.0.0']
+  - Default: `['0.0.0.0']`
  - Description: one or more ip addresses, to which ssh-server should listen to. Default is all IPv4 adresses, but should be configured to specific addresses for security reasons!
 - `ssh_host_key_files`
-  - Default: []
-  - Description: Host keys for sshd. If empty ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key', '/etc/ssh/ssh_host_ed25519_key'] will be used, as far as supported by the installed sshd version
+  - Default: `[]`
+  - Description: Host keys for sshd. If empty ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key', '/etc/ssh/ssh_host_ed25519_key'] will be used, as far as supported by the installed sshd version.
+- `ssh_host_rsa_key_size`
+  - Default: `4096`
+  - Description: Specifies the number of bits in the private host RSA key to create.
 - `ssh_host_key_algorithms`
-  - Default: []
-  - Description: Host key algorithms that the server offers. If empty the [default list](https://man.openbsd.org/sshd_config#HostKeyAlgorithms) will be used, otherwise overrides the setting with specified list of algorithms
+  - Default: `[]`
+  - Description: Host key algorithms that the server offers. If empty the [default list](https://man.openbsd.org/sshd_config#HostKeyAlgorithms) will be used, otherwise overrides the setting with specified list of algorithms.
 - `ssh_client_alive_interval`
-  - Default: 600
-  - Description: specifies an interval for sending keepalive messages
+  - Default: `600`
+  - Description: specifies an interval for sending keepalive messages.
 - `ssh_client_alive_count`
-  - Default: 3
-  - Description: defines how often keep-alive messages are sent
+  - Default: `3`
+  - Description: defines how often keep-alive messages are sent.
 - `ssh_permit_tunnel`
-  - Default: false
-  - Description: true if SSH Port Tunneling is required
+  - Default: `false`
+  - Description: true if SSH Port Tunneling is required.
 - `ssh_remote_hosts`
-  - Default: []
+  - Default: `[]`
  - Description: one or more hosts and their custom options for the ssh-client. Default is empty. See examples in `defaults/main.yml`.
 - `ssh_permit_root_login`
-  - Default: no
-  - Description: Disable root-login. Set to `without-password` or `yes` to enable root-login
+  - Default: `no`
+  - Description: Disable root-login. Set to `'without-password'` or `'yes'` to enable root-login - The quotes are required!
 - `ssh_allow_tcp_forwarding`
-  - Default: no
+  - Default: `no`
  - Description: `'no'` to disable TCP Forwarding. Set to `'yes'` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all'` or `'local'`. <br> _Note_: values passed to this variable must be strings, thus values `'yes'` and `'no'` should be passed with quotes.
 - `ssh_gateway_ports`
  - Default: `false`
  - Description: `false` to disable binding forwarded ports to non-loopback addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified` to allow the client to specify which address to bind to.
 - `ssh_allow_agent_forwarding`
-  - Default: false
+  - Default: `false`
  - Description: false to disable Agent Forwarding. Set to true to allow Agent Forwarding.
 - `ssh_x11_forwarding`
-  - Default: false
+  - Default: `false`
  - Description: false to disable X11 Forwarding. Set to true to allow X11 Forwarding.
 - `ssh_pam_support`
-  - Default: true
+  - Default: `true`
  - Description: true if SSH has PAM support.
 - `ssh_use_pam`
-  - Default: true
+  - Default: `true`
  - Description: false to disable pam authentication.
 - `ssh_gssapi_support`
-  - Default: false
-  - Description: true if SSH has GSSAPI support.
+  - Default: `false`
+  - Description: Set to true to enable GSSAPI authentication (both client and server).
+- `ssh_gssapi_delegation`
+  - Default: `false`
+  - Description: Set to true to enable GSSAPI credential forwarding.
 - `ssh_kerberos_support`
-  - Default: true
+  - Default: `true`
  - Description: true if SSH has Kerberos support.
 - `ssh_deny_users`
-  - Default: ''
+  - Default: `''`
  - Description: if specified, login is disallowed for user names that match one of the patterns.
 - `ssh_allow_users`
-  - Default: ''
+  - Default: `''`
  - Description: if specified, login is allowed only for user names that match one of the patterns.
 - `ssh_deny_groups`
-  - Default: ''
+  - Default: `''`
  - Description: if specified, login is disallowed for users whose primary group or supplementary group list matches one of the patterns.
 - `ssh_allow_groups`
-  - Default: ''
+  - Default: `''`
  - Description: if specified, login is allowed only for users whose primary group or supplementary group list matches one of the patterns.
 - `ssh_authorized_keys_file`
-  - Default: ''
+  - Default: `''`
  - Description: change default file that contains the public keys that can be used for user authentication.
 - `ssh_trusted_user_ca_keys_file`
-  - Default: ''
+  - Default: `''`
  - Description: specifies the file containing trusted certificate authorities public keys used to sign user certificates.
 - `ssh_trusted_user_ca_keys`
-  - Default: []
+  - Default: `[]`
  - Description: set the trusted certificate authorities public keys used to sign user certificates. Only used if `ssh_trusted_user_ca_keys_file` is set.
 - `ssh_authorized_principals_file`
-  - Default: ''
+  - Default: `''`
  - Description: specifies the file containing principals that are allowed. Only used if `ssh_trusted_user_ca_keys_file` is set.
 - `ssh_authorized_principals`
-  - Default: []
+  - Default: `[]`
  - Description: list of hashes containing file paths and authorized principals, see `default_custom.yml` for all options. Only used if `ssh_authorized_principals_file` is set.
 - `ssh_print_motd`
-  - Default: false
-  - Description: false to disable printing of the MOTD
+  - Default: `false`
+  - Description: false to disable printing of the MOTD.
 - `ssh_print_pam_motd`
-  - Default: false
-  - Description: false to disable printing of the MOTD via pam (Debian and Ubuntu)
+  - Default: `false`
+  - Description: false to disable printing of the MOTD via pam (Debian and Ubuntu).
 - `ssh_print_last_log`
-  - Default: false
-  - Description: false to disable display of last login information
+  - Default: `false`
+  - Description: false to disable display of last login information.
 - `sftp_enabled`
-  - Default: false
-  - Description: true to enable sftp configuration
+  - Default: `false`
+  - Description: true to enable sftp configuration.
 - `sftp_umask`
-  - Default: '0027'
-  - Description: Specifies the umask for sftp
+  - Default: `'0027'`
+  - Description: Specifies the umask for sftp.
 - `sftp_chroot`
-  - Default: true
-  - Description: false to disable chroot for sftp
+  - Default: `true`
+  - Description: false to disable chroot for sftp.
 - `sftp_chroot_dir`
-  - Default: /home/%u
-  - Description: change default sftp chroot location
+  - Default: `/home/%u`
+  - Description: change default sftp chroot location.
 - `ssh_client_roaming`
-  - Default: false
-  - Description: enable experimental client roaming
+  - Default: `false`
+  - Description: enable experimental client roaming.
 - `sshd_moduli_file`
-  - Default: '/etc/ssh/moduli'
-  - Description: path to the SSH moduli file
+  - Default: `'/etc/ssh/moduli'`
+  - Description: path to the SSH moduli file.
 - `sshd_moduli_minimum`
-  - Default: 2048
-  - Description: remove Diffie-Hellman parameters smaller than the defined size to mitigate logjam
+  - Default: `2048`
+  - Description: remove Diffie-Hellman parameters smaller than the defined size to mitigate logjam.
 - `ssh_challengeresponseauthentication`
-  - Default: false
-  - Description: Specifies whether challenge-response authentication is allowed (e.g. via PAM)
+  - Default: `false`
+  - Description: Specifies whether challenge-response authentication is allowed (e.g. via PAM).
 - `ssh_client_password_login`
-  - Default: false
-  - Description: `true` to allow password-based authentication with the ssh client
+  - Default: `false`
+  - Description: `true` to allow password-based authentication with the ssh client.
 - `ssh_server_password_login`
-  - Default: false
-  - Description: `true` to allow password-based authentication with the ssh server
+  - Default: `false`
+  - Description: `true` to allow password-based authentication to the ssh server. You probably also need to change `sshd_authenticationmethods` to include `password` if you set `ssh_server_password_login`: `true`.
 - `ssh_banner`
  - Default: `false`
-  - Description: `true` to print a banner on login
+  - Description: `true` to print a banner on login.
 - `ssh_banner_path`
-  - Default: '/etc/sshd/banner.txt'
-  - Description: path to the SSH banner file
+  - Default: `'/etc/sshd/banner.txt'`
+  - Description: path to the SSH banner file.
 - `ssh_client_hardening`
  - Default: `true`
-  - Description: `false` to stop harden the client
- `ssh_client_port`
-  - Default: `'22'`
-  - Description: Specifies the port number to connect on the remote host.
+  - Description: `false` to stop harden the client.
 - `ssh_client_compression`
  - Default: `false`
  - Description: Specifies whether the client requests compression.
@@ -157,7 +166,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
  - Description: Specifies whether server-side compression is enabled after the user has authenticated successfully.
 - `ssh_login_grace_time`
  - Default: `30s`
-  - Description: specifies the time allowed for successful authentication to the SSH server
+  - Description: specifies the time allowed for successful authentication to the SSH server.
 - `ssh_max_auth_retries`
  - Default: `2`
  - Description: Specifies the maximum number of authentication attempts permitted per connection.
@@ -166,76 +175,76 @@ Warning: This role disables root-login on the target server! Please make sure yo
  - Description: Specifies the maximum number of open sessions permitted from a given connection.
 - `ssh_print_debian_banner`
  - Default: `false`
-  - Description: `true` to print debian specific banner
+  - Description: `true` to print debian specific banner.
 - `ssh_server_enabled`
  - Default: `true`
-  - Description: `false` to disable the opensshd server
+  - Description: `false` to disable the opensshd server.
 - `ssh_server_hardening`
  - Default: `true`
-  - Description: `false` to stop harden the server
+  - Description: `false` to stop harden the server.
 - `ssh_server_match_address`
-  - Default: ''
+  - Default: `''`
  - Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
 - `ssh_server_match_group`
-  - Default: ''
+  - Default: `''`
  - Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
 - `ssh_server_match_user`
-  - Default: ''
+  - Default: `''`
  - Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
 - `ssh_server_match_local_port`
-  - Default: ''
+  - Default: `''`
  - Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
 - `ssh_server_permit_environment_vars`
  - Default: `no`
-  - Description: `yes` to specify that ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys are processed by sshd. With openssh version 7.8 it is possible to specify a whitelist of environment variable names in addition to global "yes" or "no" settings
+  - Description: `yes` to specify that ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys are processed by sshd. With openssh version 7.8 it is possible to specify a whitelist of environment variable names in addition to global "yes" or "no" settings.
 - `ssh_server_accept_env_vars`
-  - Default: ''
-  - Description: Specifies what environment variables sent by the client will be copied into the session's environment, multiple environment variables may be separated by whitespace
+  - Default: `''`
+  - Description: Specifies what environment variables sent by the client will be copied into the session's environment, multiple environment variables may be separated by whitespace.
 - `ssh_use_dns`
  - Default: `false`
  - Description: Specifies whether sshd should look up the remote host name, and to check that the resolved host name for the remote IP address maps back to the very same IP address.
 - `ssh_server_revoked_keys`
-  - Default: []
+  - Default: `[]`
  - Description: a list of revoked public keys that the ssh server will always reject, useful to revoke known weak or compromised keys.
 - `ssh_max_startups`
-  - Default: '10:30:100'
+  - Default: `'10:30:60'`
  - Description: Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon.
 - `ssh_macs`
-  - Default: []
-  - Description: Change this list to overwrite macs. Defaults found in `defaults/main.yml`
+  - Default: `[]`
+  - Description: Change this list to overwrite macs. Defaults found in `defaults/main.yml`.
 - `ssh_kex`
-  - Default: []
-  - Description: Change this list to overwrite kexs. Defaults found in `defaults/main.yml`
+  - Default: `[]`
+  - Description: Change this list to overwrite kexs. Defaults found in `defaults/main.yml`.
 - `ssh_ciphers`
-  - Default: []
-  - Description: Change this list to overwrite ciphers. Defaults found in `defaults/main.yml`
+  - Default: `[]`
+  - Description: Change this list to overwrite ciphers. Defaults found in `defaults/main.yml`.
 - `ssh_custom_options`
-  - Default: []
-  - Description: Custom lines for SSH client configuration
+  - Default: `[]`
+  - Description: Custom lines for SSH client configuration.
 - `sshd_custom_options`
-  - Default: []
-  - Description: Custom lines for SSH daemon configuration
+  - Default: `[]`
+  - Description: Custom lines for SSH daemon configuration.
 - `sshd_syslog_facility`
-  - Default: 'AUTH'
-  - Description: The facility code that is used when logging messages from sshd
+  - Default: `'AUTH'`
+  - Description: The facility code that is used when logging messages from sshd.
 - `sshd_log_level`
-  - Default: 'VERBOSE'
-  - Description: the verbosity level that is used when logging messages from sshd
+  - Default: `'VERBOSE'`
+  - Description: the verbosity level that is used when logging messages from sshd.
 - `sshd_strict_modes`
-  - Default: true
-  - Description: Check file modes and ownership of the user's files and home directory before accepting login
+  - Default: `true`
+  - Description: Check file modes and ownership of the user's files and home directory before accepting login.
 - `sshd_authenticationmethods`
  - Default: `publickey`
-  - Description: Specifies the authentication methods that must be successfully completed for a user to be granted access. Make sure to set all required variables for your selected authentication method. Defaults found in `defaults/main.yml`
+  - Description: Specifies the authentication methods that must be successfully completed for a user to be granted access. Make sure to set all required variables for your selected authentication method. Defaults found in `defaults/main.yml`.

 ## Example Playbook

-```
+```yml
 - hosts: localhost
  collections:
    - devsec.hardening
  roles:
-    - devsec.hardening.ssh_hardening
+    - ssh_hardening
 ```

 ## Configuring settings not listed in role-variables
@@ -244,12 +253,12 @@ If you want to configure ssh options that are not listed above, you can use `ssh

 Example playbook:

-```
+```yml
 - hosts: localhost
  collections:
    - devsec.hardening
  roles:
-    - devsec.hardening.ssh_hardening
+    - ssh_hardening
  vars:
    ssh_custom_options:
      - "Include /etc/ssh/ssh_config.d/*"
@@ -2,6 +2,10 @@
 # true if IPv6 is needed
 network_ipv6_enable: false          # sshd + ssh

+# Paths of the config files
+ssh_client_config_file: /etc/ssh/ssh_config   # ssh
+ssh_server_config_file: /etc/ssh/sshd_config  # sshd
+
 # true if sshd should be started and enabled
 ssh_server_enabled: true            # sshd

@@ -32,6 +36,12 @@ ssh_listen_to: ['0.0.0.0']          # sshd
 # Host keys to look for when starting sshd.
 ssh_host_key_files: []              # sshd

+# Host RSA key size in bits
+ssh_host_rsa_key_size: 4096         # sshd
+
+# Host certificates to look for when starting sshd.
+ssh_host_certificates: []           # sshd
+
 # Specifies the host key algorithms that the server offers
 ssh_host_key_algorithms: []         # sshd

@@ -75,20 +85,17 @@ ssh_allow_agent_forwarding: false   # sshd
 # false to disable X11 Forwarding. Set to true to allow X11 Forwarding.
 ssh_x11_forwarding: false   # sshd

-# true if SSH has PAM support
-ssh_pam_support: true
-
 # false to disable pam authentication.
 ssh_use_pam: true                   # sshd

 # specify AuthenticationMethods
 sshd_authenticationmethods: 'publickey'

-# true if SSH support GSSAPI
+# Set to true to enable GSSAPI authentication (both client and server)
 ssh_gssapi_support: false

-# true if SSH support Kerberos
-ssh_kerberos_support: true
+# Set to true to enable GSSAPI credential forwarding
+ssh_gssapi_delegation: false

 # if specified, login is disallowed for user names that match one of the patterns.
 ssh_deny_users: ''                  # sshd
@@ -179,7 +186,7 @@ ssh_server_permit_environment_vars: 'no'
 ssh_server_accept_env_vars: ''

 # maximum number of concurrent unauthenticated connections to the SSH daemon
-ssh_max_startups: '10:30:100'       # sshd
+ssh_max_startups: '10:30:60'       # sshd

 ssh_ps53: 'yes'
 ssh_ps59: 'sandbox'
@@ -188,62 +195,9 @@ ssh_macs: []
 ssh_ciphers: []
 ssh_kex: []

-ssh_macs_53_default:
-  - hmac-ripemd160
-  - hmac-sha1
-
-ssh_macs_53_el_6_5_default:
-  - hmac-sha2-512
-  - hmac-sha2-256
-
-ssh_macs_59_default:
-  - hmac-sha2-512
-  - hmac-sha2-256
-  - hmac-ripemd160
-
-ssh_macs_66_default:
-  - [email protected]
-  - [email protected]
-  - [email protected]
-  - hmac-sha2-512
-  - hmac-sha2-256
-
-ssh_macs_76_default:
-  - [email protected]
-  - [email protected]
-  - [email protected]
-  - hmac-sha2-512
-  - hmac-sha2-256
-
-ssh_ciphers_53_default:
-  - aes256-ctr
-  - aes192-ctr
-  - aes128-ctr
-
-ssh_ciphers_66_default:
-  - [email protected]
-  - [email protected]
-  - [email protected]
-  - aes256-ctr
-  - aes192-ctr
-  - aes128-ctr
-
-ssh_kex_59_default:
-  - diffie-hellman-group-exchange-sha256
-
-ssh_kex_66_default:
-  - [email protected]
-  - diffie-hellman-group-exchange-sha256
-
-ssh_kex_80_default:
-  - [email protected]
-  - [email protected]
-  - diffie-hellman-group-exchange-sha256
-
 # directory where to store ssh_password policy
 ssh_custom_selinux_dir: '/etc/selinux/local-policies'

-sshd_moduli_file: '/etc/ssh/moduli'
 sshd_moduli_minimum: 2048

 # disable ChallengeResponseAuthentication
@@ -267,7 +221,3 @@ sshd_syslog_facility: 'AUTH'
 sshd_log_level: 'VERBOSE'

 sshd_strict_modes: true
-
-# disable CRYPTO_POLICY to take settings from sshd configuration
-# see: https://access.redhat.com/solutions/4410591
-sshd_disable_crypto_policy: true
@@ -1,4 +1,23 @@
 ---
+- name: replace default 2048 bits RSA keypair
+  community.crypto.openssh_keypair:
+    state: present
+    type: rsa
+    size: "{{ ssh_host_rsa_key_size }}"
+    path: "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
+    force: false
+    regenerate: partial_idempotence
+
+# In RHEL and Fedora, the 'ssh_keys' group is the group owner of the host private SSH keys.
+# Since the openssh_keypair module needs to read the key to provide idempotency, we need to set ownership and group based on specific OS vars.
+- name: change host private key ownership, group and permissions
+  file:
+    path: "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
+    owner: "{{ ssh_host_keys_owner }}"
+    group: "{{ ssh_host_keys_group }}"
+    mode: "0640"
+  when: "ansible_facts.distribution in ['CentOS', 'OracleLinux', 'RedHat']"
+
 - name: set hostkeys according to openssh-version if openssh >= 5.3
  set_fact:
    ssh_host_key_files:
@@ -1,11 +1,25 @@
 ---
- name: set OS dependent variables
-  include_vars: '{{ item }}'
+- name: Fetch OS dependent variables
+  include_vars:
+    file: '{{ item }}'
+    name: 'os_vars'
  with_first_found:
-    - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
-    - '{{ ansible_facts.distribution }}.yml'
-    - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
-    - '{{ ansible_facts.os_family }}.yml'
+    - files:
+        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - '{{ ansible_facts.distribution }}.yml'
+        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - '{{ ansible_facts.os_family }}.yml'
+      skip: true
+  tags: always
+
+# we only override variables with our default, if they have not been specified already
+# by default the lookup functions finds all varnames containing the string, therefore
+# we add ^ and $ to denote start and end of string, so this returns only exact maches
+- name: Set OS dependent variables, if not already defined by user
+  set_fact:
+    '{{ item.key }}': '{{ item.value }}'
+  when: "not lookup('varnames', '^' + item.key + '$')"
+  with_dict: '{{ os_vars }}'

 - name: get openssh-version
  command: ssh -V
@@ -19,7 +33,9 @@

 - name: set default for ssh_host_key_files if not supplied
  include_tasks: crypto_hostkeys.yml
-  when: not ssh_host_key_files
+  when:
+    - ssh_server_hardening | bool
+    - not ssh_host_key_files

 - name: set default for ssh_macs if not supplied
  include_tasks: crypto_macs.yml
@@ -46,7 +62,7 @@
 - name: create sshd_config and set permissions to root/600
  template:
    src: 'opensshd.conf.j2'
-    dest: '/etc/ssh/sshd_config'
+    dest: "{{ ssh_server_config_file }}"
    mode: '0600'
    owner: '{{ ssh_owner }}'
    group: '{{ ssh_group }}'
@@ -70,7 +86,7 @@
 - name: create ssh_config and set permissions to root/644
  template:
    src: 'openssh.conf.j2'
-    dest: '/etc/ssh/ssh_config'
+    dest: "{{ ssh_client_config_file }}"
    mode: '0644'
    owner: '{{ ssh_owner }}'
    group: '{{ ssh_group }}'
@@ -1,4 +1,5 @@
 {{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}

 {% for principal in item.principals %}
 {{ principal }}
@@ -1,8 +1,9 @@
 #jinja2: trim_blocks: "true", lstrip_blocks: "true"
 {{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}

 # This is the ssh client system-wide configuration file.
-# See ssh_config(5) for more information on any settings used. Comments will be added only to clarify why a configuration was chosen.
+# See ssh_config(5) for more information on any settings used.

 {% if ssh_custom_options %}
 # Custom configuration that overwrites default configuration
@@ -26,14 +27,14 @@ Host {{ host.names | join(' ') }}
  {{ host.options | join('\n') | indent(2) }}

 {% endfor %}
-
 # Global defaults for all Hosts
 Host *

 # The port at the destination should be defined
 Port {{ ssh_client_port }}

-# Identity file configuration. You may restrict available identity files. Otherwise ssh will search for a pattern and use any that matches.
+# Identity file configuration. You may restrict available identity files.
+# Otherwise ssh will search for a pattern and use any that matches.
 #IdentityFile ~/.ssh/identity
 #IdentityFile ~/.ssh/id_rsa
 #IdentityFile ~/.ssh/id_dsa
@@ -42,9 +43,12 @@ Port {{ ssh_client_port }}
 # Security configuration
 # ======================

-# Set the protocol version to 2 for security reasons. Disables legacy support.
+{# Support for legacy SSHv1 has been completely removed from OpenSSH in version 7.6 -#}
+{% if sshd_version is version('7.6', '<') %}
+# Set the protocol version explicitly to 2. Version 1 is obsolete and should not be used.
 Protocol 2

+{% endif %}
 # Make sure passphrase querying is enabled
 BatchMode no

@@ -54,35 +58,34 @@ CheckHostIP yes
 # Always ask before adding keys to the `known_hosts` file. Do not set to `yes`.
 StrictHostKeyChecking ask

-
 # **Ciphers** -- If your clients don't support CTR (eg older versions), cbc will be added
 # CBC: is true if you want to connect with OpenSSL-base libraries
 # eg ruby Net::SSH::Transport::CipherFactory requires cbc-versions of the given openssh ciphers to work
 # -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html)
 #
-
-{# This outputs 'Ciphers <list-of-ciphers>' if ssh_ciphers is defined or '#Ciphers' if ssh_ciphers is undefined #}
+{# This outputs 'Ciphers <list-of-ciphers>' if ssh_ciphers is defined or '#Ciphers' if ssh_ciphers is undefined -#}
 {{ 'Ciphers ' ~ ssh_ciphers|join(',') if ssh_ciphers else 'Ciphers'|comment }}

 # **Hash algorithms** -- Make sure not to use SHA1 for hashing, unless it is really necessary.
 # Weak HMAC is sometimes required if older package versions are used
 # eg Ruby's Net::SSH at around 2.2.* doesn't support sha2 for hmac, so this will have to be set true in this case.
 #
-
-{# This outputs 'MACs <list-of-macs>' if ssh_macs is defined or '#MACs' if ssh_macs is undefined #}
+{# This outputs 'MACs <list-of-macs>' if ssh_macs is defined or '#MACs' if ssh_macs is undefined -#}
 {{ 'MACs ' ~ ssh_macs|join(',') if ssh_macs else 'MACs'|comment }}

-# Alternative setting, if OpenSSH version is below v5.9
-#MACs hmac-ripemd160
-
 # **Key Exchange Algorithms** -- Make sure not to use SHA1 for kex, unless it is really necessary
 # Weak kex is sometimes required if older package versions are used
 # eg ruby's Net::SSH at around 2.2.* doesn't support sha2 for kex, so this will have to be set true in this case.
 # based on: https://bettercrypto.org/static/applied-crypto-hardening.pdf
-
+#
 {# This outputs 'KexAlgorithms <list-of-algos>' if ssh_kex is defined or '#KexAlgorithms' if ssh_kex is undefined #}
 {{ 'KexAlgorithms ' ~ ssh_kex|join(',') if ssh_kex else 'KexAlgorithms'|comment }}

+{% if sshd_version is version('5.9', '<') %}
+# Alternative setting, if OpenSSH version is below v5.9
+#MACs hmac-ripemd160
+
+{% endif %}
 # Disable agent forwarding, since local agent could be accessed through forwarded connection.
 ForwardAgent no

@@ -101,8 +104,8 @@ RSAAuthentication yes
 PasswordAuthentication {{ 'yes' if ssh_client_password_login else 'no' }}

 # Only use GSSAPIAuthentication if implemented on the network.
-GSSAPIAuthentication no
-GSSAPIDelegateCredentials no
+GSSAPIAuthentication {{ 'yes' if (ssh_gssapi_support|bool) else 'no' }}
+GSSAPIDelegateCredentials {{ 'yes' if (ssh_gssapi_delegation|bool) else 'no' }}

 # Disable tunneling
 Tunnel no
@@ -120,6 +123,7 @@ Compression {{ 'yes' if (ssh_client_compression|bool) else 'no' }}
 #VisualHostKey yes

 {% if sshd_version is version('7.1', '<=') %}
-# Disable experimental client roaming. This is known to cause potential issues with secrets being disclosed to malicious servers and defaults to being disabled.
+# Disable experimental client roaming.
+# This is known to cause potential issues with secrets being disclosed to malicious servers. Disabled by default.
 UseRoaming {{ 'yes' if ssh_client_roaming else 'no' }}
 {% endif %}
@@ -1,8 +1,9 @@
 #jinja2: trim_blocks: "true", lstrip_blocks: "true"
 {{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}

-# This is the ssh client system-wide configuration file.
-# See sshd_config(5) for more information on any settings used. Comments will be added only to clarify why a configuration was chosen.
+# This is the sshd server system-wide configuration file.
+# See sshd_config(5) for more information.

 {% if sshd_custom_options %}
 # Custom configuration that overwrites default configuration
@@ -18,7 +19,7 @@
 # Either disable or only allow root login via certificates.
 PermitRootLogin {{ ssh_permit_root_login }}

-# Define which port sshd should listen to. Default to `22`.
+# TCP port sshd should listen on. Default is 22.
 {% for port in ssh_server_ports %}
 Port {{ port }}
 {% endfor %}
@@ -26,17 +27,23 @@ Port {{ port }}
 # Address family should always be limited to the active network configuration.
 AddressFamily {{ 'any' if (network_ipv6_enable|bool) else 'inet' }}

-# Define which addresses sshd should listen to. Default to `0.0.0.0`, ie make sure you put your desired address in here, since otherwise sshd will listen to everyone.
+# Addresses sshd listens on. Default is 0.0.0.0.
+# Specify desired address here if you don't want sshd to listen on all available addresses.
 {% for address in ssh_listen_to %}
 ListenAddress {{ address }}
 {% endfor %}

-# List HostKeys here.
+# HostKeys are listed here.
 {% for key in ssh_host_key_files %}
 HostKey {{ key }}
 {% endfor %}

-# Specifies the host key algorithms that the server offers.
+# HostCertificates are listed here.
+{% for certificate in ssh_host_certificates -%}
+HostCertificate {{ certificate }}
+{% endfor %}
+
+# Host key algorithms that the server offers.
 {% if sshd_version is version('5.8', '>=') %}
 {{ "HostKeyAlgorithms " ~ ssh_host_key_algorithms|join(',') if ssh_host_key_algorithms else "HostKeyAlgorithms"|comment }}
 {% endif %}
@@ -44,9 +51,12 @@ HostKey {{ key }}
 # Security configuration
 # ======================

-# Set the protocol version to 2 for security reasons. Disables legacy support.
+{# Support for legacy SSHv1 has been completely removed from OpenSSH in version 7.6 -#}
+{% if sshd_version is version('7.6', '<') %}
+# Set the protocol version explicitly to 2. Version 1 is obsolete and should not be used.
 Protocol 2

+{% endif %}
 # Make sure sshd checks file modes and ownership before accepting logins. This prevents accidental misconfiguration.
 StrictModes {{ 'yes' if (sshd_strict_modes|bool) else 'no' }}

@@ -62,26 +72,26 @@ LogLevel {{ sshd_log_level }}
 # eg ruby Net::SSH::Transport::CipherFactory requires cbc-versions of the given openssh ciphers to work
 # -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html)
 #
-
-{# This outputs 'Ciphers <list-of-ciphers>' if ssh_ciphers is defined or '#Ciphers' if ssh_ciphers is undefined #}
+{# This outputs 'Ciphers <list-of-ciphers>' if ssh_ciphers is defined or '#Ciphers' if ssh_ciphers is undefined -#}
 {{ 'Ciphers ' ~ ssh_ciphers|join(',') if ssh_ciphers else 'Ciphers'|comment }}

-# **Hash algorithms** -- Make sure not to use SHA1 for hashing, unless it is really necessary.
+# **Hash algorithms** -- SHA-1 is formally deprecated by NIST in 2011 because of security issues.
 # Weak HMAC is sometimes required if older package versions are used
 # eg Ruby's Net::SSH at around 2.2.* doesn't support sha2 for hmac, so this will have to be set true in this case.
 #
-
-{# This outputs 'MACs <list-of-macs>' if ssh_macs is defined or '#MACs' if ssh_macs is undefined #}
+{# This outputs 'MACs <list-of-macs>' if ssh_macs is defined or '#MACs' if ssh_macs is undefined -#}
 {{ 'MACs ' ~ ssh_macs|join(',') if ssh_macs else 'MACs'|comment }}

+{% if sshd_version is version('5.9', '<') %}
 # Alternative setting, if OpenSSH version is below v5.9
 #MACs hmac-ripemd160

-# **Key Exchange Algorithms** -- Make sure not to use SHA1 for kex, unless it is really necessary
+{% endif %}
+# **Key Exchange Algorithms** -- SHA-1 is formally deprecated by NIST in 2011 because of security issues.
 # Weak kex is sometimes required if older package versions are used
 # eg ruby's Net::SSH at around 2.2.* doesn't support sha2 for kex, so this will have to be set true in this case.
 # based on: https://bettercrypto.org/static/applied-crypto-hardening.pdf
-
+#
 {# This outputs 'KexAlgorithms <list-of-algos>' if ssh_kex is defined or '#KexAlgorithms' if ssh_kex is undefined #}
 {{ 'KexAlgorithms ' ~ ssh_kex|join(',') if ssh_kex else 'KexAlgorithms'|comment }}

@@ -113,17 +123,17 @@ IgnoreRhosts yes
 IgnoreUserKnownHosts yes
 HostbasedAuthentication no

-# Enable PAM to enforce system wide rules
 {% if ssh_pam_support %}
+# Enable PAM to enforce system wide rules.
 UsePAM {{ 'yes' if (ssh_use_pam|bool) else 'no' }}
-{% endif %}

-# Set AuthenticationMethods per default to publickey
-# AuthenticationMethods was introduced in OpenSSH 6.2 - https://www.openssh.com/txt/release-6.2
+{% endif %}
+{# Set AuthenticationMethods per default to publickey -#}
+{# AuthenticationMethods was introduced in OpenSSH 6.2 - https://www.openssh.com/txt/release-6.2 -#}
 {% if sshd_version is version('6.2', '>=') %}
 AuthenticationMethods {{ sshd_authenticationmethods }}
-{% endif %}

+{% endif %}
 # Disable password-based authentication, it can allow for potentially easier brute-force attacks.
 PasswordAuthentication {{ 'yes' if (ssh_server_password_login|bool) else 'no' }}
 PermitEmptyPasswords no
@@ -141,27 +151,28 @@ KerberosTicketCleanup yes
 GSSAPIAuthentication {{ 'yes' if ssh_gssapi_support else 'no' }}
 GSSAPICleanupCredentials yes

-# In case you don't use PAM (`UsePAM no`), you can alternatively restrict users and groups here. For key-based authentication this is not necessary, since all keys must be explicitely enabled.
 {% if ssh_deny_users %}
+# In case you don't use PAM (`UsePAM no`), you can alternatively restrict users and groups here.
+# For key-based authentication this is not necessary, since all keys must be explicitely enabled.
 DenyUsers {{ ssh_deny_users }}
-{% endif %}

+{% endif %}
 {% if ssh_allow_users %}
 AllowUsers {{ ssh_allow_users }}
-{% endif %}

+{% endif %}
 {% if ssh_deny_groups %}
 DenyGroups {{ ssh_deny_groups }}
-{% endif %}

+{% endif %}
 {% if ssh_allow_groups %}
 AllowGroups {{ ssh_allow_groups }}
-{% endif %}

+{% endif %}
 {% if ssh_authorized_keys_file %}
 AuthorizedKeysFile {{ ssh_authorized_keys_file }}
-{% endif %}

+{% endif %}
 {% if ssh_trusted_user_ca_keys_file %}
 TrustedUserCAKeys {{ ssh_trusted_user_ca_keys_file }}
 {% if ssh_authorized_principals_file %}
@@ -175,7 +186,9 @@ AuthorizedPrincipalsFile {{ ssh_authorized_principals_file }}
 # Disable TCP keep alive since it is spoofable. Use ClientAlive messages instead, they use the encrypted channel
 TCPKeepAlive no

-# Manage `ClientAlive..` signals via interval and maximum count. This will periodically check up to a `..CountMax` number of times within `..Interval` timeframe, and abort the connection once these fail.
+# Manage `ClientAlive..` signals via interval and maximum count.
+# This will periodically check up to a `..CountMax` number of times within `..Interval` timeframe,
+# and abort the connection once these fail.
 ClientAliveInterval {{ ssh_client_alive_interval }}
 ClientAliveCountMax {{ ssh_client_alive_count }}

@@ -235,8 +248,8 @@ Banner {{ ssh_banner_path if (ssh_banner|bool) else 'none' }}

 {% if ansible_facts.os_family == 'Debian' %}
 DebianBanner {{ 'yes' if (ssh_print_debian_banner|bool) else 'no' }}
-{% endif %}

+{% endif %}
 # Reject keys that are explicitly blacklisted
 RevokedKeys /etc/ssh/revoked_keys

@@ -1,4 +1,5 @@
 {{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}

 {% for key in ssh_server_revoked_keys %}
 {{ key }}
@@ -1,4 +1,5 @@
 {{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}

 {% for key in ssh_trusted_user_ca_keys %}
 {{ key }}
@@ -4,6 +4,16 @@ ssh_host_keys_dir: '/etc/ssh'
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'root'
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: '/etc/ssh/moduli'

 # CRYPTO_POLICY is not supported on Archlinux
 # and the package check only works in Ansible >2.10
@@ -4,6 +4,18 @@ ssh_host_keys_dir: '/etc/ssh'
 sshd_service_name: ssh
 ssh_owner: root
 ssh_group: root
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'root'
 ssh_selinux_packages:
  - policycoreutils-python
  - checkpolicy
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: '/etc/ssh/moduli'
+
+sshd_disable_crypto_policy: false
@@ -4,6 +4,20 @@ ssh_host_keys_dir: '/etc/ssh'
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'ssh_keys'
 ssh_selinux_packages:
  - python3-policycoreutils
  - checkpolicy
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: '/etc/ssh/moduli'
+
+# disable CRYPTO_POLICY to take settings from sshd configuration
+# see: https://access.redhat.com/solutions/4410591
+sshd_disable_crypto_policy: true
@@ -4,3 +4,15 @@ ssh_host_keys_dir: '/etc/ssh'
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: wheel
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'root'
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: '/etc/ssh/moduli'
+
+sshd_disable_crypto_policy: false
@@ -4,8 +4,15 @@ ssh_host_keys_dir: '/etc/ssh'
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: wheel
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'root'

-ssh_gssapi_support: false
+# true if SSH support Kerberos
 ssh_kerberos_support: false
+
+# true if SSH has PAM support
 ssh_pam_support: false
+
 sshd_moduli_file: '/etc/moduli'
+
+sshd_disable_crypto_policy: false
@@ -1,9 +0,0 @@
---
-sshd_path: /usr/sbin/sshd
-ssh_host_keys_dir: '/etc/ssh'
-sshd_service_name: sshd
-ssh_owner: root
-ssh_group: root
-ssh_selinux_packages:
-  - policycoreutils-python
-  - checkpolicy
@@ -4,6 +4,20 @@ ssh_host_keys_dir: '/etc/ssh'
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'ssh_keys'
 ssh_selinux_packages:
  - policycoreutils-python
  - checkpolicy
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: '/etc/ssh/moduli'
+
+# disable CRYPTO_POLICY to take settings from sshd configuration
+# see: https://access.redhat.com/solutions/4410591
+sshd_disable_crypto_policy: true
@@ -4,6 +4,20 @@ ssh_host_keys_dir: '/etc/ssh'
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'ssh_keys'
 ssh_selinux_packages:
  - python3-policycoreutils
  - checkpolicy
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: '/etc/ssh/moduli'
+
+# disable CRYPTO_POLICY to take settings from sshd configuration
+# see: https://access.redhat.com/solutions/4410591
+sshd_disable_crypto_policy: true
@@ -4,5 +4,15 @@ ssh_host_keys_dir: '/var/ssh'
 sshd_service_name: ssh
 ssh_owner: root
 ssh_group: root
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'root'

+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
 ssh_pam_support: false
+
+sshd_moduli_file: '/etc/ssh/moduli'
+
+sshd_disable_crypto_policy: false
@@ -4,5 +4,15 @@ ssh_host_keys_dir: '/etc/ssh'
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'root'
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: '/etc/ssh/moduli'

 sshd_disable_crypto_policy: false
@@ -0,0 +1,52 @@
+---
+ssh_macs_53_default:
+  - hmac-ripemd160
+  - hmac-sha1
+
+ssh_macs_53_el_6_5_default:
+  - hmac-sha2-512
+  - hmac-sha2-256
+
+ssh_macs_59_default:
+  - hmac-sha2-512
+  - hmac-sha2-256
+  - hmac-ripemd160
+
+ssh_macs_66_default:
+  - [email protected]
+  - [email protected]
+  - [email protected]
+  - hmac-sha2-512
+  - hmac-sha2-256
+
+ssh_macs_76_default:
+  - [email protected]
+  - [email protected]
+  - [email protected]
+  - hmac-sha2-512
+  - hmac-sha2-256
+
+ssh_ciphers_53_default:
+  - aes256-ctr
+  - aes192-ctr
+  - aes128-ctr
+
+ssh_ciphers_66_default:
+  - [email protected]
+  - [email protected]
+  - [email protected]
+  - aes256-ctr
+  - aes192-ctr
+  - aes128-ctr
+
+ssh_kex_59_default:
+  - diffie-hellman-group-exchange-sha256
+
+ssh_kex_66_default:
+  - [email protected]
+  - diffie-hellman-group-exchange-sha256
+
+ssh_kex_80_default:
+  - [email protected]
+  - [email protected]
+  - diffie-hellman-group-exchange-sha256