use fqn for with_flattened

Signed-off-by: Sebastian Gumprich <[email protected]>

.config/ansible-lint.yml

@@ -0,0 +1,17 @@
+---
+# .ansible-lint
+# exclude_paths included in this file are parsed relative to this file's location
+# and not relative to the CWD of execution. CLI arguments passed to the --exclude
+# option will be parsed relative to the CWD of execution.
+exclude_paths:
+  - .cache/  # implicit unless exclude_paths is defined in config
+  - .yamllint
+  - ../molecule/
+  - ../.github/
+
+skip_list:
+  - fqcn-builtins
+
+mock_roles:
+  - geerlingguy.git
+  - nginxinc.nginx

.github/dependabot.yml

@@ -1,3 +1,4 @@
+---
 # To get started with Dependabot version updates, you'll need to specify which
 # package ecosystems to update and where the package manifests are located.
 # Please see the documentation for all configuration options:
@@ -5,7 +6,7 @@
 
 version: 2
 updates:
-  - package-ecosystem: "pip" # See documentation for possible values
-    directory: "/" # Location of package manifests
+  - package-ecosystem: "pip"  # See documentation for possible values
+    directory: "/"  # Location of package manifests
     schedule:
       interval: "daily"

.github/workflows/ansible-lint.yml

@@ -1,6 +1,7 @@
+---
 name: Ansible Lint  # feel free to pick your own name
 
-on: [push, pull_request]
+on: [push, pull_request]   # yamllint disable-line rule:truthy
 
 jobs:
   ansible-lint:
@@ -8,49 +9,50 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    # Important: This sets up your GITHUB_WORKSPACE environment variable
-    - uses: actions/checkout@v2
+      # Important: This sets up your GITHUB_WORKSPACE environment variable
+      - uses: actions/checkout@v3
 
-    - name: Lint Ansible Playbook
-      # replace "master" with any valid ref
-      uses: ansible/ansible-lint-action@master
-      with:
-        # [required]
-        # Paths to ansible files (i.e., playbooks, tasks, handlers etc..)
-        # or valid Ansible directories according to the Ansible role
-        # directory structure.
-        # If you want to lint multiple ansible files, use the following syntax
-        # targets: |
-        #   playbook_1.yml
-        #   playbook_2.yml
-        targets: "roles/"
-        # [optional]
-        # Arguments to override a package and its version to be set explicitly.
-        # Must follow the example syntax.
-        # override-deps: |
-        #   ansible==2.9
-        #   ansible-lint==4.2.0
-        # [optional]
-        # Arguments to be passed to the ansible-lint
-
-        # Options:
-        #   -q                    quieter, although not silent output
-        #   -p                    parseable output in the format of pep8
-        #   --parseable-severity  parseable output including severity of rule
-        #   -r RULESDIR           specify one or more rules directories using one or
-        #                         more -r arguments. Any -r flags override the default
-        #                         rules in ansiblelint/rules, unless -R is also used.
-        #   -R                    Use default rules in ansiblelint/rules in addition to
-        #                         any extra
-        #                         rules directories specified with -r. There is no need
-        #                         to specify this if no -r flags are used
-        #   -t TAGS               only check rules whose id/tags match these values
-        #   -x SKIP_LIST          only check rules whose id/tags do not match these
-        #                         values
-        #   --nocolor             disable colored output
-        #   --exclude=EXCLUDE_PATHS
-        #                         path to directories or files to skip. This option is
-        #                         repeatable.
-        #   -c C                  Specify configuration file to use. Defaults to ".ansible-lint"
-        args: ""
+      - name: Lint Ansible Playbook
+        # replace "master" with any valid ref
+        uses: ansible/ansible-lint-action@main
+        with:
+          # [required]
+          # Paths to ansible files (i.e., playbooks, tasks, handlers etc..)
+          # or valid Ansible directories according to the Ansible role
+          # directory structure.
+          # If you want to lint multiple ansible files, use the following syntax
+          # targets: |
+          #   playbook_1.yml
+          #   playbook_2.yml
+          targets: "roles/"
+          # [optional]
+          # Arguments to override a package and its version to be set explicitly.
+          # Must follow the example syntax.
+          # override-deps: |
+          #   ansible==2.9
+          #   ansible-lint==4.2.0
+          override-deps: |
+            rich>=9.5.1,<11.0.0
+          # [optional]
+          # Arguments to be passed to the ansible-lint
 
+          # Options:
+          #   -q                    quieter, although not silent output
+          #   -p                    parseable output in the format of pep8
+          #   --parseable-severity  parseable output including severity of rule
+          #   -r RULESDIR           specify one or more rules directories using one or
+          #                         more -r arguments. Any -r flags override the default
+          #                         rules in ansiblelint/rules, unless -R is also used.
+          #   -R                    Use default rules in ansiblelint/rules in addition to
+          #                         any extra
+          #                         rules directories specified with -r. There is no need
+          #                         to specify this if no -r flags are used
+          #   -t TAGS               only check rules whose id/tags match these values
+          #   -x SKIP_LIST          only check rules whose id/tags do not match these
+          #                         values
+          #   --nocolor             disable colored output
+          #   --exclude=EXCLUDE_PATHS
+          #                         path to directories or files to skip. This option is
+          #                         repeatable.
+          #   -c C                  Specify configuration file to use. Defaults to ".ansible-lint"
+          args: ""

.github/workflows/enforce-labels.yml

@@ -1,12 +1,13 @@
+---
 name: "Enforce PR labels"
 
-on:
+on:  # yamllint disable-line rule:truthy
   pull_request_target:
     types: [labeled, unlabeled, opened, edited, synchronize]
 jobs:
   enforce-label:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@main
-      with:
-        repo-token: "${{ secrets.GITHUB_TOKEN }}"
+      - uses: actions/labeler@main
+        with:
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/galaxy.yml

@@ -1,7 +1,7 @@
 ---
 name: Publish collection to Ansible Galaxy
 
-on:
+on:  # yamllint disable-line rule:truthy
   release:
     types:
       - published
@@ -10,7 +10,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       # deploy the collection first, because if it fails, we don't want
       # to update the galaxy.yml
@@ -21,7 +21,7 @@ jobs:
           galaxy_version: ${{ github.event.release.tag_name }}
 
       # checkout master instead of the release-tag so we can push the galaxy.yml
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           ref: master
 
@@ -33,7 +33,7 @@ jobs:
           version: "${{ github.event.release.tag_name }}"
 
       - name: push galaxy.yml
-        uses: github-actions-x/commit@v2.7
+        uses: github-actions-x/commit@v2.9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           push-branch: 'master'

.github/workflows/mysql_hardening.yml

@@ -23,7 +23,6 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
-          - centos8
           - rocky8
           - ubuntu1804
           - ubuntu2004
@@ -35,7 +34,7 @@ jobs:
           # - fedora  # geerlingguy.mysql does not support fedora
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true

.github/workflows/nginx_hardening.yml

@@ -23,7 +23,6 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
-          - centos8
           - rocky8
           - ubuntu1804
           - ubuntu2004
@@ -35,7 +34,7 @@ jobs:
           # - fedora  # no support from geerlingguy role
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true

.github/workflows/os_hardening.yml

@@ -23,7 +23,6 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
-          - centos8
           - rocky8
           - ubuntu1804
           - ubuntu2004
@@ -34,7 +33,7 @@ jobs:
           # - arch  # needs to be fixed
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true

.github/workflows/os_hardening_vm.yml

@@ -0,0 +1,51 @@
+---
+name: "devsec.os_hardening VM"
+on:  # yamllint disable-line rule:truthy
+  workflow_dispatch:
+  push:
+    paths:
+      - 'roles/os_hardening/**'
+      - 'molecule/os_hardening_vm/**'
+      - '.github/workflows/os_hardening_vm.yml'
+  pull_request:
+    paths:
+      - 'roles/os_hardening/**'
+      - 'molecule/os_hardening_vm/**'
+      - '.github/workflows/os_hardening_vm.yml'
+jobs:
+  build:
+    runs-on: self-hosted
+    env:
+      PY_COLORS: 1
+      ANSIBLE_FORCE_COLOR: 1
+    strategy:
+      fail-fast: false
+      matrix:
+        molecule_distro:
+          - centos7
+          - rocky8
+          - ubuntu1804
+          - ubuntu2004
+          - debian9
+          - debian10
+          # - opensuse42  # opensuse currently cannot get an ip address
+          # - arch  - arch is currently not supported by cinc-auditor
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+        with:
+          path: ansible_collections/devsec/hardening
+          submodules: true
+
+      - name: Create default collection path symlink
+        run: |
+          mkdir -p /home/runner/.ansible
+          ln -fs /opt/actions-runner/_work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections /home/runner/.ansible/collections
+
+      - name: Test with molecule
+        run: |
+          molecule --version
+          molecule test -s os_hardening_vm
+        env:
+          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
+        working-directory: ansible_collections/devsec/hardening

.github/workflows/prettier-md.yml

@@ -2,7 +2,7 @@
 # https://github.com/creyD/prettier_action
 name: Prettier markdown files
 
-on:
+on:  # yamllint disable-line rule:truthy
   push:
     paths:
       - '**.md'
@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Git checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           ref: ${{ github.head_ref }}
 

.github/workflows/release.yml

@@ -12,9 +12,10 @@ jobs:
     runs-on: ubuntu-latest
     name: create release draft
     steps:
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v3
         with:
           fetch-depth: 0
+          ref: master
 
       - name: 'Get Previous tag'
         id: previoustag
@@ -40,7 +41,7 @@ jobs:
           issue_line_labels: mysql_hardening,os_hardening,ssh_hardening,nginx_hardening
 
       - name: push changelog
-        uses: github-actions-x/commit@v2.6
+        uses: github-actions-x/commit@v2.9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           push-branch: 'master'
@@ -50,12 +51,6 @@ jobs:
           name: dev-sec CI
           email: [email protected]
 
-      # do a second checkout to prevent race situation
-      # changelog gets updated but action works on old commit id
-      - uses: actions/[email protected]
-        with:
-          ref: master
-
       - name: Generate changelog for the release
         run: |
           sed '/## \[${{ steps.previoustag.outputs.tag }}\]/Q' CHANGELOG.md > CHANGELOGRELEASE.md
@@ -66,6 +61,11 @@ jobs:
         with:
           path: ./CHANGELOGRELEASE.md
 
+      - name: Delete old drafts
+        uses: hugo19941994/[email protected]
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Create Release draft
         id: create_release
         uses: actions/create-release@v1

.github/workflows/ssh_hardening.yml

@@ -23,7 +23,6 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
-          - centos8
           - rocky8
           - fedora
           - ubuntu1804
@@ -35,7 +34,7 @@ jobs:
           # - opensuse_tumbleweed  # baseline is not compatible with suse
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true

.github/workflows/ssh_hardening_custom_tests.yml

@@ -23,7 +23,6 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
-          - centos8
           - rocky8
           - fedora
           - ubuntu1804
@@ -35,7 +34,7 @@ jobs:
           # - opensuse_tumbleweed  # baseline is not compatible with suse
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true

.yamllint

@@ -15,19 +15,12 @@ rules:
   commas:
     max-spaces-after: -1
     level: error
-#  comments: disable
-#  comments-indentation: disable
-#  document-start: disable
   empty-lines:
     max: 3
     level: error
   hyphens:
     level: error
-#  indentation: disable
   key-duplicates: enable
   line-length: disable
-#  new-line-at-end-of-file: disable
   new-lines:
     type: unix
-#  trailing-spaces: disable
-#  truthy: disable

CHANGELOG.md

@@ -1,8 +1,105 @@
 # Changelog
 
-## [Unreleased](https://github.com/dev-sec/ansible-collection-hardening/tree/HEAD)
+## [7.15.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.15.0) (2022-07-11)
 
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.12.0...HEAD)
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.3...7.15.0)
+
+**Implemented enhancements:**
+
+- Harden mountpoints [\#531](https://github.com/dev-sec/ansible-collection-hardening/pull/531) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lbayerlein](https://github.com/lbayerlein))
+
+**Fixed bugs:**
+
+- os\_hardening gpg-check enabled fails on success [\#549](https://github.com/dev-sec/ansible-collection-hardening/issues/549) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- add VM tests for os\_hardening  [\#547](https://github.com/dev-sec/ansible-collection-hardening/pull/547) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- Linting [\#546](https://github.com/dev-sec/ansible-collection-hardening/pull/546) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.14.3](https://github.com/dev-sec/ansible-collection-hardening/tree/7.14.3) (2022-06-29)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.2...7.14.3)
+
+**Closed issues:**
+
+- Version 7.14.2 not released to Ansible Galaxy [\#544](https://github.com/dev-sec/ansible-collection-hardening/issues/544)
+- os\_hardening role: os\_ignore\_users not described in the Readme's variable topic [\#542](https://github.com/dev-sec/ansible-collection-hardening/issues/542)
+- doc: incorrect description for ssh\_client\_alive\_count [\#540](https://github.com/dev-sec/ansible-collection-hardening/issues/540)
+- 'legacy' branch is mentioned in README, but apparently doesn't exist [\#539](https://github.com/dev-sec/ansible-collection-hardening/issues/539)
+- ansible\_role\_name is undefined [\#532](https://github.com/dev-sec/ansible-collection-hardening/issues/532)
+- Can't sudo anymore after hardening [\#518](https://github.com/dev-sec/ansible-collection-hardening/issues/518)
+- Any planned official support for RHEL/CentOS Stream 9? [\#517](https://github.com/dev-sec/ansible-collection-hardening/issues/517)
+
+**Merged pull requests:**
+
+- Improve documentation [\#541](https://github.com/dev-sec/ansible-collection-hardening/pull/541) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+
+## [7.14.2](https://github.com/dev-sec/ansible-collection-hardening/tree/7.14.2) (2022-02-28)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.1...7.14.2)
+
+**Fixed bugs:**
+
+- debian 9's nginx doesn't support tls1.3 [\#526](https://github.com/dev-sec/ansible-collection-hardening/pull/526) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Change permissions of the tmout.sh file [\#520](https://github.com/dev-sec/ansible-collection-hardening/pull/520) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([abejotaR](https://github.com/abejotaR))
+
+**Closed issues:**
+
+- No such file directory error triggered by the  kernel.unpriviliged\_userns\_clone configuration. [\#514](https://github.com/dev-sec/ansible-collection-hardening/issues/514)
+
+**Merged pull requests:**
+
+- delete obsolete release drafts [\#530](https://github.com/dev-sec/ansible-collection-hardening/pull/530) ([schurzi](https://github.com/schurzi))
+- add waivers to skip controls [\#529](https://github.com/dev-sec/ansible-collection-hardening/pull/529) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- remove centos8 tests [\#525](https://github.com/dev-sec/ansible-collection-hardening/pull/525) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.14.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.14.1) (2022-02-18)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.0...7.14.1)
+
+**Fixed bugs:**
+
+- move sysctls to debian specific vars [\#524](https://github.com/dev-sec/ansible-collection-hardening/pull/524) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Closed issues:**
+
+- Error when using the ssh\_hardening role [\#519](https://github.com/dev-sec/ansible-collection-hardening/issues/519)
+
+## [7.14.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.14.0) (2021-12-16)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.13.2...7.14.0)
+
+**Implemented enhancements:**
+
+- Add option to set timeout in seconds to logout users [\#516](https://github.com/dev-sec/ansible-collection-hardening/pull/516) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lbayerlein](https://github.com/lbayerlein))
+- add feature to disable coredump to limit task [\#511](https://github.com/dev-sec/ansible-collection-hardening/pull/511) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lbayerlein](https://github.com/lbayerlein))
+- change hidepid mount task state to mounted [\#510](https://github.com/dev-sec/ansible-collection-hardening/pull/510) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([alegrey91](https://github.com/alegrey91))
+- prettify nginx options [\#509](https://github.com/dev-sec/ansible-collection-hardening/pull/509) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Update nginx\_add\_header README to match default [\#506](https://github.com/dev-sec/ansible-collection-hardening/pull/506) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([duffn](https://github.com/duffn))
+- Updated dh\_params to 4096 [\#501](https://github.com/dev-sec/ansible-collection-hardening/pull/501) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([ksaadDE](https://github.com/ksaadDE))
+
+**Fixed bugs:**
+
+- Duplication of sysctl default parameter fs.protected\_hardlinks and fs.protected\_symlinks [\#502](https://github.com/dev-sec/ansible-collection-hardening/issues/502)
+- Fix duplicate sysctl config in fs [\#505](https://github.com/dev-sec/ansible-collection-hardening/pull/505) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([tekicat](https://github.com/tekicat))
+
+**Merged pull requests:**
+
+- Feature coredump [\#513](https://github.com/dev-sec/ansible-collection-hardening/pull/513) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.13.2](https://github.com/dev-sec/ansible-collection-hardening/tree/7.13.2) (2021-11-23)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.13.1...7.13.2)
+
+## [7.13.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.13.1) (2021-11-23)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.13.0...7.13.1)
+
+**Closed issues:**
+
+- Unable to use 7.13.0 Release [\#503](https://github.com/dev-sec/ansible-collection-hardening/issues/503)
+
+## [7.13.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.13.0) (2021-11-15)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.12.0...7.13.0)
 
 **Implemented enhancements:**
 

README.md

@@ -1,6 +1,7 @@
 # Ansible Collection - devsec.hardening
 
 ![devsec.os_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening/badge.svg)
+![devsec.os_hardening VM](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening%20VM/badge.svg)
 ![devsec.ssh_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.ssh_hardening/badge.svg)
 ![devsec.nginx_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.nginx_hardening/badge.svg)
 ![devsec.mysql_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.mysql_hardening/badge.svg)
@@ -26,14 +27,24 @@ This collection provides battle tested hardening for:
 
 The hardening is intended to be compliant with the Inspec DevSec Baselines:
 
-- https://github.com/dev-sec/linux-baseline
-- https://github.com/dev-sec/mysql-baseline
-- https://github.com/dev-sec/nginx-baseline
-- https://github.com/dev-sec/ssh-baseline
+- <https://github.com/dev-sec/linux-baseline>
+- <https://github.com/dev-sec/mysql-baseline>
+- <https://github.com/dev-sec/nginx-baseline>
+- <https://github.com/dev-sec/ssh-baseline>
 
-## Looking for the old ansible-os-hardening role?
+## Looking for the old roles?
 
-This role is now part of the hardening-collection. You can find the old role in the branch `legacy`.
+The roles are now part of the hardening-collection.
+We have kept the old releases of the `os-hardening` role in this repository, so you can find the them by exploring older tags.
+The last release of the standalone role was [6.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/6.2.0).
+
+The other roles are in separate archives repositories
+
+- [apache_hardening](https://github.com/dev-sec/ansible-apache-hardening)
+- [mysql_hardening](https://github.com/dev-sec/ansible-mysql-hardening)
+- [nginx_hardening](https://github.com/dev-sec/ansible-nginx-hardening)
+- [ssh_hardening](https://github.com/dev-sec/ansible-ssh-hardening)
+- [windows_hardening](https://github.com/dev-sec/ansible-windows-hardening)
 
 ## Minimum required Ansible-version
 
@@ -94,6 +105,6 @@ General information:
 
 Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
 
-http://www.apache.org/licenses/LICENSE-2.0
+<http://www.apache.org/licenses/LICENSE-2.0>
 
 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

galaxy.yml

@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 7.12.0
+version: 7.15.0
 readme: README.md
 authors:
   - dev-sec <[email protected]>
@@ -21,7 +21,7 @@ tags:
   - mysql_hardening
   - nginx_hardening
   - os_hardening
-  - ssh-hardening
+  - ssh_hardening
 dependencies:
   ansible.posix: '>=1.0.0'
   community.crypto: '>=1.0.0'

molecule/mysql_hardening/prepare.yml

@@ -16,7 +16,7 @@
       when: ansible_os_family == 'Debian'
 
     - name: install required tools on SuSE
-      zypper:
+      community.general.zypper:
         name: "python-xml"
         state: present
       when: ansible_facts.os_family == 'Suse'

molecule/nginx_hardening/prepare.yml

@@ -8,7 +8,7 @@
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: install required tools on SuSE
-      zypper:
+      community.general.zypper:
         name: "python-xml"
         state: present
       when: ansible_facts.os_family == 'Suse'
@@ -17,7 +17,7 @@
       package:
         name: "python3-apt"
         update_cache: true
-      ignore_errors: true
+      ignore_errors: true  # noqa ignore-errors
 
     - name: Set correct distribution Version for Amazon Linux
       set_fact:

molecule/os_hardening/converge.yml

@@ -16,7 +16,7 @@
         name: os_hardening
   vars:
     os_security_users_allow: change_user
-    os_security_kernel_enable_core_dump: true
+    os_security_kernel_enable_core_dump: false
     os_security_suid_sgid_remove_from_unknown: true
     os_auth_pam_passwdqc_enable: false
     os_auth_lockout_time: 15
@@ -26,7 +26,6 @@
     os_security_suid_sgid_blacklist: ['/bin/umount']
     os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
     os_filesystem_whitelist: []
-    os_ctrlaltdel_disabled: true
     os_yum_repo_file_whitelist: ['foo.repo']
     sysctl_config:
       net.ipv4.ip_forward: 0

molecule/os_hardening/prepare.yml

@@ -35,14 +35,14 @@
       when: ansible_facts.distribution == 'Fedora'
 
     - name: install required tools on Arch
-      pacman:
+      community.general.pacman:
         name:
           - awk
         state: present
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: install required tools on RHEL
+    - name: install required tools on RHEL  # noqa ignore-errors
       yum:
         name:
           - openssh-clients
@@ -56,5 +56,5 @@
       changed_when: false
 
     - name: include YUM prepare tasks
-      include: prepare_yum.yml
+      include_tasks: prepare_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'

molecule/os_hardening/prepare_tasks/yum.yml

@@ -1,6 +1,6 @@
 ---
 - name: create 'foo' repository
-  yum_repository:
+  ansible.builtin.yum_repository:
     name: foo
     description: mandatory description
     baseurl: file:///mandatory-url
@@ -8,7 +8,7 @@
     gpgcheck: false
 
 - name: create 'bar' repository
-  yum_repository:
+  ansible.builtin.yum_repository:
     name: bar
     description: mandatory description
     baseurl: file:///mandatory-url

molecule/os_hardening/verify.yml

@@ -38,11 +38,11 @@
       when: ansible_facts.os_family == 'Debian'
 
     - name: include PAM tests
-      include: verify_pam.yml
+      include_tasks: verify_tasks/pam.yml
       when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
 
     - name: include YUM tests
-      include: verify_yum.yml
+      include_tasks: verify_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'
 
     - name: download cinc-auditor
@@ -54,7 +54,7 @@
     - name: install cinc-auditor
       shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
 
-    - name: Execute cinc-auditor tests
+    - name: Execute cinc-auditor tests  # noqa ignore-errors
       command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
       register: test_results
       changed_when: false

molecule/os_hardening_vm/INSTALL.rst

@@ -0,0 +1,22 @@
+*******
+Docker driver installation guide
+*******
+
+Requirements
+============
+
+* Docker Engine
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ python3 -m pip install 'molecule[docker]'

molecule/os_hardening_vm/converge.yml

@@ -0,0 +1,23 @@
+---
+- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+  hosts: all
+  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  collections:
+    - devsec.hardening
+  tasks:
+    - name: override for arch
+      set_fact: 
+        os_mnt_boot_enabled: false
+      when: ansible_facts.os_family == 'Archlinux'
+    - include_role:
+        name: os_hardening
+  vars:
+    os_auth_pam_passwdqc_enable: false
+    os_auth_lockout_time: 15
+    os_yum_repo_file_whitelist: ['foo.repo']
+    os_mnt_boot_enabled: true
+    os_mnt_boot_src: "/dev/vda1"

molecule/os_hardening_vm/molecule.yml

@@ -0,0 +1,57 @@
+---
+dependency:
+  name: galaxy
+  options:
+    role-file: molecule/os_hardening/requirements.yml
+driver:
+  name: vagrant
+  provider:
+    name: libvirt
+platforms:
+  - name: instance
+    box: "generic/${MOLECULE_DISTRO}"
+    memory: 1024
+    cpus: 2
+provisioner:
+  name: ansible
+  env:
+    ANSIBLE_PIPELINING: "True"
+  config_options:
+    defaults:
+      interpreter_python: auto_silent
+      callback_whitelist: profile_tasks, timer, yaml
+verifier:
+  name: ansible
+  env:
+    ANSIBLE_PIPELINING: "True"
+
+scenario:
+  create_sequence:
+    - dependency
+    - create
+    - prepare
+  check_sequence:
+    - dependency
+    - destroy
+    - create
+    - prepare
+    - converge
+    - check
+    - destroy
+  converge_sequence:
+    - dependency
+    - create
+    - prepare
+    - converge
+  destroy_sequence:
+    - destroy
+  test_sequence:
+    - dependency
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - verify
+    - destroy

molecule/os_hardening_vm/prepare.yml

@@ -0,0 +1,60 @@
+---
+- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+  hosts: all
+  become: true
+  collections:
+    - devsec.hardening
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
+      set_fact:
+        ansible_python_interpreter: "/usr/bin/python3"
+      when: ansible_facts.distribution == 'Fedora'
+
+    - name: Run the equivalent of "apt-get update && apt-get upgrade"
+      apt:
+        name: "*"
+        state: latest
+        update_cache: true
+      when: ansible_os_family == 'Debian'
+
+    - name: install required tools on SuSE
+      # cannot use zypper module, since it depends on python-xml
+      shell: "zypper -n install python-xml"
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: install required tools on fedora
+      dnf:
+        name:
+          - python
+          - findutils
+          - procps-ng
+      when: ansible_facts.distribution == 'Fedora'
+
+    - name: install required tools on Arch
+      community.general.pacman:
+        name:
+          - awk
+        state: present
+        update_cache: true
+      when: ansible_facts.os_family == 'Archlinux'
+
+    - name: install required tools on RHEL  # noqa ignore-errors
+      yum:
+        name:
+          - openssh-clients
+          - openssh
+        state: present
+        update_cache: true
+      ignore_errors: true
+
+    - name: create recursing symlink to test minimize access
+      shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
+      changed_when: false
+
+    - name: include YUM prepare tasks
+      include_tasks: prepare_tasks/yum.yml
+      when: ansible_facts.os_family == 'RedHat'

molecule/os_hardening_vm/prepare_tasks/yum.yml

@@ -0,0 +1,16 @@
+---
+- name: create 'foo' repository
+  ansible.builtin.yum_repository:
+    name: foo
+    description: mandatory description
+    baseurl: file:///mandatory-url
+    enabled: false
+    gpgcheck: false
+
+- name: create 'bar' repository
+  ansible.builtin.yum_repository:
+    name: bar
+    description: mandatory description
+    baseurl: file:///mandatory-url
+    enabled: false
+    gpgcheck: false

molecule/os_hardening_vm/requirements.yml

@@ -0,0 +1,3 @@
+---
+roles:
+  - geerlingguy.git

molecule/os_hardening_vm/verify.yml

@@ -0,0 +1,70 @@
+---
+- name: Verify
+  hosts: all
+  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  roles:
+    - geerlingguy.git
+  tasks:
+    - name: install fake SuSE-release for cinc compatibility
+      copy:
+        content: |
+          openSUSE Faked Enterprise 2020 (x86_64)
+          VERSION = 2020
+          CODENAME = Faked Feature
+        dest: /etc/SuSE-release
+        owner: root
+        group: root
+        mode: '0444'
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: install git for SuSE since geerlinguy.git does not support it
+      zypper:
+        name: git
+        state: present
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: Run the equivalent of "apt-get update" as a separate step
+      apt:
+        update_cache: true
+      when: ansible_facts.os_family == 'Debian'
+
+    - name: install required tools on debian
+      apt:
+        name: procps
+      when: ansible_facts.os_family == 'Debian'
+
+    - name: include PAM tests
+      include_tasks: verify_tasks/pam.yml
+      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+
+    - name: include YUM tests
+      include_tasks: verify_tasks/yum.yml
+      when: ansible_facts.os_family == 'RedHat'
+
+    - name: download cinc-auditor
+      get_url:
+        url: https://omnitruck.cinc.sh/install.sh
+        dest: /tmp/install.sh
+        mode: '0775'
+
+    - name: install cinc-auditor
+      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
+
+    - name: Execute cinc-auditor tests  # noqa ignore-errors
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
+      register: test_results
+      changed_when: false
+      ignore_errors: true
+
+    - name: Display details about the cinc-auditor results
+      debug:
+        msg: "{{ test_results.stdout_lines }}"
+
+    - name: Fail when tests fail
+      fail:
+        msg: "Inspec failed to validate"
+      when: test_results.rc != 0

molecule/os_hardening_vm/verify_tasks/pam.yml

@@ -0,0 +1,59 @@
+---
+- name: download pam-tester
+  get_url:
+    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
+    dest: /bin/pam-tester
+    mode: 0555
+
+- name: set password for test
+  set_fact:
+    test_pw: "myTest!pw"
+
+- name: set locale for test
+  set_fact:
+    locale: "en_US.UTF-8"
+  when:
+    - ansible_facts.os_family == 'RedHat'
+    - ansible_facts.distribution_major_version < '8'
+
+- name: create testuser
+  user:
+    name: testuser
+    password: "{{ test_pw | password_hash('sha512') }}"
+
+- name: check successfull login with correct password
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
+
+- name: check unsuccessfull login with incorrect password
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
+  with_sequence: count=6
+
+- name: check unsuccessfull login, with correct password (lockout)
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
+
+- name: wait for account to unlock
+  pause:
+    seconds: 20
+
+- name: check successfull login
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"

molecule/os_hardening_vm/verify_tasks/yum.yml

@@ -0,0 +1,8 @@
+---
+- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
+  command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
+  changed_when: false
+
+- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
+  command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
+  changed_when: false

molecule/ssh_hardening/prepare.yml

@@ -12,7 +12,7 @@
         ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
       yum:
         name:
           - openssh-clients
@@ -22,7 +22,7 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
       dnf:
         name:
           - openssh-clients
@@ -32,7 +32,7 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
       apt:
         name:
           - openssh-client
@@ -66,7 +66,7 @@
         path: "/var/run/sshd"
         state: directory
 
-    - name: create ssh host keys
+    - name: create ssh host keys  # noqa ignore-errors
       command: "ssh-keygen -A"
       when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
             ansible_facts.distribution == "Fedora" or

molecule/ssh_hardening_custom_tests/prepare.yml

@@ -12,7 +12,7 @@
         ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
       yum:
         name:
           - openssh-clients
@@ -22,7 +22,7 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
       dnf:
         name:
           - openssh-clients
@@ -32,7 +32,7 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
       apt:
         name:
           - openssh-client
@@ -66,7 +66,7 @@
         path: "/var/run/sshd"
         state: directory
 
-    - name: create ssh host keys
+    - name: create ssh host keys  # noqa ignore-errors
       command: "ssh-keygen -A"
       when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
             ansible_facts.distribution == "Fedora" or

roles/mysql_hardening/defaults/main.yml

@@ -7,11 +7,11 @@ mysql_daemon_enabled: true
 mysql_hardening_restart_mysql: true
 
 # general configuration
-mysql_hardening_mysql_hardening_conf_file: '{{mysql_hardening_mysql_confd_dir}}/hardening.cnf'
+mysql_hardening_mysql_hardening_conf_file: '{{ mysql_hardening_mysql_confd_dir }}/hardening.cnf'
 # You have to change this to your own strong enough mysql root password
 mysql_root_password: '-----====>SetR00tPa$$wordH3r3!!!<====-----'
 # There .my.cnf with mysql root credentials will be installed
-mysql_user_home: "{{ ansible_env.HOME}}"
+mysql_user_home: "{{ ansible_env.HOME }}"
 
 # ensure the following parameters are set properly
 mysql_remove_remote_root: true
@@ -50,4 +50,4 @@ mysql_hardening_options:
   # @see https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option-mysqld-secure-file-priv
   secure-file-priv: '/tmp'
   # @see https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_user
-  user: '{{mysql_hardening_user}}'
+  user: '{{ mysql_hardening_user }}'

roles/mysql_hardening/tasks/configure.yml

@@ -18,7 +18,7 @@
   when: item is defined and item != ""
   loop:
     - '{{ mysql_settings.settings.datadir }}'
-    - '{{ mysql_datadir|default("") }}'
+    - '{{ mysql_datadir | default("") }}'
 
 - name: Ensure permissions on mysql-logfile are correct
   file:
@@ -30,7 +30,7 @@
   when: item is defined and item != ""
   loop:
     - '{{ mysql_settings.settings.log_error }}'
-    - '{{ mysql_hardening_log_file|default("") }}'
+    - '{{ mysql_hardening_log_file | default("") }}'
 
 - name: Check mysql configuration-directory exists and has right permissions
   file:

roles/mysql_hardening/tasks/main.yml

@@ -54,7 +54,7 @@
 # dict2items and vice versa magic
 - name: Drop the secure-auth parameter on MySQL >=8.0.3 (not mariadb)
   set_fact:
-    mysql_hardening_options: "{{ mysql_hardening_options| dict2items | rejectattr('key', 'search', 'secure-auth') | list | items2dict }}"
+    mysql_hardening_options: "{{ mysql_hardening_options | dict2items | rejectattr('key', 'search', 'secure-auth') | list | items2dict }}"
   when:
     - mysql_version.version.full is version('8.0.3', '>=')
     - mysql_distribution == "mysql"

roles/nginx_hardening/README.md

@@ -61,8 +61,8 @@ It works with the following nginx-roles, including, but not limited to:
   - Default: `default 5`
   - Description: Sets the shared memory zone and the maximum allowed number of connections for a given key value.
 - [nginx_add_header][]
-  - Default: `[ "X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"" ]`
-  - Description:Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307.
+  - Default: `[ "X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"", Content-Security-Policy \"script-src 'self'; object-src 'self'\" ]`
+  - Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307.
 - [nginx_ssl_protocols][]
   - Default: `TLSv1.2`
   - Description: Specifies the SSL protocol which should be used.

roles/nginx_hardening/defaults/main.yml

@@ -11,19 +11,18 @@ nginx_client_header_timeout: "10"
 nginx_send_timeout: "10"
 nginx_limit_conn_zone: "$binary_remote_addr zone=default:10m"
 nginx_limit_conn: "default 5"
-nginx_add_header: [
-# vvoid clickjacking
-"X-Frame-Options SAMEORIGIN",
-# disable content-type sniffing
-"X-Content-Type-Options nosniff",
-# XSS filter
-"X-XSS-Protection \"1; mode=block\"",
-"Strict-Transport-Security max-age=15768000",
-"Content-Security-Policy \"script-src 'self'; object-src 'self'\"" ]
+nginx_add_header:
+  # avoid clickjacking
+  - X-Frame-Options SAMEORIGIN
+  # disable content-type sniffing
+  - X-Content-Type-Options nosniff
+  # XSS filter
+  - X-XSS-Protection "1; mode=block"
+  - Strict-Transport-Security max-age=15768000
+  - Content-Security-Policy "script-src 'self'; object-src 'self'"
 
 nginx_set_cookie_flag: "* HttpOnly secure"
 nginx_ssl_prefer_server_ciphers: "on"
-nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
 nginx_ssl_ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
 nginx_ssl_session_tickets: "off"
-nginx_dh_size: "2048"
+nginx_dh_size: "4096"

roles/nginx_hardening/tasks/main.yml

@@ -1,4 +1,27 @@
 ---
+- name: Fetch OS dependent variables
+  include_vars:
+    file: '{{ item }}'
+    name: 'os_vars'
+  with_first_found:
+    - files:
+        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - '{{ ansible_facts.distribution }}.yml'
+        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - '{{ ansible_facts.os_family }}.yml'
+      skip: true
+  tags: always
+
+# we only override variables with our default, if they have not been specified already
+# by default the lookup functions finds all varnames containing the string, therefore
+# we add ^ and $ to denote start and end of string, so this returns only exact matches
+- name: Set OS dependent variables, if not already defined by user  # noqa var-naming
+  set_fact:
+    '{{ item.key }}': '{{ item.value }}'
+  when: "not lookup('varnames', '^' + item.key + '$')"
+  with_dict: '{{ os_vars }}'
+  tags: always
+
 - name: Create additional configuration
   template:
     src: "hardening.conf.j2"

roles/nginx_hardening/vars/Amazon.yml

@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"

roles/nginx_hardening/vars/Archlinux.yml

@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"

roles/nginx_hardening/vars/Debian.yml

@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"

roles/nginx_hardening/vars/Debian_9.yml

@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2"

roles/nginx_hardening/vars/Fedora.yml

@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"

roles/nginx_hardening/vars/RedHat.yml

@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"

roles/nginx_hardening/vars/Suse.yml

@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"

roles/nginx_hardening/vars/main.yml

@@ -1 +0,0 @@
----

roles/os_hardening/README.md

@@ -1,6 +1,7 @@
 # devsec.os_hardening
 
 ![devsec.os_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening/badge.svg)
+![devsec.os_hardening VM](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening%20VM/badge.svg)
 
 ## Looking for the old ansible-os-hardening role?
 
@@ -223,6 +224,9 @@ We know that this is the case on Raspberry Pi.
 - `proc_mnt_options`
   - Default: `rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}`
   - Description: Mount proc with hardenized options, including `hidepid` with variable value.
+- `os_ignore_users`
+  - Default: `['vagrant', 'kitchen']`
+  - Description: Specify system accounts whose login should not be disabled and password not changed
 - `os_ignore_home_folder_users`
   - Default: `lost+found`
   - Description: specify user home folders in `/home` that shouldn't be chmodded to 700
@@ -250,6 +254,9 @@ We know that this is the case on Raspberry Pi.
 - `os_profile_enabled`
   - Default: `true`
   - Description: Set to false to disable installing and configuring profile.
+- `os_security_auto_logout`
+  - Default: `0`
+  - Description: Set timeout in seconds for logout users automatically after time. Setting this to `0` disables the timeout.
 - `os_securetty_enabled`
   - Default: `true`
   - Description: Set to false to disable installing and configuring securetty.
@@ -280,6 +287,141 @@ We know that this is the case on Raspberry Pi.
 - `os_sha_crypt_max_rounds`
   - Default: `640000`
   - Description: Define the number of maximum SHA rounds. With a lot of rounds brute forcing the password is more difficult. But note also that it more CPU resources will be needed to authenticate users. The values must be inside the 1000-999999999 range.
+- `os_mnt_boot_dir_mode`
+  - Default: `0700`
+  - Description: Set default perimissions for /boot
+- `os_mnt_boot_enabled`
+  - Default: `false`
+  - Description: Set to true to configure /boot mountpoint
+- `os_mnt_boot_src`
+  - Default: `''`
+  - Description: Set mount source for /boot
+- `os_mnt_boot_options`
+  - Default: `rw,nosuid,nodev,noexec`
+  - Description: Configure mount options for /boot
+- `os_mnt_boot_filesystem`
+  - Default: `ext4`
+  - Description: Configure file system for fstab entry /boot
+- `os_mnt_dev_dir_mode`
+  - Default: `0755`
+  - Description: Set default perimissions for /dev
+- `os_mnt_dev_enabled`
+  - Default: `true`
+  - Description: Set to false to ignore /dev mountpoint
+- `os_mnt_dev_src`
+  - Default: `devtmpfs`
+  - Description: Set mount source for /dev
+- `os_mnt_dev_options`
+  - Default: `'rw,nosuid,noexec'`
+  - Description: Configure mount options for /dev
+- `os_mnt_dev_filesystem`
+  - Default: `ext4`
+  - Description: Configure file system for fstab entry /dev
+- `os_mnt_dev_shm_dir_mode`
+  - Default: `1777`
+  - Description: Set default perimissions for /dev/shm
+- `os_mnt_dev_shm_enabled`
+  - Default: `true`
+  - Description: Set to false to ignore /dev/shm mountpoint
+- `os_mnt_dev_shm_src`
+  - Default: `tmpfs`
+  - Description: Set mount source for /dev/shm
+- `os_mnt_dev_shm_options`
+  - Default: `rw,nosuid,nodev,noexec`
+  - Description: Configure mount options for /dev/shm
+- `os_mnt_dev_shm_filesystem`
+  - Default: `ext4`
+  - Description: Configure file system for fstab entry /dev/shm
+- `os_mnt_home_dir_mode`
+  - Default: `0755`
+  - Description: Set default perimissions for /home
+- `os_mnt_home_enabled`
+  - Default: `false`
+  - Description: Set to true to configure /home mountpoint
+- `os_mnt_home_src`
+  - Default: `""`
+  - Description: Set mount source for /home
+- `os_mnt_home_options`
+  - Default: `rw,nosuid,nodev`
+  - Description: Configure mount options for /home
+- `os_mnt_home_filesystem`
+  - Default: `ext4`
+  - Description: Configure file system for fstab entry /home
+- `os_mnt_run_dir_mode`
+  - Default: `0755`
+  - Description: Set default perimissions for /run
+- `os_mnt_run_enabled`
+  - Default: `true`
+  - Description: Set to false to ignore /run mountpoint
+- `os_mnt_run_src`
+  - Default: `tmpfs`
+  - Description: Set mount source for /run
+- `os_mnt_run_options`
+  - Default: `rw,nosuid,nodev`
+  - Description: Configure mount options for /run
+- `os_mnt_run_filesystem`
+  - Default: `ext4`
+  - Description: Configure file system for fstab entry /run
+- `os_mnt_var_dir_mode`
+  - Default: `0755`
+  - Description: Set default perimissions for /var
+- `os_mnt_var_enabled`
+  - Default: `false`
+  - Description: Set to true to configure /var mountpoint
+- `os_mnt_var_src`
+  - Default: `""`
+  - Description: Set mount source for /var
+- `os_mnt_var_options`
+  - Default: `rw,nosuid,nodev`
+  - Description: Configure mount options for /var
+- `os_mnt_var_filesystem`
+  - Default: `ext4`
+  - Description: Configure file system for fstab entry /var
+- `os_mnt_var_log_dir_mode`
+  - Default: `0755`
+  - Description: Set default perimissions for /var/log
+- `os_mnt_var_log_enabled`
+  - Default: `false`
+  - Description: Set to true to configure /var/log mountpoint
+- `os_mnt_var_log_src`
+  - Default: `""`
+  - Description: Set mount source for /var/log
+- `os_mnt_var_log_options`
+  - Default: `rw,nosuid,nodev,noexec`
+  - Description: Configure mount options for /var/log
+- `os_mnt_var_log_filesystem`
+  - Default: `ext4`
+  - Description: Configure file system for fstab entry /var/log
+- `os_mnt_var_log_audit_dir_mode`
+  - Default: `0640`
+  - Description: Set default perimissions for /var/log/audit
+- `os_mnt_var_log_audit_enabled`
+  - Default: `false`
+  - Description: Set to true to configure /var/log/audit mountpoint
+- `os_mnt_var_log_audit_src`
+  - Default: `""`
+  - Description: Set mount source for /var/log/audit
+- `os_mnt_var_log_audit_options`
+  - Default: `rw,nosuid,nodev,noexec`
+  - Description: Configure mount options for /var/log/audit
+- `os_mnt_var_log_audit_filesystem`
+  - Default: `ext4`
+  - Description: Configure file system for fstab entry /var/log/audit
+- `os_mnt_var_tmp_dir_mode`
+  - Default: `1777`
+  - Description: Set default perimissions for /var/tmp
+- `os_mnt_var_tmp_enabled`
+  - Default: `false`
+  - Description: Set to true to configure /var/tmp mountpoint
+- `os_mnt_var_tmp_src`
+  - Default: `""`
+  - Description: Set mount source for /var/tmp
+- `os_mnt_var_tmp_options`
+  - Default: `rw,nosuid,nodev,noexec`
+  - Description: Configure mount options for /var/tmp
+- `os_mnt_var_tmp_filesystem`
+  - Default: `ext4`
+  - Description: Configure file system for fstab entry /var/tmp
 
 ## Packages
 

roles/os_hardening/defaults/main.yml

@@ -70,6 +70,12 @@ sysctl_config:
   fs.protected_hardlinks: 1
   fs.protected_symlinks: 1
 
+  # For more info on the following settings see: https://www.kernel.org/doc/html/latest/admin-guide/sysctl/fs.html
+  # Restrict FIFO special device creation behavior
+  fs.protected_fifos: 1
+  # Restrict regular files creation behavior
+  fs.protected_regular: 2
+
   # Prevent core dumps with SUID. These are usually only
   # needed by developers and may contain sensitive information. | sysctl-31
   fs.suid_dumpable: 0
@@ -282,24 +288,6 @@ sysctl_config:
   vm.mmap_rnd_bits: 32
   vm.mmap_rnd_compat_bits: 16
 
-  # Disable unprivileged users from loading eBPF programs into the kernel.
-  # One of mitigations against CVE-2021-33909. | Tail-2
-  kernel.unprivileged_bpf_disabled: 1
-
-  # Reduce attack surface by disabling unprivileged user namespaces.
-  # Mitigates CVE-2021-33909 and other exploits.
-  kernel.unprivileged_userns_clone: 0
-
-  # For more info on the following settings see: https://www.kernel.org/doc/html/latest/admin-guide/sysctl/fs.html
-  # Restrict FIFO special device creation behavior
-  fs.protected_fifos: 1
-  # Restrict hardlink creation behavior
-  fs.protected_hardlinks: 1
-  # Restrict regular files creation behavior
-  fs.protected_regular: 2
-  # Restrict symlink following behavior
-  fs.protected_symlinks: 1
-
 # Do not delete the following line or otherwise the playbook will fail
 # at task 'create a combined sysctl-dict if overwrites are defined'
 sysctl_overwrite:
@@ -368,6 +356,9 @@ os_profile_enabled: true
 # Set to false to disable installing and configuring securetty.
 os_securetty_enabled: true
 
+# Set timeout in seconds for logout users automatically after time. Setting this to `0` disables the timeout.
+os_security_auto_logout: 0
+
 # Set to false to disable installing and configuring sysctl.
 os_sysctl_enabled: true
 
@@ -394,3 +385,57 @@ os_selinux_enabled: true
 # The values must be inside the 1000-999999999 range.
 os_sha_crypt_min_rounds: "640000"
 os_sha_crypt_max_rounds: "640000"
+
+os_mnt_boot_dir_mode: '0700'
+os_mnt_boot_enabled: false
+os_mnt_boot_src: ""
+os_mnt_boot_options: 'rw,nosuid,nodev,noexec'
+os_mnt_boot_filesystem: 'ext4'
+
+os_mnt_dev_dir_mode: '0755'
+os_mnt_dev_enabled: true
+os_mnt_dev_src: "devtmpfs"
+os_mnt_dev_options: 'rw,nosuid,noexec'
+os_mnt_dev_filesystem: "devtmpfs"
+
+os_mnt_dev_shm_dir_mode: '1777'
+os_mnt_dev_shm_enabled: true
+os_mnt_dev_shm_src: "tmpfs"
+os_mnt_dev_shm_options: 'rw,nosuid,nodev,noexec'
+os_mnt_dev_shm_filesystem: "tmpfs"
+
+os_mnt_home_dir_mode: '0755'
+os_mnt_home_enabled: false
+os_mnt_home_src: ""
+os_mnt_home_options: 'rw,nosuid,nodev'
+os_mnt_home_filesystem: "ext4"
+
+os_mnt_run_dir_mode: '0755'
+os_mnt_run_enabled: true
+os_mnt_run_src: "tmpfs"
+os_mnt_run_options: 'rw,nosuid,nodev'
+os_mnt_run_filesystem: "tmpfs"
+
+os_mnt_var_dir_mode: '0755'
+os_mnt_var_enabled: false
+os_mnt_var_src: ""
+os_mnt_var_options: 'rw,nosuid,nodev'
+os_mnt_var_filesystem: "ext4"
+
+os_mnt_var_log_dir_mode: '0755'
+os_mnt_var_log_enabled: false
+os_mnt_var_log_src: ""
+os_mnt_var_log_options: 'rw,nosuid,nodev,noexec'
+os_mnt_var_log_filesystem: "ext4"
+
+os_mnt_var_log_audit_dir_mode: '0640'
+os_mnt_var_log_audit_enabled: false
+os_mnt_var_log_audit_src: ""
+os_mnt_var_log_audit_options: 'rw,nosuid,nodev,noexec'
+os_mnt_var_log_audit_filesystem: "ext4"
+
+os_mnt_var_tmp_dir_mode: '1777'
+os_mnt_var_tmp_enabled: false
+os_mnt_var_tmp_src: ""
+os_mnt_var_tmp_options: 'rw,nosuid,nodev,noexec'
+os_mnt_var_tmp_filesystem: "ext4"

roles/os_hardening/handlers/main.yml

@@ -7,3 +7,7 @@
     cmd: 'service auditd restart'  # rhel: see: https://access.redhat.com/solutions/2664811
     warn: false  # sadly 'service' module fails in that case also by using 'use: service'
   when: molecule_yml is not defined  # restarting auditd in a container does not work
+
+- name: Reload systemd
+  systemd:
+    daemon_reload: true

roles/os_hardening/tasks/ctrlaltdel.yml

@@ -2,6 +2,6 @@
 - name: Disable CTRL-ALT-DEL
   systemd:
     name: ctrl-alt-del.target
-    masked: yes
-    daemon_reload: yes
+    masked: true
+    daemon_reload: true
   when: ansible_service_mgr == "systemd"

roles/os_hardening/tasks/limits.yml

@@ -1,5 +1,6 @@
 ---
-- block:
+- name: disable coredumps
+  block:
   - name: Create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
     file:
       path: '/etc/security/limits.d'
@@ -27,10 +28,38 @@
       modification_time: preserve
       access_time: preserve
 
+  - name: create coredump.conf.d-directory if it does not exist
+    file:
+      path: '/etc/systemd/coredump.conf.d'
+      owner: root
+      group: root
+      mode: 0755
+      state: directory
+    when: ansible_service_mgr == "systemd"
+
+  - name: create custom.conf for disabling coredumps
+    template:
+      src: 'etc/systemd/coredump.conf.d/coredumps.conf.j2'
+      dest: '/etc/systemd/coredump.conf.d/custom.conf'
+      owner: root
+      group: root
+      mode: 0644
+    when: ansible_service_mgr == "systemd"
+    notify: Reload systemd
+
   when: not os_security_kernel_enable_core_dump | bool
 
-- name: Remove 10.hardcore.conf config file
-  file:
-    path: /etc/security/limits.d/10.hardcore.conf
-    state: absent
+- name: enable coredumps
+  block:
+    - name: Remove coredump.conf.d directory with files
+      file:
+        path: /etc/systemd/coredump.conf.d
+        state: absent
+      when: ansible_service_mgr == "systemd"
+      notify: Reload systemd
+
+    - name: Remove 10.hardcore.conf config file
+      file:
+        path: /etc/security/limits.d/10.hardcore.conf
+        state: absent
   when: os_security_kernel_enable_core_dump | bool

roles/os_hardening/tasks/minimize_access.yml

@@ -4,16 +4,17 @@
 # still getting found and the permissions minimized in the next task.
 # This is also the reason why there's ignore_errors: true on the task.
 # also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
+
 - name: Find files with write-permissions for group
   shell: "find -L {{ item }} -perm /go+w -type f"  # noqa command-instead-of-shell
-  with_flattened:
+  loop:
     - '/usr/local/sbin'
     - '/usr/local/bin'
     - '/usr/sbin'
     - '/usr/bin'
     - '/sbin'
     - '/bin'
-    - "{{ os_env_extra_user_paths }}"  # noqa deprecated-bare-vars
+    - "{{ os_env_extra_user_paths | flatten }}"  # noqa deprecated-bare-vars
   register: minimize_access_directories
   ignore_errors: true
   changed_when: false
@@ -79,4 +80,196 @@
     src: proc
     fstype: proc
     opts: '{{ proc_mnt_options }}'
+    state: mounted
+
+- name: Check if boot exists
+  stat:
+    path: /boot
+  register: boot_exists
+
+- name: Mount /boot with hardened options
+  mount:
+    path: /boot
+    src: '{{ os_mnt_boot_src }}'
+    fstype: '{{ os_mnt_boot_filesystem }}'
+    opts: '{{ os_mnt_boot_options }}'
     state: present
+  register: bootmount
+  when:
+    - os_mnt_boot_enabled | bool
+    - boot_exists.stat.exists | bool
+
+- name: Harden permissions for /boot directory
+  file:
+    dest: /boot
+    owner: 'root'
+    group: 'root'
+    mode: '{{ os_mnt_boot_dir_mode }}'
+  when:  boot_exists.stat.exists | bool
+
+- name: Mount /dev with hardened options
+  mount:
+    path: /dev
+    src: '{{ os_mnt_dev_src }}'
+    fstype: '{{ os_mnt_dev_filesystem }}'
+    opts: '{{ os_mnt_dev_options }}'
+    state: present
+  register: devmount
+  when: os_mnt_dev_enabled | bool
+
+- name: Harden permissions for /dev directory
+  file:
+    dest: /dev
+    owner: 'root'
+    group: 'root'
+    mode: '{{ os_mnt_dev_dir_mode }}'
+
+- name: Mount /dev/shm with hardened options
+  mount:
+    path: /dev/shm
+    src: '{{ os_mnt_dev_shm_src }}'
+    fstype: '{{ os_mnt_dev_shm_filesystem }}'
+    opts: '{{ os_mnt_dev_shm_options }}'
+    state: present
+  register: devshmmount
+  when: os_mnt_dev_shm_enabled | bool
+
+- name: Harden permissions for /dev/shm directory
+  file:
+    dest: /dev/shm
+    owner: 'root'
+    group: 'root'
+    mode: '{{ os_mnt_dev_shm_dir_mode }}'
+
+- name: Mount /home with hardened options
+  mount:
+    path: /home
+    src: '{{ os_mnt_home_src }}'
+    fstype: '{{ os_mnt_home_filesystem }}'
+    opts: '{{ os_mnt_home_options }}'
+    state: present
+  register: homemount
+  when: os_mnt_home_enabled | bool
+
+- name: Harden permissions for /home directory
+  file:
+    dest: /home
+    owner: 'root'
+    group: 'root'
+    mode: '{{ os_mnt_home_dir_mode }}'
+
+- name: Mount /run with hardened options
+  mount:
+    path: /run
+    src: '{{ os_mnt_run_src }}'
+    fstype: '{{ os_mnt_run_filesystem }}'
+    opts: '{{ os_mnt_run_options }}'
+    state: present
+  register: runmount
+  when: os_mnt_run_enabled | bool
+
+- name: Harden permissions for /run directory
+  file:
+    dest: /run
+    owner: 'root'
+    group: 'root'
+    mode: '{{ os_mnt_run_dir_mode }}'
+
+- name: Mount /var with hardened options
+  mount:
+    path: /var
+    src: '{{ os_mnt_var_src }}'
+    fstype: '{{ os_mnt_var_filesystem }}'
+    opts: '{{ os_mnt_var_options }}'
+    state: present
+  register: varmount
+  when: os_mnt_var_enabled | bool
+
+- name: Harden permissions for /var directory
+  file:
+    dest: /var
+    owner: 'root'
+    group: 'root'
+    mode: '{{ os_mnt_var_dir_mode }}'
+
+- name: Mount /var/log with hardened options
+  mount:
+    path: /var/log
+    src: '{{ os_mnt_var_log_src }}'
+    fstype: '{{ os_mnt_var_log_filesystem }}'
+    opts: '{{ os_mnt_var_log_options }}'
+    state: present
+  register: varlogmount
+  when: os_mnt_var_log_enabled | bool
+
+- name: Harden permissions for /var/log directory
+  file:
+    dest: /var/log
+    owner: 'root'
+    group: 'root'
+    mode: '{{ os_mnt_var_log_dir_mode }}'
+
+- name: Check if /var/log/audit exists
+  stat:
+    path: /var/log/audit
+  register: var_log_audit_exists
+
+- name: Mount /var/log/audit with hardened options
+  mount:
+    path: /var/log/audit
+    src: '{{ os_mnt_var_log_audit_src }}'
+    fstype: '{{ os_mnt_var_log_audit_filesystem }}'
+    opts: '{{ os_mnt_var_log_audit_options }}'
+    state: present
+  register: varlogauditmount
+  when:
+    - os_mnt_var_log_audit_enabled | bool
+    - var_log_audit_exists.stat.exists | bool
+    - os_auditd_enabled | bool
+
+- name: Harden permissions for /var/log/audit directory
+  file:
+    dest: /var/log/audit
+    owner: 'root'
+    group: 'root'
+    mode: '{{ os_mnt_var_log_audit_dir_mode }}'
+  when:
+    - os_mnt_var_log_audit_enabled | bool
+    - var_log_audit_exists.stat.exists | bool
+    - os_auditd_enabled | bool
+
+- name: Mount /var/tmp with hardened options
+  mount:
+    path: /var/tmp
+    src: '{{ os_mnt_var_tmp_src }}'
+    fstype: '{{ os_mnt_var_tmp_filesystem }}'
+    opts: '{{ os_mnt_var_tmp_options }}'
+    state: present
+  register: vartmpmount
+  when: os_mnt_var_tmp_enabled | bool
+
+- name: Harden permissions for /var/tmp directory
+  file:
+    dest: /var/tmp
+    owner: 'root'
+    group: 'root'
+    mode: '{{ os_mnt_var_tmp_dir_mode }}'
+
+- name: remount all changed mountpoints
+  mount:
+    path: "{{ item.path }}"
+    src: "{{ item.src }}"
+    fstype: "{{ item.fstype }}"
+    opts: "{{ item.opts }}"
+    state: remounted
+  when: item.when | bool
+  loop:
+    - { path: '/boot', src: '{{ os_mnt_boot_src }}', fstype: '{{ os_mnt_boot_filesystem }}', opts: '{{ os_mnt_boot_options }}', when: "{{ bootmount.changed }}" }
+    - { path: '/dev', src: '{{ os_mnt_dev_src }}', fstype: '{{ os_mnt_dev_filesystem }}', opts: '{{ os_mnt_dev_options }}', when: "{{ devmount.changed }}" }
+    - { path: '/dev/shm', src: '{{ os_mnt_dev_shm_src }}', fstype: '{{ os_mnt_dev_shm_filesystem }}', opts: '{{ os_mnt_dev_shm_options }}', when: "{{ devshmmount.changed }}" }
+    - { path: '/home', src: '{{ os_mnt_home_src }}', fstype: '{{ os_mnt_home_filesystem }}', opts: '{{ os_mnt_home_options }}', when: "{{ homemount.changed }}" }
+    - { path: '/run', src: '{{ os_mnt_run_src }}', fstype: '{{ os_mnt_run_filesystem }}', opts: '{{ os_mnt_run_options }}', when: "{{ runmount.changed }}" }
+    - { path: '/var', src: '{{ os_mnt_var_src }}', fstype: '{{ os_mnt_var_filesystem }}', opts: '{{ os_mnt_var_options }}', when: "{{ varmount.changed }}" }
+    - { path: '/var/log', src: '{{ os_mnt_var_log_src }}', fstype: '{{ os_mnt_var_log_filesystem }}', opts: '{{ os_mnt_var_log_options }}', when: "{{ varlogmount.changed }}" }
+    - { path: '/var/log/audit', src: '{{ os_mnt_var_log_audit_src }}', fstype: '{{ os_mnt_var_log_audit_filesystem }}', opts: '{{ os_mnt_var_log_audit_options }}', when: "{{ varlogauditmount.changed }}" }
+    - { path: '/var/tmp', src: '{{ os_mnt_var_tmp_src }}', fstype: '{{ os_mnt_var_tmp_filesystem }}', opts: '{{ os_mnt_var_tmp_options }}', when: "{{ vartmpmount.changed }}" }

roles/os_hardening/tasks/profile.yml

@@ -13,3 +13,11 @@
     path: /etc/profile.d/pinerolo_profile.sh
     state: absent
   when: os_security_kernel_enable_core_dump | bool
+
+- name: Add autologout to profile env
+  template:
+    src: 'etc/profile.d/tmout.sh.j2'
+    dest: '/etc/profile.d/tmout.sh'
+    owner: 'root'
+    group: 'root'
+    mode: '0644'

roles/os_hardening/tasks/rhosts.yml

@@ -9,7 +9,7 @@
   file:
     dest: '~{{ item }}/.rhosts'
     state: 'absent'
-  with_flattened: '{{ users_accounts.stdout_lines | default([]) }}'
+  loop: '{{ users_accounts.stdout_lines | default([]) | flatten }}'
 
 - name: Delete hosts.equiv from system | os-01
   file:
@@ -20,4 +20,4 @@
   file:
     dest: '~{{ item }}/.netrc'
     state: 'absent'
-  with_flattened: '{{ users_accounts.stdout_lines | default([]) }}'
+  loop: '{{ users_accounts.stdout_lines | default([]) | flatten }}'

roles/os_hardening/tasks/suid_sgid.yml

@@ -6,9 +6,9 @@
     state: 'file'
     follow: 'yes'
   failed_when: false
-  with_flattened:
-    - '{{ os_security_suid_sgid_system_blacklist }}'
-    - '{{ os_security_suid_sgid_blacklist }}'
+  loop:
+    - '{{ os_security_suid_sgid_system_blacklist | flatten }}'
+    - '{{ os_security_suid_sgid_blacklist | flatten }}'
 
 - name: Find binaries with suid/sgid set | os-06
   shell: find / -xdev \( -perm -4000 -o -perm -2000 \) -type f ! -path '/proc/*' -print 2>/dev/null
@@ -27,6 +27,6 @@
     mode: 'a-s'
     state: 'file'
     follow: 'yes'
-  with_flattened:
-    - '{{ suid | default([]) | difference(os_security_suid_sgid_whitelist) }}'
+  loop:
+    - '{{ suid | default([]) | difference(os_security_suid_sgid_whitelist) | flatten }}'
   when: os_security_suid_sgid_remove_from_unknown | bool

roles/os_hardening/tasks/sysctl.yml

@@ -43,6 +43,17 @@
 
 - name: Change sysctls
   block:
+    - name: Create a combined sysctl-dict if os-dependent sysctls are defined
+      set_fact:
+        sysctl_config: '{{ sysctl_config | combine(sysctl_custom_config) }}'
+      when: sysctl_custom_config | default()
+
+    # sysctl_rhel_config is kept for backwards-compatibility. use sysctl_custom_config instead
+    - name: Create a combined sysctl-dict if os-dependent sysctls are defined
+      set_fact:
+        sysctl_config: '{{ sysctl_config | combine(sysctl_rhel_config) }}'
+      when: sysctl_rhel_config | default()
+
     - name: Create a combined sysctl-dict if overwrites are defined
       set_fact:
         sysctl_config: '{{ sysctl_config | combine(sysctl_overwrite) }}'
@@ -57,17 +68,7 @@
         reload: true
         ignoreerrors: true
       with_dict: '{{ sysctl_config }}'
-
-    - name: Change various sysctl-settings on Amazon Linux, look at the sysctl-vars file for documentation
-      sysctl:
-        name: '{{ item.key }}'
-        value: '{{ item.value }}'
-        state: present
-        reload: true
-        ignoreerrors: true
-      with_dict: '{{ sysctl_rhel_config }}'
-      when: ansible_facts.distribution == 'Amazon'
-
+      when: item.key not in sysctl_unsupported_entries | default()
   when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']
 
 - name: Apply ufw defaults

roles/os_hardening/tasks/user_accounts.yml

@@ -43,8 +43,8 @@
     shell: '{{ os_nologin_shell_path }}'
     password: '*'
     createhome: false
-  with_flattened:
-    - '{{ sys_accs_cond | default([]) | difference(os_ignore_users) | list }}'
+  loop:
+    - '{{ sys_accs_cond | default([]) | difference(os_ignore_users) | list | flatten }}'
 
 - name: get all home directories in /home, but skip ignored users
   find:

roles/os_hardening/tasks/yum.yml

@@ -37,7 +37,7 @@
     replace: 'gpgcheck=1'
     mode: '0644'
   register: status
-  failed_when: status.rc is defined and status.rc != 257
+  failed_when: status.rc is defined and status.rc not in (257, 0)
   loop:
     - '/etc/yum.conf'
     - '/etc/dnf/dnf.conf'

roles/os_hardening/templates/etc/profile.d/tmout.sh.j2

@@ -0,0 +1,3 @@
+# Logout Timeout
+export TMOUT={{ os_security_auto_logout }}
+readonly TMOUT

roles/os_hardening/templates/etc/systemd/coredump.conf.d/coredumps.conf.j2

@@ -0,0 +1,2 @@
+[Coredump]
+Storage=none

roles/os_hardening/vars/Amazon.yml

@@ -45,8 +45,4 @@ auditd_package: 'audit'
 # system accounts that do not get their login disabled and pasword changed
 os_always_ignore_users: ['root', 'sync', 'shutdown', 'halt', 'ec2-user']
 
-sysctl_rhel_config:
-  # ExecShield protection against buffer overflows
-  kernel.exec-shield: 1
-
 hidepid_option: '2'  # allowed values: 0, 1, 2

roles/os_hardening/vars/Archlinux.yml

@@ -33,3 +33,9 @@ modprobe_package: 'kmod'
 auditd_package: 'audit'
 
 hidepid_option: '2'  # allowed values: 0, 1, 2
+
+sysctl_custom_config:
+  # Mitigation of vulnerability CVE-2021-33909
+  kernel.unprivileged_userns_clone: 0
+  # Mitigation of vulnerability CVE-2021-33910
+  kernel.unprivileged_bpf_disabled: 1

roles/os_hardening/vars/Debian.yml

@@ -43,3 +43,9 @@ tally2_path: '/usr/share/pam-configs/tally2'
 passwdqc_path: '/usr/share/pam-configs/passwdqc'
 
 hidepid_option: '2'  # allowed values: 0, 1, 2
+
+sysctl_custom_config:
+  # Mitigation of vulnerability CVE-2021-33909
+  kernel.unprivileged_userns_clone: 0
+  # Mitigation of vulnerability CVE-2021-33910
+  kernel.unprivileged_bpf_disabled: 1

roles/os_hardening/vars/RedHat_7.yml

@@ -43,3 +43,7 @@ modprobe_package: 'module-init-tools'
 auditd_package: 'audit'
 
 hidepid_option: '0'  # allowed values: 0, 1, 2
+
+sysctl_unsupported_entries:
+  - 'fs.protected_fifos'
+  - 'fs.protected_regular'

roles/ssh_hardening/README.md

@@ -49,7 +49,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
   - Description: specifies an interval for sending keepalive messages.
 - `ssh_client_alive_count`
   - Default: `3`
-  - Description: defines how often keep-alive messages are sent.
+  - Description: Defines the number of acceptable unanswered client alive messages before disconnecting clients.
 - `ssh_permit_tunnel`
   - Default: `false`
   - Description: true if SSH Port Tunneling is required.

roles/ssh_hardening/tasks/ca_keys_and_principals.yml

@@ -22,6 +22,6 @@
     src: 'authorized_principals.j2'
     dest: '{{ item.path }}'
     mode: '{{ item.filemode | default("600") }}'
-    owner: '{{ item.owner| default(ssh_owner) }}'
+    owner: '{{ item.owner | default(ssh_owner) }}'
     group: '{{ item.group | default(ssh_group) }}'
   loop: '{{ ssh_authorized_principals }}'

roles/ssh_hardening/tasks/selinux.yml

@@ -24,7 +24,8 @@
 # The following tasks only get executed when selinux is in state enforcing,
 # UsePam is 'no' and the ssh_password module is not installed. See this issue for
 # more info: https://github.com/hardening-io/ansible-ssh-hardening/issues/23
-- when:
+- name: run selinux tasks
+  when:
     - not (ssh_use_pam | bool)
     - ('ssh_password' not in ssh_password_module.stdout)
   block:
@@ -44,13 +45,13 @@
         group: 'root'
         mode: '0600'
 
-    - name: Check and compile policy
+    - name: Check and compile policy  # noqa no-changed-when
       command: checkmodule -M -m -o {{ ssh_custom_selinux_dir }}/ssh_password.mod {{ ssh_custom_selinux_dir }}/ssh_password
 
-    - name: Create selinux policy module package
+    - name: Create selinux policy module package  # noqa no-changed-when
       command: semodule_package -o {{ ssh_custom_selinux_dir }}/ssh_password.pp  -m {{ ssh_custom_selinux_dir }}/ssh_password.mod
 
-    - name: Install selinux policy
+    - name: Install selinux policy  # noqa no-changed-when
       command: semodule -i {{ ssh_custom_selinux_dir }}/ssh_password.pp