Merge pull request #431 from joubbi/pwhistory

Use pam_pwhistory.so instead of pam_unix.so for remembering old passwords

.github/dependabot.yml

@@ -0,0 +1,11 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "pip" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "daily"

.github/workflows/galaxy.yml

@@ -20,6 +20,11 @@ jobs:
           api_key: ${{ secrets.GALAXY_API_KEY }}
           galaxy_version: ${{ github.event.release.tag_name }}
 
+      # checkout master instead of the release-tag so we can push the galaxy.yml
+      - uses: actions/checkout@v2
+        with:
+          ref: master
+
       - name: update galaxy.yml with new version
         uses: microsoft/variable-substitution@v1
         with:

.github/workflows/release.yml

@@ -53,19 +53,11 @@ jobs:
       # changelog gets updated but action works on old commit id
       - uses: actions/[email protected]
         with:
-          fetch-depth: 0
+          ref: master
 
       - name: Generate changelog for the release
-        uses: charmixer/auto-changelog-action@v1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          since_tag: ${{ steps.previoustag.outputs.tag }}
-          future_release: ${{ steps.version.outputs.next-version }}
-          output: CHANGELOGRELEASE.md
-          # this excludes all versions prior to the collection-release
-          # since they break the changelog generation with the error:
-          # "No common ancestor between ... and $version"
-          exclude_tags_regex: '[0-6]\.\d\.\d'
+        run: |
+          sed '/## \[${{ steps.previoustag.outputs.tag }}\]/Q' CHANGELOG.md > CHANGELOGRELEASE.md
 
       - name: Read CHANGELOG.md
         id: package

.prettierignore

@@ -0,0 +1 @@
+CHANGELOG.md

CHANGELOG.md

@@ -1,8 +1,96 @@
 # Changelog
 
-## [Unreleased](https://github.com/dev-sec/ansible-collection-hardening/tree/HEAD)
+## [7.4.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.4.0) (2021-03-23)
 
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.0.0...HEAD)
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.3.0...7.4.0)
+
+**Closed issues:**
+
+- Errors in packer build for vagrant builder [\#244](https://github.com/dev-sec/ansible-collection-hardening/issues/244)
+
+**Merged pull requests:**
+
+- Remove comments from PAM config file, but keep it in the template [\#430](https://github.com/dev-sec/ansible-collection-hardening/pull/430) ([joubbi](https://github.com/joubbi))
+- add support for using a proxy to test with molecule [\#429](https://github.com/dev-sec/ansible-collection-hardening/pull/429) ([rndmh3ro](https://github.com/rndmh3ro))
+- Harden user home dirs [\#428](https://github.com/dev-sec/ansible-collection-hardening/pull/428) ([rndmh3ro](https://github.com/rndmh3ro))
+- Improve Documentation for sysctl defaults [\#418](https://github.com/dev-sec/ansible-collection-hardening/pull/418) ([joubbi](https://github.com/joubbi))
+
+## [7.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.3.0) (2021-03-16)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.2.0...7.3.0)
+
+**Implemented enhancements:**
+
+- pam\_tally2 is deprecated in RHEL8 and pam\_faillock should be used in EL7 and EL8 instead. [\#377](https://github.com/dev-sec/ansible-collection-hardening/issues/377)
+- Replace pam\_tally2 with pam\_faillock in Redhat [\#273](https://github.com/dev-sec/ansible-collection-hardening/issues/273)
+- Extend GSSAPI configuration support to ssh\_config [\#403](https://github.com/dev-sec/ansible-collection-hardening/pull/403) ([wzzrd](https://github.com/wzzrd))
+- add restart handler variable for mysql role [\#399](https://github.com/dev-sec/ansible-collection-hardening/pull/399) ([rndmh3ro](https://github.com/rndmh3ro))
+- restructure PAM handling and update for currently supported Linux distributions [\#392](https://github.com/dev-sec/ansible-collection-hardening/pull/392) ([schurzi](https://github.com/schurzi))
+
+**Fixed bugs:**
+
+- Not able to use `sudo` command for user authenticated via ActiveDirectory [\#278](https://github.com/dev-sec/ansible-collection-hardening/issues/278)
+- You shouldn't touch /etc/pam.d/system-auth-ac in RedHat/CentOS [\#252](https://github.com/dev-sec/ansible-collection-hardening/issues/252)
+
+**Closed issues:**
+
+- Netdata monitoring of docker in docker no longer possible [\#412](https://github.com/dev-sec/ansible-collection-hardening/issues/412)
+- Unable to connect with SSH \(Permission denied \(publickey\)\) [\#411](https://github.com/dev-sec/ansible-collection-hardening/issues/411)
+- TASK \[os\_hardening : configure auditd | package-08\] [\#410](https://github.com/dev-sec/ansible-collection-hardening/issues/410)
+- Collection throws undefined ansible\_role\_name error in auditd task [\#409](https://github.com/dev-sec/ansible-collection-hardening/issues/409)
+- Ensure permissions on /etc/crontab are configured [\#375](https://github.com/dev-sec/ansible-collection-hardening/issues/375)
+- Documentation should be updated [\#361](https://github.com/dev-sec/ansible-collection-hardening/issues/361)
+
+**Merged pull requests:**
+
+- Improve Release Action [\#421](https://github.com/dev-sec/ansible-collection-hardening/pull/421) ([schurzi](https://github.com/schurzi))
+- remove FQCN from roles in examples [\#420](https://github.com/dev-sec/ansible-collection-hardening/pull/420) ([schurzi](https://github.com/schurzi))
+- Ensure permissions on /etc/crontab are configured [\#405](https://github.com/dev-sec/ansible-collection-hardening/pull/405) ([joubbi](https://github.com/joubbi))
+- remove FQCN from roles in examples [\#404](https://github.com/dev-sec/ansible-collection-hardening/pull/404) ([schurzi](https://github.com/schurzi))
+- do not install mysql python package on target host [\#401](https://github.com/dev-sec/ansible-collection-hardening/pull/401) ([rndmh3ro](https://github.com/rndmh3ro))
+- make wrong password fail task [\#400](https://github.com/dev-sec/ansible-collection-hardening/pull/400) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.2.0) (2021-02-10)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.1.1...7.2.0)
+
+**Implemented enhancements:**
+
+- Add variable to specify SSH host RSA key size [\#394](https://github.com/dev-sec/ansible-collection-hardening/pull/394) ([Normo](https://github.com/Normo))
+- Set default for ssh host key files only when hardening the server [\#393](https://github.com/dev-sec/ansible-collection-hardening/pull/393) ([Normo](https://github.com/Normo))
+
+**Fixed bugs:**
+
+- A reason why instance would go in rescue mode ?  [\#267](https://github.com/dev-sec/ansible-collection-hardening/issues/267)
+- fix galaxy action to update local galaxy.yml [\#395](https://github.com/dev-sec/ansible-collection-hardening/pull/395) ([Normo](https://github.com/Normo))
+
+**Closed issues:**
+
+- Updating version in galaxy.yml should be part of the release process [\#396](https://github.com/dev-sec/ansible-collection-hardening/issues/396)
+- ssh\_hardening fail on keypair generation  [\#388](https://github.com/dev-sec/ansible-collection-hardening/issues/388)
+- The system must display the date and time of the last successful account logon upon an SSH logon. [\#362](https://github.com/dev-sec/ansible-collection-hardening/issues/362)
+- Error in "root password is present" step [\#326](https://github.com/dev-sec/ansible-collection-hardening/issues/326)
+
+**Merged pull requests:**
+
+- update ansible-lint to version 5 [\#397](https://github.com/dev-sec/ansible-collection-hardening/pull/397) ([schurzi](https://github.com/schurzi))
+- fix minimum required ansible version in docs [\#390](https://github.com/dev-sec/ansible-collection-hardening/pull/390) ([schurzi](https://github.com/schurzi))
+
+## [7.1.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.1.1) (2021-02-05)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.1.0...7.1.1)
+
+**Fixed bugs:**
+
+- use fqcn for community.crypto.openssh\_keypair module [\#389](https://github.com/dev-sec/ansible-collection-hardening/pull/389) ([schurzi](https://github.com/schurzi))
+
+**Closed issues:**
+
+- AnsibleUndefinedVariable: 'ansible\_role\_name' is undefined with 7.1.0 [\#387](https://github.com/dev-sec/ansible-collection-hardening/issues/387)
+
+## [7.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.1.0) (2021-02-02)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.0.0...7.1.0)
 
 **Implemented enhancements:**
 
@@ -38,6 +126,7 @@
 
 **Merged pull requests:**
 
+- use version tag for changelog action [\#386](https://github.com/dev-sec/ansible-collection-hardening/pull/386) ([schurzi](https://github.com/schurzi))
 - make release workflow manually runnable [\#384](https://github.com/dev-sec/ansible-collection-hardening/pull/384) ([schurzi](https://github.com/schurzi))
 - run labeler workflow with higher privileges [\#383](https://github.com/dev-sec/ansible-collection-hardening/pull/383) ([schurzi](https://github.com/schurzi))
 - remove issue labels from changelog [\#382](https://github.com/dev-sec/ansible-collection-hardening/pull/382) ([schurzi](https://github.com/schurzi))

README.md

@@ -36,7 +36,7 @@ This role is now part of the hardening-collection. You can find the old role in
 
 ## Minimum required Ansible-version
 
-- > = 2.9.10
+- Ansible >= 2.9.10
 
 ## Included content
 
@@ -50,6 +50,12 @@ In progress, not working:
 - [apache_hardening](roles/apache_hardening/)
 - [windows_hardening](roles/windows_hardening/)
 
+## Installation
+
+Install the collection via ansible-galaxy:
+
+`ansible-galaxy collection install devsec.hardening`
+
 ## Using this collection
 
 Please refer to the examples in the readmes of the role.

galaxy.yml

@@ -1,36 +1,13 @@
-# The namespace of the collection. This can be a company/brand/organization or product namespace under which all
-# content lives. May only contain alphanumeric lowercase characters and underscores. Namespaces cannot start with
-# underscores or numbers and cannot contain consecutive underscores
 namespace: devsec
-
-# The name of the collection. Has the same character restrictions as 'namespace'
 name: hardening
-
-# The version of the collection. Must be compatible with semantic versioning
-version: 7.0.0
-
-# The path to the Markdown (.md) readme file. This path is relative to the root of the collection
+version: 7.3.0
 readme: README.md
-
-# A list of the collection's content authors. Can be just the name or in the format 'Full Name <email> (url)
-# @nicks:irc/im.site#channel'
 authors:
-- dev-sec <[email protected]>
-
-# A short summary description of the collection
-description: This collection provides battle tested hardening for Linux, SSH, nginx, MySQL
-
-# Either a single license or a list of licenses for content inside of a collection. Ansible Galaxy currently only
-# accepts L(SPDX,https://spdx.org/licenses/) licenses. This key is mutually exclusive with 'license_file'
+  - dev-sec <[email protected]>
+description: 'This collection provides battle tested hardening for Linux, SSH, nginx, MySQL'
 license:
-- GPL-2.0-or-later
-
-# The path to the license file for the collection. This path is relative to the root of the collection. This key is
-# mutually exclusive with 'license'
+  - GPL-2.0-or-later
 license_file: ''
-
-# A list of tags you want to associate with the collection for indexing/searching. A tag name has the same character
-# requirements as 'namespace' and 'name'
 tags:
   - devsec
   - hardening
@@ -40,23 +17,11 @@ tags:
   - nginx
   - mysql
   - openssh
-
-# Collections that this collection requires to be installed for it to be usable. The key of the dict is the
-# collection label 'namespace.name'. The value is a version range
-# L(specifiers,https://python-semanticversion.readthedocs.io/en/latest/#requirement-specification). Multiple version
-# range specifiers can be set and are separated by ','
-dependencies: {}
-
-# The URL of the originating SCM repository
-repository: https://github.com/dev-sec/ansible-os-hardening
-
-# The URL to the homepage of the collection/project
-homepage: https://dev-sec.io/
-
-# The URL to the collection issue tracker
-issues: https://github.com/dev-sec/ansible-os-hardening/issues
-
-# ignore files not needed for release
+dependencies:
+  community.crypto: '>=1.0.0'
+repository: 'https://github.com/dev-sec/ansible-os-hardening'
+homepage: 'https://dev-sec.io/'
+issues: 'https://github.com/dev-sec/ansible-os-hardening/issues'
 build_ignore:
   - codecov.yml
   - .github

molecule/mysql_hardening/converge.yml

@@ -2,6 +2,10 @@
 - name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
   hosts: all
   become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
       set_fact:

molecule/mysql_hardening/molecule.yml

@@ -20,6 +20,11 @@ platforms:
       container: docker
     security_opts:
       - apparmor=unconfined
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
+      container: docker
 provisioner:
   name: ansible
   config_options:

molecule/mysql_hardening/prepare.yml

@@ -3,6 +3,10 @@
 - name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
   hosts: all
   become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: Run the equivalent of "apt-get update && apt-get upgrade"
       apt:

molecule/mysql_hardening/verify.yml

@@ -2,6 +2,10 @@
 - name: Verify
   hosts: all
   become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   roles:
     - geerlingguy.git
   tasks:

molecule/nginx_hardening/converge.yml

@@ -2,6 +2,10 @@
 - name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   become: true
   hosts: all
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   vars:
     - nginx_ppa_use: true
     - nginx_ppa_version: stable

molecule/nginx_hardening/molecule.yml

@@ -21,7 +21,10 @@ platforms:
     capabilities:
       - SYS_ADMIN
     tty: true
-    environment:
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
       container: docker
 provisioner:
   name: ansible

molecule/nginx_hardening/prepare.yml

@@ -2,6 +2,10 @@
 - name: prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   become: true
   hosts: all
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: install required tools on SuSE
       zypper:

molecule/nginx_hardening/verify.yml

@@ -2,6 +2,10 @@
 - name: Verify
   hosts: all
   become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   roles:
     - geerlingguy.git
   tasks:

molecule/os_hardening/converge.yml

@@ -2,6 +2,10 @@
 - name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   collections:
     - devsec.hardening
   tasks:
@@ -15,6 +19,7 @@
     os_security_kernel_enable_core_dump: true
     os_security_suid_sgid_remove_from_unknown: true
     os_auth_pam_passwdqc_enable: false
+    os_auth_lockout_time: 15
     os_desktop_enable: true
     os_env_extra_user_paths: ['/home']
     os_auth_allow_homeless: true

molecule/os_hardening/molecule.yml

@@ -21,7 +21,10 @@ platforms:
     capabilities:
       - SYS_ADMIN
     tty: true
-    environment:
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
       container: docker
 provisioner:
   name: ansible

molecule/os_hardening/prepare.yml

@@ -4,6 +4,10 @@
   become: true
   collections:
     - devsec.hardening
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
       set_fact:

molecule/os_hardening/verify.yml

@@ -2,6 +2,10 @@
 - name: Verify
   hosts: all
   become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   roles:
     - geerlingguy.git
   tasks:
@@ -33,6 +37,10 @@
         name: procps
       when: ansible_facts.os_family == 'Debian'
 
+    - name: include PAM tests
+      include: verify_pam.yml
+      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+
     - name: download cinc-auditor
       get_url:
         url: https://omnitruck.cinc.sh/install.sh

molecule/os_hardening/verify_pam.yml

@@ -0,0 +1,59 @@
+---
+- name: download pam-tester
+  get_url:
+    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
+    dest: /bin/pam-tester
+    mode: 0555
+
+- name: set password for test
+  set_fact:
+    test_pw: "myTest!pw"
+
+- name: set locale for test
+  set_fact:
+    locale: "en_US.UTF-8"
+  when:
+    - ansible_facts.os_family == 'RedHat'
+    - ansible_facts.distribution_major_version < '8'
+
+- name: create testuser
+  user:
+    name: testuser
+    password: "{{ test_pw | password_hash('sha512') }}"
+
+- name: check successfull login with correct password
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
+
+- name: check unsuccessfull login with incorrect password
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
+  with_sequence: count=6
+
+- name: check unsuccessfull login, with correct password (lockout)
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
+
+- name: wait for account to unlock
+  pause:
+    seconds: 20
+
+- name: check successfull login
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"

molecule/ssh_hardening/converge.yml

@@ -2,6 +2,10 @@
 - name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
   become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   collections:
     - devsec.hardening
   tasks:

molecule/ssh_hardening/molecule.yml

@@ -21,7 +21,10 @@ platforms:
     capabilities:
       - SYS_ADMIN
     tty: true
-    environment:
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
       container: docker
 provisioner:
   name: ansible

molecule/ssh_hardening/prepare.yml

@@ -2,6 +2,10 @@
 - name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
   become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: use python3
       set_fact:

molecule/ssh_hardening/verify.yml

@@ -2,6 +2,10 @@
 - name: Verify
   hosts: all
   become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   roles:
     - geerlingguy.git
   tasks:

requirements.txt

@@ -1,5 +1,6 @@
 molecule[docker]
 yamllint
+ansible
 ansible-lint
 docker
 flake8

roles/mysql_hardening/README.md

@@ -24,7 +24,7 @@ It configures:
   collections:
     - devsec.hardening
   roles:
-    - devsec.hardening.mysql_hardening
+    - mysql_hardening
 ```
 
 This role expects an existing installation of MySQL or MariaDB. Please ensure that the following variables are set accordingly:
@@ -75,5 +75,8 @@ This role expects an existing installation of MySQL or MariaDB. Please ensure th
 - `mysql_remove_test_database`
   - Default: true
   - Description: remove test database
+- `mysql_hardening_restart_mysql`
+  - Default: true
+  - Description: Restart mysql after running this role
 
 Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)

roles/mysql_hardening/defaults/main.yml

@@ -4,6 +4,8 @@ mysql_hardening_enabled: true
 
 mysql_daemon_enabled: true
 
+mysql_hardening_restart_mysql: true
+
 # general configuration
 mysql_datadir: '/var/lib/mysql'
 mysql_hardening_mysql_hardening_conf_file: '{{mysql_hardening_mysql_confd_dir}}/hardening.cnf'

roles/mysql_hardening/handlers/main.yml

@@ -1,4 +1,7 @@
 ---
 
 - name: restart mysql
-  service: name='{{ mysql_daemon }}' state=restarted
+  service:
+    name: '{{ mysql_daemon }}'
+    state: restarted
+  when: mysql_hardening_restart_mysql | bool

roles/mysql_hardening/tasks/mysql_secure_installation.yml

@@ -1,11 +1,7 @@
 ---
-- name: Install mysqld python libary for Ansible
-  package:
-    name: '{{ mysql_python_package }}'
-    state: present
-
-- debug:
-    msg: 'WARNING - you have to change default mysql_root_password'
+- name: fail the role if the mysql root password was not set
+  fail:
+    msg: 'ERROR - you have to change default mysql_root_password'
   when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'
 
 - name: root password is present

roles/mysql_hardening/vars/Debian.yml

@@ -10,5 +10,3 @@ mysql_hardening_group: 'adm'
 
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_python_package: "python3-pymysql"

roles/mysql_hardening/vars/RedHat_7.yml

@@ -5,8 +5,6 @@ mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
 
 mysql_hardening_log_file: '/var/log/mariadb/mariadb.log'
 
-mysql_python_package: 'MySQL-python'
-
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
 

roles/mysql_hardening/vars/RedHat_8.yml

@@ -4,8 +4,6 @@ mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
 mysql_hardening_log_file: '/var/log/mariadb/mariadb.log'
 
-mysql_python_package: 'python3-mysqlclient'
-
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
 

roles/mysql_hardening/vars/Ubuntu_16.yml

@@ -10,5 +10,3 @@ mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
 
 mysql_hardening_group: 'adm'
-
-mysql_python_package: "python-mysqldb"

roles/mysql_hardening/vars/Ubuntu_18.yml

@@ -10,5 +10,3 @@ mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
 
 mysql_hardening_group: 'adm'
-
-mysql_python_package: "python-mysqldb"

roles/mysql_hardening/vars/Ubuntu_20.yml

@@ -10,5 +10,3 @@ mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
 
 mysql_hardening_group: 'adm'
-
-mysql_python_package: "python3-mysqldb"

roles/nginx_hardening/README.md

@@ -83,7 +83,7 @@ It works with the following nginx-roles, including, but not limited to:
   collections:
     - devsec.hardening
   roles:
-    - devsec.hardening.nginx_hardening
+    - nginx_hardening
 ```
 
 [nginx_client_body_buffer_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size

roles/os_hardening/README.md

@@ -124,6 +124,9 @@ We know that this is the case on Raspberry Pi.
 - `os_auth_pam_passwdqc_options`
   - Default: `min=disabled,disabled,16,12,8`
   - Description: set to any option line (as a string) that you want to pass to passwdqc.
+- `os_auth_pam_sssd_enable`
+  - Default: `false` (on RHEL8/CentOS8/Fedora `true`)
+  - Description: activate PAM auth support for sssd
 - `os_security_users_allow`
   - Default: `[]`
   - Description: list of things, that a user is allowed to do. May contain `change_user`.
@@ -184,6 +187,9 @@ We know that this is the case on Raspberry Pi.
 - `proc_mnt_options`
   - Default: `rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}`
   - Description: Mount proc with hardenized options, including `hidepid` with variable value.
+- `os_ignore_home_folder_users`
+  - Default: `lost+found`
+  - Description: specify user home folders in `/home` that shouldn't be chmodded to 700
 
 ## Packages
 
@@ -219,7 +225,7 @@ To prevent some of the filesystems from being disabled, add them to the `os_file
   collections:
     - devsec.hardening
   roles:
-    - devsec.hardening.os_hardening
+    - os_hardening
 ```
 
 ## Changing sysctl variables
@@ -232,7 +238,7 @@ So for example if you want to change the IPv4 traffic forwarding variable to `1`
   collections:
     - devsec.hardening
   roles:
-    - devsec.hardening.os_hardening
+    - os_hardening
   vars:
     sysctl_overwrite:
       # Enable IPv4 traffic forwarding.
@@ -249,6 +255,13 @@ For more information, please see this [upstream documentation](https://www.kerne
 
 ## More information
 
+We use specific PAM configuration for every linux distribution. This is a very diverse area, since every vendor seems to push their own system for managing PAM. We used following guides and sources for our configuration.
+
+- on Debian/Ubuntu we use [pam-config-framework](https://wiki.ubuntu.com/PAMConfigFrameworkSpec)
+- RHEL8 and compatible use information from [authselect](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_authentication_and_authorization_in_rhel/configuring-user-authentication-using-authselect_configuring-authentication-and-authorization-in-rhel), but our setup disables the configuration from authselect
+- RHEL 6/7 and compatible use [authconfig](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/authconfig-install), but our setup disables the configuration from authconfig
+- for RHEL 6/7 we also use information from [Desktop Security](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-hardening_your_system_with_tools_and_services#sec-Desktop_Security)
+
 This role is mostly based on guides by:
 
 - [Arch Linux wiki, Sysctl hardening](https://wiki.archlinux.org/index.php/Sysctl)

roles/os_hardening/defaults/main.yml

@@ -13,8 +13,14 @@ os_auth_pam_pwquality_options: 'try_first_pass retry=3 type='  # used in RHEL7
 os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]
 
 os_chfn_restrict: ''
+
+# Set to false to disable chmod /home folders to 700
+os_chmod_home_folders: true
+
 # may contain: change_user
 os_security_users_allow: []
+# specify user home folders in /home that shouldn't be chmodded to 700
+os_ignore_home_folder_users: ['lost+found']
 # specify system accounts those login should not be disabled and password not changed
 os_ignore_users: ['vagrant', 'kitchen']
 os_security_kernel_enable_module_loading: true
@@ -137,10 +143,17 @@ sysctl_config:
   # kernel.yama.ptrace_scope = 1
   kernel.yama.ptrace_scope: 1
 
-  # Disable IPv4 traffic forwarding. | sysctl-01
+  # Disable traffic forwarding.
+  # Setting the flag to 0 ensures that a system with multiple interfaces (for example, a hard
+  # proxy), will never be able to forward packets, and therefore, never serve as a router.
+  # | sysctl-01 | sysctl-19
   net.ipv4.ip_forward: 0
+  net.ipv6.conf.all.forwarding: 0
 
-  # Enable RFC-recommended source validation feature. | sysctl-02
+  # Enable RFC-recommended source validation feature.
+  # If the return packet does not go out the same interface that the corresponding
+  # source packet came from, the packet is dropped (and logged if log_martians is set).
+  # | sysctl-02
   net.ipv4.conf.all.rp_filter: 1
   net.ipv4.conf.default.rp_filter: 1
 
@@ -148,7 +161,9 @@ sysctl_config:
   # Make sure to ignore ECHO broadcasts, which are only required in broad network analysis.
   net.ipv4.icmp_echo_ignore_broadcasts: 1
 
-  # There is no reason to accept bogus error responses from ICMP, so ignore them instead. | sysctl-03
+  # Some routers (and some attackers) will send responses that violate RFC-1122 and attempt
+  # to fill up a log file system with many useless error messages.
+  # | sysctl-03
   net.ipv4.icmp_ignore_bogus_error_responses: 1
 
   # Limit the amount of traffic the system uses for ICMP. | sysctl-05
@@ -158,7 +173,7 @@ sysctl_config:
   # source quench, ime exceed, param problem, timestamp reply, information reply | sysctl-06
   net.ipv4.icmp_ratemask: 88089
 
-  # Protect against wrapping sequence numbers at gigabit speeds | sysctl-07
+  # Disable TCP timestamps in order to not reveal system uptime. | sysctl-07
   net.ipv4.tcp_timestamps: 0
 
   # Define restriction level for announcing the local source IP | sysctl-08
@@ -188,16 +203,30 @@ sysctl_config:
   net.ipv4.conf.all.accept_source_route: 0
   net.ipv4.conf.default.accept_source_route: 0
 
-  # For non-routers: don't send redirects, these settings are 0 | sysctl-16
+  # For non-routers: don't send redirects.
+  # An attacker could use a compromised host to send invalid ICMP redirects to other
+  # router devices in an attempt to corrupt routing and have users access a system
+  # set up by the attacker as opposed to a valid system.
+  # | sysctl-16
   net.ipv4.conf.all.send_redirects: 0
   net.ipv4.conf.default.send_redirects: 0
 
-  # log martian packets | sysctl-17
+  # log martian packets
+  # This feature logs packets with un-routable source addresses to the kernel log.
+  # Enabling this feature and logging these packets allows an administrator to investigate
+  # the possibility that an attacker is sending spoofed packets to their system.
+  # | sysctl-17
   net.ipv4.conf.all.log_martians: 1
   net.ipv4.conf.default.log_martians: 1
 
   # Accepting redirects can lead to malicious networking behavior, so disable
-  # it if not needed. | sysctl-13 | sysctl-14 | sysctl-15 | sysctl-20
+  # it if not needed.
+  # Attackers could use bogus ICMP redirect messages to maliciously alter the system
+  # routing tables and get them to send packets to incorrect networks and allow
+  # your system packets to be captured.
+  # Setting net.ipv4.conf.all.secure_redirects to 0 protects the system from
+  # routing table updates by possibly compromised known gateways.
+  # | sysctl-13 | sysctl-14 | sysctl-15 | sysctl-20
   net.ipv4.conf.default.accept_redirects: 0
   net.ipv4.conf.all.accept_redirects: 0
   net.ipv4.conf.all.secure_redirects: 0
@@ -208,9 +237,6 @@ sysctl_config:
   # Disable IPv6 | sysctl-18
   net.ipv6.conf.all.disable_ipv6: 1
 
-  # Disable IPv6 traffic forwarding. | sysctl-19
-  net.ipv6.conf.all.forwarding: 0
-
   # ignore RAs on Ipv6. | sysctl-25
   net.ipv6.conf.all.accept_ra: 0
   net.ipv6.conf.default.accept_ra: 0

roles/os_hardening/tasks/cron.yml

@@ -0,0 +1,28 @@
+---
+# Granting write access to this directory for non-privileged users could provide
+# them the means for gaining unauthorized elevated privileges.
+# Granting read access to this directory could give an unprivileged user insight
+# in how to gain elevated privileges or circumvent auditing controls.
+# CIS 5.1.2 - CIS 5.1.7
+#
+- name: Find cron files and directories
+  find:
+    paths:
+      - /etc
+    patterns:
+      - cron.hourly
+      - cron.daily
+      - cron.weekly
+      - cron.monthly
+      - cron.d
+      - crontab
+    file_type: any
+  register: cron_directories
+
+- name: Ensure permissions on cron files and directories are configured
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    owner: root
+    group: root
+    mode: og-rwx
+  with_items: "{{ cron_directories.files }}"

roles/os_hardening/tasks/hardening.yml

@@ -25,6 +25,9 @@
   tags: auditd
   when: os_auditd_enabled | bool
 
+- import_tasks: cron.yml
+  tags: cron
+
 - import_tasks: limits.yml
   tags: limits
 

roles/os_hardening/tasks/minimize_access.yml

@@ -5,7 +5,7 @@
 # This is also the reason why there's ignore_errors: true on the task.
 # also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
 - name: find files with write-permissions for group
-  shell: "find -L {{ item }} -perm /go+w -type f"  # noqa 305
+  shell: "find -L {{ item }} -perm /go+w -type f"  # noqa command-instead-of-shell
   with_flattened:
     - '/usr/local/sbin'
     - '/usr/local/bin'
@@ -13,7 +13,7 @@
     - '/usr/bin'
     - '/sbin'
     - '/bin'
-    - "{{ os_env_extra_user_paths }}"  # noqa 104
+    - "{{ os_env_extra_user_paths }}"  # noqa deprecated-bare-vars
   register: minimize_access_directories
   ignore_errors: true
   changed_when: false

roles/os_hardening/tasks/pam.yml

@@ -1,10 +1,10 @@
 ---
-- name: update pam on Debian systems
-  command: 'pam-auth-update --package'
-  when: ansible_facts.distribution in ['Debian', 'Ubuntu']
-  changed_when: false
-  environment:
-    DEBIAN_FRONTEND: noninteractive
+- name: Gather package facts
+  package_facts:
+    manager: auto
+  when:
+    - ansible_facts.os_family != 'Suse'
+    - ansible_facts.os_family != 'Archlinux'
 
 # the reason for this is so a user cannot connect to a server,
 # that isn't connected to an LDAP server anymore.
@@ -17,115 +17,13 @@
   when:
     - ansible_facts.os_family != 'Archlinux'
 
-- name: remove pam_cracklib, because it does not play nice with passwdqc
-  apt:
-    name: '{{ os_packages_pam_cracklib }}'
-    state: 'absent'
+- import_tasks: pam_debian.yml
   when:
     - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - os_auth_pam_passwdqc_enable
 
-- name: install the package for strong password checking
-  apt:
-    name: '{{ os_packages_pam_passwdqc }}'
-    state: 'present'
-    update_cache: 'yes'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - os_auth_pam_passwdqc_enable
-
-- name: configure passwdqc
-  template:
-    src: 'usr/share/pam-configs/pam_passwdqd.j2'
-    dest: '{{ passwdqc_path }}'
-    mode: '0644'
-    owner: 'root'
-    group: 'root'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - os_auth_pam_passwdqc_enable
-
-- name: remove passwdqc
-  apt:
-    name: '{{ os_packages_pam_passwdqc }}'
-    state: 'absent'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-
-- name: install tally2
-  apt:
-    name: 'libpam-modules'
-    state: 'present'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-    - os_auth_retries > 0
-
-- name: configure tally2
-  template:
-    src: 'usr/share/pam-configs/pam_tally2.j2'
-    dest: '{{ tally2_path }}'
-    mode: '0644'
-    owner: 'root'
-    group: 'root'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-    - os_auth_retries > 0
-
-- name: delete tally2 when retries is 0
-  file:
-    path: '{{ tally2_path }}'
-    state: 'absent'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-    - os_auth_retries == 0
-
-- name: remove pam_cracklib, because it does not play nice with passwdqc
-  yum:
-    name: '{{ os_packages_pam_cracklib }}'
-    state: 'absent'
+- import_tasks: pam_rhel.yml
   when:
     - ansible_facts.os_family == 'RedHat'
-    - ansible_facts.distribution_major_version|int is version('7', '<')
-    - ansible_facts.distribution != 'Amazon'
-    - os_auth_pam_passwdqc_enable
-
-- name: install the package for strong password checking
-  yum:
-    name: '{{ os_packages_pam_passwdqc }}'
-    state: 'present'
-  when:
-    - ansible_facts.os_family == 'RedHat'
-    - ansible_facts.distribution_major_version|int is version('7', '<')
-    - ansible_facts.distribution != 'Amazon'
-    - os_auth_pam_passwdqc_enable
-
-- name: remove passwdqc
-  yum:
-    name: '{{ os_packages_pam_passwdqc }}'
-    state: 'absent'
-  when:
-    - ansible_facts.os_family == 'RedHat'
-    - not os_auth_pam_passwdqc_enable
-
-- name: configure passwdqc and tally via central system-auth confic
-  template:
-    src: 'etc/pam.d/rhel_system_auth.j2'
-    dest: '/etc/pam.d/system-auth-ac'
-    mode: '0640'
-    owner: 'root'
-    group: 'root'
-  when: ansible_facts.os_family == 'RedHat'
-
-- name: Gather package facts
-  package_facts:
-    manager: auto
-  when:
-    - ansible_facts.os_family != 'Suse'
-    - ansible_facts.os_family != 'Archlinux'
 
 - name: NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
   template:

roles/os_hardening/tasks/pam_debian.yml

@@ -0,0 +1,120 @@
+---
+- name: install the package for strong password checking
+  apt:
+    name: 'libpam-passwdqc'
+    state: 'present'
+    update_cache: 'yes'
+  when:
+    - os_auth_pam_passwdqc_enable
+
+- name: configure passwdqc
+  template:
+    src: 'usr/share/pam-configs/pam_passwdqc.j2'
+    dest: '{{ passwdqc_path }}'
+    mode: '0644'
+    owner: 'root'
+    group: 'root'
+  when:
+    - os_auth_pam_passwdqc_enable
+
+- name: install tally2
+  apt:
+    name: 'libpam-modules'
+    state: 'present'
+  when:
+    - os_auth_retries > 0
+
+- name: manage tally on Debian stable
+  block:
+    - name: configure tally2
+      template:
+        src: 'usr/share/pam-configs/pam_tally2.j2'
+        dest: '{{ tally2_path }}'
+        mode: '0644'
+        owner: 'root'
+        group: 'root'
+      when:
+        - os_auth_retries > 0
+
+    - name: delete tally2 when retries is 0
+      file:
+        path: '{{ tally2_path }}'
+        state: 'absent'
+      when:
+        - os_auth_retries == 0
+  when:
+    - "'libpam-modules' in ansible_facts.packages"
+    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '<')"
+
+- name: manage tally/faillock on Debian unstable
+  block:
+    - name: delete tally2
+      file:
+        path: '{{ tally2_path }}'
+        state: 'absent'
+
+    - name:  create tally directory
+      file:
+        path: '/var/run/faillock'
+        state: 'directory'
+        mode: '0755'
+        owner: 'root'
+        group: 'root'
+
+    - name: configure faillock
+      template:
+        src: 'etc/security/faillock.conf.j2'
+        dest: '/etc/security/faillock.conf'
+        mode: '0644'
+        owner: 'root'
+        group: 'root'
+
+    - name: configure faillock pam
+      template:
+        src: 'usr/share/pam-configs/pam_faillock.j2'
+        dest: '/usr/share/pam-configs/faillock'
+        mode: '0644'
+        owner: 'root'
+        group: 'root'
+      when:
+        - os_auth_retries > 0
+
+    - name: configure faillock pam authfail
+      template:
+        src: 'usr/share/pam-configs/pam_faillock_authfail.j2'
+        dest: '/usr/share/pam-configs/faillock_authfail'
+        mode: '0644'
+        owner: 'root'
+        group: 'root'
+      when:
+        - os_auth_retries > 0
+
+    - name: delete faillock when retries is 0
+      file:
+        path: '/usr/share/pam-configs/faillock'
+        state: 'absent'
+      when:
+        - os_auth_retries == 0
+
+    - name: delete faillock authfail when retries is 0
+      file:
+        path: '/usr/share/pam-configs/faillock_authfail'
+        state: 'absent'
+      when:
+        - os_auth_retries == 0
+  when:
+    - "'libpam-modules' in ansible_facts.packages"
+    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '>=')"
+
+- name: update pam on Debian systems
+  command: 'pam-auth-update --package'
+  environment:
+    DEBIAN_FRONTEND: noninteractive
+  changed_when: false
+
+- name: remove passwdqc
+  apt:
+    name: 'libpam-passwdqc'
+    state: 'absent'
+  when:
+    - not os_auth_pam_passwdqc_enable

roles/os_hardening/tasks/pam_rhel.yml

@@ -0,0 +1,43 @@
+---
+- name: install sssd-clients
+  yum:
+    name: sssd-client
+    state: 'present'
+  when:
+    - os_auth_pam_sssd_enable | bool
+
+- name: configure passwdqc and faillock via central system-auth config
+  template:
+    src: 'etc/pam.d/rhel_auth.j2'
+    dest: '/etc/pam.d/system-auth-local'
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
+
+- name: enable our config for system-auth
+  file:
+    src: /etc/pam.d/system-auth-local
+    dest: /etc/pam.d/system-auth
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
+    state: link
+    force: true
+
+- name: configure passwdqc and faillock via central password-auth config
+  template:
+    src: 'etc/pam.d/rhel_auth.j2'
+    dest: '/etc/pam.d/password-auth-local'
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
+
+- name: enable our config for password-auth
+  file:
+    src: /etc/pam.d/password-auth-local
+    dest: /etc/pam.d/password-auth
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
+    state: link
+    force: true

roles/os_hardening/tasks/user_accounts.yml

@@ -45,3 +45,20 @@
     createhome: false
   with_flattened:
     - '{{ sys_accs_cond | default([]) | difference(os_ignore_users) | list }}'
+
+- name: get all home directories in /home, but skip ignored users
+  find:
+    paths: /home/
+    recurse: false
+    file_type: directory
+    excludes: "{{ os_ignore_home_folder_users | join(',') }}"
+  register: home_directories
+  when: os_chmod_home_folders | bool
+
+- name: set ownership of /home directories to 0700
+  file:
+    mode: 0700
+    path: "{{ item.path }}"
+    state: directory
+  loop: "{{ home_directories.files }}"
+  when: os_chmod_home_folders | bool

roles/os_hardening/templates/etc/pam.d/rhel_auth.j2

@@ -0,0 +1,54 @@
+{{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}
+
+#%PAM-1.0
+auth        required      pam_env.so
+auth        required      pam_faildelay.so delay=2000000
+{% if os_auth_retries > 0 %}
+auth        required      pam_faillock.so preauth silent audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
+{% endif %}
+{% if (os_auth_pam_sssd_enable | bool) %}
+auth        [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
+auth        [default=1 ignore=ignore success=ok] pam_localuser.so
+{% endif %}
+auth        sufficient    pam_unix.so nullok try_first_pass
+{% if (os_auth_pam_sssd_enable | bool) %}
+auth        [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
+auth        sufficient    pam_sss.so forward_pass
+{% endif %}
+{% if os_auth_retries > 0 %}
+auth        required      pam_faillock.so authfail audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
+{% endif %}
+auth        required      pam_deny.so
+
+{% if os_auth_retries > 0 %}
+account     required      pam_faillock.so
+{% endif %}
+account     required      pam_unix.so
+account     sufficient    pam_localuser.so
+account     sufficient    pam_succeed_if.so uid < 1000 quiet
+{% if (os_auth_pam_sssd_enable | bool) %}
+account     [default=bad success=ok user_unknown=ignore] pam_sss.so
+{% endif %}
+account     required      pam_permit.so
+
+{% if (os_auth_pam_passwdqc_enable | bool) %}
+password    requisite     pam_pwquality.so {{ os_auth_pam_pwquality_options }}
+{% endif %}
+{# NSA 2.3.3.6 Limit Password Reuse #}
+password    requisite     pam_pwhistory.so remember=5 use_authtok
+{# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512 #}
+password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
+{% if (os_auth_pam_sssd_enable | bool) %}
+password    sufficient    pam_sss.so use_authtok
+{% endif %}
+password    required      pam_deny.so
+
+session     optional      pam_keyinit.so revoke
+session     required      pam_limits.so
+-session    optional      pam_systemd.so
+session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+session     required      pam_unix.so
+{% if (os_auth_pam_sssd_enable | bool) %}
+session     optional      pam_sss.so
+{% endif %}

roles/os_hardening/templates/etc/pam.d/rhel_system_auth.j2

@@ -1,40 +0,0 @@
-{{ ansible_managed | comment }}
-# Generated by Ansible role {{ ansible_role_name }}
-
-#%PAM-1.0
-{% if os_auth_retries > 0 %}
-auth        required      pam_tally2.so deny={{ os_auth_retries }} onerr=fail unlock_time={{ os_auth_lockout_time }}
-{% endif %}
-auth        required      pam_env.so
-auth        sufficient    pam_unix.so nullok try_first_pass
-auth        requisite     pam_succeed_if.so uid >= 500 quiet
-auth        required      pam_deny.so
-
-{% if os_auth_retries > 0 %}
-account     required      pam_tally2.so
-{% endif %}
-account     required      pam_unix.so
-account     sufficient    pam_localuser.so
-account     sufficient    pam_succeed_if.so uid < 500 quiet
-account     required      pam_permit.so
-
-{% if (os_auth_pam_passwdqc_enable|bool) %}
-  {%- if ((ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_version|int is version('7', '>=')) or ansible_facts.distribution == 'Amazon') %}
-password    required      pam_pwquality.so {{ os_auth_pam_pwquality_options }}
-  {%- else %}
-password    requisite     pam_passwdqc.so {{ os_auth_pam_passwdqc_options }}
-  {%- endif %}
-{% else %}
-password    requisite     pam_cracklib.so try_first_pass retry=3 type=
-{% endif %}
-
-
-# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
-# NSA 2.3.3.6 Limit Password Reuse
-password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
-password    required      pam_deny.so
-
-session     optional      pam_keyinit.so revoke
-session     required      pam_limits.so
-session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
-session     required      pam_unix.so

roles/os_hardening/templates/etc/security/faillock.conf.j2

@@ -0,0 +1,65 @@
+{{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}
+#
+# Configuration for locking the user after multiple failed
+# authentication attempts.
+#
+# The directory where the user files with the failure records are kept.
+# The default is /var/run/faillock.
+# dir = /var/run/faillock
+#
+# Will log the user name into the system log if the user is not found.
+# Enabled if option is present.
+# audit
+#
+# Don't print informative messages.
+# Enabled if option is present.
+# silent
+#
+# Don't log informative messages via syslog.
+# Enabled if option is present.
+# no_log_info
+#
+# Only track failed user authentications attempts for local users
+# in /etc/passwd and ignore centralized (AD, IdM, LDAP, etc.) users.
+# The `faillock` command will also no longer track user failed
+# authentication attempts. Enabling this option will prevent a
+# double-lockout scenario where a user is locked out locally and
+# in the centralized mechanism.
+# Enabled if option is present.
+# local_users_only
+#
+# Deny access if the number of consecutive authentication failures
+# for this user during the recent interval exceeds n tries.
+# The default is 3.
+deny = {{ os_auth_retries }}
+#
+# The length of the interval during which the consecutive
+# authentication failures must happen for the user account
+# lock out is <replaceable>n</replaceable> seconds.
+# The default is 900 (15 minutes).
+# fail_interval = 900
+#
+# The access will be re-enabled after n seconds after the lock out.
+# The value 0 has the same meaning as value `never` - the access
+# will not be re-enabled without resetting the faillock
+# entries by the `faillock` command.
+# The default is 600 (10 minutes).
+unlock_time = {{ os_auth_lockout_time }}
+#
+# Root account can become locked as well as regular accounts.
+# Enabled if option is present.
+even_deny_root
+#
+# This option implies the `even_deny_root` option.
+# Allow access after n seconds to root account after the
+# account is locked. In case the option is not specified
+# the value is the same as of the `unlock_time` option.
+# root_unlock_time = 900
+#
+# If a group name is specified with this option, members
+# of the group will be handled by this module the same as
+# the root account (the options `even_deny_root>` and
+# `root_unlock_time` will apply to them.
+# By default, the option is not set.
+# admin_group = <admin_group_name>

roles/os_hardening/templates/usr/share/pam-configs/pam_faillock.j2

@@ -0,0 +1,12 @@
+{{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}
+
+Name: faillock boilerplate
+Default: yes
+Priority: 1024
+Auth-Type: Primary
+Auth:
+  required           pam_faillock.so preauth
+Account-Type: Primary
+Account:
+  required           pam_faillock.so

roles/os_hardening/templates/usr/share/pam-configs/pam_faillock_authfail.j2

@@ -0,0 +1,10 @@
+{{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}
+
+Name: faillock lockout after failed attempts enforcement
+Default: yes
+Priority: 0
+Auth-Type: Primary
+Auth:
+  required           pam_faillock.so authfail
+

roles/os_hardening/vars/Amazon.yml

@@ -1,8 +1,6 @@
 ---
 
 os_packages_pam_ccreds: 'pam_ccreds'
-os_packages_pam_passwdqc: 'pam_passwdqc'
-os_packages_pam_cracklib: 'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'
 
 # Different distros use different standards for /etc/shadow perms, e.g.
@@ -27,6 +25,8 @@ os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
 
+os_auth_pam_sssd_enable: false
+
 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
 os_useradd_create_home: true

roles/os_hardening/vars/Debian.yml

@@ -1,8 +1,6 @@
 ---
 
 os_packages_pam_ccreds: 'libpam-ccreds'
-os_packages_pam_passwdqc: 'libpam-passwdqc'
-os_packages_pam_cracklib: 'libpam-cracklib'
 os_nologin_shell_path: '/usr/sbin/nologin'
 
 # Different distros use different standards for /etc/shadow perms, e.g.

roles/os_hardening/vars/Fedora.yml

@@ -1,8 +1,6 @@
 ---
 
 os_packages_pam_ccreds: 'pam_ccreds'
-os_packages_pam_passwdqc: 'pam_passwdqc'
-os_packages_pam_cracklib: 'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'
 
 # Different distros use different standards for /etc/shadow perms, e.g.
@@ -27,6 +25,8 @@ os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
 
+os_auth_pam_sssd_enable: true
+
 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
 os_useradd_create_home: true

roles/os_hardening/vars/RedHat.yml

@@ -1,8 +1,6 @@
 ---
 
 os_packages_pam_ccreds: 'pam_ccreds'
-os_packages_pam_passwdqc: 'pam_passwdqc'
-os_packages_pam_cracklib: 'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'
 
 # Different distros use different standards for /etc/shadow perms, e.g.
@@ -27,6 +25,8 @@ os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
 
+os_auth_pam_sssd_enable: false
+
 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
 os_useradd_create_home: true

roles/os_hardening/vars/RedHat_7.yml

@@ -1,8 +1,6 @@
 ---
 
 os_packages_pam_ccreds: 'pam_ccreds'
-os_packages_pam_passwdqc: 'pam_passwdqc'
-os_packages_pam_cracklib: 'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'
 
 # Different distros use different standards for /etc/shadow perms, e.g.
@@ -27,6 +25,8 @@ os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
 
+os_auth_pam_sssd_enable: false
+
 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
 os_useradd_create_home: true

roles/os_hardening/vars/RedHat_8.yml

@@ -0,0 +1,37 @@
+---
+
+os_packages_pam_ccreds: 'pam_ccreds'
+os_nologin_shell_path: '/sbin/nologin'
+
+# Different distros use different standards for /etc/shadow perms, e.g.
+# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
+# You must provide key/value pairs for owner, group, and mode if overriding.
+os_shadow_perms:
+  owner: root
+  group: root
+  mode: '0000'
+
+os_passwd_perms:
+  owner: root
+  group: root
+  mode: '0644'
+
+os_env_umask: '077'
+
+os_auth_uid_min: 1000
+os_auth_gid_min: 1000
+os_auth_sys_uid_min: 201
+os_auth_sys_uid_max: 999
+os_auth_sys_gid_min: 201
+os_auth_sys_gid_max: 999
+
+os_auth_pam_sssd_enable: true
+
+# defaults for useradd
+os_useradd_mail_dir: /var/spool/mail
+os_useradd_create_home: true
+
+modprobe_package: 'module-init-tools'
+auditd_package: 'audit'
+
+hidepid_option: '2'  # allowed values: 0, 1, 2

roles/os_hardening/vars/Suse.yml

@@ -1,8 +1,6 @@
 ---
 
 os_packages_pam_ccreds: 'pam_ccreds'
-os_packages_pam_passwdqc: 'pam_passwdqc'
-os_packages_pam_cracklib: 'cracklib'
 os_nologin_shell_path: '/sbin/nologin'
 
 # Different distros use different standards for /etc/shadow perms, e.g.

roles/ssh_hardening/README.md

@@ -35,6 +35,9 @@ Warning: This role disables root-login on the target server! Please make sure yo
 - `ssh_host_key_files`
   - Default: `[]`
   - Description: Host keys for sshd. If empty ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key', '/etc/ssh/ssh_host_ed25519_key'] will be used, as far as supported by the installed sshd version.
+- `ssh_host_rsa_key_size`
+  - Default: `4096`
+  - Description: Specifies the number of bits in the private host RSA key to create.
 - `ssh_host_key_algorithms`
   - Default: `[]`
   - Description: Host key algorithms that the server offers. If empty the [default list](https://man.openbsd.org/sshd_config#HostKeyAlgorithms) will be used, otherwise overrides the setting with specified list of algorithms.
@@ -73,7 +76,10 @@ Warning: This role disables root-login on the target server! Please make sure yo
   - Description: false to disable pam authentication.
 - `ssh_gssapi_support`
   - Default: `false`
-  - Description: true if SSH has GSSAPI support.
+  - Description: Set to true to enable GSSAPI authentication (both client and server).
+- `ssh_gssapi_delegation`
+  - Default: `false`
+  - Description: Set to true to enable GSSAPI credential forwarding.
 - `ssh_kerberos_support`
   - Default: `true`
   - Description: true if SSH has Kerberos support.
@@ -238,7 +244,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
   collections:
     - devsec.hardening
   roles:
-    - devsec.hardening.ssh_hardening
+    - ssh_hardening
 ```
 
 ## Configuring settings not listed in role-variables
@@ -252,7 +258,7 @@ Example playbook:
   collections:
     - devsec.hardening
   roles:
-    - devsec.hardening.ssh_hardening
+    - ssh_hardening
   vars:
     ssh_custom_options:
       - "Include /etc/ssh/ssh_config.d/*"

roles/ssh_hardening/defaults/main.yml

@@ -36,6 +36,9 @@ ssh_listen_to: ['0.0.0.0']          # sshd
 # Host keys to look for when starting sshd.
 ssh_host_key_files: []              # sshd
 
+# Host RSA key size in bits
+ssh_host_rsa_key_size: 4096         # sshd
+
 # Host certificates to look for when starting sshd.
 ssh_host_certificates: []           # sshd
 
@@ -88,9 +91,12 @@ ssh_use_pam: true                   # sshd
 # specify AuthenticationMethods
 sshd_authenticationmethods: 'publickey'
 
-# true if SSH support GSSAPI
+# Set to true to enable GSSAPI authentication (both client and server)
 ssh_gssapi_support: false
 
+# Set to true to enable GSSAPI credential forwarding
+ssh_gssapi_delegation: false
+
 # if specified, login is disallowed for user names that match one of the patterns.
 ssh_deny_users: ''                  # sshd
 

roles/ssh_hardening/tasks/crypto_hostkeys.yml

@@ -1,9 +1,9 @@
 ---
-- name: replace default 2048 bits RSA keypair with 4096 bits keypair
-  openssh_keypair:
+- name: replace default 2048 bits RSA keypair
+  community.crypto.openssh_keypair:
     state: present
     type: rsa
-    size: 4096
+    size: "{{ ssh_host_rsa_key_size }}"
     path: "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
     force: false
     regenerate: partial_idempotence

roles/ssh_hardening/tasks/hardening.yml

@@ -33,7 +33,9 @@
 
 - name: set default for ssh_host_key_files if not supplied
   include_tasks: crypto_hostkeys.yml
-  when: not ssh_host_key_files
+  when:
+    - ssh_server_hardening | bool
+    - not ssh_host_key_files
 
 - name: set default for ssh_macs if not supplied
   include_tasks: crypto_macs.yml

roles/ssh_hardening/templates/openssh.conf.j2

@@ -104,8 +104,8 @@ RSAAuthentication yes
 PasswordAuthentication {{ 'yes' if ssh_client_password_login else 'no' }}
 
 # Only use GSSAPIAuthentication if implemented on the network.
-GSSAPIAuthentication no
-GSSAPIDelegateCredentials no
+GSSAPIAuthentication {{ 'yes' if (ssh_gssapi_support|bool) else 'no' }}
+GSSAPIDelegateCredentials {{ 'yes' if (ssh_gssapi_delegation|bool) else 'no' }}
 
 # Disable tunneling
 Tunnel no