Merge branch 'support_more_os' into test_crypto_lib

Signed-off-by: Sebastian Gumprich <[email protected]>

.config/ansible-lint.yml

@@ -0,0 +1,17 @@
+---
+# .ansible-lint
+# exclude_paths included in this file are parsed relative to this file's location
+# and not relative to the CWD of execution. CLI arguments passed to the --exclude
+# option will be parsed relative to the CWD of execution.
+exclude_paths:
+  - .cache/  # implicit unless exclude_paths is defined in config
+  - .yamllint
+  - ../molecule/
+  - ../.github/
+
+skip_list:
+  - fqcn-builtins
+
+mock_roles:
+  - geerlingguy.git
+  - nginxinc.nginx

.github/dependabot.yml

@@ -0,0 +1,12 @@
+---
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "pip"  # See documentation for possible values
+    directory: "/"  # Location of package manifests
+    schedule:
+      interval: "daily"

.github/labeler.yml

@@ -12,7 +12,9 @@ os_hardening:
 ssh_hardening:
   - 'roles/ssh_hardening/**'
   - 'molecule/ssh_hardening/**'
+  - 'molecule/ssh_hardening_custom_tests/**'
   - '.github/workflows/ssh_hardening.yml'
+  - '.github/workflows/ssh_hardening_custom_tests.yml'
 
 nginx_hardening:
   - 'roles/nginx_hardening/**'

.github/workflows/ansible-lint.yml

@@ -0,0 +1,24 @@
+---
+name: Ansible Lint  # feel free to pick your own name
+
+on:  # yamllint disable-line rule:truthy
+  # Run CI against all pushes (direct commits, also merged PRs), Pull Requests
+  push:
+    branches: [master]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master]
+
+jobs:
+  ansible-lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      # Important: This sets up your GITHUB_WORKSPACE environment variable
+      - uses: actions/checkout@v3
+
+      - name: Lint Ansible Playbook
+        # replace "master" with any valid ref
+        uses: ansible/ansible-lint-action@main
+        with:
+          path: "roles/"

.github/workflows/enforce-labels.yml

@@ -1,12 +1,14 @@
+---
 name: "Enforce PR labels"
 
-on:
+on:  # yamllint disable-line rule:truthy
   pull_request_target:
     types: [labeled, unlabeled, opened, edited, synchronize]
 jobs:
   enforce-label:
+    if: github.repository == 'dev-sec/ansible-collection-hardening'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@main
-      with:
-        repo-token: "${{ secrets.GITHUB_TOKEN }}"
+      - uses: actions/labeler@main
+        with:
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/galaxy.yml

@@ -1,16 +1,17 @@
 ---
 name: Publish collection to Ansible Galaxy
 
-on:
+on:  # yamllint disable-line rule:truthy
   release:
     types:
       - published
 
 jobs:
   deploy:
+    if: github.repository == 'dev-sec/ansible-collection-hardening'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       # deploy the collection first, because if it fails, we don't want
       # to update the galaxy.yml
@@ -20,6 +21,11 @@ jobs:
           api_key: ${{ secrets.GALAXY_API_KEY }}
           galaxy_version: ${{ github.event.release.tag_name }}
 
+      # checkout master instead of the release-tag so we can push the galaxy.yml
+      - uses: actions/checkout@v3
+        with:
+          ref: master
+
       - name: update galaxy.yml with new version
         uses: microsoft/variable-substitution@v1
         with:
@@ -28,7 +34,7 @@ jobs:
           version: "${{ github.event.release.tag_name }}"
 
       - name: push galaxy.yml
-        uses: github-actions-x/commit@v2.7
+        uses: github-actions-x/commit@v2.9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           push-branch: 'master'

.github/workflows/mysql_hardening.yml

@@ -1,13 +1,16 @@
 ---
 name: "devsec.mysql_hardening"
+
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
+    branches: [master]
     paths:
       - 'roles/mysql_hardening/**'
       - 'molecule/mysql_hardening/**'
       - '.github/workflows/mysql_hardening.yml'
   pull_request:
+    branches: [master]
     paths:
       - 'roles/mysql_hardening/**'
       - 'molecule/mysql_hardening/**'
@@ -23,19 +26,22 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
-          - centos8
-          - ubuntu1604
+          - centosstream8
+          - centosstream9
+          - rocky8
+          - rocky9
           - ubuntu1804
           - ubuntu2004
-          - debian9
+          - ubuntu2204
           - debian10
+          - debian11
           # - amazon  # geerlingguy.mysql does not support fedora
           # - arch  # needs to be fixed
           # - opensuse_tumbleweed  # needs to be fixed
           # - fedora  # geerlingguy.mysql does not support fedora
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true

.github/workflows/nginx_hardening.yml

@@ -3,11 +3,13 @@ name: "devsec.nginx_hardening"
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
+    branches: [master]
     paths:
       - 'roles/nginx_hardening/**'
       - 'molecule/nginx_hardening/**'
       - '.github/workflows/nginx_hardening.yml'
   pull_request:
+    branches: [master]
     paths:
       - 'roles/nginx_hardening/**'
       - 'molecule/nginx_hardening/**'
@@ -23,19 +25,22 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
-          - centos8
-          - ubuntu1604
+          - centosstream8
+          - centosstream9
+          - rocky8
+          - rocky9
           - ubuntu1804
           - ubuntu2004
-          - debian9
+          - ubuntu2204
           - debian10
+          - debian11
           - amazon
           # - arch  # needs to be fixed
           # - opensuse_tumbleweed  # needs to be fixed
           # - fedora  # no support from geerlingguy role
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true

.github/workflows/os_hardening.yml

@@ -3,11 +3,13 @@ name: "devsec.os_hardening"
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
+    branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening/**'
       - '.github/workflows/os_hardening.yml'
   pull_request:
+    branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening/**'
@@ -23,18 +25,21 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
-          - centos8
-          - ubuntu1604
+          - centosstream8
+          - centosstream9
+          - rocky8
+          - rocky9
           - ubuntu1804
           - ubuntu2004
-          - debian9
+          - ubuntu2204
           - debian10
+          - debian11
           - amazon
           - opensuse_tumbleweed
           # - arch  # needs to be fixed
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true

.github/workflows/os_hardening_vm.yml

@@ -0,0 +1,57 @@
+---
+name: "devsec.os_hardening VM"
+on:  # yamllint disable-line rule:truthy
+  workflow_dispatch:
+  push:
+    branches: [master]
+    paths:
+      - 'roles/os_hardening/**'
+      - 'molecule/os_hardening_vm/**'
+      - '.github/workflows/os_hardening_vm.yml'
+  pull_request:
+    branches: [master]
+    paths:
+      - 'roles/os_hardening/**'
+      - 'molecule/os_hardening_vm/**'
+      - '.github/workflows/os_hardening_vm.yml'
+jobs:
+  build:
+    runs-on: self-hosted
+    env:
+      PY_COLORS: 1
+      ANSIBLE_FORCE_COLOR: 1
+    strategy:
+      fail-fast: false
+      matrix:
+        molecule_distro:
+          - centos7
+          - centosstream8
+          - centosstream9
+          - rocky8
+          - rocky9
+          - ubuntu1804
+          - ubuntu2004
+          - ubuntu2204
+          - debian10
+          - debian11
+          # - opensuse42  # opensuse currently cannot get an ip address
+          # - arch  - arch is currently not supported by cinc-auditor
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+        with:
+          path: ansible_collections/devsec/hardening
+          submodules: true
+
+      - name: Create default collection path symlink
+        run: |
+          mkdir -p /home/runner/.ansible
+          ln -fs /opt/actions-runner/_work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections /home/runner/.ansible/collections
+
+      - name: Test with molecule
+        run: |
+          molecule --version
+          molecule test -s os_hardening_vm
+        env:
+          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
+        working-directory: ansible_collections/devsec/hardening

.github/workflows/prettier-md.yml

@@ -2,19 +2,21 @@
 # https://github.com/creyD/prettier_action
 name: Prettier markdown files
 
-on:
+on:  # yamllint disable-line rule:truthy
   push:
+    branches: [master]
     paths:
       - '**.md'
 
 jobs:
   prettier-md:
+    if: github.repository == 'dev-sec/ansible-collection-hardening'
     runs-on: ubuntu-latest
     timeout-minutes: 1
 
     steps:
       - name: Git checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           ref: ${{ github.head_ref }}
 

.github/workflows/release.yml

@@ -9,12 +9,14 @@ on:  # yamllint disable-line rule:truthy
 
 jobs:
   generate_changelog:
-    runs-on: ubuntu-latest
     name: create release draft
+    if: github.repository == 'dev-sec/ansible-collection-hardening'
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v3
         with:
           fetch-depth: 0
+          ref: master
 
       - name: 'Get Previous tag'
         id: previoustag
@@ -37,9 +39,10 @@ jobs:
           # since they break the changelog generation with the error:
           # "No common ancestor between ... and $version"
           exclude_tags_regex: '[0-6]\.\d\.\d'
+          issue_line_labels: mysql_hardening,os_hardening,ssh_hardening,nginx_hardening
 
       - name: push changelog
-        uses: github-actions-x/commit@v2.6
+        uses: github-actions-x/commit@v2.9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           push-branch: 'master'
@@ -49,23 +52,9 @@ jobs:
           name: dev-sec CI
           email: [email protected]
 
-      # do a second checkout to prevent race situation
-      # changelog gets updated but action works on old commit id
-      - uses: actions/[email protected]
-        with:
-          fetch-depth: 0
-
       - name: Generate changelog for the release
-        uses: charmixer/auto-changelog-action@v1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          since_tag: ${{ steps.previoustag.outputs.tag }}
-          future_release: ${{ steps.version.outputs.next-version }}
-          output: CHANGELOGRELEASE.md
-          # this excludes all versions prior to the collection-release
-          # since they break the changelog generation with the error:
-          # "No common ancestor between ... and $version"
-          exclude_tags_regex: '[0-6]\.\d\.\d'
+        run: |
+          sed '/## \[${{ steps.previoustag.outputs.tag }}\]/Q' CHANGELOG.md > CHANGELOGRELEASE.md
 
       - name: Read CHANGELOG.md
         id: package
@@ -73,6 +62,11 @@ jobs:
         with:
           path: ./CHANGELOGRELEASE.md
 
+      - name: Delete old drafts
+        uses: hugo19941994/[email protected]
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Create Release draft
         id: create_release
         uses: actions/create-release@v1

.github/workflows/ssh_hardening.yml

@@ -3,11 +3,13 @@ name: "devsec.ssh_hardening"
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
+    branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening/**'
       - '.github/workflows/ssh_hardening.yml'
   pull_request:
+    branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening/**'
@@ -23,19 +25,22 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
-          - centos8
+          - centosstream8
+          - centosstream9
+          - rocky8
+          - rocky9
           - fedora
-          - ubuntu1604
           - ubuntu1804
           - ubuntu2004
-          - debian9
+          - ubuntu2204
           - debian10
+          - debian11
           - amazon
           # - arch  # needs to be fixed
           # - opensuse_tumbleweed  # baseline is not compatible with suse
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true

.github/workflows/ssh_hardening_custom_tests.yml

@@ -0,0 +1,74 @@
+---
+name: "devsec.ssh_hardening with custom tests"
+on:  # yamllint disable-line rule:truthy
+  workflow_dispatch:
+  push:
+    branches: [master]
+    paths:
+      - 'roles/ssh_hardening/**'
+      - 'molecule/ssh_hardening_custom_tests/**'
+      - '.github/workflows/ssh_hardening_custom_tests.yml'
+  pull_request:
+    branches: [master]
+    paths:
+      - 'roles/ssh_hardening/**'
+      - 'molecule/ssh_hardening_custom_tests/**'
+      - '.github/workflows/ssh_hardening_custom_tests.yml'
+jobs:
+  build:
+    runs-on: ubuntu-18.04
+    env:
+      PY_COLORS: 1
+      ANSIBLE_FORCE_COLOR: 1
+    strategy:
+      fail-fast: false
+      matrix:
+        molecule_distro:
+          - centos7
+          - centosstream8
+          - centosstream9
+          - rocky8
+          - rocky9
+          - fedora
+          - ubuntu1804
+          - ubuntu2004
+          - ubuntu2204
+          - debian10
+          - debian11
+          - amazon
+          # - arch  # needs to be fixed
+          # - opensuse_tumbleweed  # baseline is not compatible with suse
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+        with:
+          path: ansible_collections/devsec/hardening
+          submodules: true
+
+      - name: Set up Python 3.7
+        uses: actions/setup-python@v1
+        with:
+          python-version: 3.7
+
+      - name: Install dependencies
+        run: |
+          sudo apt install git
+          python -m pip install --no-cache-dir --upgrade pip
+          pip install -r requirements.txt
+        working-directory: ansible_collections/devsec/hardening
+
+      - name: Create default collection path symlink
+        run: |
+          mkdir -p /home/runner/.ansible
+          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
+
+      - name: Test with molecule
+        run: |
+          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
+            export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
+          fi
+          molecule --version
+          molecule converge -s ssh_hardening_custom_tests
+        env:
+          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
+        working-directory: ansible_collections/devsec/hardening

.gitignore

@@ -1,3 +1,4 @@
 .kitchen
 hosts
 Gemfile.lock
+.venv

.prettierignore

@@ -0,0 +1 @@
+CHANGELOG.md

.yamllint

@@ -15,19 +15,12 @@ rules:
   commas:
     max-spaces-after: -1
     level: error
-#  comments: disable
-#  comments-indentation: disable
-#  document-start: disable
   empty-lines:
     max: 3
     level: error
   hyphens:
     level: error
-#  indentation: disable
   key-duplicates: enable
   line-length: disable
-#  new-line-at-end-of-file: disable
   new-lines:
     type: unix
-#  trailing-spaces: disable
-#  truthy: disable

CHANGELOG.md

@@ -1,55 +1,550 @@
 # Changelog
 
-## [Unreleased](https://github.com/dev-sec/ansible-collection-hardening/tree/HEAD)
+## [8.2.1](https://github.com/dev-sec/ansible-collection-hardening/tree/8.2.1) (2022-10-20)
 
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.0.0...HEAD)
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.2.0...8.2.1)
+
+**Fixed bugs:**
+
+- do not manage trusted user ca keys if none exist [\#580](https://github.com/dev-sec/ansible-collection-hardening/pull/580) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([hollow](https://github.com/hollow))
+
+**Closed issues:**
+
+- Trying to run the os\_hardening on Debian 11, but fails on privilege escalation [\#587](https://github.com/dev-sec/ansible-collection-hardening/issues/587)
+- auditd increasing logfiles [\#586](https://github.com/dev-sec/ansible-collection-hardening/issues/586)
+- Path to nginx.conf should be configurable in a variable  [\#577](https://github.com/dev-sec/ansible-collection-hardening/issues/577)
+
+**Merged pull requests:**
+
+- run tests only on pushes to master or to PRs [\#581](https://github.com/dev-sec/ansible-collection-hardening/pull/581) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [8.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.2.0) (2022-09-08)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.1.0...8.2.0)
 
 **Implemented enhancements:**
 
-- Default value for ssh\_max\_startups should be changed [\#366](https://github.com/dev-sec/ansible-collection-hardening/issues/366)
+- Add nginx variables for config-path and owner/group [\#578](https://github.com/dev-sec/ansible-collection-hardening/pull/578) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([hagenbauer](https://github.com/hagenbauer))
+- add centos \>8 Support [\#573](https://github.com/dev-sec/ansible-collection-hardening/pull/573) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([sbaerlocher](https://github.com/sbaerlocher))
+- add always-tag to include so other tags can be used [\#569](https://github.com/dev-sec/ansible-collection-hardening/pull/569) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Closed issues:**
+
+- Bug using os\_hardening "tags" [\#567](https://github.com/dev-sec/ansible-collection-hardening/issues/567)
+
+## [8.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.1.0) (2022-08-26)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.0.0...8.1.0)
+
+**Closed issues:**
+
+- dev-sec CI bot should not update CHANGELOG.md in fork repository [\#566](https://github.com/dev-sec/ansible-collection-hardening/issues/566)
+
+**Merged pull requests:**
+
+- update supported OS in meta and fix linting [\#572](https://github.com/dev-sec/ansible-collection-hardening/pull/572) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- fix misleading comment [\#571](https://github.com/dev-sec/ansible-collection-hardening/pull/571) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([donestefan](https://github.com/donestefan))
+- only run release actions on upstream-repo [\#568](https://github.com/dev-sec/ansible-collection-hardening/pull/568) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [8.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.0.0) (2022-08-22)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.16.0...8.0.0)
+
+**Breaking changes:**
+
+- change default to allow SFTP [\#564](https://github.com/dev-sec/ansible-collection-hardening/pull/564) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+
+**Implemented enhancements:**
+
+- add possibility to keep .netrc files in users homedir [\#563](https://github.com/dev-sec/ansible-collection-hardening/pull/563) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([PhilippFunk](https://github.com/PhilippFunk))
+- rework filesystem hardening [\#555](https://github.com/dev-sec/ansible-collection-hardening/pull/555) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([divialth](https://github.com/divialth))
+
+**Closed issues:**
+
+- Error in Task 'Create sshd\_config and set permissions to root/600' [\#565](https://github.com/dev-sec/ansible-collection-hardening/issues/565) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
+- \[ssh\_hardening\] Debian 11 - Ansible cannot transfer files [\#557](https://github.com/dev-sec/ansible-collection-hardening/issues/557)
+- Add the old SFTP-Reminder to the stable ssh\_hardening role for ansible [\#521](https://github.com/dev-sec/ansible-collection-hardening/issues/521)
+
+## [7.16.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.16.0) (2022-08-16)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.15.1...7.16.0)
+
+**Implemented enhancements:**
+
+- revert debian 9 change, only one tls variable now [\#562](https://github.com/dev-sec/ansible-collection-hardening/pull/562) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add posibility to run ssh\_hardening as unprivileged user [\#561](https://github.com/dev-sec/ansible-collection-hardening/pull/561) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- add basic support for ubuntu22.04 [\#554](https://github.com/dev-sec/ansible-collection-hardening/pull/554) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Add full support for Debian 11 [\#538](https://github.com/dev-sec/ansible-collection-hardening/pull/538) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([addianto](https://github.com/addianto))
+
+**Fixed bugs:**
+
+- Replace default 2048 bits RSA keypair fails on Ubuntu 20.04 [\#459](https://github.com/dev-sec/ansible-collection-hardening/issues/459)
+
+**Closed issues:**
+
+- os-hardening: yum gpg-check fails if gpg-check already set [\#556](https://github.com/dev-sec/ansible-collection-hardening/issues/556)
+- Ubuntu 22.04 LTS [\#553](https://github.com/dev-sec/ansible-collection-hardening/issues/553)
+- Revert nginx ssl-protocol after deprecation of debian9 [\#528](https://github.com/dev-sec/ansible-collection-hardening/issues/528)
+- Support for Debian 11 [\#527](https://github.com/dev-sec/ansible-collection-hardening/issues/527)
+- Support baseline-control os-14 [\#507](https://github.com/dev-sec/ansible-collection-hardening/issues/507)
+
+## [7.15.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.15.1) (2022-07-26)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.15.0...7.15.1)
+
+**Fixed bugs:**
+
+- Fix broken mode for /var/log/audit [\#552](https://github.com/dev-sec/ansible-collection-hardening/pull/552) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([hollow](https://github.com/hollow))
+
+**Merged pull requests:**
+
+- Only run hardening if /var/log/audit exists [\#550](https://github.com/dev-sec/ansible-collection-hardening/pull/550) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([mego22](https://github.com/mego22))
+
+## [7.15.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.15.0) (2022-07-11)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.3...7.15.0)
+
+**Implemented enhancements:**
+
+- Harden mountpoints [\#531](https://github.com/dev-sec/ansible-collection-hardening/pull/531) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lbayerlein](https://github.com/lbayerlein))
+
+**Fixed bugs:**
+
+- os\_hardening gpg-check enabled fails on success [\#549](https://github.com/dev-sec/ansible-collection-hardening/issues/549) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- add VM tests for os\_hardening  [\#547](https://github.com/dev-sec/ansible-collection-hardening/pull/547) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- Linting [\#546](https://github.com/dev-sec/ansible-collection-hardening/pull/546) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.14.3](https://github.com/dev-sec/ansible-collection-hardening/tree/7.14.3) (2022-06-29)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.2...7.14.3)
+
+**Closed issues:**
+
+- Version 7.14.2 not released to Ansible Galaxy [\#544](https://github.com/dev-sec/ansible-collection-hardening/issues/544)
+- os\_hardening role: os\_ignore\_users not described in the Readme's variable topic [\#542](https://github.com/dev-sec/ansible-collection-hardening/issues/542)
+- doc: incorrect description for ssh\_client\_alive\_count [\#540](https://github.com/dev-sec/ansible-collection-hardening/issues/540)
+- 'legacy' branch is mentioned in README, but apparently doesn't exist [\#539](https://github.com/dev-sec/ansible-collection-hardening/issues/539)
+- ansible\_role\_name is undefined [\#532](https://github.com/dev-sec/ansible-collection-hardening/issues/532)
+- Can't sudo anymore after hardening [\#518](https://github.com/dev-sec/ansible-collection-hardening/issues/518)
+- Any planned official support for RHEL/CentOS Stream 9? [\#517](https://github.com/dev-sec/ansible-collection-hardening/issues/517)
+
+**Merged pull requests:**
+
+- Improve documentation [\#541](https://github.com/dev-sec/ansible-collection-hardening/pull/541) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+
+## [7.14.2](https://github.com/dev-sec/ansible-collection-hardening/tree/7.14.2) (2022-02-28)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.1...7.14.2)
+
+**Fixed bugs:**
+
+- debian 9's nginx doesn't support tls1.3 [\#526](https://github.com/dev-sec/ansible-collection-hardening/pull/526) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Change permissions of the tmout.sh file [\#520](https://github.com/dev-sec/ansible-collection-hardening/pull/520) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([abejotaR](https://github.com/abejotaR))
+
+**Closed issues:**
+
+- No such file directory error triggered by the  kernel.unpriviliged\_userns\_clone configuration. [\#514](https://github.com/dev-sec/ansible-collection-hardening/issues/514)
+
+**Merged pull requests:**
+
+- delete obsolete release drafts [\#530](https://github.com/dev-sec/ansible-collection-hardening/pull/530) ([schurzi](https://github.com/schurzi))
+- add waivers to skip controls [\#529](https://github.com/dev-sec/ansible-collection-hardening/pull/529) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- remove centos8 tests [\#525](https://github.com/dev-sec/ansible-collection-hardening/pull/525) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.14.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.14.1) (2022-02-18)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.0...7.14.1)
+
+**Fixed bugs:**
+
+- move sysctls to debian specific vars [\#524](https://github.com/dev-sec/ansible-collection-hardening/pull/524) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Closed issues:**
+
+- Error when using the ssh\_hardening role [\#519](https://github.com/dev-sec/ansible-collection-hardening/issues/519)
+
+## [7.14.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.14.0) (2021-12-16)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.13.2...7.14.0)
+
+**Implemented enhancements:**
+
+- Add option to set timeout in seconds to logout users [\#516](https://github.com/dev-sec/ansible-collection-hardening/pull/516) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lbayerlein](https://github.com/lbayerlein))
+- add feature to disable coredump to limit task [\#511](https://github.com/dev-sec/ansible-collection-hardening/pull/511) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lbayerlein](https://github.com/lbayerlein))
+- change hidepid mount task state to mounted [\#510](https://github.com/dev-sec/ansible-collection-hardening/pull/510) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([alegrey91](https://github.com/alegrey91))
+- prettify nginx options [\#509](https://github.com/dev-sec/ansible-collection-hardening/pull/509) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Update nginx\_add\_header README to match default [\#506](https://github.com/dev-sec/ansible-collection-hardening/pull/506) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([duffn](https://github.com/duffn))
+- Updated dh\_params to 4096 [\#501](https://github.com/dev-sec/ansible-collection-hardening/pull/501) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([ksaadDE](https://github.com/ksaadDE))
+
+**Fixed bugs:**
+
+- Duplication of sysctl default parameter fs.protected\_hardlinks and fs.protected\_symlinks [\#502](https://github.com/dev-sec/ansible-collection-hardening/issues/502)
+- Fix duplicate sysctl config in fs [\#505](https://github.com/dev-sec/ansible-collection-hardening/pull/505) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([tekicat](https://github.com/tekicat))
+
+**Merged pull requests:**
+
+- Feature coredump [\#513](https://github.com/dev-sec/ansible-collection-hardening/pull/513) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.13.2](https://github.com/dev-sec/ansible-collection-hardening/tree/7.13.2) (2021-11-23)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.13.1...7.13.2)
+
+## [7.13.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.13.1) (2021-11-23)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.13.0...7.13.1)
+
+**Closed issues:**
+
+- Unable to use 7.13.0 Release [\#503](https://github.com/dev-sec/ansible-collection-hardening/issues/503)
+
+## [7.13.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.13.0) (2021-11-15)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.12.0...7.13.0)
+
+**Implemented enhancements:**
+
+- os\_hardening: Provide a whitelist for yum repositories with non-signed RPMs [\#485](https://github.com/dev-sec/ansible-collection-hardening/issues/485)
+- Disable ctrl-alt-del key combination [\#496](https://github.com/dev-sec/ansible-collection-hardening/pull/496) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lbayerlein](https://github.com/lbayerlein))
+- implement sysctl-34 - link protection settings [\#494](https://github.com/dev-sec/ansible-collection-hardening/pull/494) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Add whitelist option for yum repository files [\#487](https://github.com/dev-sec/ansible-collection-hardening/pull/487) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([darxriggs](https://github.com/darxriggs))
+- Add TLSv1.3 to nginx default configuration [\#470](https://github.com/dev-sec/ansible-collection-hardening/pull/470) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([ksaadDE](https://github.com/ksaadDE))
+
+**Closed issues:**
+
+- Please create the collection in ansible-galaxy [\#407](https://github.com/dev-sec/ansible-collection-hardening/issues/407)
+
+**Merged pull requests:**
+
+- Improve testing: install packages on Arch Linux [\#499](https://github.com/dev-sec/ansible-collection-hardening/pull/499) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([darxriggs](https://github.com/darxriggs))
+- add old role names to tags in Galaxy [\#495](https://github.com/dev-sec/ansible-collection-hardening/pull/495) ([schurzi](https://github.com/schurzi))
+- update minimum ansible version for roles [\#493](https://github.com/dev-sec/ansible-collection-hardening/pull/493) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- revive old tests with custom ssh settings [\#491](https://github.com/dev-sec/ansible-collection-hardening/pull/491) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.12.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.12.0) (2021-10-21)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.11.0...7.12.0)
+
+**Implemented enhancements:**
+
+- feat\(os\_hardening\): extend file permission tasks to cover more files [\#489](https://github.com/dev-sec/ansible-collection-hardening/pull/489) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([cmhe](https://github.com/cmhe))
+
+**Fixed bugs:**
+
+- mysql remove deprecated 'secure\_auth' parameter in mysql [\#346](https://github.com/dev-sec/ansible-collection-hardening/issues/346)
+- change baseline urls to full zip-url [\#490](https://github.com/dev-sec/ansible-collection-hardening/pull/490) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- fix filter error in ansible.builtin.file mode parameter [\#486](https://github.com/dev-sec/ansible-collection-hardening/pull/486) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([ssttehrani](https://github.com/ssttehrani))
+
+**Closed issues:**
+
+- Extend os\_hardening minimize\_access task to cover additional passwd/group/shadow/gshadow paths [\#488](https://github.com/dev-sec/ansible-collection-hardening/issues/488)
+- postgresql\_hardening role [\#484](https://github.com/dev-sec/ansible-collection-hardening/issues/484)
+- os\_hardening fails on "Create a combined sysctl-dict if overwrites are defined" task [\#482](https://github.com/dev-sec/ansible-collection-hardening/issues/482)
+- Improve changelog generation [\#381](https://github.com/dev-sec/ansible-collection-hardening/issues/381)
+
+## [7.11.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.11.0) (2021-08-30)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.10.0...7.11.0)
+
+**Implemented enhancements:**
+
+- Use `log_error` file and `datadir` from mysql\_info settings instead of variables `mysql_datadir` and `mysql_hardening_log_file` [\#478](https://github.com/dev-sec/ansible-collection-hardening/pull/478) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([123quhiwiwk](https://github.com/123quhiwiwk))
+- Execute check of MySQL error logfile permissions on Debian 11 only when log\_error is defined [\#477](https://github.com/dev-sec/ansible-collection-hardening/pull/477) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([123quhiwiwk](https://github.com/123quhiwiwk))
+- \[mysql\_hardening\] Setup defaults for MySQL on FreeBSD [\#474](https://github.com/dev-sec/ansible-collection-hardening/pull/474) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([sdwilsh](https://github.com/sdwilsh))
+
+**Closed issues:**
+
+- MariaDB hardening fails, because log\_error file is missing \[Debian 11\] [\#476](https://github.com/dev-sec/ansible-collection-hardening/issues/476)
+
+**Merged pull requests:**
+
+- ssh\_allow\_tcp\_forwarding is not a boolean [\#480](https://github.com/dev-sec/ansible-collection-hardening/pull/480) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([ReinerNippes](https://github.com/ReinerNippes))
+- chore\(ssh\_hardening\): set min\_ansible\_version to \>=2.9.10 [\#479](https://github.com/dev-sec/ansible-collection-hardening/pull/479) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([bufferoverflow](https://github.com/bufferoverflow))
+
+## [7.10.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.10.0) (2021-08-15)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.9.0...7.10.0)
+
+**Implemented enhancements:**
+
+- use Ansible lint in separate task [\#475](https://github.com/dev-sec/ansible-collection-hardening/pull/475) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- \[mysql\_hardening\] Allow setting the mysql\_distribution [\#473](https://github.com/dev-sec/ansible-collection-hardening/pull/473) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([sdwilsh](https://github.com/sdwilsh))
+
+**Fixed bugs:**
+
+- mysql\_hardening cannot work with mysql on freebsd [\#472](https://github.com/dev-sec/ansible-collection-hardening/issues/472)
+
+**Closed issues:**
+
+- run ansible-lint only once in Github Actions [\#398](https://github.com/dev-sec/ansible-collection-hardening/issues/398)
+
+**Merged pull requests:**
+
+- SSH Hardening: backtick typo [\#471](https://github.com/dev-sec/ansible-collection-hardening/pull/471) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Slamdunk](https://github.com/Slamdunk))
+- fix license in galaxy [\#469](https://github.com/dev-sec/ansible-collection-hardening/pull/469) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.9.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.9.0) (2021-07-22)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.8.0...7.9.0)
+
+**Implemented enhancements:**
+
+- Allow configuration of password remember in pam [\#467](https://github.com/dev-sec/ansible-collection-hardening/pull/467) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([m41kc0d3](https://github.com/m41kc0d3))
+- Add CVE-2021-33909 mitigations [\#466](https://github.com/dev-sec/ansible-collection-hardening/pull/466) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([kravietz](https://github.com/kravietz))
+- Add SUB\_UID\_MIN/MAX/COUNT, SUB\_GID\_MIN/MAX/COUNT [\#463](https://github.com/dev-sec/ansible-collection-hardening/pull/463) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([elgalu](https://github.com/elgalu))
+- Add os\_auth\_uid\_max, os\_auth\_gid\_max [\#461](https://github.com/dev-sec/ansible-collection-hardening/pull/461) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([elgalu](https://github.com/elgalu))
+
+**Closed issues:**
+
+- MySQL hardening fails because of missing attribute [\#464](https://github.com/dev-sec/ansible-collection-hardening/issues/464)
+- add "when" statements for every import\_tasks in hardening.yml [\#453](https://github.com/dev-sec/ansible-collection-hardening/issues/453)
+
+**Merged pull requests:**
+
+- update metadata to include community.mysql deps [\#465](https://github.com/dev-sec/ansible-collection-hardening/pull/465) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.8.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.8.0) (2021-07-01)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.7.0...7.8.0)
+
+**Implemented enhancements:**
+
+- SHA\_CRYPT\_MIN\_ROUNDS should be increased in login.defs [\#365](https://github.com/dev-sec/ansible-collection-hardening/issues/365) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Add support for Rocky Linux 8 [\#454](https://github.com/dev-sec/ansible-collection-hardening/pull/454) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([sherwind](https://github.com/sherwind))
+- make sha rounds configurable and increase no of rounds [\#452](https://github.com/dev-sec/ansible-collection-hardening/pull/452) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Fixed bugs:**
+
+- add tag always to os dependent vars task [\#456](https://github.com/dev-sec/ansible-collection-hardening/pull/456) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Use `include_tasks` for os\_hardening/main.yml [\#451](https://github.com/dev-sec/ansible-collection-hardening/pull/451) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([coadler](https://github.com/coadler))
+
+**Closed issues:**
+
+- Disable IPv6 | sysctl-18   net.ipv6.conf.all.disable\_ipv6: 1 [\#406](https://github.com/dev-sec/ansible-collection-hardening/issues/406) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+
+**Merged pull requests:**
+
+- Cleanup old OS-support and simplify vars [\#458](https://github.com/dev-sec/ansible-collection-hardening/pull/458) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add rocky linux 8 tests and make sure that all relevant tasks are execd [\#457](https://github.com/dev-sec/ansible-collection-hardening/pull/457) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add "when" statements in hardening.yml\(\#453\) [\#455](https://github.com/dev-sec/ansible-collection-hardening/pull/455) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([jqiuyin](https://github.com/jqiuyin))
+- enable ipv6 globally [\#450](https://github.com/dev-sec/ansible-collection-hardening/pull/450) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.7.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.7.0) (2021-05-24)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.6.0...7.7.0)
+
+**Implemented enhancements:**
+
+- Add tasks for new controls [\#123](https://github.com/dev-sec/ansible-collection-hardening/issues/123)
+- ssh\_allow\_tcp\_forwarding remote option added [\#447](https://github.com/dev-sec/ansible-collection-hardening/pull/447) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([alimli](https://github.com/alimli))
+
+**Fixed bugs:**
+
+- Warning: iptables-legacy tables present, Debian 10 [\#274](https://github.com/dev-sec/ansible-collection-hardening/issues/274)
+- Check for MariaDB Version when selecting users without passwords [\#444](https://github.com/dev-sec/ansible-collection-hardening/pull/444) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([neubi4](https://github.com/neubi4))
+- Adds dependency on ansible.posix and community.general [\#415](https://github.com/dev-sec/ansible-collection-hardening/pull/415) ([irl](https://github.com/irl))
+
+**Closed issues:**
+
+- No dependency on ansible.posix collection [\#414](https://github.com/dev-sec/ansible-collection-hardening/issues/414)
+- No dependency on community.general [\#413](https://github.com/dev-sec/ansible-collection-hardening/issues/413)
+- in lxc/docker/openvz IPv6 is always disabled by ufw-configuration [\#402](https://github.com/dev-sec/ansible-collection-hardening/issues/402)
+- Allow login\_unix\_socket to be specified [\#327](https://github.com/dev-sec/ansible-collection-hardening/issues/327)
+
+**Merged pull requests:**
+
+- Removed sysctl that tries to disable IPv6 [\#449](https://github.com/dev-sec/ansible-collection-hardening/pull/449) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lduesing](https://github.com/lduesing))
+- limit changelog labels to role names [\#448](https://github.com/dev-sec/ansible-collection-hardening/pull/448) ([schurzi](https://github.com/schurzi))
+- add back labels to changelog [\#446](https://github.com/dev-sec/ansible-collection-hardening/pull/446) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.6.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.6.0) (2021-04-27)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.5.0...7.6.0)
+
+**Implemented enhancements:**
+
+- ssh: Client HostKeyAlgorithms configuration variable [\#442](https://github.com/dev-sec/ansible-collection-hardening/pull/442) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([sepek](https://github.com/sepek))
+
+**Fixed bugs:**
+
+- mysql USER and HOST should be quoted for drop query [\#443](https://github.com/dev-sec/ansible-collection-hardening/pull/443) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([neubi4](https://github.com/neubi4))
+
+**Closed issues:**
+
+- Support HostKeyAlgorithms configuration for ssh\_client file [\#441](https://github.com/dev-sec/ansible-collection-hardening/issues/441)
+
+**Merged pull requests:**
+
+- fixed a typo in comments [\#439](https://github.com/dev-sec/ansible-collection-hardening/pull/439) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([ssttehrani](https://github.com/ssttehrani))
+
+## [7.5.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.5.0) (2021-04-01)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.4.0...7.5.0)
+
+**Implemented enhancements:**
+
+- Not accepting source routing for IPv6. This was already done for IPv4. [\#424](https://github.com/dev-sec/ansible-collection-hardening/pull/424) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+
+**Fixed bugs:**
+
+- SSH kex sntrup4591761x25519-sha512@tinyssh.org replaced [\#433](https://github.com/dev-sec/ansible-collection-hardening/issues/433)
+- Fix ssh kex sntrup761x25519-sha512@openssh.com for openssh \>= 8.5 [\#437](https://github.com/dev-sec/ansible-collection-hardening/pull/437) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([BenjaminBoehm](https://github.com/BenjaminBoehm))
+
+**Closed issues:**
+
+- Harden user home directories [\#276](https://github.com/dev-sec/ansible-collection-hardening/issues/276)
+
+**Merged pull requests:**
+
+-  remove secure-auth param if mysql \>= 8.0.3 [\#438](https://github.com/dev-sec/ansible-collection-hardening/pull/438) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Improved comments. [\#436](https://github.com/dev-sec/ansible-collection-hardening/pull/436) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- os\_auth\_pam\_pwquality\_options: Changed type to authtok\_type [\#432](https://github.com/dev-sec/ansible-collection-hardening/pull/432) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- add restart-auditd handler after configuration change [\#427](https://github.com/dev-sec/ansible-collection-hardening/pull/427) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add new tasks to delete mysql users without passwords [\#423](https://github.com/dev-sec/ansible-collection-hardening/pull/423) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Uppercased first letter of task names. [\#422](https://github.com/dev-sec/ansible-collection-hardening/pull/422) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([joubbi](https://github.com/joubbi))
+
+## [7.4.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.4.0) (2021-03-23)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.3.0...7.4.0)
+
+**Implemented enhancements:**
+
+- Harden user home dirs [\#428](https://github.com/dev-sec/ansible-collection-hardening/pull/428) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Closed issues:**
+
+- Errors in packer build for vagrant builder [\#244](https://github.com/dev-sec/ansible-collection-hardening/issues/244)
+
+**Merged pull requests:**
+
+- Use pam\_pwhistory.so instead of pam\_unix.so for remembering old passwords [\#431](https://github.com/dev-sec/ansible-collection-hardening/pull/431) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- Remove comments from PAM config file, but keep it in the template [\#430](https://github.com/dev-sec/ansible-collection-hardening/pull/430) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- add support for using a proxy to test with molecule [\#429](https://github.com/dev-sec/ansible-collection-hardening/pull/429) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Improve Documentation for sysctl defaults [\#418](https://github.com/dev-sec/ansible-collection-hardening/pull/418) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+
+## [7.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.3.0) (2021-03-16)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.2.0...7.3.0)
+
+**Implemented enhancements:**
+
+- pam\_tally2 is deprecated in RHEL8 and pam\_faillock should be used in EL7 and EL8 instead. [\#377](https://github.com/dev-sec/ansible-collection-hardening/issues/377) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Replace pam\_tally2 with pam\_faillock in Redhat [\#273](https://github.com/dev-sec/ansible-collection-hardening/issues/273) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Extend GSSAPI configuration support to ssh\_config [\#403](https://github.com/dev-sec/ansible-collection-hardening/pull/403) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([wzzrd](https://github.com/wzzrd))
+- add restart handler variable for mysql role [\#399](https://github.com/dev-sec/ansible-collection-hardening/pull/399) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- restructure PAM handling and update for currently supported Linux distributions [\#392](https://github.com/dev-sec/ansible-collection-hardening/pull/392) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+
+**Fixed bugs:**
+
+- Not able to use `sudo` command for user authenticated via ActiveDirectory [\#278](https://github.com/dev-sec/ansible-collection-hardening/issues/278) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- You shouldn't touch /etc/pam.d/system-auth-ac in RedHat/CentOS [\#252](https://github.com/dev-sec/ansible-collection-hardening/issues/252) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+
+**Closed issues:**
+
+- Netdata monitoring of docker in docker no longer possible [\#412](https://github.com/dev-sec/ansible-collection-hardening/issues/412)
+- Unable to connect with SSH \(Permission denied \(publickey\)\) [\#411](https://github.com/dev-sec/ansible-collection-hardening/issues/411)
+- TASK \[os\_hardening : configure auditd | package-08\] [\#410](https://github.com/dev-sec/ansible-collection-hardening/issues/410)
+- Collection throws undefined ansible\_role\_name error in auditd task [\#409](https://github.com/dev-sec/ansible-collection-hardening/issues/409)
+- Ensure permissions on /etc/crontab are configured [\#375](https://github.com/dev-sec/ansible-collection-hardening/issues/375) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Documentation should be updated [\#361](https://github.com/dev-sec/ansible-collection-hardening/issues/361)
+
+**Merged pull requests:**
+
+- Improve Release Action [\#421](https://github.com/dev-sec/ansible-collection-hardening/pull/421) ([schurzi](https://github.com/schurzi))
+- remove FQCN from roles in examples [\#420](https://github.com/dev-sec/ansible-collection-hardening/pull/420) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Ensure permissions on /etc/crontab are configured [\#405](https://github.com/dev-sec/ansible-collection-hardening/pull/405) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- remove FQCN from roles in examples [\#404](https://github.com/dev-sec/ansible-collection-hardening/pull/404) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- do not install mysql python package on target host [\#401](https://github.com/dev-sec/ansible-collection-hardening/pull/401) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- make wrong password fail task [\#400](https://github.com/dev-sec/ansible-collection-hardening/pull/400) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.2.0) (2021-02-10)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.1.1...7.2.0)
+
+**Implemented enhancements:**
+
+- Add variable to specify SSH host RSA key size [\#394](https://github.com/dev-sec/ansible-collection-hardening/pull/394) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Normo](https://github.com/Normo))
+- Set default for ssh host key files only when hardening the server [\#393](https://github.com/dev-sec/ansible-collection-hardening/pull/393) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Normo](https://github.com/Normo))
+
+**Fixed bugs:**
+
+- A reason why instance would go in rescue mode ?  [\#267](https://github.com/dev-sec/ansible-collection-hardening/issues/267)
+- fix galaxy action to update local galaxy.yml [\#395](https://github.com/dev-sec/ansible-collection-hardening/pull/395) ([Normo](https://github.com/Normo))
+
+**Closed issues:**
+
+- Updating version in galaxy.yml should be part of the release process [\#396](https://github.com/dev-sec/ansible-collection-hardening/issues/396)
+- ssh\_hardening fail on keypair generation  [\#388](https://github.com/dev-sec/ansible-collection-hardening/issues/388)
+- The system must display the date and time of the last successful account logon upon an SSH logon. [\#362](https://github.com/dev-sec/ansible-collection-hardening/issues/362)
+- Error in "root password is present" step [\#326](https://github.com/dev-sec/ansible-collection-hardening/issues/326)
+
+**Merged pull requests:**
+
+- update ansible-lint to version 5 [\#397](https://github.com/dev-sec/ansible-collection-hardening/pull/397) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- fix minimum required ansible version in docs [\#390](https://github.com/dev-sec/ansible-collection-hardening/pull/390) ([schurzi](https://github.com/schurzi))
+
+## [7.1.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.1.1) (2021-02-05)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.1.0...7.1.1)
+
+**Fixed bugs:**
+
+- use fqcn for community.crypto.openssh\_keypair module [\#389](https://github.com/dev-sec/ansible-collection-hardening/pull/389) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+
+**Closed issues:**
+
+- AnsibleUndefinedVariable: 'ansible\_role\_name' is undefined with 7.1.0 [\#387](https://github.com/dev-sec/ansible-collection-hardening/issues/387)
+
+## [7.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.1.0) (2021-02-02)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.0.0...7.1.0)
+
+**Implemented enhancements:**
+
+- Default value for ssh\_max\_startups should be changed [\#366](https://github.com/dev-sec/ansible-collection-hardening/issues/366) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
 - Comment in configuration files should state which collection was there [\#345](https://github.com/dev-sec/ansible-collection-hardening/issues/345)
 - Error on applying the sysctl vars on Debian Jessy [\#230](https://github.com/dev-sec/ansible-collection-hardening/issues/230)
-- add Support for OpenSSH HostCertificate config option [\#380](https://github.com/dev-sec/ansible-collection-hardening/pull/380) ([mpraeger](https://github.com/mpraeger))
-- Syncookie [\#372](https://github.com/dev-sec/ansible-collection-hardening/pull/372) ([joubbi](https://github.com/joubbi))
-- Sorted sysctl values and lists in READMEs alphabetically \(No functional changes\). [\#371](https://github.com/dev-sec/ansible-collection-hardening/pull/371) ([joubbi](https://github.com/joubbi))
-- make auditd 'max\_log\_file' configurable [\#370](https://github.com/dev-sec/ansible-collection-hardening/pull/370) ([tgueldner-mms](https://github.com/tgueldner-mms))
-- reduce maximum unauthenticated ssh sessions [\#368](https://github.com/dev-sec/ansible-collection-hardening/pull/368) ([schurzi](https://github.com/schurzi))
+- add Support for OpenSSH HostCertificate config option [\#380](https://github.com/dev-sec/ansible-collection-hardening/pull/380) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([mpraeger](https://github.com/mpraeger))
+- Syncookie [\#372](https://github.com/dev-sec/ansible-collection-hardening/pull/372) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- Sorted sysctl values and lists in READMEs alphabetically \(No functional changes\). [\#371](https://github.com/dev-sec/ansible-collection-hardening/pull/371) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- make auditd 'max\_log\_file' configurable [\#370](https://github.com/dev-sec/ansible-collection-hardening/pull/370) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([tgueldner-mms](https://github.com/tgueldner-mms))
+- reduce maximum unauthenticated ssh sessions [\#368](https://github.com/dev-sec/ansible-collection-hardening/pull/368) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
 - add a runtime.yml to declare minimum ansible version [\#363](https://github.com/dev-sec/ansible-collection-hardening/pull/363) ([rndmh3ro](https://github.com/rndmh3ro))
-- change inclusion of os specific defaults [\#353](https://github.com/dev-sec/ansible-collection-hardening/pull/353) ([schurzi](https://github.com/schurzi))
-- make the os\_env\_umask variable usable [\#351](https://github.com/dev-sec/ansible-collection-hardening/pull/351) ([sprat](https://github.com/sprat))
-- Fix \#348: make ssh configuration files paths configurable [\#350](https://github.com/dev-sec/ansible-collection-hardening/pull/350) ([sprat](https://github.com/sprat))
-- Removed Protocol statement in later versions of sshd, since the code … [\#342](https://github.com/dev-sec/ansible-collection-hardening/pull/342) ([joubbi](https://github.com/joubbi))
-- Improvements of comments in opensshd.conf.j2  \#338 [\#339](https://github.com/dev-sec/ansible-collection-hardening/pull/339) ([joubbi](https://github.com/joubbi))
+- change inclusion of os specific defaults [\#353](https://github.com/dev-sec/ansible-collection-hardening/pull/353) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- make the os\_env\_umask variable usable [\#351](https://github.com/dev-sec/ansible-collection-hardening/pull/351) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([sprat](https://github.com/sprat))
+- Fix \#348: make ssh configuration files paths configurable [\#350](https://github.com/dev-sec/ansible-collection-hardening/pull/350) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([sprat](https://github.com/sprat))
+- Removed Protocol statement in later versions of sshd, since the code … [\#342](https://github.com/dev-sec/ansible-collection-hardening/pull/342) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([joubbi](https://github.com/joubbi))
+- Improvements of comments in opensshd.conf.j2  \#338 [\#339](https://github.com/dev-sec/ansible-collection-hardening/pull/339) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([joubbi](https://github.com/joubbi))
 
 **Fixed bugs:**
 
 - Comments in opensshd.conf.j2 should be improved [\#338](https://github.com/dev-sec/ansible-collection-hardening/issues/338)
-- check for correct cpu vendor in initramfs-tools [\#374](https://github.com/dev-sec/ansible-collection-hardening/pull/374) ([schurzi](https://github.com/schurzi))
-- set hidepid=0 on RHEL/CentOS 7 [\#369](https://github.com/dev-sec/ansible-collection-hardening/pull/369) ([schurzi](https://github.com/schurzi))
+- check for correct cpu vendor in initramfs-tools [\#374](https://github.com/dev-sec/ansible-collection-hardening/pull/374) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- set hidepid=0 on RHEL/CentOS 7 [\#369](https://github.com/dev-sec/ansible-collection-hardening/pull/369) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
 
 **Closed issues:**
 
 - initramfs-tools modules.j2 does not seem to be able to detect AMD CPUs [\#373](https://github.com/dev-sec/ansible-collection-hardening/issues/373)
 - How do i install this on Centos 8? [\#367](https://github.com/dev-sec/ansible-collection-hardening/issues/367)
-- hidepid=2 gives error when running systemctl on EL7 [\#364](https://github.com/dev-sec/ansible-collection-hardening/issues/364)
+- hidepid=2 gives error when running systemctl on EL7 [\#364](https://github.com/dev-sec/ansible-collection-hardening/issues/364) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
 - Allow putting the ssh/sshd config in alternative files [\#348](https://github.com/dev-sec/ansible-collection-hardening/issues/348)
 - os\_env\_umask has no effect [\#344](https://github.com/dev-sec/ansible-collection-hardening/issues/344)
-- Don't modify /etc/sysctl.conf [\#343](https://github.com/dev-sec/ansible-collection-hardening/issues/343)
+- Don't modify /etc/sysctl.conf [\#343](https://github.com/dev-sec/ansible-collection-hardening/issues/343) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
 
 **Merged pull requests:**
 
+- use version tag for changelog action [\#386](https://github.com/dev-sec/ansible-collection-hardening/pull/386) ([schurzi](https://github.com/schurzi))
 - make release workflow manually runnable [\#384](https://github.com/dev-sec/ansible-collection-hardening/pull/384) ([schurzi](https://github.com/schurzi))
 - run labeler workflow with higher privileges [\#383](https://github.com/dev-sec/ansible-collection-hardening/pull/383) ([schurzi](https://github.com/schurzi))
 - remove issue labels from changelog [\#382](https://github.com/dev-sec/ansible-collection-hardening/pull/382) ([schurzi](https://github.com/schurzi))
-- Added comment on top of templates about which role manages the file [\#378](https://github.com/dev-sec/ansible-collection-hardening/pull/378) ([joubbi](https://github.com/joubbi))
+- Added comment on top of templates about which role manages the file [\#378](https://github.com/dev-sec/ansible-collection-hardening/pull/378) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([joubbi](https://github.com/joubbi))
 - Regenerate RSA key with size 4096 bits [\#376](https://github.com/dev-sec/ansible-collection-hardening/pull/376) ([ssttehrani](https://github.com/ssttehrani))
 - fix second changelog generation task, too [\#349](https://github.com/dev-sec/ansible-collection-hardening/pull/349) ([rndmh3ro](https://github.com/rndmh3ro))
 - fix changelog generation [\#341](https://github.com/dev-sec/ansible-collection-hardening/pull/341) ([rndmh3ro](https://github.com/rndmh3ro))
-- Improve README for ssh\_hardening [\#335](https://github.com/dev-sec/ansible-collection-hardening/pull/335) ([szEvEz](https://github.com/szEvEz))
+- Improve README for ssh\_hardening [\#335](https://github.com/dev-sec/ansible-collection-hardening/pull/335) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([szEvEz](https://github.com/szEvEz))
 
 ## [7.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.0.0) (2020-11-11)
 
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/6.2.0...7.0.0)
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/a9591764206b79a4ed324bb8576151ebac0127b1...7.0.0)
 
 **Breaking changes:**
 
@@ -57,11 +552,21 @@
 
 **Implemented enhancements:**
 
-- Breaking change in ansible-lint - set file permissions explicitly [\#299](https://github.com/dev-sec/ansible-collection-hardening/issues/299)
-- Improve Documentation [\#315](https://github.com/dev-sec/ansible-collection-hardening/pull/315) ([schurzi](https://github.com/schurzi))
-- Arch support [\#303](https://github.com/dev-sec/ansible-collection-hardening/pull/303) ([rndmh3ro](https://github.com/rndmh3ro))
-- fix linting for molecule [\#301](https://github.com/dev-sec/ansible-collection-hardening/pull/301) ([schurzi](https://github.com/schurzi))
-- file permissions explicitly defined [\#300](https://github.com/dev-sec/ansible-collection-hardening/pull/300) ([danielkubat](https://github.com/danielkubat))
+- Breaking change in ansible-lint - set file permissions explicitly [\#299](https://github.com/dev-sec/ansible-collection-hardening/issues/299) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Configure audit=1 for more accurate auid auditing [\#253](https://github.com/dev-sec/ansible-collection-hardening/issues/253)
+- Add Debian Buster support for ansible-os-hardening [\#233](https://github.com/dev-sec/ansible-collection-hardening/issues/233)
+- Add CentOS 8 support for ansible-os-hardening [\#232](https://github.com/dev-sec/ansible-collection-hardening/issues/232)
+- Speed up "minimize access on found files" task [\#208](https://github.com/dev-sec/ansible-collection-hardening/issues/208)
+- Fedora support? [\#163](https://github.com/dev-sec/ansible-collection-hardening/issues/163)
+- Update some RH settings in this role [\#155](https://github.com/dev-sec/ansible-collection-hardening/issues/155)
+- Add selinux configuration [\#154](https://github.com/dev-sec/ansible-collection-hardening/issues/154)
+- Warning about "include" for tasks for ansible-playbook 2.4.0 \(devel f0a5854e39\) [\#131](https://github.com/dev-sec/ansible-collection-hardening/issues/131)
+- Removal of core dump hardening configuration if core dumps are allowed [\#129](https://github.com/dev-sec/ansible-collection-hardening/issues/129)
+- Description of the Ansible roles of dev-sec says "This Ansible playbook" [\#97](https://github.com/dev-sec/ansible-collection-hardening/issues/97)
+- Improve Documentation [\#315](https://github.com/dev-sec/ansible-collection-hardening/pull/315) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- Arch support [\#303](https://github.com/dev-sec/ansible-collection-hardening/pull/303) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- fix linting for molecule [\#301](https://github.com/dev-sec/ansible-collection-hardening/pull/301) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- file permissions explicitly defined [\#300](https://github.com/dev-sec/ansible-collection-hardening/pull/300) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([danielkubat](https://github.com/danielkubat))
 - Optimize and unify when clause [\#295](https://github.com/dev-sec/ansible-collection-hardening/pull/295) ([Alexhha](https://github.com/Alexhha))
 - use find module instead of shell [\#294](https://github.com/dev-sec/ansible-collection-hardening/pull/294) ([danielkubat](https://github.com/danielkubat))
 - improve testing [\#287](https://github.com/dev-sec/ansible-collection-hardening/pull/287) ([schurzi](https://github.com/schurzi))
@@ -69,18 +574,172 @@
 - unify changelog and release actions [\#279](https://github.com/dev-sec/ansible-collection-hardening/pull/279) ([rndmh3ro](https://github.com/rndmh3ro))
 - purge insecure packages [\#275](https://github.com/dev-sec/ansible-collection-hardening/pull/275) ([chris-rock](https://github.com/chris-rock))
 - add changelog and release workflow [\#271](https://github.com/dev-sec/ansible-collection-hardening/pull/271) ([rndmh3ro](https://github.com/rndmh3ro))
+- github action for changelog generation [\#270](https://github.com/dev-sec/ansible-collection-hardening/pull/270) ([rndmh3ro](https://github.com/rndmh3ro))
+- Make useradd defaults in login.defs dependent on OS [\#266](https://github.com/dev-sec/ansible-collection-hardening/pull/266) ([aisbergg](https://github.com/aisbergg))
+- Add kernel hardening parameters from Tails and CIS Benchmark [\#263](https://github.com/dev-sec/ansible-collection-hardening/pull/263) ([kravietz](https://github.com/kravietz))
+- add ansible-lint [\#262](https://github.com/dev-sec/ansible-collection-hardening/pull/262) ([rndmh3ro](https://github.com/rndmh3ro))
+- Remove trailing space [\#261](https://github.com/dev-sec/ansible-collection-hardening/pull/261) ([kravietz](https://github.com/kravietz))
+- Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-collection-hardening/pull/259) ([jaredledvina](https://github.com/jaredledvina))
+- Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-collection-hardening/pull/254) ([kravietz](https://github.com/kravietz))
+- Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-collection-hardening/pull/251) ([dustinmiller](https://github.com/dustinmiller))
+- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
+- Make max\_log\_file\_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-collection-hardening/pull/246) ([jandd](https://github.com/jandd))
+- Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-collection-hardening/pull/240) ([ghost](https://github.com/ghost))
+- Fedora - Use new auto ansible\_python\_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-collection-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
+- add test support for CentOS8 [\#237](https://github.com/dev-sec/ansible-collection-hardening/pull/237) ([yeoldegrove](https://github.com/yeoldegrove))
+- Support configuring SELinux and default to enforcing [\#236](https://github.com/dev-sec/ansible-collection-hardening/pull/236) ([jaredledvina](https://github.com/jaredledvina))
+- Add test support for debian buster [\#234](https://github.com/dev-sec/ansible-collection-hardening/pull/234) ([123Haynes](https://github.com/123Haynes))
+- Changed local var name to a less common one [\#231](https://github.com/dev-sec/ansible-collection-hardening/pull/231) ([rgarrigue](https://github.com/rgarrigue))
+- Use ansible facts for vars [\#226](https://github.com/dev-sec/ansible-collection-hardening/pull/226) ([joshuatalb](https://github.com/joshuatalb))
+- Fix deprecation warnings in Ansible 2.8 [\#224](https://github.com/dev-sec/ansible-collection-hardening/pull/224) ([Normo](https://github.com/Normo))
+- add docs to find-task in minimize access. fix \#219 [\#220](https://github.com/dev-sec/ansible-collection-hardening/pull/220) ([rndmh3ro](https://github.com/rndmh3ro))
+- remove eol'd OS and add new [\#217](https://github.com/dev-sec/ansible-collection-hardening/pull/217) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add note about docker under warning [\#214](https://github.com/dev-sec/ansible-collection-hardening/pull/214) ([ChrisMcKee](https://github.com/ChrisMcKee))
+- change minimize access tasks to speed them up [\#209](https://github.com/dev-sec/ansible-collection-hardening/pull/209) ([rndmh3ro](https://github.com/rndmh3ro))
+- Added fedora support [\#206](https://github.com/dev-sec/ansible-collection-hardening/pull/206) ([jonaswre](https://github.com/jonaswre))
+- Pass package list directly to apt and yum modules without using with\_items loop [\#200](https://github.com/dev-sec/ansible-collection-hardening/pull/200) ([Normo](https://github.com/Normo))
+- add ubuntu 1804 support [\#196](https://github.com/dev-sec/ansible-collection-hardening/pull/196) ([rndmh3ro](https://github.com/rndmh3ro))
+- add option to disable auditd [\#192](https://github.com/dev-sec/ansible-collection-hardening/pull/192) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix problems with efi and vfat [\#190](https://github.com/dev-sec/ansible-collection-hardening/pull/190) ([rndmh3ro](https://github.com/rndmh3ro))
+- added os\_hardening\_enabled flag [\#186](https://github.com/dev-sec/ansible-collection-hardening/pull/186) ([jcheroske](https://github.com/jcheroske))
+- add amazon run opts to travis [\#183](https://github.com/dev-sec/ansible-collection-hardening/pull/183) ([rndmh3ro](https://github.com/rndmh3ro))
+- use package instead of yum and apt [\#180](https://github.com/dev-sec/ansible-collection-hardening/pull/180) ([rndmh3ro](https://github.com/rndmh3ro))
+- add oracle7 to travis [\#178](https://github.com/dev-sec/ansible-collection-hardening/pull/178) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix wrong permissions passwdqc \#170 [\#176](https://github.com/dev-sec/ansible-collection-hardening/pull/176) ([rndmh3ro](https://github.com/rndmh3ro))
+- ipv4 forwarding comment is inconsistent with example [\#174](https://github.com/dev-sec/ansible-collection-hardening/pull/174) ([carchrae](https://github.com/carchrae))
+- Rename pam\_passwdqd.j2 to pam\_passwdqc.j2 [\#172](https://github.com/dev-sec/ansible-collection-hardening/pull/172) ([martinbydefault](https://github.com/martinbydefault))
+- Use package state 'present' since 'installed' is deprecated [\#168](https://github.com/dev-sec/ansible-collection-hardening/pull/168) ([Normo](https://github.com/Normo))
+- Update syntax to Ansible 2.4 [\#161](https://github.com/dev-sec/ansible-collection-hardening/pull/161) ([thomasjpfan](https://github.com/thomasjpfan))
+- add amazon linux testing [\#160](https://github.com/dev-sec/ansible-collection-hardening/pull/160) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add support for Amazon Linux [\#158](https://github.com/dev-sec/ansible-collection-hardening/pull/158) ([woneill](https://github.com/woneill))
+- Don't create home for system accounts [\#156](https://github.com/dev-sec/ansible-collection-hardening/pull/156) ([oakey-b1](https://github.com/oakey-b1))
+- Prevent disabling of filesystems via whitelist [\#153](https://github.com/dev-sec/ansible-collection-hardening/pull/153) ([manuelprinz](https://github.com/manuelprinz))
+- Add kernel hardening settings from Ubuntu /etc/sysctl.d [\#150](https://github.com/dev-sec/ansible-collection-hardening/pull/150) ([kravietz](https://github.com/kravietz))
+- Removal of core dump hardening configuration if core dumps are allowed [\#146](https://github.com/dev-sec/ansible-collection-hardening/pull/146) ([martinbydefault](https://github.com/martinbydefault))
+- install and configure auditd - fix inspec package-08 [\#144](https://github.com/dev-sec/ansible-collection-hardening/pull/144) ([rndmh3ro](https://github.com/rndmh3ro))
+- add missing sysctl parameter [\#143](https://github.com/dev-sec/ansible-collection-hardening/pull/143) ([rndmh3ro](https://github.com/rndmh3ro))
+- update readme [\#139](https://github.com/dev-sec/ansible-collection-hardening/pull/139) ([rndmh3ro](https://github.com/rndmh3ro))
+- add modprobe template, control os-10 [\#138](https://github.com/dev-sec/ansible-collection-hardening/pull/138) ([rndmh3ro](https://github.com/rndmh3ro))
+- new task for delete netrc files, control os-09 [\#137](https://github.com/dev-sec/ansible-collection-hardening/pull/137) ([rndmh3ro](https://github.com/rndmh3ro))
+- add passwd task, control os-03 [\#136](https://github.com/dev-sec/ansible-collection-hardening/pull/136) ([rndmh3ro](https://github.com/rndmh3ro))
+- remove prelink package, control package-09 [\#135](https://github.com/dev-sec/ansible-collection-hardening/pull/135) ([rndmh3ro](https://github.com/rndmh3ro))
+- style update [\#134](https://github.com/dev-sec/ansible-collection-hardening/pull/134) ([rndmh3ro](https://github.com/rndmh3ro))
+- Remove deprecated include for static tasks and use instead import\_tasks fix \#131 [\#132](https://github.com/dev-sec/ansible-collection-hardening/pull/132) ([HelioCampos](https://github.com/HelioCampos))
+- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-collection-hardening/pull/130) ([fazlearefin](https://github.com/fazlearefin))
+- install initramfs-tools [\#114](https://github.com/dev-sec/ansible-collection-hardening/pull/114) ([rndmh3ro](https://github.com/rndmh3ro))
+- omit empty variables [\#106](https://github.com/dev-sec/ansible-collection-hardening/pull/106) ([rndmh3ro](https://github.com/rndmh3ro))
+- Supports --check mode [\#93](https://github.com/dev-sec/ansible-collection-hardening/pull/93) ([conorsch](https://github.com/conorsch))
+- Adds support for CentOS 7 [\#91](https://github.com/dev-sec/ansible-collection-hardening/pull/91) ([conorsch](https://github.com/conorsch))
+- Docker [\#90](https://github.com/dev-sec/ansible-collection-hardening/pull/90) ([rndmh3ro](https://github.com/rndmh3ro))
+- debian 8 support [\#88](https://github.com/dev-sec/ansible-collection-hardening/pull/88) ([rndmh3ro](https://github.com/rndmh3ro))
+- Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-collection-hardening/pull/85) ([fitz123](https://github.com/fitz123))
+- replace ignore\_errors to failed\_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-collection-hardening/pull/81) ([fitz123](https://github.com/fitz123))
+- fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-collection-hardening/pull/79) ([fitz123](https://github.com/fitz123))
+- update platforms in meta-file [\#69](https://github.com/dev-sec/ansible-collection-hardening/pull/69) ([rndmh3ro](https://github.com/rndmh3ro))
+- add webhook for ansible galaxy [\#68](https://github.com/dev-sec/ansible-collection-hardening/pull/68) ([rndmh3ro](https://github.com/rndmh3ro))
+- Move sysctl vars to defaults [\#67](https://github.com/dev-sec/ansible-collection-hardening/pull/67) ([rndmh3ro](https://github.com/rndmh3ro))
+- make sys\_uid and sys\_gid configurable [\#62](https://github.com/dev-sec/ansible-collection-hardening/pull/62) ([rndmh3ro](https://github.com/rndmh3ro))
+- Ansible 2.0 support [\#59](https://github.com/dev-sec/ansible-collection-hardening/pull/59) ([rndmh3ro](https://github.com/rndmh3ro))
+- use inspec as test framework [\#58](https://github.com/dev-sec/ansible-collection-hardening/pull/58) ([chris-rock](https://github.com/chris-rock))
+- Packages as attributes [\#57](https://github.com/dev-sec/ansible-collection-hardening/pull/57) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change categories to tags for upcoming ansible 2.0 [\#56](https://github.com/dev-sec/ansible-collection-hardening/pull/56) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add SINGLE and PROMPT parameters. [\#55](https://github.com/dev-sec/ansible-collection-hardening/pull/55) ([rndmh3ro](https://github.com/rndmh3ro))
+- add changelog generator [\#54](https://github.com/dev-sec/ansible-collection-hardening/pull/54) ([chris-rock](https://github.com/chris-rock))
 
 **Fixed bugs:**
 
 - Task "set 10.hardcore.conf perms to 0400 and root ownership" fails in check mode [\#313](https://github.com/dev-sec/ansible-collection-hardening/issues/313)
+- Inconsistent use of role vars/role defaults [\#284](https://github.com/dev-sec/ansible-collection-hardening/issues/284)
+- Is it safe to use on Debian 10? The build is failing. [\#281](https://github.com/dev-sec/ansible-collection-hardening/issues/281)
+- /etc/login.defs alters centos 7/8 default values [\#265](https://github.com/dev-sec/ansible-collection-hardening/issues/265)
+- Invalid Conditionals in user\_accounts.yml [\#255](https://github.com/dev-sec/ansible-collection-hardening/issues/255)
+- `auth-system` related files are created for non-RHEL systems \(e.g. Debian\) [\#247](https://github.com/dev-sec/ansible-collection-hardening/issues/247)
+- NSA website links are stale [\#227](https://github.com/dev-sec/ansible-collection-hardening/issues/227)
+- Running ansible on python3 throughs "TypeError: '\<=' not supported between instances of 'str' and 'int'"  [\#223](https://github.com/dev-sec/ansible-collection-hardening/issues/223)
+- \[lots of\] deprecation warnings in Ansible 2.8 [\#221](https://github.com/dev-sec/ansible-collection-hardening/issues/221)
+- `squash_actions` deprecation warning [\#218](https://github.com/dev-sec/ansible-collection-hardening/issues/218)
+- login.defs.j2 template: ENV\_PATH is missing ':' before variable substitution [\#202](https://github.com/dev-sec/ansible-collection-hardening/issues/202)
+- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-collection-hardening/issues/191)
+- Setting os\_security\_users\_allow has no effect [\#175](https://github.com/dev-sec/ansible-collection-hardening/issues/175)
+- minimize\_access: maximum recursion depth exceeded on Ansible 2.5 [\#171](https://github.com/dev-sec/ansible-collection-hardening/issues/171)
+- wrong permissions passwdqc [\#170](https://github.com/dev-sec/ansible-collection-hardening/issues/170)
+- 'sysctl\_rhel\_config' is undefined [\#167](https://github.com/dev-sec/ansible-collection-hardening/issues/167)
+- Update deprecated `include` statements [\#166](https://github.com/dev-sec/ansible-collection-hardening/issues/166)
+- Strongly recommend against disabling vfat by default [\#162](https://github.com/dev-sec/ansible-collection-hardening/issues/162)
+- bug in ufw.j2 template [\#151](https://github.com/dev-sec/ansible-collection-hardening/issues/151)
+- Add a "don't fail on error" switch ? [\#148](https://github.com/dev-sec/ansible-collection-hardening/issues/148)
+- System completely unresponsive after role execution [\#145](https://github.com/dev-sec/ansible-collection-hardening/issues/145)
+- Why is rsync removed? [\#141](https://github.com/dev-sec/ansible-collection-hardening/issues/141)
+- RHEL 7.4: Too many setuid bits removed [\#140](https://github.com/dev-sec/ansible-collection-hardening/issues/140)
+- Change system accounts not on the user provided ignore-list items are not JSON serializable [\#125](https://github.com/dev-sec/ansible-collection-hardening/issues/125)
+- playbook makes OS undetectable [\#124](https://github.com/dev-sec/ansible-collection-hardening/issues/124)
+- Centos7/RHEL7: Exec shield is enabled by default and not manageable anymore by sysctl.conf [\#118](https://github.com/dev-sec/ansible-collection-hardening/issues/118)
+- Could not find gem 'ruby \(\>= 2.1.0\)' [\#116](https://github.com/dev-sec/ansible-collection-hardening/issues/116)
+- os\_security\_kernel\_enable\_sysrq is not implemented [\#115](https://github.com/dev-sec/ansible-collection-hardening/issues/115)
+- The task sysctl fails when /etc/initramfs-tools is not present [\#111](https://github.com/dev-sec/ansible-collection-hardening/issues/111)
+- The role fails when conditionally included [\#105](https://github.com/dev-sec/ansible-collection-hardening/issues/105)
+- Deprecation warning always\_run [\#103](https://github.com/dev-sec/ansible-collection-hardening/issues/103)
+- CentOS 7 selinux dependencies [\#102](https://github.com/dev-sec/ansible-collection-hardening/issues/102)
+- ubuntu xenial warning during activate gpg-check for yum-repos [\#99](https://github.com/dev-sec/ansible-collection-hardening/issues/99)
+- rhel\_system\_auth.j2 is still using pam\_passwdqc.so for CentOS 7 [\#98](https://github.com/dev-sec/ansible-collection-hardening/issues/98)
+- Centos 7.1 fails at  \[Change various sysctl-settings on rhel-hosts...\] [\#74](https://github.com/dev-sec/ansible-collection-hardening/issues/74)
+- Enable pam\_pwquality in rhel-family \> 7 [\#73](https://github.com/dev-sec/ansible-collection-hardening/issues/73)
+- Hardening fails on Centos 7.1 at task 'minimize access' [\#71](https://github.com/dev-sec/ansible-collection-hardening/issues/71)
+- "irc" user always changed after reboot [\#53](https://github.com/dev-sec/ansible-collection-hardening/issues/53)
 - use touch for 10.hardcore.conf to avoid problems with dry-run [\#314](https://github.com/dev-sec/ansible-collection-hardening/pull/314) ([schurzi](https://github.com/schurzi))
 - use touch with no date changes [\#310](https://github.com/dev-sec/ansible-collection-hardening/pull/310) ([rndmh3ro](https://github.com/rndmh3ro))
 - do not touch sysctl file to avoid idempotency problems [\#309](https://github.com/dev-sec/ansible-collection-hardening/pull/309) ([rndmh3ro](https://github.com/rndmh3ro))
 - replace module parameter fixed [\#297](https://github.com/dev-sec/ansible-collection-hardening/pull/297) ([danielkubat](https://github.com/danielkubat))
+- Addressing issue \#255 [\#258](https://github.com/dev-sec/ansible-collection-hardening/pull/258) ([ljkimmel](https://github.com/ljkimmel))
+- Fix \#247, cleanup conditions [\#248](https://github.com/dev-sec/ansible-collection-hardening/pull/248) ([fernandezcuesta](https://github.com/fernandezcuesta))
+- Fix error on applying the sysctl vars on containers [\#243](https://github.com/dev-sec/ansible-collection-hardening/pull/243) ([ghost](https://github.com/ghost))
+- Update location of NSA RHEL 5 Guide [\#235](https://github.com/dev-sec/ansible-collection-hardening/pull/235) ([jaredledvina](https://github.com/jaredledvina))
+- Fix typo [\#212](https://github.com/dev-sec/ansible-collection-hardening/pull/212) ([ruslo](https://github.com/ruslo))
+- Update modprobe to 0644 [\#211](https://github.com/dev-sec/ansible-collection-hardening/pull/211) ([joshuatalb](https://github.com/joshuatalb))
+- Test Kitchen Vagrant Fixes [\#210](https://github.com/dev-sec/ansible-collection-hardening/pull/210) ([joshuatalb](https://github.com/joshuatalb))
+- \[readme\] Update documentation link [\#207](https://github.com/dev-sec/ansible-collection-hardening/pull/207) ([pmav99](https://github.com/pmav99))
+- fix ansible lint remarks [\#204](https://github.com/dev-sec/ansible-collection-hardening/pull/204) ([rndmh3ro](https://github.com/rndmh3ro))
+- add colon to user env paths - fix \#202 [\#203](https://github.com/dev-sec/ansible-collection-hardening/pull/203) ([rndmh3ro](https://github.com/rndmh3ro))
+- add /usr/bin/su to suid\_guid whitelist [\#199](https://github.com/dev-sec/ansible-collection-hardening/pull/199) ([ccolic](https://github.com/ccolic))
+- ensure that permissions to su-binary are not restricted to root user and group only, if os\_security\_users\_allow contains the value change\_user [\#197](https://github.com/dev-sec/ansible-collection-hardening/pull/197) ([szEvEz](https://github.com/szEvEz))
+- do not install passwdqc on amazon linux [\#189](https://github.com/dev-sec/ansible-collection-hardening/pull/189) ([rndmh3ro](https://github.com/rndmh3ro))
+- add back run opts for debian 8 in travis [\#184](https://github.com/dev-sec/ansible-collection-hardening/pull/184) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix core dump config file creation when core dumps are disabled [\#182](https://github.com/dev-sec/ansible-collection-hardening/pull/182) ([Normo](https://github.com/Normo))
+- change minimize access method [\#181](https://github.com/dev-sec/ansible-collection-hardening/pull/181) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix errors produced by ansible-lint [\#159](https://github.com/dev-sec/ansible-collection-hardening/pull/159) ([zbrojny120](https://github.com/zbrojny120))
+- replace single ticks with double ticks. fix \#151 [\#152](https://github.com/dev-sec/ansible-collection-hardening/pull/152) ([rndmh3ro](https://github.com/rndmh3ro))
+- fixed tag [\#149](https://github.com/dev-sec/ansible-collection-hardening/pull/149) ([martinbydefault](https://github.com/martinbydefault))
+- Remove rsync from package blacklist [\#142](https://github.com/dev-sec/ansible-collection-hardening/pull/142) ([duk3luk3](https://github.com/duk3luk3))
+- Updates "tags" parameters on includes in main.yml [\#66](https://github.com/dev-sec/ansible-collection-hardening/pull/66) ([conorsch](https://github.com/conorsch))
+- Suid set def var, fix \#64 [\#63](https://github.com/dev-sec/ansible-collection-hardening/pull/63) ([rndmh3ro](https://github.com/rndmh3ro))
 
 **Closed issues:**
 
 - Any planned support for RHEL/CentOS 8? [\#298](https://github.com/dev-sec/ansible-collection-hardening/issues/298)
+- Consider using find module instead of shell [\#293](https://github.com/dev-sec/ansible-collection-hardening/issues/293)
+- Optimize logical OR in when clause [\#292](https://github.com/dev-sec/ansible-collection-hardening/issues/292)
+- vfat added to dev-sec.conf, but efi is used [\#288](https://github.com/dev-sec/ansible-collection-hardening/issues/288)
+- The state of the galaxy release [\#269](https://github.com/dev-sec/ansible-collection-hardening/issues/269)
+- OpenSUSE Support [\#249](https://github.com/dev-sec/ansible-collection-hardening/issues/249)
+- ansible hardening fails on ubuntu 16.04 with msg": "ERROR! 'sysctl\_rhel\_config' is undefined [\#147](https://github.com/dev-sec/ansible-collection-hardening/issues/147)
+- Enhancement: Test with TestInfra and Molecule [\#128](https://github.com/dev-sec/ansible-collection-hardening/issues/128)
+- Enhancement: Pin python dependencies for development and testing [\#127](https://github.com/dev-sec/ansible-collection-hardening/issues/127)
+- Update readme to include baselines [\#122](https://github.com/dev-sec/ansible-collection-hardening/issues/122)
+- Error running on RHEL 7 due to syntax issues [\#112](https://github.com/dev-sec/ansible-collection-hardening/issues/112)
+- disable password age [\#109](https://github.com/dev-sec/ansible-collection-hardening/issues/109)
+- Permissions on /etc/shadow can lock out GUI users [\#86](https://github.com/dev-sec/ansible-collection-hardening/issues/86)
+- network related sysctl rewritten by ufw in ubuntu  [\#82](https://github.com/dev-sec/ansible-collection-hardening/issues/82)
+- ansible \>= 2.0 complains: Using bare variables is deprecated [\#78](https://github.com/dev-sec/ansible-collection-hardening/issues/78)
+- Hardening fails on Centos 7.1 at task 'remove suid/sgid bit from all binaries except in system and user whitelist' [\#72](https://github.com/dev-sec/ansible-collection-hardening/issues/72)
+- ansible 2.0 | "remove suid/sgid" task fails [\#64](https://github.com/dev-sec/ansible-collection-hardening/issues/64)
+- Custom sysctl [\#50](https://github.com/dev-sec/ansible-collection-hardening/issues/50)
+- Fix directory structure. [\#48](https://github.com/dev-sec/ansible-collection-hardening/issues/48)
+- pam auth update error [\#47](https://github.com/dev-sec/ansible-collection-hardening/issues/47)
+- ansible-os-hardening/tasks/minimize\_access.yml [\#38](https://github.com/dev-sec/ansible-collection-hardening/issues/38)
+- Role configuration. vars/main.yml? [\#34](https://github.com/dev-sec/ansible-collection-hardening/issues/34)
+- Sysctl reloading [\#18](https://github.com/dev-sec/ansible-collection-hardening/issues/18)
+- Add conditions for disabling of ip forwarding [\#15](https://github.com/dev-sec/ansible-collection-hardening/issues/15)
+- Disable System Accounts [\#6](https://github.com/dev-sec/ansible-collection-hardening/issues/6)
 
 **Merged pull requests:**
 
@@ -90,6 +749,60 @@
 - do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-collection-hardening/pull/289) ([schurzi](https://github.com/schurzi))
 - move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-collection-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
 - install procps in debian so sysctl.conf exists [\#282](https://github.com/dev-sec/ansible-collection-hardening/pull/282) ([rndmh3ro](https://github.com/rndmh3ro))
+- move defaults to os-specific vars [\#157](https://github.com/dev-sec/ansible-collection-hardening/pull/157) ([rndmh3ro](https://github.com/rndmh3ro))
+- Converts set to JSON-serializable list [\#126](https://github.com/dev-sec/ansible-collection-hardening/pull/126) ([pestaa](https://github.com/pestaa))
+- add more sysctl settings, allow overwriting [\#120](https://github.com/dev-sec/ansible-collection-hardening/pull/120) ([rndmh3ro](https://github.com/rndmh3ro))
+- remove execshield sysctl-parameter on rhel7 [\#119](https://github.com/dev-sec/ansible-collection-hardening/pull/119) ([rndmh3ro](https://github.com/rndmh3ro))
+- change shadow owner in debian systems [\#117](https://github.com/dev-sec/ansible-collection-hardening/pull/117) ([rndmh3ro](https://github.com/rndmh3ro))
+- Rhel7 [\#113](https://github.com/dev-sec/ansible-collection-hardening/pull/113) ([tyrken](https://github.com/tyrken))
+- use new Docker images [\#110](https://github.com/dev-sec/ansible-collection-hardening/pull/110) ([rndmh3ro](https://github.com/rndmh3ro))
+- Don’t refer to this role as "playbook" in the role description [\#104](https://github.com/dev-sec/ansible-collection-hardening/pull/104) ([ypid](https://github.com/ypid))
+- update template [\#101](https://github.com/dev-sec/ansible-collection-hardening/pull/101) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix deprecation warning for undefined error. \#99 [\#100](https://github.com/dev-sec/ansible-collection-hardening/pull/100) ([rndmh3ro](https://github.com/rndmh3ro))
+- add rhel7 pam\_pwquality. fix \#73 [\#94](https://github.com/dev-sec/ansible-collection-hardening/pull/94) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix a formatting issue in readme. [\#92](https://github.com/dev-sec/ansible-collection-hardening/pull/92) ([vivekagr](https://github.com/vivekagr))
+- Permits overriding permissions on /etc/shadow [\#89](https://github.com/dev-sec/ansible-collection-hardening/pull/89) ([conorsch](https://github.com/conorsch))
+- Release 3.0.0 [\#75](https://github.com/dev-sec/ansible-collection-hardening/pull/75) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add explicit role-path to kitchen.yml [\#52](https://github.com/dev-sec/ansible-collection-hardening/pull/52) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix pam passwdqc template [\#51](https://github.com/dev-sec/ansible-collection-hardening/pull/51) ([rndmh3ro](https://github.com/rndmh3ro))
+- New dir layout [\#49](https://github.com/dev-sec/ansible-collection-hardening/pull/49) ([rndmh3ro](https://github.com/rndmh3ro))
+- remove duplicate "update pam" task [\#46](https://github.com/dev-sec/ansible-collection-hardening/pull/46) ([fitz123](https://github.com/fitz123))
+- Fix stuck in case pam files was updated before by force update [\#45](https://github.com/dev-sec/ansible-collection-hardening/pull/45) ([fitz123](https://github.com/fitz123))
+- Fix nologin shell path [\#44](https://github.com/dev-sec/ansible-collection-hardening/pull/44) ([fitz123](https://github.com/fitz123))
+- improved travis-tests to cover more cases [\#42](https://github.com/dev-sec/ansible-collection-hardening/pull/42) ([rndmh3ro](https://github.com/rndmh3ro))
+- Update kitchen-ansible, remove separate debian install [\#40](https://github.com/dev-sec/ansible-collection-hardening/pull/40) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add mode to su-binary task. Fix \#38 [\#39](https://github.com/dev-sec/ansible-collection-hardening/pull/39) ([rndmh3ro](https://github.com/rndmh3ro))
+- update common kitchen.yml platforms \(ansible\), kitchen\_debian.yml platforms \(ansible\) [\#37](https://github.com/dev-sec/ansible-collection-hardening/pull/37) ([chris-rock](https://github.com/chris-rock))
+- Change oneliner if-statements to be more readable [\#36](https://github.com/dev-sec/ansible-collection-hardening/pull/36) ([rndmh3ro](https://github.com/rndmh3ro))
+- Separate system-vars from editable vars. Fix \#34 [\#35](https://github.com/dev-sec/ansible-collection-hardening/pull/35) ([rndmh3ro](https://github.com/rndmh3ro))
+- Create limits.d-directory if it does not exist. [\#33](https://github.com/dev-sec/ansible-collection-hardening/pull/33) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add correct CONTRIB-file [\#32](https://github.com/dev-sec/ansible-collection-hardening/pull/32) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add Ansible Galaxy badge [\#31](https://github.com/dev-sec/ansible-collection-hardening/pull/31) ([rndmh3ro](https://github.com/rndmh3ro))
+-  Update readme, todo, changelog, vars [\#30](https://github.com/dev-sec/ansible-collection-hardening/pull/30) ([rndmh3ro](https://github.com/rndmh3ro))
+- List-cleanup and follow symlinks added [\#29](https://github.com/dev-sec/ansible-collection-hardening/pull/29) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add module configuration [\#28](https://github.com/dev-sec/ansible-collection-hardening/pull/28) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix two sysctl-settings [\#27](https://github.com/dev-sec/ansible-collection-hardening/pull/27) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add meta-files for Ansible Galaxy [\#26](https://github.com/dev-sec/ansible-collection-hardening/pull/26) ([rndmh3ro](https://github.com/rndmh3ro))
+- Disable System Accounts. Fix \#6 [\#25](https://github.com/dev-sec/ansible-collection-hardening/pull/25) ([rndmh3ro](https://github.com/rndmh3ro))
+- Use changed\_when to avoid changed tasks [\#24](https://github.com/dev-sec/ansible-collection-hardening/pull/24) ([rndmh3ro](https://github.com/rndmh3ro))
+- Delete authconfig-task on rhel-systems [\#23](https://github.com/dev-sec/ansible-collection-hardening/pull/23) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add missing rhosts-include task [\#21](https://github.com/dev-sec/ansible-collection-hardening/pull/21) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change sysctl-task. Fix \#18 [\#20](https://github.com/dev-sec/ansible-collection-hardening/pull/20) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add travis-support [\#17](https://github.com/dev-sec/ansible-collection-hardening/pull/17) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add conditions for various tasks. Fix \#15 [\#16](https://github.com/dev-sec/ansible-collection-hardening/pull/16) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix configuration of playbook path [\#14](https://github.com/dev-sec/ansible-collection-hardening/pull/14) ([chris-rock](https://github.com/chris-rock))
+- Make tasks clearer [\#13](https://github.com/dev-sec/ansible-collection-hardening/pull/13) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add remove suid/sgid function [\#12](https://github.com/dev-sec/ansible-collection-hardening/pull/12) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add task to remove unused repos and pkgs [\#11](https://github.com/dev-sec/ansible-collection-hardening/pull/11) ([rndmh3ro](https://github.com/rndmh3ro))
+- Edit README to fit to os-hardening [\#10](https://github.com/dev-sec/ansible-collection-hardening/pull/10) ([rndmh3ro](https://github.com/rndmh3ro))
+- ignore RAs on Ipv6 [\#9](https://github.com/dev-sec/ansible-collection-hardening/pull/9) ([rndmh3ro](https://github.com/rndmh3ro))
+- Repair debian install script [\#8](https://github.com/dev-sec/ansible-collection-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
+- Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-collection-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
+- Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-collection-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-collection-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-collection-hardening/pull/3) ([arlimus](https://github.com/arlimus))
+- Add Securetty-support [\#2](https://github.com/dev-sec/ansible-collection-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-collection-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))
 
 
 

LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

README.md

@@ -1,6 +1,7 @@
 # Ansible Collection - devsec.hardening
 
 ![devsec.os_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening/badge.svg)
+![devsec.os_hardening VM](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening%20VM/badge.svg)
 ![devsec.ssh_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.ssh_hardening/badge.svg)
 ![devsec.nginx_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.nginx_hardening/badge.svg)
 ![devsec.mysql_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.mysql_hardening/badge.svg)
@@ -10,9 +11,10 @@
 This collection provides battle tested hardening for:
 
 - Linux operating systems:
-  - CentOS 7/8
-  - Debian 9/10
-  - Ubuntu 16.04/18.04/20.04
+  - CentOS 7
+  - Rocky Linux 8
+  - Debian 10/11
+  - Ubuntu 18.04/20.04/22.04
   - Amazon Linux (some roles supported)
   - Arch Linux (some roles supported)
   - Fedora (some roles supported)
@@ -25,18 +27,28 @@ This collection provides battle tested hardening for:
 
 The hardening is intended to be compliant with the Inspec DevSec Baselines:
 
-- https://github.com/dev-sec/linux-baseline
-- https://github.com/dev-sec/mysql-baseline
-- https://github.com/dev-sec/nginx-baseline
-- https://github.com/dev-sec/ssh-baseline
+- <https://github.com/dev-sec/linux-baseline>
+- <https://github.com/dev-sec/mysql-baseline>
+- <https://github.com/dev-sec/nginx-baseline>
+- <https://github.com/dev-sec/ssh-baseline>
 
-## Looking for the old ansible-os-hardening role?
+## Looking for the old roles?
 
-This role is now part of the hardening-collection. You can find the old role in the branch `legacy`.
+The roles are now part of the hardening-collection.
+We have kept the old releases of the `os-hardening` role in this repository, so you can find the them by exploring older tags.
+The last release of the standalone role was [6.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/6.2.0).
+
+The other roles are in separate archives repositories:
+
+- [apache_hardening](https://github.com/dev-sec/ansible-apache-hardening)
+- [mysql_hardening](https://github.com/dev-sec/ansible-mysql-hardening)
+- [nginx_hardening](https://github.com/dev-sec/ansible-nginx-hardening)
+- [ssh_hardening](https://github.com/dev-sec/ansible-ssh-hardening)
+- [windows_hardening](https://github.com/dev-sec/ansible-windows-hardening)
 
 ## Minimum required Ansible-version
 
-- > = 2.9.10
+- Ansible >= 2.9.10
 
 ## Included content
 
@@ -50,6 +62,12 @@ In progress, not working:
 - [apache_hardening](roles/apache_hardening/)
 - [windows_hardening](roles/windows_hardening/)
 
+## Installation
+
+Install the collection via ansible-galaxy:
+
+`ansible-galaxy collection install devsec.hardening`
+
 ## Using this collection
 
 Please refer to the examples in the readmes of the role.
@@ -68,8 +86,8 @@ See the [changelog](https://github.com/dev-sec/ansible-os-hardening/tree/master/
 
 Todos:
 
-- Work on [apache_hardening](roles/apache_hardening/) and [windows_hardening](roles/windows_hardening/).
-- Add support for more operating systems,
+- Work on [apache_hardening](roles/apache_hardening/) and [windows_hardening](roles/windows_hardening/)
+- Add support for more operating systems
 
 ## More information
 
@@ -87,6 +105,6 @@ General information:
 
 Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
 
-http://www.apache.org/licenses/LICENSE-2.0
+<http://www.apache.org/licenses/LICENSE-2.0>
 
 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

galaxy.yml

@@ -1,36 +1,13 @@
-# The namespace of the collection. This can be a company/brand/organization or product namespace under which all
-# content lives. May only contain alphanumeric lowercase characters and underscores. Namespaces cannot start with
-# underscores or numbers and cannot contain consecutive underscores
 namespace: devsec
-
-# The name of the collection. Has the same character restrictions as 'namespace'
 name: hardening
-
-# The version of the collection. Must be compatible with semantic versioning
-version: 7.0.0
-
-# The path to the Markdown (.md) readme file. This path is relative to the root of the collection
+version: 8.2.0
 readme: README.md
-
-# A list of the collection's content authors. Can be just the name or in the format 'Full Name <email> (url)
-# @nicks:irc/im.site#channel'
 authors:
-- dev-sec <[email protected]>
-
-# A short summary description of the collection
-description: This collection provides battle tested hardening for Linux, SSH, nginx, MySQL
-
-# Either a single license or a list of licenses for content inside of a collection. Ansible Galaxy currently only
-# accepts L(SPDX,https://spdx.org/licenses/) licenses. This key is mutually exclusive with 'license_file'
+  - dev-sec <[email protected]>
+description: 'This collection provides battle tested hardening for Linux, SSH, nginx, MySQL'
 license:
-- GPL-2.0-or-later
-
-# The path to the license file for the collection. This path is relative to the root of the collection. This key is
-# mutually exclusive with 'license'
+  - Apache-2.0
 license_file: ''
-
-# A list of tags you want to associate with the collection for indexing/searching. A tag name has the same character
-# requirements as 'namespace' and 'name'
 tags:
   - devsec
   - hardening
@@ -40,23 +17,19 @@ tags:
   - nginx
   - mysql
   - openssh
-
-# Collections that this collection requires to be installed for it to be usable. The key of the dict is the
-# collection label 'namespace.name'. The value is a version range
-# L(specifiers,https://python-semanticversion.readthedocs.io/en/latest/#requirement-specification). Multiple version
-# range specifiers can be set and are separated by ','
-dependencies: {}
-
-# The URL of the originating SCM repository
-repository: https://github.com/dev-sec/ansible-os-hardening
-
-# The URL to the homepage of the collection/project
-homepage: https://dev-sec.io/
-
-# The URL to the collection issue tracker
-issues: https://github.com/dev-sec/ansible-os-hardening/issues
-
-# ignore files not needed for release
+  - apache_hardening
+  - mysql_hardening
+  - nginx_hardening
+  - os_hardening
+  - ssh_hardening
+dependencies:
+  ansible.posix: '>=1.0.0'
+  community.crypto: '>=1.0.0'
+  community.general: '>=1.0.0'
+  community.mysql: '>=1.3.0'
+repository: 'https://github.com/dev-sec/ansible-collection-hardening/'
+homepage: 'https://dev-sec.io/'
+issues: 'https://github.com/dev-sec/ansible-collection-hardening/issues'
 build_ignore:
   - codecov.yml
   - .github

molecule/mysql_hardening/converge.yml

@@ -2,6 +2,12 @@
 - name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
   hosts: all
   become: true
+  collections:
+    - devsec.hardening
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
       set_fact:
@@ -18,9 +24,6 @@
         - mysql_python_package_debian is not defined
         - ansible_distribution != "Ubuntu"
         - ansible_distribution_major_version|int < 20
-    - include_role:
-        name: dev-sec.mysql
-
     - include_role:
         name: mysql_hardening
   vars:

molecule/mysql_hardening/molecule.yml

@@ -3,11 +3,9 @@ dependency:
   name: galaxy
   options:
     role-file: molecule/mysql_hardening/requirements.yml
+    requirements-file: molecule/mysql_hardening/requirements.yml
 driver:
   name: docker
-lint: |
-  yamllint roles/mysql_hardening/ molecule/mysql_hardening/ .github/workflows/mysql_hardening.yml
-  ansible-lint roles/mysql_hardening/
 platforms:
   - name: instance
     image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
@@ -20,6 +18,11 @@ platforms:
       container: docker
     security_opts:
       - apparmor=unconfined
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
+      container: docker
 provisioner:
   name: ansible
   config_options:
@@ -51,7 +54,6 @@ scenario:
     - destroy
   test_sequence:
     - dependency
-    - lint
     - destroy
     - syntax
     - create

molecule/mysql_hardening/prepare.yml

@@ -3,7 +3,25 @@
 - name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
   hosts: all
   become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
+    - name: Use Python 3 on Debian 11
+      set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+      when:
+        - ansible_distribution == 'Debian'
+        - ansible_distribution_major_version|int >= 11
+
+    - name: Use Python 2 on Debian 10
+      set_fact:
+        ansible_python_interpreter: /usr/bin/python
+      when:
+        - ansible_distribution == 'Debian'
+        - ansible_distribution_major_version|int == 10
+
     - name: Run the equivalent of "apt-get update && apt-get upgrade"
       apt:
         name: "*"
@@ -12,7 +30,7 @@
       when: ansible_os_family == 'Debian'
 
     - name: install required tools on SuSE
-      zypper:
+      community.general.zypper:
         name: "python-xml"
         state: present
       when: ansible_facts.os_family == 'Suse'
@@ -21,3 +39,35 @@
       file:
         path: "/etc/mysql/conf.d"
         state: directory
+
+    - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
+      set_fact:
+        mysql_python_package_debian: "python3-pymysql"
+      when:
+        - mysql_python_package_debian is not defined
+        - ansible_distribution == "Ubuntu"
+        - ansible_distribution_major_version|int > 19
+
+    - name: Determine required MySQL Python libraries.
+      set_fact:
+        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
+      when:
+        - mysql_python_package_debian is not defined
+        - ansible_distribution != "Ubuntu"
+        - ansible_distribution_major_version|int < 20
+
+
+    - include_role:
+        name: dev-sec.mysql
+
+    - name: create a user with an empty password
+      community.mysql.mysql_query:
+        query:
+          - "CREATE USER foo@bar;"
+        login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  vars:
+    overwrite_global_mycnf: false
+    mysql_root_password: iloverandompasswordsbutthiswilldo
+    mysql_user_password: iloverandompasswordsbutthiswilldo
+    mysql_config_file: /etc/mysql/mariadb.cnf
+    mysql_root_password_update: true

molecule/mysql_hardening/verify.yml

@@ -2,6 +2,10 @@
 - name: Verify
   hosts: all
   become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   roles:
     - geerlingguy.git
   tasks:
@@ -40,7 +44,7 @@
       shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
 
     - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/mysql-baseline.git"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/mysql-baseline/archive/refs/heads/master.zip"
       register: test_results
       changed_when: false
       ignore_errors: true

molecule/nginx_hardening/converge.yml

@@ -2,6 +2,10 @@
 - name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   become: true
   hosts: all
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   vars:
     - nginx_ppa_use: true
     - nginx_ppa_version: stable

molecule/nginx_hardening/molecule.yml

@@ -5,9 +5,6 @@ dependency:
     role-file: molecule/nginx_hardening/requirements.yml
 driver:
   name: docker
-lint: |
-  yamllint roles/nginx_hardening/ molecule/nginx_hardening/ .github/workflows/nginx_hardening.yml
-  ansible-lint roles/nginx_hardening/
 platforms:
   - name: instance
     image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
@@ -21,7 +18,10 @@ platforms:
     capabilities:
       - SYS_ADMIN
     tty: true
-    environment:
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
       container: docker
 provisioner:
   name: ansible
@@ -54,7 +54,6 @@ scenario:
     - destroy
   test_sequence:
     - dependency
-    - lint
     - destroy
     - syntax
     - create

molecule/nginx_hardening/prepare.yml

@@ -2,9 +2,13 @@
 - name: prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   become: true
   hosts: all
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: install required tools on SuSE
-      zypper:
+      community.general.zypper:
         name: "python-xml"
         state: present
       when: ansible_facts.os_family == 'Suse'
@@ -13,7 +17,7 @@
       package:
         name: "python3-apt"
         update_cache: true
-      ignore_errors: true
+      ignore_errors: true  # noqa ignore-errors
 
     - name: Set correct distribution Version for Amazon Linux
       set_fact:

molecule/nginx_hardening/verify.yml

@@ -2,6 +2,10 @@
 - name: Verify
   hosts: all
   become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   roles:
     - geerlingguy.git
   tasks:
@@ -43,7 +47,7 @@
       shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
 
     - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/nginx-baseline.git"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/nginx-baseline/archive/refs/heads/master.zip"
       register: test_results
       changed_when: false
       ignore_errors: true

molecule/os_hardening/converge.yml

@@ -2,6 +2,10 @@
 - name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   collections:
     - devsec.hardening
   tasks:
@@ -12,15 +16,18 @@
         name: os_hardening
   vars:
     os_security_users_allow: change_user
-    os_security_kernel_enable_core_dump: true
+    os_security_kernel_enable_core_dump: false
     os_security_suid_sgid_remove_from_unknown: true
     os_auth_pam_passwdqc_enable: false
+    os_auth_lockout_time: 15
     os_desktop_enable: true
     os_env_extra_user_paths: ['/home']
     os_auth_allow_homeless: true
     os_security_suid_sgid_blacklist: ['/bin/umount']
     os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
     os_filesystem_whitelist: []
+    os_yum_repo_file_whitelist: ['foo.repo']
+    os_netrc_enabled: false
     sysctl_config:
       net.ipv4.ip_forward: 0
       net.ipv6.conf.all.forwarding: 0
@@ -32,7 +39,6 @@
       net.ipv4.icmp_ignore_bogus_error_responses: 1
       net.ipv4.icmp_ratelimit: 100
       net.ipv4.icmp_ratemask: 88089
-      net.ipv6.conf.all.disable_ipv6: 1
       net.ipv4.conf.all.arp_ignore: 1
       net.ipv4.conf.all.arp_announce: 2
       net.ipv4.conf.all.shared_media: 1

molecule/os_hardening/molecule.yml

@@ -5,9 +5,6 @@ dependency:
     role-file: molecule/os_hardening/requirements.yml
 driver:
   name: docker
-lint: |
-  yamllint roles/os_hardening/ molecule/os_hardening/ .github/workflows/os_hardening.yml
-  ansible-lint roles/os_hardening/
 platforms:
   - name: instance
     image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
@@ -21,7 +18,10 @@ platforms:
     capabilities:
       - SYS_ADMIN
     tty: true
-    environment:
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
       container: docker
 provisioner:
   name: ansible
@@ -54,7 +54,6 @@ scenario:
     - destroy
   test_sequence:
     - dependency
-    - lint
     - destroy
     - syntax
     - create

molecule/os_hardening/prepare.yml

@@ -4,6 +4,10 @@
   become: true
   collections:
     - devsec.hardening
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
       set_fact:
@@ -30,15 +34,15 @@
           - procps-ng
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: install packages
-      pacman:
+    - name: install required tools on Arch
+      community.general.pacman:
         name:
-          - "awk"
+          - awk
         state: present
         update_cache: true
-      ignore_errors: true
+      when: ansible_facts.os_family == 'Archlinux'
 
-    - name: install required tools on RHEL
+    - name: install required tools on RHEL  # noqa ignore-errors
       yum:
         name:
           - openssh-clients
@@ -50,3 +54,11 @@
     - name: create recursing symlink to test minimize access
       shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
       changed_when: false
+
+    - name: include YUM prepare tasks
+      include_tasks: prepare_tasks/yum.yml
+      when: ansible_facts.os_family == 'RedHat'
+
+    - name: include YUM prepare tasks
+      include_tasks: prepare_tasks/netrc.yml
+

molecule/os_hardening/prepare_tasks/netrc.yml

@@ -0,0 +1,9 @@
+---
+- name: create '.netrc' in /root
+  ansible.builtin.copy:
+    dest: '/root/.netrc'
+    mode: '0600'
+    content: |
+      machine localhost
+      login root
+      password ipsum

molecule/os_hardening/prepare_tasks/yum.yml

@@ -0,0 +1,16 @@
+---
+- name: create 'foo' repository
+  ansible.builtin.yum_repository:
+    name: foo
+    description: mandatory description
+    baseurl: file:///mandatory-url
+    enabled: false
+    gpgcheck: false
+
+- name: create 'bar' repository
+  ansible.builtin.yum_repository:
+    name: bar
+    description: mandatory description
+    baseurl: file:///mandatory-url
+    enabled: false
+    gpgcheck: false

molecule/os_hardening/verify.yml

@@ -2,6 +2,10 @@
 - name: Verify
   hosts: all
   become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   roles:
     - geerlingguy.git
   tasks:
@@ -33,6 +37,17 @@
         name: procps
       when: ansible_facts.os_family == 'Debian'
 
+    - name: include netrc tests
+      include_tasks: verify_tasks/netrc.yml
+
+    - name: include PAM tests
+      include_tasks: verify_tasks/pam.yml
+      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+
+    - name: include YUM tests
+      include_tasks: verify_tasks/yum.yml
+      when: ansible_facts.os_family == 'RedHat'
+
     - name: download cinc-auditor
       get_url:
         url: https://omnitruck.cinc.sh/install.sh
@@ -42,8 +57,8 @@
     - name: install cinc-auditor
       shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
 
-    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline.git"
+    - name: Execute cinc-auditor tests  # noqa ignore-errors
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
       register: test_results
       changed_when: false
       ignore_errors: true

molecule/os_hardening/verify_tasks/netrc.yml

@@ -0,0 +1,19 @@
+---
+- name: test that .netrc in root homedir exists
+  ansible.builtin.file:
+    path: '/root/.netrc'
+    state: file
+  register: result_test_netrc
+
+- name: output result if .netrc for user root exists
+  ansible.builtin.assert:
+    that:
+      - "result_test_netrc.state == 'file'"
+    fail_msg: ".netrc in /root/ not present"
+    success_msg: ".netrc exists in /root/"
+
+- name: delete '.netrc' in /root
+  ansible.builtin.file:
+    path: '/root/.netrc'
+    state: absent
+  when: result_test_netrc.state == 'file'

molecule/os_hardening/verify_tasks/pam.yml

@@ -0,0 +1,59 @@
+---
+- name: download pam-tester
+  get_url:
+    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
+    dest: /bin/pam-tester
+    mode: 0555
+
+- name: set password for test
+  set_fact:
+    test_pw: "myTest!pw"
+
+- name: set locale for test
+  set_fact:
+    locale: "en_US.UTF-8"
+  when:
+    - ansible_facts.os_family == 'RedHat'
+    - ansible_facts.distribution_major_version < '8'
+
+- name: create testuser
+  user:
+    name: testuser
+    password: "{{ test_pw | password_hash('sha512') }}"
+
+- name: check successfull login with correct password
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
+
+- name: check unsuccessfull login with incorrect password
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
+  with_sequence: count=6
+
+- name: check unsuccessfull login, with correct password (lockout)
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
+
+- name: wait for account to unlock
+  pause:
+    seconds: 20
+
+- name: check successfull login
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"

molecule/os_hardening/verify_tasks/yum.yml

@@ -0,0 +1,8 @@
+---
+- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
+  command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
+  changed_when: false
+
+- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
+  command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
+  changed_when: false

molecule/os_hardening_vm/INSTALL.rst

@@ -0,0 +1,22 @@
+*******
+Docker driver installation guide
+*******
+
+Requirements
+============
+
+* Docker Engine
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ python3 -m pip install 'molecule[docker]'

molecule/os_hardening_vm/converge.yml

@@ -0,0 +1,23 @@
+---
+- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+  hosts: all
+  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  collections:
+    - devsec.hardening
+  tasks:
+    - name: override for arch
+      set_fact: 
+        os_mnt_boot_enabled: false
+      when: ansible_facts.os_family == 'Archlinux'
+    - include_role:
+        name: os_hardening
+  vars:
+    os_auth_pam_passwdqc_enable: false
+    os_auth_lockout_time: 15
+    os_yum_repo_file_whitelist: ['foo.repo']
+    os_mnt_boot_enabled: true
+    os_mnt_boot_src: "/dev/vda1"

molecule/os_hardening_vm/molecule.yml

@@ -0,0 +1,57 @@
+---
+dependency:
+  name: galaxy
+  options:
+    role-file: molecule/os_hardening/requirements.yml
+driver:
+  name: vagrant
+  provider:
+    name: libvirt
+platforms:
+  - name: instance
+    box: "generic/${MOLECULE_DISTRO}"
+    memory: 1024
+    cpus: 2
+provisioner:
+  name: ansible
+  env:
+    ANSIBLE_PIPELINING: "True"
+  config_options:
+    defaults:
+      interpreter_python: auto_silent
+      callback_whitelist: profile_tasks, timer, yaml
+verifier:
+  name: ansible
+  env:
+    ANSIBLE_PIPELINING: "True"
+
+scenario:
+  create_sequence:
+    - dependency
+    - create
+    - prepare
+  check_sequence:
+    - dependency
+    - destroy
+    - create
+    - prepare
+    - converge
+    - check
+    - destroy
+  converge_sequence:
+    - dependency
+    - create
+    - prepare
+    - converge
+  destroy_sequence:
+    - destroy
+  test_sequence:
+    - dependency
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - verify
+    - destroy

molecule/os_hardening_vm/prepare.yml

@@ -0,0 +1,60 @@
+---
+- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+  hosts: all
+  become: true
+  collections:
+    - devsec.hardening
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
+      set_fact:
+        ansible_python_interpreter: "/usr/bin/python3"
+      when: ansible_facts.distribution == 'Fedora'
+
+    - name: Run the equivalent of "apt-get update && apt-get upgrade"
+      apt:
+        name: "*"
+        state: latest
+        update_cache: true
+      when: ansible_os_family == 'Debian'
+
+    - name: install required tools on SuSE
+      # cannot use zypper module, since it depends on python-xml
+      shell: "zypper -n install python-xml"
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: install required tools on fedora
+      dnf:
+        name:
+          - python
+          - findutils
+          - procps-ng
+      when: ansible_facts.distribution == 'Fedora'
+
+    - name: install required tools on Arch
+      community.general.pacman:
+        name:
+          - awk
+        state: present
+        update_cache: true
+      when: ansible_facts.os_family == 'Archlinux'
+
+    - name: install required tools on RHEL  # noqa ignore-errors
+      yum:
+        name:
+          - openssh-clients
+          - openssh
+        state: present
+        update_cache: true
+      ignore_errors: true
+
+    - name: create recursing symlink to test minimize access
+      shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
+      changed_when: false
+
+    - name: include YUM prepare tasks
+      include_tasks: prepare_tasks/yum.yml
+      when: ansible_facts.os_family == 'RedHat'

molecule/os_hardening_vm/prepare_tasks/yum.yml

@@ -0,0 +1,16 @@
+---
+- name: create 'foo' repository
+  ansible.builtin.yum_repository:
+    name: foo
+    description: mandatory description
+    baseurl: file:///mandatory-url
+    enabled: false
+    gpgcheck: false
+
+- name: create 'bar' repository
+  ansible.builtin.yum_repository:
+    name: bar
+    description: mandatory description
+    baseurl: file:///mandatory-url
+    enabled: false
+    gpgcheck: false

molecule/os_hardening_vm/requirements.yml

@@ -0,0 +1,3 @@
+---
+roles:
+  - geerlingguy.git

molecule/os_hardening_vm/verify.yml

@@ -0,0 +1,70 @@
+---
+- name: Verify
+  hosts: all
+  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  roles:
+    - geerlingguy.git
+  tasks:
+    - name: install fake SuSE-release for cinc compatibility
+      copy:
+        content: |
+          openSUSE Faked Enterprise 2020 (x86_64)
+          VERSION = 2020
+          CODENAME = Faked Feature
+        dest: /etc/SuSE-release
+        owner: root
+        group: root
+        mode: '0444'
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: install git for SuSE since geerlinguy.git does not support it
+      zypper:
+        name: git
+        state: present
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: Run the equivalent of "apt-get update" as a separate step
+      apt:
+        update_cache: true
+      when: ansible_facts.os_family == 'Debian'
+
+    - name: install required tools on debian
+      apt:
+        name: procps
+      when: ansible_facts.os_family == 'Debian'
+
+    - name: include PAM tests
+      include_tasks: verify_tasks/pam.yml
+      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+
+    - name: include YUM tests
+      include_tasks: verify_tasks/yum.yml
+      when: ansible_facts.os_family == 'RedHat'
+
+    - name: download cinc-auditor
+      get_url:
+        url: https://omnitruck.cinc.sh/install.sh
+        dest: /tmp/install.sh
+        mode: '0775'
+
+    - name: install cinc-auditor
+      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
+
+    - name: Execute cinc-auditor tests  # noqa ignore-errors
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
+      register: test_results
+      changed_when: false
+      ignore_errors: true
+
+    - name: Display details about the cinc-auditor results
+      debug:
+        msg: "{{ test_results.stdout_lines }}"
+
+    - name: Fail when tests fail
+      fail:
+        msg: "Inspec failed to validate"
+      when: test_results.rc != 0

molecule/os_hardening_vm/verify_tasks/pam.yml

@@ -0,0 +1,59 @@
+---
+- name: download pam-tester
+  get_url:
+    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
+    dest: /bin/pam-tester
+    mode: 0555
+
+- name: set password for test
+  set_fact:
+    test_pw: "myTest!pw"
+
+- name: set locale for test
+  set_fact:
+    locale: "en_US.UTF-8"
+  when:
+    - ansible_facts.os_family == 'RedHat'
+    - ansible_facts.distribution_major_version < '8'
+
+- name: create testuser
+  user:
+    name: testuser
+    password: "{{ test_pw | password_hash('sha512') }}"
+
+- name: check successfull login with correct password
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
+
+- name: check unsuccessfull login with incorrect password
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
+  with_sequence: count=6
+
+- name: check unsuccessfull login, with correct password (lockout)
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
+
+- name: wait for account to unlock
+  pause:
+    seconds: 20
+
+- name: check successfull login
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"

molecule/os_hardening_vm/verify_tasks/yum.yml

@@ -0,0 +1,8 @@
+---
+- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
+  command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
+  changed_when: false
+
+- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
+  command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
+  changed_when: false

molecule/ssh_hardening/converge.yml

@@ -1,9 +1,14 @@
 ---
 - name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
-  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   collections:
     - devsec.hardening
   tasks:
     - include_role:
         name: ssh_hardening
+  vars:
+    sftp_enabled: false

molecule/ssh_hardening/molecule.yml

@@ -5,9 +5,6 @@ dependency:
     role-file: molecule/ssh_hardening/requirements.yml
 driver:
   name: docker
-lint: |
-  yamllint roles/ssh_hardening/ molecule/ssh_hardening/ .github/workflows/ssh_hardening.yml
-  ansible-lint roles/ssh_hardening/
 platforms:
   - name: instance
     image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
@@ -21,7 +18,10 @@ platforms:
     capabilities:
       - SYS_ADMIN
     tty: true
-    environment:
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
       container: docker
 provisioner:
   name: ansible
@@ -29,6 +29,12 @@ provisioner:
     defaults:
       interpreter_python: auto_silent
       callback_whitelist: profile_tasks, timer, yaml
+  inventory:
+    host_vars:
+      # https://molecule.readthedocs.io/en/latest/examples.html#docker-with-non-privileged-user
+      # setting for the platform instance named 'instance'
+      instance:
+        ansible_user: ansible
 verifier:
   name: ansible
 
@@ -54,7 +60,6 @@ scenario:
     - destroy
   test_sequence:
     - dependency
-    - lint
     - destroy
     - syntax
     - create

molecule/ssh_hardening/prepare.yml

@@ -2,13 +2,17 @@
 - name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
   become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: use python3
       set_fact:
         ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
       yum:
         name:
           - openssh-clients
@@ -18,7 +22,7 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
       dnf:
         name:
           - openssh-clients
@@ -28,7 +32,7 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
       apt:
         name:
           - openssh-client
@@ -48,21 +52,21 @@
           - "openssh"
       when: ansible_facts.os_family == 'Suse'
 
-    - name: install packages
+    - name: install required tools on Arch
       pacman:
         name:
-          - "openssh"
-          - "awk"
+          - openssh
+          - awk
         state: present
         update_cache: true
-      ignore_errors: true
+      when: ansible_facts.os_family == 'Archlinux'
 
     - name: created needed directory
       file:
         path: "/var/run/sshd"
         state: directory
 
-    - name: create ssh host keys
+    - name: create ssh host keys  # noqa ignore-errors
       command: "ssh-keygen -A"
       when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
             ansible_facts.distribution == "Fedora" or

molecule/ssh_hardening/verify.yml

@@ -2,6 +2,10 @@
 - name: Verify
   hosts: all
   become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   roles:
     - geerlingguy.git
   tasks:
@@ -38,7 +42,7 @@
       shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
 
     - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline.git"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/simplify_crypto.zip"
       register: test_results
       changed_when: false
       ignore_errors: true

molecule/ssh_hardening_custom_tests/INSTALL.rst

@@ -0,0 +1,22 @@
+*******
+Docker driver installation guide
+*******
+
+Requirements
+============
+
+* Docker Engine
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ python3 -m pip install 'molecule[docker]'

molecule/ssh_hardening_custom_tests/converge.yml

@@ -0,0 +1,103 @@
+---
+- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
+  hosts: all
+  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  collections:
+    - devsec.hardening
+  tasks:
+    - include_role:
+        name: ssh_hardening
+  vars:
+    ssh_trusted_user_ca_keys_file: '/etc/ssh/ca.pub'
+    ssh_trusted_user_ca_keys:
+      - '# ssh-rsa ...'
+    ssh_authorized_principals_file: '/etc/ssh/auth_principals/%u'
+    ssh_authorized_principals:
+      - path: "/etc/ssh/auth_principals/root"
+        principals:
+          - "root"
+        owner: "{{ ssh_owner }}"
+        group: "{{ ssh_group }}"
+        directoryowner: "{{ ssh_owner }}"
+        directorygroup: "{{ ssh_group }}"
+        directorymode: "0700"
+    network_ipv6_enable: true
+    ssh_allow_tcp_forwarding: 'yes'
+    ssh_gateway_ports: true
+    ssh_allow_agent_forwarding: true
+    ssh_server_permit_environment_vars: 'yes'
+    ssh_server_accept_env_vars: 'PWD HTTP_PROXY'
+    ssh_client_alive_interval: 100
+    ssh_client_alive_count: 10
+    ssh_client_password_login: true
+    ssh_challengeresponseauthentication: true
+    ssh_compression: true
+    ssh_allow_users: 'root kitchen vagrant'
+    ssh_allow_groups: 'root kitchen vagrant'
+    ssh_deny_users: 'foo bar'
+    ssh_deny_groups: 'foo bar'
+    ssh_authorized_keys_file: '/etc/ssh/authorized_keys/%u'
+    ssh_max_auth_retries: 10
+    ssh_permit_root_login: "without-password"
+    ssh_permit_tunnel: true
+    ssh_print_motd: true
+    ssh_print_last_log: true
+    ssh_banner: true
+    ssh_server_password_login: true
+    sftp_chroot: true
+    # ssh_server_enabled: false
+    ssh_server_ports:
+      - 22
+      - 222
+    ssh_server_match_address:
+      - address: '192.168.1.0/24'
+        rules:
+          - 'AllowTcpForwarding yes'
+          - 'AllowAgentForwarding no'
+    ssh_server_match_group:
+      - group: 'root'
+        rules:
+          - 'AllowTcpForwarding yes'
+          - 'AllowAgentForwarding no'
+    ssh_server_match_user:
+      - user: 'root'
+        rules:
+          - 'AllowTcpForwarding yes'
+          - 'AllowAgentForwarding no'
+    ssh_server_match_local_port:
+      - port: 222
+        rules:
+          - 'AllowTcpForwarding yes'
+          - 'AllowAgentForwarding no'
+    ssh_remote_hosts:
+      - names: ['example.com', 'example2.com']
+        options: ['Port 2222', 'ForwardAgent yes']
+      - names: ['example3.com']
+        options: ['StrictHostKeyChecking no']
+    ssh_use_dns: true
+    ssh_use_pam: true
+    ssh_max_startups: '10:30:60'
+    ssh_host_key_algorithms:
+      - ssh-ed25519
+      - rsa-sha2-512
+      - rsa-sha2-256
+      - ssh-rsa
+    ssh_macs:
+      - hmac-sha2-512
+      - hmac-sha2-256
+    ssh_ciphers:
+      - aes256-ctr
+      - aes192-ctr
+      - aes128-ctr
+      - aes256-cbc
+    ssh_kex:
+      - diffie-hellman-group-exchange-sha256
+      - diffie-hellman-group-exchange-sha1
+    ssh_custom_options:
+      - "Include /etc/ssh/ssh_config.d/*"
+    sshd_custom_options:
+      - "AcceptEnv LANG"

molecule/ssh_hardening_custom_tests/molecule.yml

@@ -0,0 +1,64 @@
+---
+dependency:
+  name: galaxy
+  options:
+    role-file: molecule/ssh_hardening/requirements.yml
+driver:
+  name: docker
+platforms:
+  - name: instance
+    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    privileged: true
+    tmpfs:
+      - /tmp
+      - /run
+    capabilities:
+      - SYS_ADMIN
+    tty: true
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
+      container: docker
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      interpreter_python: auto_silent
+      callback_whitelist: profile_tasks, timer, yaml
+verifier:
+  name: ansible
+
+scenario:
+  create_sequence:
+    - dependency
+    - create
+    - prepare
+  check_sequence:
+    - dependency
+    - destroy
+    - create
+    - prepare
+    - converge
+    - check
+    - destroy
+  converge_sequence:
+    - dependency
+    - create
+    - prepare
+    - converge
+  destroy_sequence:
+    - destroy
+  test_sequence:
+    - dependency
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - verify
+    - destroy

molecule/ssh_hardening_custom_tests/prepare.yml

@@ -0,0 +1,76 @@
+---
+- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+  hosts: all
+  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: use python3
+      set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+      when: ansible_facts.distribution == 'Fedora'
+
+    - name: install packages  # noqa ignore-errors
+      yum:
+        name:
+          - openssh-clients
+          - openssh-server
+          - libselinux-python
+        state: present
+        update_cache: true
+      ignore_errors: true
+
+    - name: install packages  # noqa ignore-errors
+      dnf:
+        name:
+          - openssh-clients
+          - openssh-server
+          - procps-ng
+        state: present
+        update_cache: true
+      ignore_errors: true
+
+    - name: install packages  # noqa ignore-errors
+      apt:
+        name:
+          - openssh-client
+          - openssh-server
+        state: present
+        update_cache: true
+      ignore_errors: true
+
+    - name: install required tools on SuSE
+      # cannot use zypper module, since it depends on python-xml
+      shell: "zypper -n install python-xml"
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: install packages
+      zypper:
+        name:
+          - "openssh"
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: install required tools on Arch
+      pacman:
+        name:
+          - openssh
+          - awk
+        state: present
+        update_cache: true
+      when: ansible_facts.os_family == 'Archlinux'
+
+    - name: created needed directory
+      file:
+        path: "/var/run/sshd"
+        state: directory
+
+    - name: create ssh host keys  # noqa ignore-errors
+      command: "ssh-keygen -A"
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
+            ansible_facts.distribution == "Fedora" or
+            ansible_facts.distribution == "Amazon" or
+            ansible_facts.os_family == "Suse"
+      changed_when: false
+      ignore_errors: true

molecule/ssh_hardening_custom_tests/requirements.yml

@@ -0,0 +1,3 @@
+---
+roles:
+  - geerlingguy.git

requirements.txt

@@ -1,5 +1,7 @@
 molecule[docker]
 yamllint
+ansible
 ansible-lint
 docker
 flake8
+jmespath

roles/mysql_hardening/README.md

@@ -9,7 +9,7 @@ This role provides security configurations for MySQL and its derivates. It is in
 It configures:
 
 - Permissions for the various configuration files and folders
-- Removes anonymous users, root-users without a password and test databases
+- Removes anonymous users, users without a password or authentication_string and test databases
 - various hardening options inside MySQL
 
 ## Requirements
@@ -24,15 +24,17 @@ It configures:
   collections:
     - devsec.hardening
   roles:
-    - devsec.hardening.mysql_hardening
+    - mysql_hardening
 ```
 
-This role expects an existing installation of MySQL or MariaDB. Please ensure that the following variables are set accordingly:
+This role expects an existing installation of MySQL or MariaDB. Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.  
+Please ensure that the following variables are set accordingly:
 
 - `mysql_hardening_enabled: yes` role is enabled by default and can be disabled without removing it from a playbook. You can use conditional variable, for example: `mysql_hardening_enabled: "{{ true if mysql_enabled else false }}"`
 - `mysql_hardening_user: 'mysql'` The user that mysql runs as.
-- `mysql_datadir: '/var/lib/mysql'` The MySQL data directory
 - `mysql_hardening_mysql_hardening_conf_file: '/etc/mysql/conf.d/hardening.cnf'` The path to the configuration file where the hardening will be performed
+- _deprecated: `mysql_datadir: '/var/lib/mysql'` The MySQL data directory_
+  - `mysql_datadir` is no longer necessary, as MySQL data directory is automatically taken from `mysql_info`. But it can still be defined and will also be checked for correct permissions.
 
 ## Role Variables
 
@@ -75,5 +77,8 @@ This role expects an existing installation of MySQL or MariaDB. Please ensure th
 - `mysql_remove_test_database`
   - Default: true
   - Description: remove test database
+- `mysql_hardening_restart_mysql`
+  - Default: true
+  - Description: Restart mysql after running this role
 
 Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)

roles/mysql_hardening/defaults/main.yml

@@ -4,13 +4,14 @@ mysql_hardening_enabled: true
 
 mysql_daemon_enabled: true
 
+mysql_hardening_restart_mysql: true
+
 # general configuration
-mysql_datadir: '/var/lib/mysql'
-mysql_hardening_mysql_hardening_conf_file: '{{mysql_hardening_mysql_confd_dir}}/hardening.cnf'
+mysql_hardening_mysql_hardening_conf_file: '{{ mysql_hardening_mysql_confd_dir }}/hardening.cnf'
 # You have to change this to your own strong enough mysql root password
 mysql_root_password: '-----====>SetR00tPa$$wordH3r3!!!<====-----'
 # There .my.cnf with mysql root credentials will be installed
-mysql_user_home: "{{ ansible_env.HOME}}"
+mysql_user_home: "{{ ansible_env.HOME }}"
 
 # ensure the following parameters are set properly
 mysql_remove_remote_root: true
@@ -49,4 +50,4 @@ mysql_hardening_options:
   # @see https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option-mysqld-secure-file-priv
   secure-file-priv: '/tmp'
   # @see https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_user
-  user: '{{mysql_hardening_user}}'
+  user: '{{ mysql_hardening_user }}'

roles/mysql_hardening/handlers/main.yml

@@ -1,4 +1,7 @@
 ---
 
-- name: restart mysql
-  service: name='{{ mysql_daemon }}' state=restarted
+- name: Restart mysql
+  service:
+    name: '{{ mysql_daemon }}'
+    state: restarted
+  when: mysql_hardening_restart_mysql | bool

roles/mysql_hardening/meta/main.yml

@@ -4,19 +4,21 @@ galaxy_info:
   description: 'This Ansible playbook provides security configuration for mysql.'
   company: Hardening Framework Team
   license: Apache License 2.0
-  min_ansible_version: '1.9'
+  min_ansible_version: '2.9.10'
   platforms:
     - name: EL
       versions:
-        - 6
-        - 7
+        - "7"
+        - "8"
     - name: Ubuntu
       versions:
-        - xenial
         - bionic
+        - focal
+        - jammy
     - name: Debian
       versions:
-        - jessie
+        - bullseye
+        - buster
     - name: Amazon
     - name: Fedora
   galaxy_tags:

roles/mysql_hardening/tasks/configure.yml

@@ -1,5 +1,5 @@
 ---
-- name: protect my.cnf
+- name: Protect my.cnf
   file:
     path: '{{ mysql_hardening_mysql_conf_file }}'
     mode: '0640'
@@ -8,23 +8,31 @@
     follow: true
     state: file
 
-- name: ensure permissions on mysql-datadir are correct
+- name: Ensure permissions on mysql-datadir are correct
   file:
-    path: '{{ mysql_datadir }}'
+    path: '{{ item }}'
     state: directory
     owner: '{{ mysql_hardening_user }}'
     group: '{{ mysql_hardening_user }}'
     mode: '0750'
+  when: item is defined and item != ""
+  loop:
+    - '{{ mysql_settings.settings.datadir }}'
+    - '{{ mysql_datadir | default("") }}'
 
-- name: ensure permissions on mysql-logfile are correct
+- name: Ensure permissions on mysql-logfile are correct
   file:
-    path: '{{ mysql_hardening_log_file }}'
+    path: '{{ item }}'
     state: file
     owner: '{{ mysql_hardening_user }}'
     group: '{{ mysql_hardening_group }}'
     mode: '0640'
+  when: item is defined and item != ""
+  loop:
+    - '{{ mysql_settings.settings.log_error }}'
+    - '{{ mysql_hardening_log_file | default("") }}'
 
-- name: check mysql configuration-directory exists and has right permissions
+- name: Check mysql configuration-directory exists and has right permissions
   file:
     path: '{{ mysql_hardening_mysql_confd_dir }}'
     state: directory
@@ -32,25 +40,25 @@
     group: '{{ mysql_hardening_group }}'
     mode: '0750'
 
-- name: check include-dir directive is present in my.cnf
+- name: Check include-dir directive is present in my.cnf
   lineinfile:
     dest: '{{ mysql_hardening_mysql_conf_file }}'
     line: '!includedir {{ mysql_hardening_mysql_confd_dir }}'
     insertafter: 'EOF'
     state: present
     backup: true
-  notify: restart mysql
+  notify: Restart mysql
 
-- name: apply hardening configuration
+- name: Apply hardening configuration
   template:
     src: 'hardening.cnf.j2'
     dest: '{{ mysql_hardening_mysql_hardening_conf_file }}'
     owner: '{{ mysql_cnf_owner }}'
     group: '{{ mysql_cnf_group }}'
     mode: '0640'
-  notify: restart mysql
+  notify: Restart mysql
 
-- name: enable mysql
+- name: Enable mysql
   service:
     name: '{{ mysql_daemon }}'
     enabled: '{{ mysql_daemon_enabled }}'

roles/mysql_hardening/tasks/main.yml

@@ -15,11 +15,49 @@
 # we only override variables with our default if they have not been specified already.
 # by default the lookup functions finds all varnames containing the string, therefore
 # we add ^ and $ to denote start and end of string, so this returns only exact maches.
-- name: Set OS dependent variables, if not already defined by user
+- name: Set OS dependent variables, if not already defined by user  # noqa var-naming
   set_fact:
     '{{ item.key }}': '{{ item.value }}'
   when: "not lookup('varnames', '^' + item.key + '$')"
   with_dict: '{{ os_vars }}'
+  tags: always
+
+- name: Check that the variable mysql_distribution is set correctly
+  ansible.builtin.assert:
+    that: mysql_distribution == 'mysql' or mysql_distribution == 'mariadb'
+    fail_msg: 'mysql_distribution must be set to either mysql or mariadb!'
+  when: mysql_distribution is defined
+
+- name: Gather package facts to check for mysql/mariadb version
+  ansible.builtin.package_facts:
+    manager: auto
+  when: not mysql_distribution is defined
+
+- name: Check if MySQL or MariaDB is used
+  set_fact:
+    mysql_distribution: "{{ ansible_facts.packages['mysql-server'] is defined | ternary('mysql', 'mariadb') }}"
+  when: not mysql_distribution is defined
+
+- name: Check which MySQL/MariaDB version is used
+  community.mysql.mysql_info:
+    filter: version
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_version
+
+- name: Check MySQL/MariaDB settings
+  community.mysql.mysql_info:
+    filter: settings
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_settings
+
+# see https://stackoverflow.com/a/59451077/2953919 for the
+# dict2items and vice versa magic
+- name: Drop the secure-auth parameter on MySQL >=8.0.3 (not mariadb)
+  set_fact:
+    mysql_hardening_options: "{{ mysql_hardening_options | dict2items | rejectattr('key', 'search', 'secure-auth') | list | items2dict }}"
+  when:
+    - mysql_version.version.full is version('8.0.3', '>=')
+    - mysql_distribution == "mysql"
 
 - include: configure.yml
   when: mysql_hardening_enabled | bool

roles/mysql_hardening/tasks/mysql_secure_installation.yml

@@ -1,46 +1,104 @@
 ---
-- name: Install mysqld python libary for Ansible
-  package:
-    name: '{{ mysql_python_package }}'
-    state: present
-
-- debug:
-    msg: 'WARNING - you have to change default mysql_root_password'
+- name: Fail the role if the mysql root password was not set
+  fail:
+    msg: 'ERROR - you have to change default mysql_root_password'
   when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'
 
-- name: root password is present
-  mysql_user:
+- name: ensure that the root password is present
+  community.mysql.mysql_user:
     name: 'root'
     host_all: true
     password: '{{ mysql_root_password | mandatory }}'
     state: present
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
 
-- name: install .my.cnf with credentials
+- name: Install .my.cnf with credentials
   template:
     src: 'my.cnf.j2'
     dest: '{{ mysql_user_home }}/.my.cnf'
     mode: '0400'
   tags: my_cnf
 
-- name: test database is absent
-  mysql_db:
+- name: ensure that the test database is absent
+  community.mysql.mysql_db:
     name: test
     state: absent
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   when: mysql_remove_test_database
 
-- name: anonymous users are absent
-  mysql_user:
+- name: ensure that anonymous users are absent
+  community.mysql.mysql_user:
     name: ''
     state: absent
     host_all: true
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   when: mysql_remove_anonymous_users
 
-- name: remove remote root
+- name: ensure that root can only login from localhost
   community.mysql.mysql_query:
     query:
-      - DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1')
+      - DELETE
+        FROM mysql.user
+        WHERE USER='root'
+          AND HOST NOT IN ('localhost',
+                          '127.0.0.1',
+                          '::1')
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   when: mysql_remove_remote_root
+
+- name: get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
+  community.mysql.mysql_query:
+    query:
+      - SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
+        FROM mysql.user
+        WHERE (length(authentication_string)=0
+              OR authentication_string="")
+          AND USER NOT IN ('mysql.sys',
+                          'mysqlxsys',
+                          'mariadb.sys');
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_users_wo_passwords_or_auth_string
+  when:
+    - (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '>=')) or
+      (mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '>='))
+
+- name: get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
+  community.mysql.mysql_query:
+    query:
+      - SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
+        FROM mysql.user
+        WHERE (length(password)=0
+              OR password="")
+          AND (length(authentication_string)=0
+              OR authentication_string="")
+          AND USER NOT IN ('mysql.sys',
+                          'mysqlxsys',
+                          'mariadb.sys');
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_users_wo_passwords
+  when:
+    - (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '<')) or
+      (mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '<'))
+
+- name: create a fact for users without password or authentication_string
+  set_fact:
+    users_wo_auth: "{{ mysql_users_wo_passwords_or_auth_string.query_result.0.0 | community.general.json_query('users') }}"
+  when:
+    - mysql_users_wo_passwords_or_auth_string.query_result is defined
+    - mysql_users_wo_passwords_or_auth_string.query_result != ""  # noqa empty-string-compare
+
+- name: create a fact for users without password
+  set_fact:
+    users_wo_auth: "{{ mysql_users_wo_passwords.query_result.0.0 | community.general.json_query('users') }}"
+  when:
+    - mysql_users_wo_passwords.query_result is defined
+    - mysql_users_wo_passwords.query_result != ""  # noqa empty-string-compare
+
+- name: ensure that there are no users without password or authentication_string
+  community.mysql.mysql_query:
+    query:
+      - "DROP USER {{ users_wo_auth }}"
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  when:
+    - users_wo_auth is defined
+    - users_wo_auth != ""  # noqa empty-string-compare

roles/mysql_hardening/vars/Debian.yml

@@ -4,11 +4,7 @@ mysql_daemon: mysql
 mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
 
-mysql_hardening_log_file: '/var/log/mysql/error.log'
-
 mysql_hardening_group: 'adm'
 
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_python_package: "python3-pymysql"

roles/mysql_hardening/vars/Fedora.yml

@@ -2,5 +2,3 @@
 mysql_daemon: mysqld
 mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
-
-mysql_hardening_mysql_log_file: '/var/log/mysqld.log'

roles/mysql_hardening/vars/FreeBSD.yml

@@ -0,0 +1,10 @@
+---
+mysql_daemon: mysql-server
+
+mysql_hardening_mysql_conf_file: '/usr/local/etc/mysql/my.cnf'
+mysql_hardening_mysql_confd_dir: '/usr/local/etc/mysql/conf.d'
+
+mysql_hardening_group: 'mysql'
+
+mysql_cnf_owner: 'root'  # owner of /usr/local/etc/mysql/*.cnf files
+mysql_cnf_group: 'mysql'  # owner of /usr/local/etc/mysql/*.cnf files

roles/mysql_hardening/vars/Oracle Linux.yml

@@ -4,6 +4,4 @@ mysql_daemon: mysqld
 mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
 
-mysql_hardening_log_file: '/var/log/mysqld.log'
-
 mysql_hardening_group: 'adm'

roles/mysql_hardening/vars/RedHat.yml

@@ -3,10 +3,6 @@ mysql_daemon: mariadb
 mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
 
-mysql_hardening_log_file: '/var/log/mariadb/mariadb.log'
-
-mysql_python_package: 'MySQL-python'
-
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
 

roles/mysql_hardening/vars/RedHat_8.yml

@@ -1,12 +0,0 @@
----
-mysql_daemon: mariadb
-mysql_hardening_mysql_conf_file: '/etc/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
-mysql_hardening_log_file: '/var/log/mariadb/mariadb.log'
-
-mysql_python_package: 'python3-mysqlclient'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'mysql'

roles/mysql_hardening/vars/Ubuntu.yml

@@ -4,11 +4,7 @@ mysql_daemon: mysql
 mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
 
-mysql_hardening_log_file: '/var/log/mysql/error.log'
-
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
 
 mysql_hardening_group: 'adm'
-
-mysql_python_package: "python-mysqldb"

roles/mysql_hardening/vars/Ubuntu_18.yml

@@ -1,14 +0,0 @@
----
-mysql_daemon: mysql
-
-mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
-
-mysql_hardening_log_file: '/var/log/mysql/error.log'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'adm'
-
-mysql_python_package: "python-mysqldb"

roles/mysql_hardening/vars/Ubuntu_20.yml

@@ -1,14 +0,0 @@
----
-mysql_daemon: mysql
-
-mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
-
-mysql_hardening_log_file: '/var/log/mysql/error.log'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'adm'
-
-mysql_python_package: "python3-mysqldb"

roles/nginx_hardening/README.md

@@ -61,8 +61,8 @@ It works with the following nginx-roles, including, but not limited to:
   - Default: `default 5`
   - Description: Sets the shared memory zone and the maximum allowed number of connections for a given key value.
 - [nginx_add_header][]
-  - Default: `[ "X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"" ]`
-  - Description:Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307.
+  - Default: `[ "X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"", Content-Security-Policy \"script-src 'self'; object-src 'self'\" ]`
+  - Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307.
 - [nginx_ssl_protocols][]
   - Default: `TLSv1.2`
   - Description: Specifies the SSL protocol which should be used.
@@ -75,6 +75,18 @@ It works with the following nginx-roles, including, but not limited to:
 - [nginx_dh_size][]
   - Default: `2048`
   - Description: Specifies the length of DH parameters for EDH ciphers.
+- [nginx_configuration_dir][]
+  - default: "/etc/nginx"
+  - Description: The main location for all nginx configuration files
+- [nginx_configuration_hardening_dir][]
+  - default: "/etc/nginx"
+  - Description: The location for the nginx hardening configuration file (Could be different e.g. when used in jails)
+- [nginx_owner_user][]
+  - default: "root"
+  - Description: The owner user of the nginx configuration files
+- [nginx_owner_group][]
+  - default: "root"
+  - Description: The owner group of the nginx configuration files
 
 ## Example Playbook
 
@@ -83,7 +95,7 @@ It works with the following nginx-roles, including, but not limited to:
   collections:
     - devsec.hardening
   roles:
-    - devsec.hardening.nginx_hardening
+    - nginx_hardening
 ```
 
 [nginx_client_body_buffer_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size

roles/nginx_hardening/defaults/main.yml

@@ -11,19 +11,23 @@ nginx_client_header_timeout: "10"
 nginx_send_timeout: "10"
 nginx_limit_conn_zone: "$binary_remote_addr zone=default:10m"
 nginx_limit_conn: "default 5"
-nginx_add_header: [
-# vvoid clickjacking
-"X-Frame-Options SAMEORIGIN",
-# disable content-type sniffing
-"X-Content-Type-Options nosniff",
-# XSS filter
-"X-XSS-Protection \"1; mode=block\"",
-"Strict-Transport-Security max-age=15768000",
-"Content-Security-Policy \"script-src 'self'; object-src 'self'\"" ]
+nginx_configuration_dir: "/etc/nginx"
+nginx_configuration_hardening_dir: "/etc/nginx"
+nginx_owner_user: "root"
+nginx_owner_group: "root"
+nginx_add_header:
+  # avoid clickjacking
+  - X-Frame-Options SAMEORIGIN
+  # disable content-type sniffing
+  - X-Content-Type-Options nosniff
+  # XSS filter
+  - X-XSS-Protection "1; mode=block"
+  - Strict-Transport-Security max-age=15768000
+  - Content-Security-Policy "script-src 'self'; object-src 'self'"
 
 nginx_set_cookie_flag: "* HttpOnly secure"
 nginx_ssl_prefer_server_ciphers: "on"
-nginx_ssl_protocols: "TLSv1.2"
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
 nginx_ssl_ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
 nginx_ssl_session_tickets: "off"
-nginx_dh_size: "2048"
+nginx_dh_size: "4096"

roles/nginx_hardening/handlers/main.yml

@@ -1,5 +1,5 @@
 ---
-- name: restart nginx
+- name: Restart nginx
   service:
     name: "nginx"
     state: restarted

roles/nginx_hardening/meta/main.yml

@@ -4,20 +4,21 @@ galaxy_info:
   description: 'This Ansible role provides secure nginx configurations. http://dev-sec.io/'
   company: Hardening Framework Team
   license: Apache License 2.0
-  min_ansible_version: '2.5'
+  min_ansible_version: '2.9.10'
   platforms:
     - name: EL
       versions:
-        - 6
-        - 7
+        - "7"
+        - "8"
     - name: Ubuntu
       versions:
-        - xenial
         - bionic
+        - focal
+        - jammy
     - name: Debian
       versions:
-        - stretch
         - buster
+        - bullseye
   galaxy_tags:
     - system
     - security

roles/nginx_hardening/tasks/main.yml

@@ -1,94 +1,94 @@
 ---
-- name: create additional configuration
+- name: Create additional configuration
   template:
     src: "hardening.conf.j2"
-    dest: "/etc/nginx/conf.d/90.hardening.conf"
+    dest: "{{ nginx_configuration_dir }}/conf.d/90.hardening.conf"
     mode: '0600'
-    owner: "root"
-    group: "root"
-  notify: restart nginx
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
+  notify: Restart nginx
 
-- name: change configuration in main nginx.conf
+- name: Change configuration in main nginx.conf
   lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
     regexp: '^\s*server_tokens'
     line: "    server_tokens {{ nginx_server_tokens }};"
     insertafter: "http {"
     mode: '0640'
-    owner: "root"
-    group: "root"
-  notify: restart nginx
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
+  notify: Restart nginx
 
-- name: change ssl_protocols in main nginx.conf
+- name: Change ssl_protocols in main nginx.conf
   lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
     regexp: '^\s*ssl_protocols'
     line: "    ssl_protocols {{ nginx_ssl_protocols }};"
     insertafter: "http {"
     mode: '0640'
-    owner: "root"
-    group: "root"
-  notify: restart nginx
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
+  notify: Restart nginx
 
-- name: change ssl_prefer_server_ciphers in main nginx.conf
+- name: Change ssl_prefer_server_ciphers in main nginx.conf
   lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
     regexp: '^\s*ssl_prefer_server_ciphers'
     line: "    ssl_prefer_server_ciphers {{ nginx_ssl_prefer_server_ciphers }};"
     insertafter: "http {"
     mode: '0640'
-    owner: "root"
-    group: "root"
-  notify: restart nginx
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
+  notify: Restart nginx
 
-- name: change client_max_body_size in main nginx.conf
+- name: Change client_max_body_size in main nginx.conf
   lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
     regexp: '^\s*client_max_body_size'
     line: "    client_max_body_size {{ nginx_client_max_body_size }};"
     insertafter: "http {"
     mode: '0640'
-    owner: "root"
-    group: "root"
-  notify: restart nginx
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
+  notify: Restart nginx
 
-- name: change client_body_buffer_size in main nginx.conf
+- name: Change client_body_buffer_size in main nginx.conf
   lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
     regexp: '^\s*client_body_buffer_size'
     line: "    client_body_buffer_size {{ nginx_client_body_buffer_size }};"
     insertafter: "http {"
     mode: '0640'
-    owner: "root"
-    group: "root"
-  notify: restart nginx
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
+  notify: Restart nginx
 
-- name: change keepalive_timeout in main nginx.conf
+- name: Change keepalive_timeout in main nginx.conf
   lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
     regexp: '^\s*keepalive_timeout'
     line: "    keepalive_timeout {{ nginx_keepalive_timeout }};"
     insertafter: "http {"
     mode: '0640'
-    owner: "root"
-    group: "root"
-  notify: restart nginx
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
+  notify: Restart nginx
 
-- name: remove default.conf
+- name: Remove default.conf
   file:
     path: "{{ item }}"
     state: absent
   when: nginx_remove_default_site
-  notify: restart nginx
+  notify: Restart nginx
   loop:
-    - "/etc/nginx/conf.d/default.conf"
-    - "/etc/nginx/sites-enabled/default"
+    - "{{ nginx_configuration_dir }}/conf.d/default.conf"
+    - "{{ nginx_configuration_dir }}/sites-enabled/default"
 
-- name: generate dh group
+- name: Generate dh group
   openssl_dhparam:
-    path: "/etc/nginx/dh{{ nginx_dh_size }}.pem"
+    path: "{{ nginx_configuration_dir }}/dh{{ nginx_dh_size }}.pem"
     size: "{{ nginx_dh_size }}"
     mode: '0640'
-    owner: "root"
-    group: "root"
-  notify: restart nginx
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
+  notify: Restart nginx

roles/nginx_hardening/templates/hardening.conf.j2

@@ -11,7 +11,7 @@ limit_conn_zone             {{ nginx_limit_conn_zone }};
 limit_conn                  {{ nginx_limit_conn }};
 ssl_ciphers                 '{{ nginx_ssl_ciphers }}';
 ssl_session_tickets         {{ nginx_ssl_session_tickets }};
-ssl_dhparam                 /etc/nginx/dh{{ nginx_dh_size }}.pem;
+ssl_dhparam                 {{ nginx_configuration_hardening_dir }}/dh{{ nginx_dh_size }}.pem;
 {% for header in nginx_add_header %}
 add_header                  {{ header }};
 {% endfor %}

roles/nginx_hardening/vars/main.yml

@@ -1 +0,0 @@
----

roles/os_hardening/README.md

@@ -1,6 +1,7 @@
 # devsec.os_hardening
 
 ![devsec.os_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening/badge.svg)
+![devsec.os_hardening VM](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening%20VM/badge.svg)
 
 ## Looking for the old ansible-os-hardening role?
 
@@ -106,6 +107,9 @@ We know that this is the case on Raspberry Pi.
 - `os_auth_pw_min_age`
   - Default: `7`
   - Description: minimum password age (before allowing any other password change).
+- `os_auth_pw_remember`
+  - Default: `5`
+  - Description: how many used passwords are record.
 - `os_auth_retries`
   - Default: `5`
   - Description: the maximum number of authentication attempts, before the account is locked for some time.
@@ -124,6 +128,9 @@ We know that this is the case on Raspberry Pi.
 - `os_auth_pam_passwdqc_options`
   - Default: `min=disabled,disabled,16,12,8`
   - Description: set to any option line (as a string) that you want to pass to passwdqc.
+- `os_auth_pam_sssd_enable`
+  - Default: `false` (on RHEL8/CentOS8/Fedora `true`)
+  - Description: activate PAM auth support for sssd
 - `os_security_users_allow`
   - Default: `[]`
   - Description: list of things, that a user is allowed to do. May contain `change_user`.
@@ -145,6 +152,36 @@ We know that this is the case on Raspberry Pi.
 - `os_security_suid_sgid_remove_from_unknown`
   - Default: `false`
   - Description: true if you want to remove SUID/SGID bits from any file, that is not explicitly configured in a `blacklist`. This will make every Ansible-run search through the mounted filesystems looking for SUID/SGID bits that are not configured in the default and user blacklist. If it finds an SUID/SGID bit, it will be removed, unless this file is in your `whitelist`.
+- `os_auth_uid_min`
+  - Default: `1000`
+  - Description: minimum number for automatic uid selection in useradd.
+- `os_auth_uid_max`
+  - Default: `60000`
+  - Description: maximum number for automatic uid selection in useradd.
+- `os_auth_gid_min`
+  - Default: `1000`
+  - Description: minimum number for automatic gid selection in groupadd.
+- `os_auth_gid_max`
+  - Default: `60000`
+  - Description: maximum number for automatic gid selection in groupadd.
+- `os_auth_sub_uid_count`
+  - Default: `65536`
+  - Description: If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate user IDs) allocate SUB_UID_COUNT unused user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user. See also `os_auth_sub_uid_min` and `os_auth_sub_uid_max`.
+- `os_auth_sub_uid_min`.
+  - Default: `100000`
+  - Description: minimum number for automatic subordinate uid selection in useradd and newusers.
+- `os_auth_sub_uid_max`
+  - Default: `600100000`
+  - Description: maximum number for automatic subordinate uid selection in useradd and newusers.
+- `os_auth_sub_gid_count`
+  - Default: `65536`
+  - Description: If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate group IDs) allocate SUB_GID_COUNT unused group IDs from the range SUB_GID_MIN to SUB_GID_MAX for each new user. See also `os_auth_sub_gid_min` and `os_auth_sub_gid_max`.
+- `os_auth_sub_gid_min`
+  - Default: `100000`
+  - Description: minimum number for automatic subordinate gid selection in useradd and newusers.
+- `os_auth_sub_gid_max`
+  - Default: `600100000`
+  - Description: maximum number for automatic subordinate gid selection in useradd and newusers.
 - `os_security_packages_clean`
   - Default: `true`
   - Description: removes packages with known issues. See section packages.
@@ -169,6 +206,9 @@ We know that this is the case on Raspberry Pi.
 - `ufw_default_forward_policy`
   - Default: `DROP`
   - Description: set default forward policy of ufw to `DROP`.
+- `ufw_enable_ipv6`
+  - Default: `true`
+  - Description: Set to `true` to apply rules to support IPv6 (no means only IPv6 on loopback accepted).
 - `os_auditd_enabled`
   - Default: `true`
   - Description: Set to false to disable installing and configuring auditd.
@@ -184,6 +224,285 @@ We know that this is the case on Raspberry Pi.
 - `proc_mnt_options`
   - Default: `rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}`
   - Description: Mount proc with hardenized options, including `hidepid` with variable value.
+- `os_ignore_users`
+  - Default: `['vagrant', 'kitchen']`
+  - Description: Specify system accounts whose login should not be disabled and password not changed
+- `os_ignore_home_folder_users`
+  - Default: `lost+found`
+  - Description: specify user home folders in `/home` that shouldn't be chmodded to 700
+- `os_cron_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring cron.
+- `os_ctrlaltdel_disabled`
+  - Default: `false`
+  - Description: Set to true to disable ctrl-alt-delete key combination.
+- `os_limits_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring limits.
+- `os_login_defs_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring login_defs.
+- `os_minimize_access_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring minimize_access.
+- `os_pam_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring pam.
+- `os_modprobe_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring modprobe.
+- `os_profile_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring profile.
+- `os_security_auto_logout`
+  - Default: `0`
+  - Description: Set timeout in seconds for logout users automatically after time. Setting this to `0` disables the timeout.
+- `os_securetty_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring securetty.
+- `os_sysctl_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring sysctl.
+- `os_user_accounts_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring user_accounts.
+- `os_rhosts_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring rhosts.
+- `os_yum_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring yum.
+- `os_yum_repo_file_whitelist`
+  - Default: `[]`
+  - Description: List of yum repository files under /etc/yum.repos.d/ which should not be altered.
+- `os_apt_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring apt.
+- `os_selinux_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring selinux.
+- `os_sha_crypt_min_rounds`
+  - Default: `640000`
+  - Description: Define the number of minimum SHA rounds. With a lot of rounds brute forcing the password is more difficult. But note also that it more CPU resources will be needed to authenticate users. The values must be inside the 1000-999999999 range.
+- `os_sha_crypt_max_rounds`
+  - Default: `640000`
+  - Description: Define the number of maximum SHA rounds. With a lot of rounds brute forcing the password is more difficult. But note also that it more CPU resources will be needed to authenticate users. The values must be inside the 1000-999999999 range.
+- `os_mnt_boot_dir_mode`
+  - Default: `0700`
+  - Description: Set default perimissions for /boot
+- `os_mnt_boot_enabled`
+  - Default: `false`
+  - Description: Set to true to configure /boot mountpoint
+- `os_mnt_boot_src`
+  - Default: `''`
+  - Description: Set mount source for /boot
+- `os_mnt_boot_options`
+  - Default: `rw,nosuid,nodev,noexec`
+  - Description: Configure mount options for /boot
+- `os_mnt_boot_filesystem`
+  - Default: `""`
+  - Description: Configure file system for fstab entry /boot. If empty, the current file system type will be used.
+- `os_mnt_boot_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_boot_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_dev_dir_mode`
+  - Default: `0755`
+  - Description: Set default perimissions for /dev
+- `os_mnt_dev_enabled`
+  - Default: `true`
+  - Description: Set to false to ignore /dev mountpoint
+- `os_mnt_dev_src`
+  - Default: `devtmpfs`
+  - Description: Set mount source for /dev
+- `os_mnt_dev_options`
+  - Default: `'rw,nosuid,noexec'`
+  - Description: Configure mount options for /dev
+- `os_mnt_dev_filesystem`
+  - Default: `devtmpfs`
+  - Description: Configure file system for fstab entry /dev
+- `os_mnt_dev_dump`
+  - Default: `0`
+  - Description: Configure dump for fstab entry /var/tmp.
+- `os_mnt_dev_passno`
+  - Default: `0`
+  - Description: Configure passno for fstab entry /var/tmp.
+- `os_mnt_dev_shm_dir_mode`
+  - Default: `1777`
+  - Description: Set default perimissions for /dev/shm
+- `os_mnt_dev_shm_enabled`
+  - Default: `true`
+  - Description: Set to false to ignore /dev/shm mountpoint
+- `os_mnt_dev_shm_src`
+  - Default: `tmpfs`
+  - Description: Set mount source for /dev/shm
+- `os_mnt_dev_shm_options`
+  - Default: `rw,nosuid,nodev,noexec`
+  - Description: Configure mount options for /dev/shm
+- `os_mnt_dev_shm_filesystem`
+  - Default: `tmpfs`
+  - Description: Configure file system for fstab entry /dev/shm
+- `os_mnt_dev_shm_dump`
+  - Default: `0`
+  - Description: Configure dump for fstab entry /var/tmp.
+- `os_mnt_dev_shm_passno`
+  - Default: `0`
+  - Description: Configure passno for fstab entry /var/tmp.
+- `os_mnt_home_dir_mode`
+  - Default: `0755`
+  - Description: Set default perimissions for /home
+- `os_mnt_home_enabled`
+  - Default: `false`
+  - Description: Set to true to configure /home mountpoint
+- `os_mnt_home_src`
+  - Default: `""`
+  - Description: Set mount source for /home. If empty, the current file system source device will be used.
+- `os_mnt_home_options`
+  - Default: `rw,nosuid,nodev`
+  - Description: Configure mount options for /home
+- `os_mnt_home_filesystem`
+  - Default: `""`
+  - Description: Configure file system for fstab entry /home. If empty, the current file system type will be used.
+- `os_mnt_home_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_home_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_run_dir_mode`
+  - Default: `0755`
+  - Description: Set default perimissions for /run
+- `os_mnt_run_enabled`
+  - Default: `true`
+  - Description: Set to false to ignore /run mountpoint
+- `os_mnt_run_src`
+  - Default: `tmpfs`
+  - Description: Set mount source for /run
+- `os_mnt_run_options`
+  - Default: `rw,nosuid,nodev`
+  - Description: Configure mount options for /run
+- `os_mnt_run_filesystem`
+  - Default: `tmpfs`
+  - Description: Configure file system for fstab entry /run
+- `os_mnt_run_dump`
+  - Default: `0`
+  - Description: Configure dump for fstab entry /var/tmp.
+- `os_mnt_run_passno`
+  - Default: `0`
+  - Description: Configure passno for fstab entry /var/tmp.
+- `os_mnt_tmp_dir_mode`
+  - Default: `1777`
+  - Description: Set default perimissions for /tmp
+- `os_mnt_tmp_enabled`
+  - Default: `false`
+  - Description: Set to true to configure /tmp mountpoint
+- `os_mnt_tmp_src`
+  - Default: `""`
+  - Description: Set mount source for /tmp. If empty, the current file system source device will be used.
+- `os_mnt_tmp_options`
+  - Default: `rw,nosuid,nodev,noexec`
+  - Description: Configure mount options for /tmp
+- `os_mnt_tmp_filesystem`
+  - Default: `""`
+  - Description: Configure file system for fstab entry /tmp. If empty, the current file system type will be used.
+- `os_mnt_tmp_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_tmp_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_var_dir_mode`
+  - Default: `0755`
+  - Description: Set default perimissions for /var
+- `os_mnt_var_enabled`
+  - Default: `false`
+  - Description: Set to true to configure /var mountpoint
+- `os_mnt_var_src`
+  - Default: `""`
+  - Description: Set mount source for /var. If empty, the current file system source device will be used.
+- `os_mnt_var_options`
+  - Default: `rw,nosuid,nodev`
+  - Description: Configure mount options for /var
+- `os_mnt_var_filesystem`
+  - Default: `""`
+  - Description: Configure file system for fstab entry /var. If empty, the current file system type will be used.
+- `os_mnt_var_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_var_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_var_log_dir_mode`
+  - Default: `0755`
+  - Description: Set default perimissions for /var/log
+- `os_mnt_var_log_enabled`
+  - Default: `false`
+  - Description: Set to true to configure /var/log mountpoint
+- `os_mnt_var_log_src`
+  - Default: `""`
+  - Description: Set mount source for /var/log. If empty, the current file system source device will be used.
+- `os_mnt_var_log_options`
+  - Default: `rw,nosuid,nodev,noexec`
+  - Description: Configure mount options for /var/log
+- `os_mnt_var_log_filesystem`
+  - Default: `""`
+  - Description: Configure file system for fstab entry /var/log. If empty, the current file system type will be used.
+- `os_mnt_var_log_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_var_log_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_var_log_audit_dir_mode`
+  - Default: `0640`
+  - Description: Set default perimissions for /var/log/audit
+- `os_mnt_var_log_audit_enabled`
+  - Default: `false`
+  - Description: Set to true to configure /var/log/audit mountpoint
+- `os_mnt_var_log_audit_src`
+  - Default: `""`
+  - Description: Set mount source for /var/log/audit. If empty, the current file system source device will be used.
+- `os_mnt_var_log_audit_options`
+  - Default: `rw,nosuid,nodev,noexec`
+  - Description: Configure mount options for /var/log/audit
+- `os_mnt_var_log_audit_filesystem`
+  - Default: `""`
+  - Description: Configure file system for fstab entry /var/log/audit. If empty, the current file system type will be used.
+- `os_mnt_var_log_audit_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_var_log_audit_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_var_tmp_dir_mode`
+  - Default: `1777`
+  - Description: Set default perimissions for /var/tmp
+- `os_mnt_var_tmp_enabled`
+  - Default: `false`
+  - Description: Set to true to configure /var/tmp mountpoint
+- `os_mnt_var_tmp_src`
+  - Default: `""`
+  - Description: Set mount source for /var/tmp. If empty, the current file system source device will be used.
+- `os_mnt_var_tmp_options`
+  - Default: `rw,nosuid,nodev,noexec`
+  - Description: Configure mount options for /var/tmp
+- `os_mnt_var_tmp_filesystem`
+  - Default: `""`
+  - Description: Configure file system for fstab entry /var/tmp. If empty, the current file system type will be used.
+- `os_mnt_var_tmp_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_var_tmp_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_netrc_enabled`
+  - Default: `True`
+  - Description: Configure filesystem for existence of .netrc file in homedir
+- `os_netrc_whitelist_user`
+  - Default: ``
+  - Description: Add list of user to allow creation of .netrc in users homedir
 
 ## Packages
 
@@ -219,7 +538,7 @@ To prevent some of the filesystems from being disabled, add them to the `os_file
   collections:
     - devsec.hardening
   roles:
-    - devsec.hardening.os_hardening
+    - os_hardening
 ```
 
 ## Changing sysctl variables
@@ -232,7 +551,7 @@ So for example if you want to change the IPv4 traffic forwarding variable to `1`
   collections:
     - devsec.hardening
   roles:
-    - devsec.hardening.os_hardening
+    - os_hardening
   vars:
     sysctl_overwrite:
       # Enable IPv4 traffic forwarding.
@@ -249,6 +568,13 @@ For more information, please see this [upstream documentation](https://www.kerne
 
 ## More information
 
+We use specific PAM configuration for every linux distribution. This is a very diverse area, since every vendor seems to push their own system for managing PAM. We used following guides and sources for our configuration.
+
+- on Debian/Ubuntu we use [pam-config-framework](https://wiki.ubuntu.com/PAMConfigFrameworkSpec)
+- RHEL8 and compatible use information from [authselect](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_authentication_and_authorization_in_rhel/configuring-user-authentication-using-authselect_configuring-authentication-and-authorization-in-rhel), but our setup disables the configuration from authselect
+- RHEL 6/7 and compatible use [authconfig](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/authconfig-install), but our setup disables the configuration from authconfig
+- for RHEL 6/7 we also use information from [Desktop Security](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-hardening_your_system_with_tools_and_services#sec-Desktop_Security)
+
 This role is mostly based on guides by:
 
 - [Arch Linux wiki, Sysctl hardening](https://wiki.archlinux.org/index.php/Sysctl)

roles/os_hardening/defaults/main.yml

@@ -2,31 +2,38 @@
 os_desktop_enable: false
 os_env_extra_user_paths: []
 os_auth_pw_max_age: 60
-os_auth_pw_min_age: 7  # discourage password cycling
+os_auth_pw_min_age: 7  # Discourage password cycling
+os_auth_pw_remember: 5  # Specify how many used passwords are record
 os_auth_retries: 5
-os_auth_lockout_time: 600  # 10min
+os_auth_lockout_time: 600  # Seconds (600 = 10min)
 os_auth_timeout: 60
 os_auth_allow_homeless: false
 os_auth_pam_passwdqc_enable: true
-os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8'  # used in RHEL6
-os_auth_pam_pwquality_options: 'try_first_pass retry=3 type='  # used in RHEL7
+os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8'  # Used in Debian
+os_auth_pam_pwquality_options: 'try_first_pass retry=3 authtok_type='  # Used in RHEL7 and RHEL8
 os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]
 
 os_chfn_restrict: ''
-# may contain: change_user
+
+# Set to false to disable chmod /home folders to 700
+os_chmod_home_folders: true
+
+# May contain: change_user
 os_security_users_allow: []
-# specify system accounts those login should not be disabled and password not changed
+# Specify user home folders in /home that shouldn't be chmodded to 700
+os_ignore_home_folder_users: ['lost+found']
+# Specify system accounts whose login should not be disabled and password not changed
 os_ignore_users: ['vagrant', 'kitchen']
 os_security_kernel_enable_module_loading: true
 os_security_kernel_enable_core_dump: false
 os_security_suid_sgid_enforce: true
-# user-defined blacklist and whitelist
+# User-defined blacklist and whitelist
 os_security_suid_sgid_blacklist: []
 os_security_suid_sgid_whitelist: []
-# if this is true, remove any suid/sgid bits from files that were not in the whitelist
+# If this is true, remove any suid/sgid bits from files that are not in the whitelist
 os_security_suid_sgid_remove_from_unknown: false
 
-# remove packages with known issues
+# Remove packages with known security issues
 os_security_packages_clean: true
 os_security_packages_list: ['xinetd', 'inetd', 'ypserv', 'telnet-server', 'rsh-server', 'prelink']
 
@@ -39,9 +46,9 @@ os_security_init_single: false
 ufw_manage_defaults: true
 
 # Empty variable disables IPT_SYSCTL in /etc/default/ufw
-# by default in Ubuntu it set to: /etc/ufw/sysctl.conf
-# CAUTION
-# if you enable it - it'll overwrite /etc/sysctl.conf file, managed by hardening framework
+# By default in Ubuntu it is set to: /etc/ufw/sysctl.conf
+# CAUTION!
+# If you enable it - it overwrites /etc/sysctl.conf file, managed by hardening framework
 ufw_ipt_sysctl: ''
 
 # Default ufw variables
@@ -52,6 +59,10 @@ ufw_default_application_policy: 'SKIP'
 ufw_manage_builtins: 'no'
 ufw_ipt_modules: 'nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns'
 
+# Set to true to apply rules to support IPv6 (no means only IPv6 on loopback
+# accepted).
+ufw_enable_ipv6: true
+
 sysctl_config:
   # These settings eliminate an entire class of security vulnerabilities:
   # time-of-check-time-of-use cross-privilege attacks using guessable
@@ -59,6 +70,12 @@ sysctl_config:
   fs.protected_hardlinks: 1
   fs.protected_symlinks: 1
 
+  # For more info on the following settings see: https://www.kernel.org/doc/html/latest/admin-guide/sysctl/fs.html
+  # Restrict FIFO special device creation behavior
+  fs.protected_fifos: 1
+  # Restrict regular files creation behavior
+  fs.protected_regular: 2
+
   # Prevent core dumps with SUID. These are usually only
   # needed by developers and may contain sensitive information. | sysctl-31
   fs.suid_dumpable: 0
@@ -137,10 +154,17 @@ sysctl_config:
   # kernel.yama.ptrace_scope = 1
   kernel.yama.ptrace_scope: 1
 
-  # Disable IPv4 traffic forwarding. | sysctl-01
+  # Disable traffic forwarding.
+  # Setting the flag to 0 ensures that a system with multiple interfaces (for example, a hard
+  # proxy), will never be able to forward packets, and therefore, never serve as a router.
+  # | sysctl-01 | sysctl-19
   net.ipv4.ip_forward: 0
+  net.ipv6.conf.all.forwarding: 0
 
-  # Enable RFC-recommended source validation feature. | sysctl-02
+  # Enable RFC-recommended source validation feature.
+  # If the return packet does not go out the same interface that the corresponding
+  # source packet came from, the packet is dropped (and logged if log_martians is set).
+  # | sysctl-02
   net.ipv4.conf.all.rp_filter: 1
   net.ipv4.conf.default.rp_filter: 1
 
@@ -148,7 +172,9 @@ sysctl_config:
   # Make sure to ignore ECHO broadcasts, which are only required in broad network analysis.
   net.ipv4.icmp_echo_ignore_broadcasts: 1
 
-  # There is no reason to accept bogus error responses from ICMP, so ignore them instead. | sysctl-03
+  # Some routers (and some attackers) will send responses that violate RFC-1122 and attempt
+  # to fill up a log file system with many useless error messages.
+  # | sysctl-03
   net.ipv4.icmp_ignore_bogus_error_responses: 1
 
   # Limit the amount of traffic the system uses for ICMP. | sysctl-05
@@ -158,7 +184,7 @@ sysctl_config:
   # source quench, ime exceed, param problem, timestamp reply, information reply | sysctl-06
   net.ipv4.icmp_ratemask: 88089
 
-  # Protect against wrapping sequence numbers at gigabit speeds | sysctl-07
+  # Disable TCP timestamps in order to not reveal system uptime. | sysctl-07
   net.ipv4.tcp_timestamps: 0
 
   # Define restriction level for announcing the local source IP | sysctl-08
@@ -187,17 +213,33 @@ sysctl_config:
   # so disable it if not needed. | sysctl-13
   net.ipv4.conf.all.accept_source_route: 0
   net.ipv4.conf.default.accept_source_route: 0
+  net.ipv6.conf.all.accept_source_route: 0
+  net.ipv6.conf.default.accept_source_route: 0
 
-  # For non-routers: don't send redirects, these settings are 0 | sysctl-16
+  # For non-routers: don't send redirects.
+  # An attacker could use a compromised host to send invalid ICMP redirects to other
+  # router devices in an attempt to corrupt routing and have users access a system
+  # set up by the attacker as opposed to a valid system.
+  # | sysctl-16
   net.ipv4.conf.all.send_redirects: 0
   net.ipv4.conf.default.send_redirects: 0
 
-  # log martian packets | sysctl-17
+  # Log martian packets
+  # This feature logs packets with un-routable source addresses to the kernel log.
+  # Enabling this feature and logging these packets allows an administrator to investigate
+  # the possibility that an attacker is sending spoofed packets to their system.
+  # | sysctl-17
   net.ipv4.conf.all.log_martians: 1
   net.ipv4.conf.default.log_martians: 1
 
   # Accepting redirects can lead to malicious networking behavior, so disable
-  # it if not needed. | sysctl-13 | sysctl-14 | sysctl-15 | sysctl-20
+  # it if not needed.
+  # Attackers could use bogus ICMP redirect messages to maliciously alter the system
+  # routing tables and get them to send packets to incorrect networks and allow
+  # your system packets to be captured.
+  # Setting net.ipv4.conf.all.secure_redirects to 0 protects the system from
+  # routing table updates by possibly compromised known gateways.
+  # | sysctl-13 | sysctl-14 | sysctl-15 | sysctl-20
   net.ipv4.conf.default.accept_redirects: 0
   net.ipv4.conf.all.accept_redirects: 0
   net.ipv4.conf.all.secure_redirects: 0
@@ -205,13 +247,7 @@ sysctl_config:
   net.ipv6.conf.default.accept_redirects: 0
   net.ipv6.conf.all.accept_redirects: 0
 
-  # Disable IPv6 | sysctl-18
-  net.ipv6.conf.all.disable_ipv6: 1
-
-  # Disable IPv6 traffic forwarding. | sysctl-19
-  net.ipv6.conf.all.forwarding: 0
-
-  # ignore RAs on Ipv6. | sysctl-25
+  # Ignore RAs on Ipv6. | sysctl-25
   net.ipv6.conf.all.accept_ra: 0
   net.ipv6.conf.default.accept_ra: 0
 
@@ -256,7 +292,7 @@ sysctl_config:
 # at task 'create a combined sysctl-dict if overwrites are defined'
 sysctl_overwrite:
 
-# disable unused filesystems
+# Disable unused filesystems
 os_unused_filesystems:
   - "cramfs"
   - "freevxfs"
@@ -273,7 +309,7 @@ os_unused_filesystems:
   - "sctp"  # CIS 3.5.2
   - "tipc"  # CIS 3.5.4
 
-# whitelist for used filesystems
+# Whitelist for used filesystems
 os_filesystem_whitelist: []
 
 # Set to false to turn the role into a no-op. Useful when using
@@ -285,9 +321,153 @@ os_auditd_enabled: true
 os_auditd_max_log_file: 6
 os_auditd_max_log_file_action: keep_logs
 
-# Set the SELinux state, can be either disabled, permissive, or enforcing.
+# Set the SELinux state, which can be either disabled, permissive, or enforcing.
 os_selinux_state: enforcing
 # Set the SELinux polixy.
 os_selinux_policy: targeted
 
+# Mount options for proc in /etc/fstab.
 proc_mnt_options: 'rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}'
+
+# Set to false to disable installing and configuring cron.
+os_cron_enabled: true
+
+# Set to true to disable ctrl-alt-del key combination.
+os_ctrlaltdel_disabled: false
+
+# Set to false to disable installing and configuring limits.
+os_limits_enabled: true
+
+# Set to false to disable installing and configuring login_defs.
+os_login_defs_enabled: true
+
+# Set to false to disable installing and configuring minimize_access.
+os_minimize_access_enabled: true
+
+# Set to false to disable installing and configuring pam.
+os_pam_enabled: true
+
+# Set to false to disable installing and configuring modprobe.
+os_modprobe_enabled: true
+
+# Set to false to disable installing and configuring profile.
+os_profile_enabled: true
+
+# Set to false to disable installing and configuring securetty.
+os_securetty_enabled: true
+
+# Set timeout in seconds for logout users automatically after time. Setting this to `0` disables the timeout.
+os_security_auto_logout: 0
+
+# Set to false to disable installing and configuring sysctl.
+os_sysctl_enabled: true
+
+# Set to false to disable installing and configuring user_accounts.
+os_user_accounts_enabled: true
+
+# Set to false to disable installing and configuring rhosts.
+os_rhosts_enabled: true
+
+# Set to false to disable installing and configuring yum.
+os_yum_enabled: true
+
+# List of yum repository files under /etc/yum.repos.d/ which should not be altered.
+os_yum_repo_file_whitelist: []
+
+# Set to false to disable installing and configuring apt.
+os_apt_enabled: true
+
+# Set to false to disable installing and configuring selinux.
+os_selinux_enabled: true
+
+# Define the number of SHA rounds.
+# With a lot of rounds brute forcing the password is more difficult. But note also that it more CPU resources will be needed to authenticate users.
+# The values must be inside the 1000-999999999 range.
+os_sha_crypt_min_rounds: "640000"
+os_sha_crypt_max_rounds: "640000"
+
+os_mnt_boot_dir_mode: '0700'
+os_mnt_boot_enabled: false
+os_mnt_boot_src: ""
+os_mnt_boot_options: 'rw,nosuid,nodev,noexec'
+os_mnt_boot_filesystem: ""
+os_mnt_boot_dump: ""
+os_mnt_boot_passno: ""
+
+os_mnt_dev_dir_mode: '0755'
+os_mnt_dev_enabled: true
+os_mnt_dev_src: "devtmpfs"
+os_mnt_dev_options: 'rw,nosuid,noexec'
+os_mnt_dev_filesystem: "devtmpfs"
+os_mnt_dev_dump: ""
+os_mnt_dev_passno: ""
+
+os_mnt_dev_shm_dir_mode: '1777'
+os_mnt_dev_shm_enabled: true
+os_mnt_dev_shm_src: "tmpfs"
+os_mnt_dev_shm_options: 'rw,nosuid,nodev,noexec'
+os_mnt_dev_shm_filesystem: "tmpfs"
+os_mnt_dev_shm_dump: ""
+os_mnt_dev_shm_passno: ""
+
+os_mnt_home_dir_mode: '0755'
+os_mnt_home_enabled: false
+os_mnt_home_src: ""
+os_mnt_home_options: 'rw,nosuid,nodev'
+os_mnt_home_filesystem: ""
+os_mnt_home_dump: ""
+os_mnt_home_passno: ""
+
+os_mnt_run_dir_mode: '0755'
+os_mnt_run_enabled: true
+os_mnt_run_src: "tmpfs"
+os_mnt_run_options: 'rw,nosuid,nodev'
+os_mnt_run_filesystem: "tmpfs"
+os_mnt_run_dump: ""
+os_mnt_run_passno: ""
+
+os_mnt_tmp_dir_mode: '1777'
+os_mnt_tmp_enabled: false
+os_mnt_tmp_src: ""
+os_mnt_tmp_options: 'rw,nosuid,nodev,noexec'
+os_mnt_tmp_filesystem: ""
+os_mnt_tmp_dump: ""
+os_mnt_tmp_passno: ""
+
+os_mnt_var_dir_mode: '0755'
+os_mnt_var_enabled: false
+os_mnt_var_src: ""
+os_mnt_var_options: 'rw,nosuid,nodev'
+os_mnt_var_filesystem: ""
+os_mnt_var_dump: ""
+os_mnt_var_passno: ""
+
+os_mnt_var_log_dir_mode: '0755'
+os_mnt_var_log_enabled: false
+os_mnt_var_log_src: ""
+os_mnt_var_log_options: 'rw,nosuid,nodev,noexec'
+os_mnt_var_log_filesystem: ""
+os_mnt_var_log_dump: ""
+os_mnt_var_log_passno: ""
+
+os_mnt_var_log_audit_dir_mode: '0700'
+os_mnt_var_log_audit_enabled: false
+os_mnt_var_log_audit_src: ""
+os_mnt_var_log_audit_options: 'rw,nosuid,nodev,noexec'
+os_mnt_var_log_audit_filesystem: ""
+os_mnt_var_log_audit_dump: ""
+os_mnt_var_log_audit_passno: ""
+
+os_mnt_var_tmp_dir_mode: '1777'
+os_mnt_var_tmp_enabled: false
+os_mnt_var_tmp_src: ""
+os_mnt_var_tmp_options: 'rw,nosuid,nodev,noexec'
+os_mnt_var_tmp_filesystem: ""
+os_mnt_var_tmp_dump: ""
+os_mnt_var_tmp_passno: ""
+
+#
+# .netrc User whitelist
+# keep .netrc file for users in whitelist
+os_netrc_enabled: true
+os_netrc_whitelist_user: []

roles/os_hardening/handlers/main.yml

@@ -1,3 +1,19 @@
 ---
-- name: update-initramfs
+- name: Update-initramfs
   command: 'update-initramfs -u'
+
+- name: restart-auditd
+  command:
+    cmd: 'service auditd restart'  # rhel: see: https://access.redhat.com/solutions/2664811
+    warn: false  # sadly 'service' module fails in that case also by using 'use: service'
+  when: molecule_yml is not defined  # restarting auditd in a container does not work
+
+- name: Reload systemd
+  systemd:
+    daemon_reload: true
+
+- name: Remount filesystems
+  mount:
+    path: "{{ item }}"
+    state: remounted
+  loop: "{{ mountpoints_changed }}"

roles/os_hardening/meta/main.yml

@@ -4,25 +4,26 @@ galaxy_info:
   description: 'This Ansible role provides numerous security-related ssh configurations, providing all-round base protection.'
   company: Hardening Framework Team
   license: Apache License 2.0
-  min_ansible_version: '2.5'
+  min_ansible_version: '2.9.10'
   platforms:
     - name: EL
       versions:
-        - 7
-        - 8
+        - "7"
+        - "8"
     - name: Ubuntu
       versions:
-        - xenial
         - bionic
+        - focal
+        - jammy
     - name: Debian
       versions:
-        - stretch
         - buster
+        - bullseye
     - name: Amazon
     - name: Fedora
-    - name: Archlinux
+    - name: ArchLinux
     - name: SmartOS
-    - name: openSUSE
+    - name: opensuse
   galaxy_tags:
     - system
     - security

roles/os_hardening/tasks/apt.yml

@@ -1,5 +1,5 @@
 ---
-- name: remove deprecated or insecure packages | package-01 - package-09
+- name: Remove deprecated or insecure packages | package-01 - package-09
   apt:
     name: '{{ os_security_packages_list }}'
     state: 'absent'

roles/os_hardening/tasks/auditd.yml

@@ -1,13 +1,16 @@
 ---
-- name: install auditd package | package-08
+- name: Install auditd package | package-08
   package:
     name: '{{ auditd_package }}'
     state: 'present'
+  tags: auditd
 
-- name: configure auditd | package-08
+- name: Configure auditd | package-08
   template:
     src: 'etc/audit/auditd.conf.j2'
     dest: '/etc/audit/auditd.conf'
     owner: 'root'
     group: 'root'
     mode: '0640'
+  notify: 'restart-auditd'
+  tags: auditd

roles/os_hardening/tasks/cron.yml

@@ -0,0 +1,28 @@
+---
+# Granting write access to this directory for non-privileged users could provide
+# them the means for gaining unauthorized elevated privileges.
+# Granting read access to this directory could give an unprivileged user insight
+# in how to gain elevated privileges or circumvent auditing controls.
+# CIS 5.1.2 - CIS 5.1.7
+#
+- name: Find cron files and directories
+  find:
+    paths:
+      - /etc
+    patterns:
+      - cron.hourly
+      - cron.daily
+      - cron.weekly
+      - cron.monthly
+      - cron.d
+      - crontab
+    file_type: any
+  register: cron_directories
+
+- name: Ensure permissions on cron files and directories are configured
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    owner: root
+    group: root
+    mode: og-rwx
+  with_items: "{{ cron_directories.files }}"

roles/os_hardening/tasks/ctrlaltdel.yml

@@ -0,0 +1,7 @@
+---
+- name: Disable CTRL-ALT-DEL
+  systemd:
+    name: ctrl-alt-del.target
+    masked: true
+    daemon_reload: true
+  when: ansible_service_mgr == "systemd"

roles/os_hardening/tasks/hardening.yml

@@ -14,37 +14,53 @@
 
 # we only override variables with our default, if they have not been specified already
 # by default the lookup functions finds all varnames containing the string, therefore
-# we add ^ and $ to denote start and end of string, so this returns only exact maches
-- name: Set OS dependent variables, if not already defined by user
+# we add ^ and $ to denote start and end of string, so this returns only exact matches
+- name: Set OS dependent variables, if not already defined by user  # noqa var-naming
   set_fact:
     '{{ item.key }}': '{{ item.value }}'
   when: "not lookup('varnames', '^' + item.key + '$')"
   with_dict: '{{ os_vars }}'
+  tags: always
 
 - import_tasks: auditd.yml
   tags: auditd
   when: os_auditd_enabled | bool
 
+- import_tasks: cron.yml
+  tags: cron
+  when: os_cron_enabled | bool
+
+- import_tasks: ctrlaltdel.yml
+  tags: ctrlaltdel
+  when: os_ctrlaltdel_disabled | bool
+
 - import_tasks: limits.yml
   tags: limits
+  when: os_limits_enabled | bool
 
 - import_tasks: login_defs.yml
   tags: login_defs
+  when: os_login_defs_enabled | bool
 
 - import_tasks: minimize_access.yml
   tags: minimize_access
+  when: os_minimize_access_enabled | bool
 
 - import_tasks: pam.yml
   tags: pam
+  when: os_pam_enabled | bool
 
 - import_tasks: modprobe.yml
   tags: modprobe
+  when: os_modprobe_enabled | bool
 
 - import_tasks: profile.yml
   tags: profile
+  when: os_profile_enabled | bool
 
 - import_tasks: securetty.yml
   tags: securetty
+  when: os_securetty_enabled | bool
 
 - import_tasks: suid_sgid.yml
   when: os_security_suid_sgid_enforce  | bool
@@ -52,21 +68,34 @@
 
 - import_tasks: sysctl.yml
   tags: sysctl
+  when: os_sysctl_enabled | bool
 
 - import_tasks: user_accounts.yml
   tags: user_accounts
+  when: os_user_accounts_enabled | bool
 
 - import_tasks: rhosts.yml
   tags: rhosts
+  when: os_rhosts_enabled | bool
+
+- import_tasks: netrc.yml
+  tags: netrc
+  when: os_netrc_enabled | bool
 
 - import_tasks: yum.yml
-  when: ansible_facts.os_family == 'RedHat'
   tags: yum
+  when:
+    - ansible_facts.os_family == 'RedHat'
+    - os_yum_enabled | bool
 
 - import_tasks: apt.yml
-  when: ansible_facts.distribution in ['Debian', 'Ubuntu']
   tags: apt
+  when:
+    - ansible_facts.os_family == 'Debian'
+    - os_apt_enabled | bool
 
 - import_tasks: selinux.yml
   tags: selinux
-  when: ansible_facts.selinux.status == 'enabled'
+  when:
+    - ansible_facts.selinux.status == 'enabled'
+    - os_selinux_enabled | bool

roles/os_hardening/tasks/limits.yml

@@ -1,6 +1,7 @@
 ---
-- block:
-  - name: create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
+- name: disable coredumps
+  block:
+  - name: Create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
     file:
       path: '/etc/security/limits.d'
       owner: 'root'
@@ -8,7 +9,7 @@
       mode: '0755'
       state: 'directory'
 
-  - name: create additional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
+  - name: Create additional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
     pam_limits:
       dest: '/etc/security/limits.d/10.hardcore.conf'
       domain: '*'
@@ -17,7 +18,7 @@
       value: '0'
       comment: Prevent core dumps for all users. These are usually not needed and may contain sensitive information
 
-  - name: set 10.hardcore.conf perms to 0400 and root ownership
+  - name: Set 10.hardcore.conf perms to 0400 and root ownership
     file:
       path: /etc/security/limits.d/10.hardcore.conf
       owner: 'root'
@@ -27,10 +28,38 @@
       modification_time: preserve
       access_time: preserve
 
+  - name: create coredump.conf.d-directory if it does not exist
+    file:
+      path: '/etc/systemd/coredump.conf.d'
+      owner: root
+      group: root
+      mode: 0755
+      state: directory
+    when: ansible_service_mgr == "systemd"
+
+  - name: create custom.conf for disabling coredumps
+    template:
+      src: 'etc/systemd/coredump.conf.d/coredumps.conf.j2'
+      dest: '/etc/systemd/coredump.conf.d/custom.conf'
+      owner: root
+      group: root
+      mode: 0644
+    when: ansible_service_mgr == "systemd"
+    notify: Reload systemd
+
   when: not os_security_kernel_enable_core_dump | bool
 
-- name: remove 10.hardcore.conf config file
-  file:
-    path: /etc/security/limits.d/10.hardcore.conf
-    state: absent
+- name: enable coredumps
+  block:
+    - name: Remove coredump.conf.d directory with files
+      file:
+        path: /etc/systemd/coredump.conf.d
+        state: absent
+      when: ansible_service_mgr == "systemd"
+      notify: Reload systemd
+
+    - name: Remove 10.hardcore.conf config file
+      file:
+        path: /etc/security/limits.d/10.hardcore.conf
+        state: absent
   when: os_security_kernel_enable_core_dump | bool

roles/os_hardening/tasks/login_defs.yml

@@ -1,5 +1,5 @@
 ---
-- name: create login.defs | os-05, os-05b
+- name: Create login.defs | os-05, os-05b
   template:
     src: 'etc/login.defs.j2'
     dest: '/etc/login.defs'

roles/os_hardening/tasks/main.yml

@@ -1,3 +1,5 @@
 ---
-- import_tasks: hardening.yml
+- include_tasks: hardening.yml
   when: os_hardening_enabled | bool
+  tags:
+    - always

roles/os_hardening/tasks/minimize_access.yml

@@ -4,21 +4,21 @@
 # still getting found and the permissions minimized in the next task.
 # This is also the reason why there's ignore_errors: true on the task.
 # also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
-- name: find files with write-permissions for group
-  shell: "find -L {{ item }} -perm /go+w -type f"  # noqa 305
-  with_flattened:
+- name: Find files with write-permissions for group
+  shell: "find -L {{ item }} -perm /go+w -type f"  # noqa command-instead-of-shell
+  with_community.general.flattened:
     - '/usr/local/sbin'
     - '/usr/local/bin'
     - '/usr/sbin'
     - '/usr/bin'
     - '/sbin'
     - '/bin'
-    - "{{ os_env_extra_user_paths }}"  # noqa 104
+    - "{{ os_env_extra_user_paths }}"  # noqa deprecated-bare-vars
   register: minimize_access_directories
   ignore_errors: true
   changed_when: false
 
-- name: minimize access on found files
+- name: Minimize access on found files
   file:
     path: '{{ item.1 }}'
     mode: 'go-w'
@@ -27,21 +27,45 @@
     - "{{ minimize_access_directories.results }}"
     - stdout_lines
 
-- name: change shadow ownership to root and mode to 0600 | os-02
+- name: Find shadow files
+  stat:
+    path: "{{ item }}"
+  loop:
+    - '/etc/shadow'
+    - '/etc/gshadow'
+    - '/etc/shadow-'
+    - '/etc/gshadow-'
+  register: minimize_access_shadow_files
+
+- name: Change shadow ownership to root and mode to 0600 | os-02
   file:
-    dest: '/etc/shadow'
+    dest: "{{ item.item }}"
     owner: '{{ os_shadow_perms.owner }}'
     group: '{{ os_shadow_perms.group }}'
     mode: '{{ os_shadow_perms.mode }}'
+  when: item.stat.exists
+  loop: "{{ minimize_access_shadow_files.results }}"
 
-- name: change passwd ownership to root and mode to 0644 | os-03
+- name: Find passwd files
+  stat:
+    path: "{{ item }}"
+  loop:
+    - '/etc/passwd'
+    - '/etc/group'
+    - '/etc/passwd-'
+    - '/etc/group-'
+  register: minimize_access_passwd_files
+
+- name: Change passwd ownership to root and mode to 0644 | os-03
   file:
-    dest: '/etc/passwd'
+    dest: "{{ item.item }}"
     owner: '{{ os_passwd_perms.owner }}'
     group: '{{ os_passwd_perms.group }}'
     mode: '{{ os_passwd_perms.mode }}'
+  when: item.stat.exists
+  loop: "{{ minimize_access_passwd_files.results }}"
 
-- name: change su-binary to only be accessible to user and group root
+- name: Change su-binary to only be accessible to user and group root
   file:
     dest: '/bin/su'
     owner: 'root'
@@ -49,10 +73,34 @@
     mode: '0750'
   when: '"change_user" not in os_security_users_allow'
 
-- name: set option hidepid for proc filesystem
+- name: Set option hidepid for proc filesystem
   mount:
     path: /proc
     src: proc
     fstype: proc
     opts: '{{ proc_mnt_options }}'
-    state: present
+    state: mounted
+
+- name: Generate list of current available mounted filesystems on the system
+  set_fact:
+    mountpoints_list: "{{ ansible_mounts | map(attribute='mount') | list }}"
+
+- name: Append special devices list to valid mountpoint list
+  set_fact:
+    mountpoints_list: "{{ mountpoints_list + ['/dev', '/dev/shm', '/run'] }}"
+
+- name: Minimize access for filesystems
+  include_tasks: minimize_access_fs.yml
+  loop:
+    - { path: '/boot', src: '{{ os_mnt_boot_src }}', fstype: '{{ os_mnt_boot_filesystem }}', opts: '{{ os_mnt_boot_options }}', enabled: "{{ os_mnt_boot_enabled }}", mode: "{{ os_mnt_boot_dir_mode }}", dump: "{{ os_mnt_boot_dump }}", passno: "{{ os_mnt_boot_passno }}" }
+    - { path: '/dev', src: '{{ os_mnt_dev_src }}', fstype: '{{ os_mnt_dev_filesystem }}', opts: '{{ os_mnt_dev_options }}', enabled: "{{ os_mnt_dev_enabled }}", mode: "{{ os_mnt_dev_dir_mode }}", dump: "{{ os_mnt_dev_dump }}", passno: "{{ os_mnt_dev_passno }}" }
+    - { path: '/dev/shm', src: '{{ os_mnt_dev_shm_src }}', fstype: '{{ os_mnt_dev_shm_filesystem }}', opts: '{{ os_mnt_dev_shm_options }}', enabled: "{{ os_mnt_dev_shm_enabled }}", mode: "{{ os_mnt_dev_shm_dir_mode }}", dump: "{{ os_mnt_dev_shm_dump }}", passno: "{{ os_mnt_dev_shm_passno }}" }
+    - { path: '/home', src: '{{ os_mnt_home_src }}', fstype: '{{ os_mnt_home_filesystem }}', opts: '{{ os_mnt_home_options }}', enabled: "{{ os_mnt_home_enabled }}", mode: "{{ os_mnt_home_dir_mode }}", dump: "{{ os_mnt_home_dump }}", passno: "{{ os_mnt_home_passno }}" }
+    - { path: '/run', src: '{{ os_mnt_run_src }}', fstype: '{{ os_mnt_run_filesystem }}', opts: '{{ os_mnt_run_options }}', enabled: "{{ os_mnt_run_enabled }}", mode: "{{ os_mnt_run_dir_mode }}", dump: "{{ os_mnt_run_dump }}", passno: "{{ os_mnt_run_passno }}" }
+    - { path: '/tmp', src: '{{ os_mnt_tmp_src }}', fstype: '{{ os_mnt_tmp_filesystem }}', opts: '{{ os_mnt_tmp_options }}', enabled: "{{ os_mnt_tmp_enabled }}", mode: "{{ os_mnt_tmp_dir_mode }}", dump: "{{ os_mnt_tmp_dump }}", passno: "{{ os_mnt_tmp_passno }}" }
+    - { path: '/var', src: '{{ os_mnt_var_src }}', fstype: '{{ os_mnt_var_filesystem }}', opts: '{{ os_mnt_var_options }}', enabled: "{{ os_mnt_var_enabled }}", mode: "{{ os_mnt_var_dir_mode }}", dump: "{{ os_mnt_var_dump }}", passno: "{{ os_mnt_var_passno }}" }
+    - { path: '/var/log', src: '{{ os_mnt_var_log_src }}', fstype: '{{ os_mnt_var_log_filesystem }}', opts: '{{ os_mnt_var_log_options }}', enabled: "{{ os_mnt_var_log_enabled }}", mode: "{{ os_mnt_var_log_dir_mode }}", dump: "{{ os_mnt_var_log_dump }}", passno: "{{ os_mnt_var_log_passno }}" }
+    - { path: '/var/log/audit', src: '{{ os_mnt_var_log_audit_src }}', fstype: '{{ os_mnt_var_log_audit_filesystem }}', opts: '{{ os_mnt_var_log_audit_options }}', enabled: "{{ os_mnt_var_log_audit_enabled }}", mode: "{{ os_mnt_var_log_audit_dir_mode }}", dump: "{{ os_mnt_var_log_audit_dump }}", passno: "{{ os_mnt_var_log_audit_passno }}" }
+    - { path: '/var/tmp', src: '{{ os_mnt_var_tmp_src }}', fstype: '{{ os_mnt_var_tmp_filesystem }}', opts: '{{ os_mnt_var_tmp_options }}', enabled: "{{ os_mnt_var_tmp_enabled }}", mode: "{{ os_mnt_var_tmp_dir_mode }}", dump: "{{ os_mnt_var_tmp_dump }}", passno: "{{ os_mnt_var_tmp_passno }}" }
+  loop_control:
+    loop_var: mount

roles/os_hardening/tasks/minimize_access_fs.yml

@@ -0,0 +1,36 @@
+---
+- name: "Configure mount {{ mount.path }} with hardened options"
+  mount:
+    path: "{{ mount.path }}"
+    src: "{{ mount.src | default(mountinfo.device, true) }}"
+    fstype: "{{ mount.fstype | default(mountinfo.fstype, true) }}"
+    opts: "{{ mount.opts }}"
+    dump: "{{ mount.dump | default('1' if mount.fstype | default(mountinfo.fstype, true) in ['ext3', 'ext4'] else '0', true) }}"
+    passno: "{{ mount.passno | default('2' if mount.fstype | default(mountinfo.fstype, true) in ['ext3', 'ext4'] else '0', true) }}"
+    state: present
+  register: mountpoint
+  when:
+    - mount.enabled | bool
+    - mount.path in mountpoints_list
+  vars:
+    mountinfo: "{{ ansible_mounts | selectattr('mount', 'equalto', mount.path) | list | first | default(None) }}"
+  notify: Remount filesystems
+
+- name: "Check if {{ mount.path }} exists"
+  stat:
+    path: "{{ mount.path }}"
+  register: mountpoint_exists
+
+- name: "Harden permissions for {{ mount.path }} directory"
+  file:
+    dest: "{{ mount.path }}"
+    owner: 'root'
+    group: 'root'
+    mode: "{{ mount.mode }}"
+  when:
+    - mountpoint_exists.stat.exists | bool
+
+- name: "Register changed mountpoints"
+  set_fact:
+    mountpoints_changed: "{{ mountpoints_changed | default([]) + [mount.path] }}"
+  when: mountpoint.changed  # noqa no-handler

roles/os_hardening/tasks/modprobe.yml

@@ -1,28 +1,26 @@
 ---
-- name: install modprobe to disable filesystems | os-10
+- name: Install modprobe to disable filesystems | os-10
   package:
     name: '{{ modprobe_package }}'
     state: 'present'
 
-- name: check if efi is installed
+- name: Check if efi is installed
   stat:
     path: "/sys/firmware/efi"
   register: efi_installed
 
-- name: remove vfat from fs-list if efi is used
+- name: Remove vfat from fs-list if efi is used
   set_fact:
     os_unused_filesystems: "{{ os_unused_filesystems | difference('vfat') }}"
   when:
     - efi_installed.stat.isdir is defined
     - efi_installed.stat.isdir
 
-- name: remove used filesystems from fs-list
+- name: Remove used filesystems from fs-list
   set_fact:
     os_unused_filesystems: "{{ os_unused_filesystems | difference(ansible_mounts | map(attribute='fstype') | list) }}"
-  # we cannot do this on el6 and below, because these systems don't support the map function
-  when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
 
-- name: disable unused filesystems | os-10
+- name: Disable unused filesystems | os-10
   template:
     src: 'etc/modprobe.d/modprobe.j2'
     dest: '/etc/modprobe.d/dev-sec.conf'

roles/os_hardening/tasks/netrc.yml

@@ -0,0 +1,13 @@
+---
+- name: Get user accounts | os-09
+  command: "awk -F: '{print $1}' /etc/passwd"
+  changed_when: false
+  check_mode: false
+  register: users_accounts
+
+- name: Delete .netrc-files from system | os-09
+  file:
+    dest: '~{{ item }}/.netrc'
+    state: 'absent'
+  loop: '{{ users_accounts.stdout_lines | flatten | default([]) }}'
+  when: item not in os_netrc_whitelist_user

roles/os_hardening/tasks/pam.yml

@@ -1,125 +1,4 @@
 ---
-- name: update pam on Debian systems
-  command: 'pam-auth-update --package'
-  when: ansible_facts.distribution in ['Debian', 'Ubuntu']
-  changed_when: false
-  environment:
-    DEBIAN_FRONTEND: noninteractive
-
-# the reason for this is so a user cannot connect to a server,
-# that isn't connected to an LDAP server anymore.
-# normally caching credentials shouldn't be necessary for most machines.
-# removing it provides some more security while not removing usability.
-- name: remove pam ccreds to disable password caching
-  package:
-    name: '{{ os_packages_pam_ccreds }}'
-    state: 'absent'
-  when:
-    - ansible_facts.os_family != 'Archlinux'
-
-- name: remove pam_cracklib, because it does not play nice with passwdqc
-  apt:
-    name: '{{ os_packages_pam_cracklib }}'
-    state: 'absent'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - os_auth_pam_passwdqc_enable
-
-- name: install the package for strong password checking
-  apt:
-    name: '{{ os_packages_pam_passwdqc }}'
-    state: 'present'
-    update_cache: 'yes'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - os_auth_pam_passwdqc_enable
-
-- name: configure passwdqc
-  template:
-    src: 'usr/share/pam-configs/pam_passwdqd.j2'
-    dest: '{{ passwdqc_path }}'
-    mode: '0644'
-    owner: 'root'
-    group: 'root'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - os_auth_pam_passwdqc_enable
-
-- name: remove passwdqc
-  apt:
-    name: '{{ os_packages_pam_passwdqc }}'
-    state: 'absent'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-
-- name: install tally2
-  apt:
-    name: 'libpam-modules'
-    state: 'present'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-    - os_auth_retries > 0
-
-- name: configure tally2
-  template:
-    src: 'usr/share/pam-configs/pam_tally2.j2'
-    dest: '{{ tally2_path }}'
-    mode: '0644'
-    owner: 'root'
-    group: 'root'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-    - os_auth_retries > 0
-
-- name: delete tally2 when retries is 0
-  file:
-    path: '{{ tally2_path }}'
-    state: 'absent'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-    - os_auth_retries == 0
-
-- name: remove pam_cracklib, because it does not play nice with passwdqc
-  yum:
-    name: '{{ os_packages_pam_cracklib }}'
-    state: 'absent'
-  when:
-    - ansible_facts.os_family == 'RedHat'
-    - ansible_facts.distribution_major_version|int is version('7', '<')
-    - ansible_facts.distribution != 'Amazon'
-    - os_auth_pam_passwdqc_enable
-
-- name: install the package for strong password checking
-  yum:
-    name: '{{ os_packages_pam_passwdqc }}'
-    state: 'present'
-  when:
-    - ansible_facts.os_family == 'RedHat'
-    - ansible_facts.distribution_major_version|int is version('7', '<')
-    - ansible_facts.distribution != 'Amazon'
-    - os_auth_pam_passwdqc_enable
-
-- name: remove passwdqc
-  yum:
-    name: '{{ os_packages_pam_passwdqc }}'
-    state: 'absent'
-  when:
-    - ansible_facts.os_family == 'RedHat'
-    - not os_auth_pam_passwdqc_enable
-
-- name: configure passwdqc and tally via central system-auth confic
-  template:
-    src: 'etc/pam.d/rhel_system_auth.j2'
-    dest: '/etc/pam.d/system-auth-ac'
-    mode: '0640'
-    owner: 'root'
-    group: 'root'
-  when: ansible_facts.os_family == 'RedHat'
-
 - name: Gather package facts
   package_facts:
     manager: auto
@@ -127,6 +6,25 @@
     - ansible_facts.os_family != 'Suse'
     - ansible_facts.os_family != 'Archlinux'
 
+# the reason for this is so a user cannot connect to a server,
+# that isn't connected to an LDAP server anymore.
+# normally caching credentials shouldn't be necessary for most machines.
+# removing it provides some more security while not removing usability.
+- name: Remove pam ccreds to disable password caching
+  package:
+    name: '{{ os_packages_pam_ccreds }}'
+    state: 'absent'
+  when:
+    - ansible_facts.os_family != 'Archlinux'
+
+- import_tasks: pam_debian.yml
+  when:
+    - ansible_facts.os_family == 'Debian'
+
+- import_tasks: pam_rhel.yml
+  when:
+    - ansible_facts.os_family == 'RedHat'
+
 - name: NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
   template:
     src: 'etc/libuser.conf.j2'

roles/os_hardening/tasks/pam_debian.yml

@@ -0,0 +1,120 @@
+---
+- name: Install the package for strong password checking
+  apt:
+    name: 'libpam-passwdqc'
+    state: 'present'
+    update_cache: 'yes'
+  when:
+    - os_auth_pam_passwdqc_enable
+
+- name: Configure passwdqc
+  template:
+    src: 'usr/share/pam-configs/pam_passwdqc.j2'
+    dest: '{{ passwdqc_path }}'
+    mode: '0644'
+    owner: 'root'
+    group: 'root'
+  when:
+    - os_auth_pam_passwdqc_enable
+
+- name: Install tally2
+  apt:
+    name: 'libpam-modules'
+    state: 'present'
+  when:
+    - os_auth_retries > 0
+
+- name: Manage tally on Debian stable
+  block:
+    - name: Configure tally2
+      template:
+        src: 'usr/share/pam-configs/pam_tally2.j2'
+        dest: '{{ tally2_path }}'
+        mode: '0644'
+        owner: 'root'
+        group: 'root'
+      when:
+        - os_auth_retries > 0
+
+    - name: Delete tally2 when retries is 0
+      file:
+        path: '{{ tally2_path }}'
+        state: 'absent'
+      when:
+        - os_auth_retries == 0
+  when:
+    - "'libpam-modules' in ansible_facts.packages"
+    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '<')"
+
+- name: Manage tally/faillock on Debian unstable
+  block:
+    - name: Delete tally2
+      file:
+        path: '{{ tally2_path }}'
+        state: 'absent'
+
+    - name:  create tally directory
+      file:
+        path: '/var/run/faillock'
+        state: 'directory'
+        mode: '0755'
+        owner: 'root'
+        group: 'root'
+
+    - name: Configure faillock
+      template:
+        src: 'etc/security/faillock.conf.j2'
+        dest: '/etc/security/faillock.conf'
+        mode: '0644'
+        owner: 'root'
+        group: 'root'
+
+    - name: Configure faillock pam
+      template:
+        src: 'usr/share/pam-configs/pam_faillock.j2'
+        dest: '/usr/share/pam-configs/faillock'
+        mode: '0644'
+        owner: 'root'
+        group: 'root'
+      when:
+        - os_auth_retries > 0
+
+    - name: Configure faillock pam authfail
+      template:
+        src: 'usr/share/pam-configs/pam_faillock_authfail.j2'
+        dest: '/usr/share/pam-configs/faillock_authfail'
+        mode: '0644'
+        owner: 'root'
+        group: 'root'
+      when:
+        - os_auth_retries > 0
+
+    - name: Delete faillock when retries is 0
+      file:
+        path: '/usr/share/pam-configs/faillock'
+        state: 'absent'
+      when:
+        - os_auth_retries == 0
+
+    - name: Delete faillock authfail when retries is 0
+      file:
+        path: '/usr/share/pam-configs/faillock_authfail'
+        state: 'absent'
+      when:
+        - os_auth_retries == 0
+  when:
+    - "'libpam-modules' in ansible_facts.packages"
+    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '>=')"
+
+- name: Update pam on Debian systems
+  command: 'pam-auth-update --package'
+  environment:
+    DEBIAN_FRONTEND: noninteractive
+  changed_when: false
+
+- name: Remove passwdqc
+  apt:
+    name: 'libpam-passwdqc'
+    state: 'absent'
+  when:
+    - not os_auth_pam_passwdqc_enable

roles/os_hardening/tasks/pam_rhel.yml

@@ -0,0 +1,43 @@
+---
+- name: Install sssd-clients
+  yum:
+    name: sssd-client
+    state: 'present'
+  when:
+    - os_auth_pam_sssd_enable | bool
+
+- name: Configure passwdqc and faillock via central system-auth config
+  template:
+    src: 'etc/pam.d/rhel_auth.j2'
+    dest: '/etc/pam.d/system-auth-local'
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
+
+- name: Enable our config for system-auth
+  file:
+    src: /etc/pam.d/system-auth-local
+    dest: /etc/pam.d/system-auth
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
+    state: link
+    force: true
+
+- name: Configure passwdqc and faillock via central password-auth config
+  template:
+    src: 'etc/pam.d/rhel_auth.j2'
+    dest: '/etc/pam.d/password-auth-local'
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
+
+- name: Enable our config for password-auth
+  file:
+    src: /etc/pam.d/password-auth-local
+    dest: /etc/pam.d/password-auth
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
+    state: link
+    force: true

roles/os_hardening/tasks/profile.yml

@@ -1,5 +1,5 @@
 ---
-- name: add pinerolo_profile.sh to profile.d
+- name: Add pinerolo_profile.sh to profile.d
   template:
     src: 'etc/profile.d/profile.conf.j2'
     dest: '/etc/profile.d/pinerolo_profile.sh'
@@ -8,8 +8,16 @@
     mode: '0750'
   when: not os_security_kernel_enable_core_dump | bool
 
-- name: remove pinerolo_profile.sh from profile.d
+- name: Remove pinerolo_profile.sh from profile.d
   file:
     path: /etc/profile.d/pinerolo_profile.sh
     state: absent
   when: os_security_kernel_enable_core_dump | bool
+
+- name: Add autologout to profile env
+  template:
+    src: 'etc/profile.d/tmout.sh.j2'
+    dest: '/etc/profile.d/tmout.sh'
+    owner: 'root'
+    group: 'root'
+    mode: '0644'