Merge pull request #628 from Normo/add-password-warn-age-option

Set number of warning days before user password expires
os_hardening: Add test for setting password warning days via variable os_auth_pw_warn_age
2023-02-04 18:21:52 +01:00 · 2023-02-03 14:47:27 +01:00 · 2023-02-01 16:17:36 +01:00 · 2023-02-01 11:40:40 +00:00 · 2023-02-01 12:37:31 +01:00 · 2023-01-31 06:55:37 +00:00
157 changed files with 3428 additions and 1451 deletions
@@ -0,0 +1,14 @@
 ---
 # .ansible-lint
 # exclude_paths included in this file are parsed relative to this file's location
 # and not relative to the CWD of execution. CLI arguments passed to the --exclude
 # option will be parsed relative to the CWD of execution.
 exclude_paths:
  - .cache/ # implicit unless exclude_paths is defined in config
  - .yamllint
  - ../molecule/
  - ../.github/
 mock_roles:
  - geerlingguy.git
  - nginxinc.nginx
@@ -1,49 +0,0 @@
 ---
 name: Bug report
 about: Create a report to help us improve
 ---
 **Describe the bug**
 A clear and concise description of what the bug is.
 **Expected behavior**
 A clear and concise description of what you expected to happen.
 **Actual behavior**
 <!--- Paste verbatim command output between quotes -->
 ```paste below
 ```
 **Example Playbook**
 <!--- Paste an example playbook that can be used to reproduce the problem between quotes -->
 ```paste below
 ```
 **OS / Environment**
 <!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
 **Ansible Version**
 <!--- Paste verbatim output from "ansible --version" between quotes -->
 ```paste below
 ```
 **Role Version**
 <!--- Paste version of the role between quotes -->
 ```paste below
 ```
 **Additional context**
 Add any other context about the problem here.
@@ -0,0 +1,97 @@
 ---
 # reference: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests
 name: "Bug report"
 description: "Create a report to help us improve."
 labels: [
  "bug"
 ]
 body:
  - type: markdown
    attributes:
      value: |
        Reporting Bugs ld follow some simple rules:
        - **Check**, if you can find similar bugs
        - **Describe** what is happening and what should happen
        - **Explain** how to reproduce the problem
        - **Add** more details and attachments
        - **Follow up**, if somebody is having questions or needs more details
  - type: textarea
    id: description
    attributes:
      label: "Description"
      description: Describe the bug
      placeholder: A clear and concise description of what the bug is.
    validations:
      required: true
  - type: textarea
    id: reprod
    attributes:
      label: "Reproduction steps"
      render: Shell
      description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, so no need for backticks.
      value: |
        ...
    validations:
      required: true
  - type: textarea
    id: currentbehavior
    attributes:
      label: "Current Behavior"
      description: Please describe the results you received
      value: |
        ...
    validations:
      required: true
  - type: textarea
    id: expectedbehavior
    attributes:
      label: "Expected Behavior"
      description: Please describe the results you expect
      value: |
        ...
    validations:
      required: true
  - type: textarea
    id: os
    attributes:
      label: "OS / Environment"
      value: |
        Provide all relevant information below, e.g. target OS versions, network device firmware, etc.
    validations:
      required: true
  - type: textarea
    id: ansible
    attributes:
      label: "Ansible Version"
      render: Shell
      value: |
        Paste verbatim output from "ansible --version" between quotes. This will be automatically formatted into code, so no need for backticks.
    validations:
      required: true
  - type: textarea
    id: collection
    attributes:
      label: "Collection Version"
      render: Shell
      value: |
        Paste version of the collection. This will be automatically formatted into code, so no need for backticks.
    validations:
      required: true
  - type: textarea
    id: additional
    attributes:
      label: "Additional information"
      description: Please add information like the used software versions, outputs of logs, OS information, screenshots, etc. to enhance the report
      value: |
        ...
    validations:
      required: false
@@ -1,16 +0,0 @@
 ---
 name: Feature request
 about: Suggest an idea for this project
 ---
 **Is your feature request related to a problem? Please describe.**
 A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
 **Describe the solution you'd like**
 A clear and concise description of what you want to happen.
 **Describe alternatives you've considered**
 A clear and concise description of any alternative solutions or features you've considered.
 **Additional context**
 Add any other context or screenshots about the feature request here.
@@ -0,0 +1,55 @@
 ---
 # reference: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests
 name: "Feature request"
 description: "Suggest an idea for this project."
 labels: [
  "enhancement"
 ]
 body:
  - type: markdown
    attributes:
      value: |
        Requesting a new feature or enhancement is following some simple rules:
        - **Check**, if the feature is already requested
        - **Describe** what your feature will bring to the community
        - **Explain** the criteria to fulfill the request
        - **Add** more details like mock ups, attachments, lists, screenshots
        - **Follow Up** in the discussion to the feature
  - type: textarea
    id: description
    attributes:
      label: "Description"
      description: Is your feature request related to a problem? Please describe.
      placeholder: A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
    validations:
      required: true
  - type: textarea
    id: solution
    attributes:
      label: "Solution"
      description: Describe the solution you'd like
      placeholder: A clear and concise description of what you want to happen.
    validations:
      required: false
  - type: textarea
    id: alternatives
    attributes:
      label: "Alternatives"
      description: Describe alternatives you've considered
      placeholder: A clear and concise description of any alternative solutions or features you've considered.
    validations:
      required: false
  - type: textarea
    id: additional
    attributes:
      label: "Additional information"
      description: Add any other context or screenshots about the feature request here.
      value: |
        ...
    validations:
      required: false
@@ -1,3 +1,4 @@
 ---
 # To get started with Dependabot version updates, you'll need to specify which
 # package ecosystems to update and where the package manifests are located.
 # Please see the documentation for all configuration options:
@@ -9,3 +10,16 @@ updates:
    directory: "/"  # Location of package manifests
    schedule:
      interval: "daily"
    # by default Dependabot creates labels like "major" or "minor" for version updates of our deps.
    # however this interferes with the github changelog generator which uses these labels to define
    # a new version for the collection
    labels: [ ]
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "daily"
    # by default Dependabot creates labels like "major" or "minor" for version updates of our deps.
    # however this interferes with the github changelog generator which uses these labels to define
    # a new version for the collection
    labels: [ ]
@@ -1,56 +1,28 @@
 ---
 name: Ansible Lint  # feel free to pick your own name
-on: [push, pull_request]
+on:  # yamllint disable-line rule:truthy
  # Run CI against all pushes (direct commits, also merged PRs), Pull Requests
  push:
    branches: [master]
    paths:
      - 'roles/**'
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [master]
    paths:
      - 'roles/**'
 jobs:
  ansible-lint:
    runs-on: ubuntu-latest
    steps:
      # Important: This sets up your GITHUB_WORKSPACE environment variable
-    - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
      - name: Lint Ansible Playbook
        # replace "master" with any valid ref
-      uses: ansible/ansible-lint-action@master
+        uses: ansible/ansible-lint-action@main
        with:
-        # [required]
+          path: "roles/"
        # Paths to ansible files (i.e., playbooks, tasks, handlers etc..)
        # or valid Ansible directories according to the Ansible role
        # directory structure.
        # If you want to lint multiple ansible files, use the following syntax
        # targets: |
        #   playbook_1.yml
        #   playbook_2.yml
        targets: "roles/"
        # [optional]
        # Arguments to override a package and its version to be set explicitly.
        # Must follow the example syntax.
        # override-deps: |
        #   ansible==2.9
        #   ansible-lint==4.2.0
        # [optional]
        # Arguments to be passed to the ansible-lint
        # Options:
        #   -q                    quieter, although not silent output
        #   -p                    parseable output in the format of pep8
        #   --parseable-severity  parseable output including severity of rule
        #   -r RULESDIR           specify one or more rules directories using one or
        #                         more -r arguments. Any -r flags override the default
        #                         rules in ansiblelint/rules, unless -R is also used.
        #   -R                    Use default rules in ansiblelint/rules in addition to
        #                         any extra
        #                         rules directories specified with -r. There is no need
        #                         to specify this if no -r flags are used
        #   -t TAGS               only check rules whose id/tags match these values
        #   -x SKIP_LIST          only check rules whose id/tags do not match these
        #                         values
        #   --nocolor             disable colored output
        #   --exclude=EXCLUDE_PATHS
        #                         path to directories or files to skip. This option is
        #                         repeatable.
        #   -c C                  Specify configuration file to use. Defaults to ".ansible-lint"
        args: ""
@@ -1,10 +1,12 @@
 ---
 name: "Enforce PR labels"
-on:
+on:  # yamllint disable-line rule:truthy
  pull_request_target:
    types: [labeled, unlabeled, opened, edited, synchronize]
 jobs:
  enforce-label:
    if: github.repository == 'dev-sec/ansible-collection-hardening'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/labeler@main
@@ -1,16 +1,17 @@
 ---
 name: Publish collection to Ansible Galaxy
-on:
+on:  # yamllint disable-line rule:truthy
  release:
    types:
      - published
 jobs:
  deploy:
    if: github.repository == 'dev-sec/ansible-collection-hardening'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
      # deploy the collection first, because if it fails, we don't want
      # to update the galaxy.yml
@@ -21,7 +22,7 @@ jobs:
          galaxy_version: ${{ github.event.release.tag_name }}
      # checkout master instead of the release-tag so we can push the galaxy.yml
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
        with:
          ref: master
@@ -33,7 +34,7 @@ jobs:
          version: "${{ github.event.release.tag_name }}"
      - name: push galaxy.yml
-        uses: github-actions-x/commit@v2.7
+        uses: github-actions-x/commit@v2.9
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          push-branch: 'master'
@@ -1,17 +1,28 @@
 ---
 name: "devsec.mysql_hardening"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - 'roles/mysql_hardening/**'
      - 'molecule/mysql_hardening/**'
      - '.github/workflows/mysql_hardening.yml'
  pull_request:
    branches: [master]
    paths:
      - 'roles/mysql_hardening/**'
      - 'molecule/mysql_hardening/**'
      - '.github/workflows/mysql_hardening.yml'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
    runs-on: ubuntu-18.04
@@ -23,25 +34,28 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
-          - centos8
+          - centosstream8
          - centosstream9
          - rocky8
          - rocky9
          - ubuntu1804
          - ubuntu2004
-          - debian9
+          - ubuntu2204
          - debian10
          - debian11
          # - amazon  # geerlingguy.mysql does not support fedora
          # - arch  # needs to be fixed
-          # - opensuse_tumbleweed  # needs to be fixed
+          - opensuse_tumbleweed  # needs to be fixed
          # - fedora  # geerlingguy.mysql does not support fedora
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
      - name: Set up Python 3.7
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
        with:
          python-version: 3.7
@@ -3,15 +3,25 @@ name: "devsec.nginx_hardening"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - 'roles/nginx_hardening/**'
      - 'molecule/nginx_hardening/**'
      - '.github/workflows/nginx_hardening.yml'
  pull_request:
    branches: [master]
    paths:
      - 'roles/nginx_hardening/**'
      - 'molecule/nginx_hardening/**'
      - '.github/workflows/nginx_hardening.yml'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
    runs-on: ubuntu-18.04
@@ -23,25 +33,28 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
-          - centos8
+          - centosstream8
          - centosstream9
          - rocky8
          - rocky9
          - ubuntu1804
          - ubuntu2004
-          - debian9
+          - ubuntu2204
          - debian10
          - debian11
          - amazon
          # - arch  # needs to be fixed
          # - opensuse_tumbleweed  # needs to be fixed
          # - fedora  # no support from geerlingguy role
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
      - name: Set up Python 3.7
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
        with:
          python-version: 3.7
@@ -3,15 +3,25 @@ name: "devsec.os_hardening"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening/**'
      - '.github/workflows/os_hardening.yml'
  pull_request:
    branches: [master]
    paths:
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening/**'
      - '.github/workflows/os_hardening.yml'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
    runs-on: ubuntu-18.04
@@ -23,24 +33,27 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
-          - centos8
+          - centosstream8
          - centosstream9
          - rocky8
          - rocky9
          - ubuntu1804
          - ubuntu2004
-          - debian9
+          - ubuntu2204
          - debian10
          - debian11
          - amazon
          - opensuse_tumbleweed
          # - arch  # needs to be fixed
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
      - name: Set up Python 3.7
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
        with:
          python-version: 3.7
@@ -0,0 +1,65 @@
 ---
 name: "devsec.os_hardening VM"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening_vm/**'
      - '.github/workflows/os_hardening_vm.yml'
  pull_request:
    branches: [master]
    paths:
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening_vm/**'
      - '.github/workflows/os_hardening_vm.yml'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
    runs-on: self-hosted
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
    strategy:
      fail-fast: false
      matrix:
        molecule_distro:
          - centos7
          - centos8s
          # - centos9s  # problems with vagrant
          - rocky8
          # - rocky9  # problems with vagrant
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
          - debian10
          - debian11
          # - opensuse42  # opensuse currently cannot get an ip address
          # - arch  # arch is currently not supported by cinc-auditor
    steps:
      - name: Checkout repo
        uses: actions/checkout@v3
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
      - name: Create default collection path symlink
        run: |
          mkdir -p /home/runner/.ansible
          ln -fs /opt/actions-runner/_work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections /home/runner/.ansible/collections
      - name: Test with molecule
        run: |
          molecule --version
          molecule test -s os_hardening_vm
        env:
          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
        working-directory: ansible_collections/devsec/hardening
@@ -2,23 +2,25 @@
 # https://github.com/creyD/prettier_action
 name: Prettier markdown files
-on:
+on:  # yamllint disable-line rule:truthy
  push:
    branches: [master]
    paths:
      - '**.md'
 jobs:
  prettier-md:
    if: github.repository == 'dev-sec/ansible-collection-hardening'
    runs-on: ubuntu-latest
    timeout-minutes: 1
    steps:
      - name: Git checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
        with:
          ref: ${{ github.head_ref }}
      - name: Prettify code
-        uses: creyD/prettier_action@v3.1
+        uses: creyD/prettier_action@v4.2
        with:
          prettier_options: --write {**/*,*}.md
@@ -9,12 +9,14 @@ on:  # yamllint disable-line rule:truthy
 jobs:
  generate_changelog:
    runs-on: ubuntu-latest
    name: create release draft
    if: github.repository == 'dev-sec/ansible-collection-hardening'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
          ref: master
      - name: 'Get Previous tag'
        id: previoustag
@@ -40,7 +42,7 @@ jobs:
          issue_line_labels: mysql_hardening,os_hardening,ssh_hardening,nginx_hardening
      - name: push changelog
-        uses: github-actions-x/commit@v2.6
+        uses: github-actions-x/commit@v2.9
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          push-branch: 'master'
@@ -50,12 +52,6 @@ jobs:
          name: dev-sec CI
          email: [email protected]
      # do a second checkout to prevent race situation
      # changelog gets updated but action works on old commit id
      - uses: actions/[email protected]
        with:
          ref: master
      - name: Generate changelog for the release
        run: |
          sed '/## \[${{ steps.previoustag.outputs.tag }}\]/Q' CHANGELOG.md > CHANGELOGRELEASE.md
@@ -66,6 +62,11 @@ jobs:
        with:
          path: ./CHANGELOGRELEASE.md
      - name: Delete old drafts
        uses: hugo19941994/[email protected]
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Create Release draft
        id: create_release
        uses: actions/create-release@v1
@@ -3,15 +3,25 @@ name: "devsec.ssh_hardening"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening/**'
      - '.github/workflows/ssh_hardening.yml'
  pull_request:
    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening/**'
      - '.github/workflows/ssh_hardening.yml'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
    runs-on: ubuntu-18.04
@@ -23,25 +33,28 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
-          - centos8
+          - centosstream8
          - centosstream9
          - rocky8
          - rocky9
          - fedora
          - ubuntu1804
          - ubuntu2004
-          - debian9
+          - ubuntu2204
          - debian10
          - debian11
          - amazon
          # - arch  # needs to be fixed
          # - opensuse_tumbleweed  # baseline is not compatible with suse
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
      - name: Set up Python 3.7
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
        with:
          python-version: 3.7
@@ -3,15 +3,25 @@ name: "devsec.ssh_hardening with custom tests"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening_custom_tests/**'
      - '.github/workflows/ssh_hardening_custom_tests.yml'
  pull_request:
    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening_custom_tests/**'
      - '.github/workflows/ssh_hardening_custom_tests.yml'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
    runs-on: ubuntu-18.04
@@ -23,25 +33,28 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
-          - centos8
+          - centosstream8
          - centosstream9
          - rocky8
          - rocky9
          - fedora
          - ubuntu1804
          - ubuntu2004
-          - debian9
+          - ubuntu2204
          - debian10
          - debian11
          - amazon
          # - arch  # needs to be fixed
          # - opensuse_tumbleweed  # baseline is not compatible with suse
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
      - name: Set up Python 3.7
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
        with:
          python-version: 3.7
@@ -1,3 +1,4 @@
 .kitchen
 hosts
 Gemfile.lock
 .venv
@@ -1,33 +0,0 @@
 ---
 # Based on ansible-lint config
 extends: default
 rules:
  braces:
    max-spaces-inside: 1
    level: error
  brackets:
    max-spaces-inside: 1
    level: error
  colons:
    max-spaces-after: -1
    level: error
  commas:
    max-spaces-after: -1
    level: error
 #  comments: disable
 #  comments-indentation: disable
 #  document-start: disable
  empty-lines:
    max: 3
    level: error
  hyphens:
    level: error
 #  indentation: disable
  key-duplicates: enable
  line-length: disable
 #  new-line-at-end-of-file: disable
  new-lines:
    type: unix
 #  trailing-spaces: disable
 #  truthy: disable
@@ -1,8 +1,288 @@
 # Changelog
-## [Unreleased](https://github.com/dev-sec/ansible-collection-hardening/tree/HEAD)
+## [8.5.1](https://github.com/dev-sec/ansible-collection-hardening/tree/8.5.1) (2023-02-01)
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.12.0...HEAD)
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.5.0...8.5.1)
 **Merged pull requests:**
 - Bump hugo19941994/delete-draft-releases from 1.0.0 to 1.0.1 [\#627](https://github.com/dev-sec/ansible-collection-hardening/pull/627) ([dependabot[bot]](https://github.com/apps/dependabot))
 ## [8.5.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.5.0) (2023-01-30)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.4.0...8.5.0)
 **Implemented enhancements:**
 - Add support for /etc/auditd.conf num\_logs to go with max\_log\_file\_action [\#616](https://github.com/dev-sec/ansible-collection-hardening/issues/616)
 - password ageing not enforced [\#570](https://github.com/dev-sec/ansible-collection-hardening/issues/570)
 - Rewrite system account detection and hardening and create tests [\#621](https://github.com/dev-sec/ansible-collection-hardening/pull/621) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Add support for /etc/auditd.conf num\_logs to go with max\_log\_file\_action [\#617](https://github.com/dev-sec/ansible-collection-hardening/pull/617) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([richardlock](https://github.com/richardlock))
 - Preserve default ownership and dir mode for /var/log on Ubuntu [\#615](https://github.com/dev-sec/ansible-collection-hardening/pull/615) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([stdtom](https://github.com/stdtom))
 - rewrite user home dir hardening [\#584](https://github.com/dev-sec/ansible-collection-hardening/pull/584) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 - apply password age settings to exisiting regular users [\#582](https://github.com/dev-sec/ansible-collection-hardening/pull/582) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 - Parametrize more auditd.conf options [\#535](https://github.com/dev-sec/ansible-collection-hardening/pull/535) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([kravietz](https://github.com/kravietz))
 **Fixed bugs:**
 - os\_hardening is setting wrong ownership for /var/log on Ubuntu [\#614](https://github.com/dev-sec/ansible-collection-hardening/issues/614)
 - \[os\_hardening\] Task for setting `initramfs` modules does not match its condition [\#590](https://github.com/dev-sec/ansible-collection-hardening/issues/590) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
 - Support for Amazon Linux 2 [\#624](https://github.com/dev-sec/ansible-collection-hardening/pull/624) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([mmitnyan](https://github.com/mmitnyan))
 **Deprecated:**
 - deprecate rebuilding of initramfs [\#618](https://github.com/dev-sec/ansible-collection-hardening/pull/618) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 **Closed issues:**
 - Ubuntu 22.04 vars file missing? [\#619](https://github.com/dev-sec/ansible-collection-hardening/issues/619)
 - SSH KexAlgorithms causes SSH daemon to fail [\#500](https://github.com/dev-sec/ansible-collection-hardening/issues/500)
 - Playbook won't run for hardening  [\#462](https://github.com/dev-sec/ansible-collection-hardening/issues/462)
 **Merged pull requests:**
 - do not let dependabot label our prs [\#626](https://github.com/dev-sec/ansible-collection-hardening/pull/626) ([rndmh3ro](https://github.com/rndmh3ro))
 - run linting only when files inside roles change [\#625](https://github.com/dev-sec/ansible-collection-hardening/pull/625) ([rndmh3ro](https://github.com/rndmh3ro))
 - cancel running tests if new commit to branch is made [\#622](https://github.com/dev-sec/ansible-collection-hardening/pull/622) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Fixed problems with running molecule locally with cgroup v2 [\#620](https://github.com/dev-sec/ansible-collection-hardening/pull/620) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Bump actions/setup-python from 1 to 4 [\#611](https://github.com/dev-sec/ansible-collection-hardening/pull/611) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([dependabot[bot]](https://github.com/apps/dependabot))
 - Bump creyD/prettier\_action from 3.1 to 4.2 [\#610](https://github.com/dev-sec/ansible-collection-hardening/pull/610) ([dependabot[bot]](https://github.com/apps/dependabot))
 - linting [\#603](https://github.com/dev-sec/ansible-collection-hardening/pull/603) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 ## [8.4.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.4.0) (2022-12-17)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.3.0...8.4.0)
 **Implemented enhancements:**
 - Implement Test for MySQL systemd service [\#606](https://github.com/dev-sec/ansible-collection-hardening/issues/606)
 - Extended net hardening [\#607](https://github.com/dev-sec/ansible-collection-hardening/pull/607) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 - Add OpenSUSE support  [\#605](https://github.com/dev-sec/ansible-collection-hardening/pull/605) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Allow ssh\_allow\_tcp\_forwarding to be a boolean [\#600](https://github.com/dev-sec/ansible-collection-hardening/pull/600) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([crisbal](https://github.com/crisbal))
 - OpenBSD does not support GSSAPI Authentication [\#598](https://github.com/dev-sec/ansible-collection-hardening/pull/598) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([dennisse](https://github.com/dennisse))
 - add Ansible specific templates for issues [\#596](https://github.com/dev-sec/ansible-collection-hardening/pull/596) ([schurzi](https://github.com/schurzi))
 - use github templates for new issues [\#595](https://github.com/dev-sec/ansible-collection-hardening/pull/595) ([schurzi](https://github.com/schurzi))
 **Fixed bugs:**
 - os\_auth\_retries variable causes a comparison type error on pam tasks [\#593](https://github.com/dev-sec/ansible-collection-hardening/issues/593)
 - ssh\_hardening: Install selinux dependencies fails on Oracle Linux \(RHEL\) 9 [\#585](https://github.com/dev-sec/ansible-collection-hardening/issues/585)
 - OpenBSD does not set distributiuon\_major\_version [\#597](https://github.com/dev-sec/ansible-collection-hardening/pull/597) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([dennisse](https://github.com/dennisse))
 **Merged pull requests:**
 - Check for github action updates daily [\#609](https://github.com/dev-sec/ansible-collection-hardening/pull/609) ([jlosito](https://github.com/jlosito))
 - add verify-task to check if mysql is running and enabled [\#608](https://github.com/dev-sec/ansible-collection-hardening/pull/608) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Updates handlers for new ansible syntax and deprecated options for legacy commands [\#602](https://github.com/dev-sec/ansible-collection-hardening/pull/602) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([jsievertde](https://github.com/jsievertde))
 - add notice to sign-off work to contributor guideline [\#601](https://github.com/dev-sec/ansible-collection-hardening/pull/601) ([schurzi](https://github.com/schurzi))
 ## [8.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.3.0) (2022-10-27)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.2.0...8.3.0)
 **Implemented enhancements:**
 - add hardening of root user account\(s\) [\#579](https://github.com/dev-sec/ansible-collection-hardening/pull/579) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 **Fixed bugs:**
 - cast expected int types in pam tasks [\#594](https://github.com/dev-sec/ansible-collection-hardening/pull/594) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([dlouzan](https://github.com/dlouzan))
 - do not manage trusted user ca keys if none exist [\#580](https://github.com/dev-sec/ansible-collection-hardening/pull/580) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([hollow](https://github.com/hollow))
 **Closed issues:**
 - Trying to run the os\_hardening on Debian 11, but fails on privilege escalation [\#587](https://github.com/dev-sec/ansible-collection-hardening/issues/587)
 - auditd increasing logfiles [\#586](https://github.com/dev-sec/ansible-collection-hardening/issues/586)
 - Path to nginx.conf should be configurable in a variable  [\#577](https://github.com/dev-sec/ansible-collection-hardening/issues/577)
 **Merged pull requests:**
 - adopt all current suggestions from ansible-lint [\#592](https://github.com/dev-sec/ansible-collection-hardening/pull/592) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
 - Support more os [\#588](https://github.com/dev-sec/ansible-collection-hardening/pull/588) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - run tests only on pushes to master or to PRs [\#581](https://github.com/dev-sec/ansible-collection-hardening/pull/581) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 ## [8.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.2.0) (2022-09-08)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.1.0...8.2.0)
 **Implemented enhancements:**
 - Add nginx variables for config-path and owner/group [\#578](https://github.com/dev-sec/ansible-collection-hardening/pull/578) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([hagenbauer](https://github.com/hagenbauer))
 - add centos \>8 Support [\#573](https://github.com/dev-sec/ansible-collection-hardening/pull/573) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([sbaerlocher](https://github.com/sbaerlocher))
 - add always-tag to include so other tags can be used [\#569](https://github.com/dev-sec/ansible-collection-hardening/pull/569) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 **Closed issues:**
 - Bug using os\_hardening "tags" [\#567](https://github.com/dev-sec/ansible-collection-hardening/issues/567)
 ## [8.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.1.0) (2022-08-26)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.0.0...8.1.0)
 **Closed issues:**
 - dev-sec CI bot should not update CHANGELOG.md in fork repository [\#566](https://github.com/dev-sec/ansible-collection-hardening/issues/566)
 **Merged pull requests:**
 - update supported OS in meta and fix linting [\#572](https://github.com/dev-sec/ansible-collection-hardening/pull/572) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - fix misleading comment [\#571](https://github.com/dev-sec/ansible-collection-hardening/pull/571) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 - only run release actions on upstream-repo [\#568](https://github.com/dev-sec/ansible-collection-hardening/pull/568) ([rndmh3ro](https://github.com/rndmh3ro))
 ## [8.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.0.0) (2022-08-22)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.16.0...8.0.0)
 **Breaking changes:**
 - change default to allow SFTP [\#564](https://github.com/dev-sec/ansible-collection-hardening/pull/564) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
 **Implemented enhancements:**
 - add possibility to keep .netrc files in users homedir [\#563](https://github.com/dev-sec/ansible-collection-hardening/pull/563) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([PhilippFunk](https://github.com/PhilippFunk))
 - rework filesystem hardening [\#555](https://github.com/dev-sec/ansible-collection-hardening/pull/555) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([divialth](https://github.com/divialth))
 **Closed issues:**
 - Error in Task 'Create sshd\_config and set permissions to root/600' [\#565](https://github.com/dev-sec/ansible-collection-hardening/issues/565) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
 - \[ssh\_hardening\] Debian 11 - Ansible cannot transfer files [\#557](https://github.com/dev-sec/ansible-collection-hardening/issues/557)
 - Add the old SFTP-Reminder to the stable ssh\_hardening role for ansible [\#521](https://github.com/dev-sec/ansible-collection-hardening/issues/521)
 ## [7.16.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.16.0) (2022-08-16)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.15.1...7.16.0)
 **Implemented enhancements:**
 - revert debian 9 change, only one tls variable now [\#562](https://github.com/dev-sec/ansible-collection-hardening/pull/562) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - add posibility to run ssh\_hardening as unprivileged user [\#561](https://github.com/dev-sec/ansible-collection-hardening/pull/561) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
 - add basic support for ubuntu22.04 [\#554](https://github.com/dev-sec/ansible-collection-hardening/pull/554) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
 - Add full support for Debian 11 [\#538](https://github.com/dev-sec/ansible-collection-hardening/pull/538) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([addianto](https://github.com/addianto))
 **Fixed bugs:**
 - Replace default 2048 bits RSA keypair fails on Ubuntu 20.04 [\#459](https://github.com/dev-sec/ansible-collection-hardening/issues/459)
 **Closed issues:**
 - os-hardening: yum gpg-check fails if gpg-check already set [\#556](https://github.com/dev-sec/ansible-collection-hardening/issues/556)
 - Ubuntu 22.04 LTS [\#553](https://github.com/dev-sec/ansible-collection-hardening/issues/553)
 - Revert nginx ssl-protocol after deprecation of debian9 [\#528](https://github.com/dev-sec/ansible-collection-hardening/issues/528)
 - Support for Debian 11 [\#527](https://github.com/dev-sec/ansible-collection-hardening/issues/527)
 - Support baseline-control os-14 [\#507](https://github.com/dev-sec/ansible-collection-hardening/issues/507)
 ## [7.15.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.15.1) (2022-07-26)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.15.0...7.15.1)
 **Fixed bugs:**
 - Fix broken mode for /var/log/audit [\#552](https://github.com/dev-sec/ansible-collection-hardening/pull/552) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([hollow](https://github.com/hollow))
 **Merged pull requests:**
 - Only run hardening if /var/log/audit exists [\#550](https://github.com/dev-sec/ansible-collection-hardening/pull/550) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([mego22](https://github.com/mego22))
 ## [7.15.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.15.0) (2022-07-11)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.3...7.15.0)
 **Implemented enhancements:**
 - Harden mountpoints [\#531](https://github.com/dev-sec/ansible-collection-hardening/pull/531) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lbayerlein](https://github.com/lbayerlein))
 **Fixed bugs:**
 - os\_hardening gpg-check enabled fails on success [\#549](https://github.com/dev-sec/ansible-collection-hardening/issues/549) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
 - add VM tests for os\_hardening  [\#547](https://github.com/dev-sec/ansible-collection-hardening/pull/547) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
 - Linting [\#546](https://github.com/dev-sec/ansible-collection-hardening/pull/546) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 ## [7.14.3](https://github.com/dev-sec/ansible-collection-hardening/tree/7.14.3) (2022-06-29)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.2...7.14.3)
 **Closed issues:**
 - Version 7.14.2 not released to Ansible Galaxy [\#544](https://github.com/dev-sec/ansible-collection-hardening/issues/544)
 - os\_hardening role: os\_ignore\_users not described in the Readme's variable topic [\#542](https://github.com/dev-sec/ansible-collection-hardening/issues/542)
 - doc: incorrect description for ssh\_client\_alive\_count [\#540](https://github.com/dev-sec/ansible-collection-hardening/issues/540)
 - 'legacy' branch is mentioned in README, but apparently doesn't exist [\#539](https://github.com/dev-sec/ansible-collection-hardening/issues/539)
 - ansible\_role\_name is undefined [\#532](https://github.com/dev-sec/ansible-collection-hardening/issues/532)
 - Can't sudo anymore after hardening [\#518](https://github.com/dev-sec/ansible-collection-hardening/issues/518)
 - Any planned official support for RHEL/CentOS Stream 9? [\#517](https://github.com/dev-sec/ansible-collection-hardening/issues/517)
 **Merged pull requests:**
 - Improve documentation [\#541](https://github.com/dev-sec/ansible-collection-hardening/pull/541) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
 ## [7.14.2](https://github.com/dev-sec/ansible-collection-hardening/tree/7.14.2) (2022-02-28)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.1...7.14.2)
 **Fixed bugs:**
 - debian 9's nginx doesn't support tls1.3 [\#526](https://github.com/dev-sec/ansible-collection-hardening/pull/526) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Change permissions of the tmout.sh file [\#520](https://github.com/dev-sec/ansible-collection-hardening/pull/520) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([abejotaR](https://github.com/abejotaR))
 **Closed issues:**
 - No such file directory error triggered by the  kernel.unpriviliged\_userns\_clone configuration. [\#514](https://github.com/dev-sec/ansible-collection-hardening/issues/514)
 **Merged pull requests:**
 - delete obsolete release drafts [\#530](https://github.com/dev-sec/ansible-collection-hardening/pull/530) ([schurzi](https://github.com/schurzi))
 - add waivers to skip controls [\#529](https://github.com/dev-sec/ansible-collection-hardening/pull/529) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - remove centos8 tests [\#525](https://github.com/dev-sec/ansible-collection-hardening/pull/525) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 ## [7.14.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.14.1) (2022-02-18)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.0...7.14.1)
 **Fixed bugs:**
 - move sysctls to debian specific vars [\#524](https://github.com/dev-sec/ansible-collection-hardening/pull/524) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 **Closed issues:**
 - Error when using the ssh\_hardening role [\#519](https://github.com/dev-sec/ansible-collection-hardening/issues/519)
 ## [7.14.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.14.0) (2021-12-16)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.13.2...7.14.0)
 **Implemented enhancements:**
 - Add option to set timeout in seconds to logout users [\#516](https://github.com/dev-sec/ansible-collection-hardening/pull/516) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lbayerlein](https://github.com/lbayerlein))
 - add feature to disable coredump to limit task [\#511](https://github.com/dev-sec/ansible-collection-hardening/pull/511) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lbayerlein](https://github.com/lbayerlein))
 - change hidepid mount task state to mounted [\#510](https://github.com/dev-sec/ansible-collection-hardening/pull/510) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([alegrey91](https://github.com/alegrey91))
 - prettify nginx options [\#509](https://github.com/dev-sec/ansible-collection-hardening/pull/509) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
 - Update nginx\_add\_header README to match default [\#506](https://github.com/dev-sec/ansible-collection-hardening/pull/506) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([duffn](https://github.com/duffn))
 - Updated dh\_params to 4096 [\#501](https://github.com/dev-sec/ansible-collection-hardening/pull/501) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([ksaadDE](https://github.com/ksaadDE))
 **Fixed bugs:**
 - Duplication of sysctl default parameter fs.protected\_hardlinks and fs.protected\_symlinks [\#502](https://github.com/dev-sec/ansible-collection-hardening/issues/502)
 - Fix duplicate sysctl config in fs [\#505](https://github.com/dev-sec/ansible-collection-hardening/pull/505) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([tekicat](https://github.com/tekicat))
 **Merged pull requests:**
 - Feature coredump [\#513](https://github.com/dev-sec/ansible-collection-hardening/pull/513) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 ## [7.13.2](https://github.com/dev-sec/ansible-collection-hardening/tree/7.13.2) (2021-11-23)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.13.1...7.13.2)
 ## [7.13.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.13.1) (2021-11-23)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.13.0...7.13.1)
 **Closed issues:**
 - Unable to use 7.13.0 Release [\#503](https://github.com/dev-sec/ansible-collection-hardening/issues/503)
 ## [7.13.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.13.0) (2021-11-15)
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.12.0...7.13.0)
 **Implemented enhancements:**
@@ -15,7 +15,7 @@ In order to contribute code please:
 1. Fork the project on GitHub
 2. Clone the project
 3. Add changes (and tests)
-4. Commit and push
+4. Commit, sign off and push your changes
 5. Create a merge-request
 To have your code merged, see the expectations listed below.
@@ -28,6 +28,24 @@ Some great guidelines can be found [here](https://wiki.openstack.org/wiki/GitCom
 ## Expectations
 ## Sign off Your Work
 The Developer Certificate of Origin (DCO) is a lightweight way for contributors to certify that they wrote or otherwise have the right to submit the code they are contributing to the project.
 [Here is the full text of the DCO](http://developercertificate.org/).
 Contributors must sign-off that they adhere to these requirements by adding a `Signed-off-by` line to commit messages.
 ```text
 This is my commit message
 Signed-off-by: Random J Developer <[email protected]>
 ```
 Git even has a -s command line option to append this automatically to your commit message:
 ```text
 git commit -s -m 'This is my commit message'
 ```
 ### Don't reinvent the wheel
 This hardening project doesn't intend to reinvent the configuration stack for services. Aim to use official configuration projects first and provide hardening as a layer on top. The goal is remove the need for a user to configure all aspects of services and maintain security configuration. This way, the user can still configure a service using the interface provided by the official project.
@@ -1,6 +1,7 @@
 # Ansible Collection - devsec.hardening
 ![devsec.os_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening/badge.svg)
 ![devsec.os_hardening VM](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening%20VM/badge.svg)
 ![devsec.ssh_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.ssh_hardening/badge.svg)
 ![devsec.nginx_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.nginx_hardening/badge.svg)
 ![devsec.mysql_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.mysql_hardening/badge.svg)
@@ -10,10 +11,10 @@
 This collection provides battle tested hardening for:
 - Linux operating systems:
-  - CentOS 7/8
+  - CentOS 7
  - Rocky Linux 8
-  - Debian 9/10
+  - Debian 10/11
-  - Ubuntu 16.04/18.04/20.04
+  - Ubuntu 18.04/20.04/22.04
  - Amazon Linux (some roles supported)
  - Arch Linux (some roles supported)
  - Fedora (some roles supported)
@@ -26,14 +27,24 @@ This collection provides battle tested hardening for:
 The hardening is intended to be compliant with the Inspec DevSec Baselines:
- https://github.com/dev-sec/linux-baseline
+- <https://github.com/dev-sec/linux-baseline>
- https://github.com/dev-sec/mysql-baseline
+- <https://github.com/dev-sec/mysql-baseline>
- https://github.com/dev-sec/nginx-baseline
+- <https://github.com/dev-sec/nginx-baseline>
- https://github.com/dev-sec/ssh-baseline
+- <https://github.com/dev-sec/ssh-baseline>
-## Looking for the old ansible-os-hardening role?
+## Looking for the old roles?
-This role is now part of the hardening-collection. You can find the old role in the branch `legacy`.
+The roles are now part of the hardening-collection.
 We have kept the old releases of the `os-hardening` role in this repository, so you can find the them by exploring older tags.
 The last release of the standalone role was [6.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/6.2.0).
 The other roles are in separate archives repositories:
 - [apache_hardening](https://github.com/dev-sec/ansible-apache-hardening)
 - [mysql_hardening](https://github.com/dev-sec/ansible-mysql-hardening)
 - [nginx_hardening](https://github.com/dev-sec/ansible-nginx-hardening)
 - [ssh_hardening](https://github.com/dev-sec/ansible-ssh-hardening)
 - [windows_hardening](https://github.com/dev-sec/ansible-windows-hardening)
 ## Minimum required Ansible-version
@@ -75,8 +86,8 @@ See the [changelog](https://github.com/dev-sec/ansible-os-hardening/tree/master/
 Todos:
- Work on [apache_hardening](roles/apache_hardening/) and [windows_hardening](roles/windows_hardening/).
+- Work on [apache_hardening](roles/apache_hardening/) and [windows_hardening](roles/windows_hardening/)
- Add support for more operating systems,
+- Add support for more operating systems
 ## More information
@@ -94,6 +105,6 @@ General information:
 Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
-http://www.apache.org/licenses/LICENSE-2.0
+<http://www.apache.org/licenses/LICENSE-2.0>
 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 7.12.0
+version: 8.5.0
 readme: README.md
 authors:
  - dev-sec <[email protected]>
@@ -21,7 +21,7 @@ tags:
  - mysql_hardening
  - nginx_hardening
  - os_hardening
-  - ssh-hardening
+  - ssh_hardening
 dependencies:
  ansible.posix: '>=1.0.0'
  community.crypto: '>=1.0.0'
@@ -1,2 +1,2 @@
 ---
-requires_ansible: '>=2.9.10'
+requires_ansible: ">=2.9.10"
@@ -2,6 +2,8 @@
 - name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
  hosts: all
  become: true
  collections:
    - devsec.hardening
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
@@ -22,6 +24,13 @@
        - mysql_python_package_debian is not defined
        - ansible_distribution != "Ubuntu"
        - ansible_distribution_major_version|int < 20
    - name: Use Python 3 on Suse
      set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
        - ansible_os_family == 'Suse'
    - include_role:
        name: mysql_hardening
  vars:
@@ -11,8 +11,9 @@ platforms:
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
    cgroupns_mode: host
    pre_build_image: true
    environment:
      container: docker
@@ -25,6 +26,8 @@ platforms:
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
@@ -8,6 +8,26 @@
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Use Python 3 on Debian 11
      set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
        - ansible_distribution == 'Debian'
        - ansible_distribution_major_version|int >= 11
    - name: Use Python 3 on Suse
      set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
        - ansible_os_family == 'Suse'
    - name: Use Python 2 on Debian 10
      set_fact:
        ansible_python_interpreter: /usr/bin/python
      when:
        - ansible_distribution == 'Debian'
        - ansible_distribution_major_version|int == 10
    - name: Run the equivalent of "apt-get update && apt-get upgrade"
      apt:
        name: "*"
@@ -15,11 +35,9 @@
        update_cache: true
      when: ansible_os_family == 'Debian'
-    - name: install required tools on SuSE
+    - name: Install required python packages on Suse
-      zypper:
+      ansible.builtin.shell: zypper -n install python-xml python3-rpm python3-PyMySQL
-        name: "python-xml"
+      when: ansible_os_family == 'Suse'
        state: present
      when: ansible_facts.os_family == 'Suse'
    - name: create missing directory
      file:
@@ -34,6 +34,9 @@
        update_cache: true
      when: ansible_distribution == 'Debian'
    - name: include tests for the service
      include_tasks: verify_tasks/service.yml
    - name: download cinc-auditor
      get_url:
        url: https://omnitruck.cinc.sh/install.sh
@@ -0,0 +1,16 @@
 ---
 - name: Load variables from role to use the "mysql_daemon" variable
  ansible.builtin.include_role:
    name: devsec.hardening.mysql_hardening
    apply:
      tags:
        - never
 - name: Populate service facts
  ansible.builtin.service_facts:
 - name: Check if MySQL is running and enabled
  assert:
    that:
      - "ansible_facts.services[mysql_daemon + '.service'].state == 'running'"
      - "ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'"
@@ -10,14 +10,14 @@ platforms:
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
-    tmpfs:
+    cgroupns_mode: host
-      - /tmp
+    pre_build_image: true
-      - /run
+    environment:
-    capabilities:
+      container: docker
-      - SYS_ADMIN
+    security_opts:
-    tty: true
+      - apparmor=unconfined
    env:
      http_proxy: "${http_proxy}"
      https_proxy: "${https_proxy}"
@@ -25,6 +25,8 @@ platforms:
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
@@ -8,7 +8,7 @@
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: install required tools on SuSE
-      zypper:
+      community.general.zypper:
        name: "python-xml"
        state: present
      when: ansible_facts.os_family == 'Suse'
@@ -17,7 +17,7 @@
      package:
        name: "python3-apt"
        update_cache: true
-      ignore_errors: true
+      ignore_errors: true  # noqa ignore-errors
    - name: Set correct distribution Version for Amazon Linux
      set_fact:
@@ -16,7 +16,8 @@
        name: os_hardening
  vars:
    os_security_users_allow: change_user
-    os_security_kernel_enable_core_dump: true
+    os_security_kernel_enable_core_dump: false
    os_auditd_num_logs: 10
    os_security_suid_sgid_remove_from_unknown: true
    os_auth_pam_passwdqc_enable: false
    os_auth_lockout_time: 15
@@ -26,8 +27,12 @@
    os_security_suid_sgid_blacklist: ['/bin/umount']
    os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
    os_filesystem_whitelist: []
    os_ctrlaltdel_disabled: true
    os_yum_repo_file_whitelist: ['foo.repo']
    os_users_without_password_ageing: ['pw_no_ageing']
    os_auth_pw_warn_age: 7
    os_netrc_enabled: false
    os_ignore_users: ["shell_sys_acc"]
    os_ignore_home_folder_users: ["user_with_777_home"]
    sysctl_config:
      net.ipv4.ip_forward: 0
      net.ipv6.conf.all.forwarding: 0
@@ -10,14 +10,14 @@ platforms:
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
-    tmpfs:
+    cgroupns_mode: host
-      - /tmp
+    pre_build_image: true
-      - /run
+    environment:
-    capabilities:
+      container: docker
-      - SYS_ADMIN
+    security_opts:
-    tty: true
+      - apparmor=unconfined
    env:
      http_proxy: "${http_proxy}"
      https_proxy: "${https_proxy}"
@@ -25,6 +25,8 @@ platforms:
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
@@ -35,14 +35,14 @@
      when: ansible_facts.distribution == 'Fedora'
    - name: install required tools on Arch
-      pacman:
+      community.general.pacman:
        name:
          - awk
        state: present
        update_cache: true
      when: ansible_facts.os_family == 'Archlinux'
-    - name: install required tools on RHEL
+    - name: install required tools on RHEL  # noqa ignore-errors
      yum:
        name:
          - openssh-clients
@@ -56,5 +56,14 @@
      changed_when: false
    - name: include YUM prepare tasks
-      include: prepare_yum.yml
+      include_tasks: prepare_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'
    - name: include preparation tasks
      ansible.builtin.include_tasks:
        file: "{{ item }}"
      loop:
        - prepare_tasks/netrc.yml
        - prepare_tasks/pw_ageing.yml
        - prepare_tasks/sys_account_shell.yml
        - prepare_tasks/ignore_home_folders.yml
@@ -0,0 +1,9 @@
 ---
 - name: Create user whose home-folder should not be touched
  ansible.builtin.user:
    name: "user_with_777_home"
 - name: Change mode of home-folder for user to 777
  ansible.builtin.file:
    path: /home/user_with_777_home
    mode: "0777"
@@ -0,0 +1,9 @@
 ---
 - name: create '.netrc' in /root
  ansible.builtin.copy:
    dest: '/root/.netrc'
    mode: '0600'
    content: |
      machine localhost
      login root
      password ipsum
@@ -0,0 +1,9 @@
 - name: Create user those password ageing should not be changed
  user:
    name: "pw_no_ageing"
    password: "$6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1"
 - name: Create user those password ageing should be changed
  user:
    name: "pw_ageing"
    password: "$6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1"
@@ -0,0 +1,5 @@
 ---
 - name: Create system user with shell that should keep it
  user:
    name: "shell_sys_acc"
    shell: "/bin/bash"
@@ -1,6 +1,6 @@
 ---
 - name: create 'foo' repository
-  yum_repository:
+  ansible.builtin.yum_repository:
    name: foo
    description: mandatory description
    baseurl: file:///mandatory-url
@@ -8,7 +8,7 @@
    gpgcheck: false
 - name: create 'bar' repository
-  yum_repository:
+  ansible.builtin.yum_repository:
    name: bar
    description: mandatory description
    baseurl: file:///mandatory-url
@@ -37,12 +37,21 @@
        name: procps
      when: ansible_facts.os_family == 'Debian'
    - name: include verification tasks
      ansible.builtin.include_tasks:
        file: "{{ item }}"
      loop: 
        - verify_tasks/sys_account_shell.yml
        - verify_tasks/pw_ageing.yml
        - verify_tasks/netrc.yml
        - verify_tasks/ignore_home_folders.yml
    - name: include PAM tests
-      include: verify_pam.yml
+      include_tasks: verify_tasks/pam.yml
      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
    - name: include YUM tests
-      include: verify_yum.yml
+      include_tasks: verify_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'
    - name: download cinc-auditor
@@ -54,8 +63,8 @@
    - name: install cinc-auditor
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
-    - name: Execute cinc-auditor tests
+    - name: Execute cinc-auditor tests  # noqa ignore-errors
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit --waiver-file waivers.yaml https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -0,0 +1,10 @@
 ---
 - name: Get properties of user user_with_777_home's home-folder
  ansible.builtin.stat:
    path: /home/user_with_777_home
  register: stats
 - name: Check that the home-folder has mode 777
  ansible.builtin.assert:
    that:
      - stats.stat.mode == "0777"
@@ -0,0 +1,19 @@
 ---
 - name: test that .netrc in root homedir exists
  ansible.builtin.file:
    path: '/root/.netrc'
    state: file
  register: result_test_netrc
 - name: output result if .netrc for user root exists
  ansible.builtin.assert:
    that:
      - "result_test_netrc.state == 'file'"
    fail_msg: ".netrc in /root/ not present"
    success_msg: ".netrc exists in /root/"
 - name: delete '.netrc' in /root
  ansible.builtin.file:
    path: '/root/.netrc'
    state: absent
  when: result_test_netrc.state == 'file'
@@ -0,0 +1,32 @@
 ---
 - name: Get Password Expiry date for use pw_no_ageing
  ansible.builtin.shell: chage -l pw_no_ageing | grep "Password expires" | cut -d ":" -f 2
  changed_when: false
  register: expiry_date
 - name: Check that the expiry date of pw_no_ageing is "never"
  ansible.builtin.assert:
    that:
      - "expiry_date.stdout | trim == 'never'"
 - name: Get Password Expiry date for pw_ageing
  ansible.builtin.shell: chage -l pw_ageing | grep "Password expires" | cut -d ":" -f 2
  changed_when: false
  register: expiry_date
 - name: Check that the expiry date of pw_ageing is 60 days
  ansible.builtin.assert:
    # this uses the date from the expire_date variable and subtracts the current date.
    # it should be bigger that the password_expire_min of the user "pw_no_ageing"
    that:
      - "{{ ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_date_time.date | to_datetime('%Y-%m-%d')).days }} == 60"
 - name: Get Password Expiry warning days for pw_ageing
  ansible.builtin.shell: chage -l pw_ageing | grep "warning before password expires" | cut -d ":" -f 2
  changed_when: false
  register: expiry_warndays
 - name: Check that number of days of warning before password expires is 7 days
  ansible.builtin.assert:
    that:
      - "expiry_warndays.stdout | trim == '7'"
@@ -0,0 +1,8 @@
 - name: Read local linux user database
  getent:
    database: passwd
 - name: Check that shell_sys_acc's shell is still bash
  assert:
    that:
      - getent_passwd['shell_sys_acc'][5] == "/bin/bash"
@@ -0,0 +1,9 @@
 os-14:
  run: false
  justification: "ansible does not gather all fact-mounts (e.g. mounts with tmpfs) so we cannot change these. see https://github.com/ansible/ansible/pull/79787"
 os-15:
  run: false
  justification: "ansible does not gather all fact-mounts (e.g. mounts with tmpfs) so we cannot change these. see https://github.com/ansible/ansible/pull/79787"
 os-16:
  run: false
  justification: "ansible does not gather all fact-mounts (e.g. mounts with tmpfs) so we cannot change these. see https://github.com/ansible/ansible/pull/79787"
@@ -0,0 +1,22 @@
 *******
 Docker driver installation guide
 *******
 Requirements
 ============
 * Docker Engine
 Install
 =======
 Please refer to the `Virtual environment`_ documentation for installation best
 practices. If not using a virtual environment, please consider passing the
 widely recommended `'--user' flag`_ when invoking ``pip``.
 .. _Virtual environment: https://virtualenv.pypa.io/en/latest/
 .. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
 .. code-block:: bash
    $ python3 -m pip install 'molecule[docker]'
@@ -0,0 +1,23 @@
 ---
 - name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  collections:
    - devsec.hardening
  tasks:
    - name: override for arch
      set_fact: 
        os_mnt_boot_enabled: false
      when: ansible_facts.os_family == 'Archlinux'
    - include_role:
        name: os_hardening
  vars:
    os_auth_pam_passwdqc_enable: false
    os_auth_lockout_time: 15
    os_yum_repo_file_whitelist: ['foo.repo']
    os_mnt_boot_enabled: true
    os_mnt_boot_src: "/dev/vda1"
@@ -0,0 +1,59 @@
 ---
 dependency:
  name: galaxy
  options:
    role-file: molecule/os_hardening/requirements.yml
 driver:
  name: vagrant
  provider:
    name: libvirt
 platforms:
  - name: instance
    box: "generic/${MOLECULE_DISTRO}"
    memory: 1024
    cpus: 2
 provisioner:
  name: ansible
  options:
    diff: true
  env:
    ANSIBLE_PIPELINING: "True"
  config_options:
    defaults:
      interpreter_python: auto_silent
      callback_whitelist: profile_tasks, timer, yaml
 verifier:
  name: ansible
  env:
    ANSIBLE_PIPELINING: "True"
 scenario:
  create_sequence:
    - dependency
    - create
    - prepare
  check_sequence:
    - dependency
    - destroy
    - create
    - prepare
    - converge
    - check
    - destroy
  converge_sequence:
    - dependency
    - create
    - prepare
    - converge
  destroy_sequence:
    - destroy
  test_sequence:
    - dependency
    - destroy
    - syntax
    - create
    - prepare
    - converge
    - idempotence
    - verify
    - destroy
@@ -0,0 +1,58 @@
 ---
 - name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
  hosts: all
  become: true
  collections:
    - devsec.hardening
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
      set_fact:
        ansible_python_interpreter: "/usr/bin/python3"
      when: ansible_facts.distribution == 'Fedora'
    - name: Run the equivalent of "apt-get update && apt-get upgrade"
      apt:
        update_cache: true
      when: ansible_os_family == 'Debian'
    - name: install required tools on SuSE
      # cannot use zypper module, since it depends on python-xml
      shell: "zypper -n install python-xml"
      when: ansible_facts.os_family == 'Suse'
    - name: install required tools on fedora
      dnf:
        name:
          - python
          - findutils
          - procps-ng
      when: ansible_facts.distribution == 'Fedora'
    - name: install required tools on Arch
      community.general.pacman:
        name:
          - awk
        state: present
        update_cache: true
      when: ansible_facts.os_family == 'Archlinux'
    - name: install required tools on RHEL  # noqa ignore-errors
      yum:
        name:
          - openssh-clients
          - openssh
        state: present
        update_cache: true
      ignore_errors: true
    - name: create recursing symlink to test minimize access
      shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
      changed_when: false
    - name: include YUM prepare tasks
      include_tasks: prepare_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'
@@ -0,0 +1,16 @@
 ---
 - name: create 'foo' repository
  ansible.builtin.yum_repository:
    name: foo
    description: mandatory description
    baseurl: file:///mandatory-url
    enabled: false
    gpgcheck: false
 - name: create 'bar' repository
  ansible.builtin.yum_repository:
    name: bar
    description: mandatory description
    baseurl: file:///mandatory-url
    enabled: false
    gpgcheck: false
@@ -0,0 +1,3 @@
 ---
 roles:
  - geerlingguy.git
@@ -0,0 +1,70 @@
 ---
 - name: Verify
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  roles:
    - geerlingguy.git
  tasks:
    - name: install fake SuSE-release for cinc compatibility
      copy:
        content: |
          openSUSE Faked Enterprise 2020 (x86_64)
          VERSION = 2020
          CODENAME = Faked Feature
        dest: /etc/SuSE-release
        owner: root
        group: root
        mode: '0444'
      when: ansible_facts.os_family == 'Suse'
    - name: install git for SuSE since geerlinguy.git does not support it
      zypper:
        name: git
        state: present
      when: ansible_facts.os_family == 'Suse'
    - name: Run the equivalent of "apt-get update" as a separate step
      apt:
        update_cache: true
      when: ansible_facts.os_family == 'Debian'
    - name: install required tools on debian
      apt:
        name: procps
      when: ansible_facts.os_family == 'Debian'
    - name: include PAM tests
      include_tasks: verify_tasks/pam.yml
      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
    - name: include YUM tests
      include_tasks: verify_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'
    - name: download cinc-auditor
      get_url:
        url: https://omnitruck.cinc.sh/install.sh
        dest: /tmp/install.sh
        mode: '0775'
    - name: install cinc-auditor
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
    - name: Execute cinc-auditor tests  # noqa ignore-errors
      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
      register: test_results
      changed_when: false
      ignore_errors: true
    - name: Display details about the cinc-auditor results
      debug:
        msg: "{{ test_results.stdout_lines }}"
    - name: Fail when tests fail
      fail:
        msg: "Inspec failed to validate"
      when: test_results.rc != 0
@@ -0,0 +1,59 @@
 ---
 - name: download pam-tester
  get_url:
    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
    dest: /bin/pam-tester
    mode: 0555
 - name: set password for test
  set_fact:
    test_pw: "myTest!pw"
 - name: set locale for test
  set_fact:
    locale: "en_US.UTF-8"
  when:
    - ansible_facts.os_family == 'RedHat'
    - ansible_facts.distribution_major_version < '8'
 - name: create testuser
  user:
    name: testuser
    password: "{{ test_pw | password_hash('sha512') }}"
 - name: check successfull login with correct password
  shell:
    cmd: "pam-tester --user testuser --password {{ test_pw }}"
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"
 - name: check unsuccessfull login with incorrect password
  shell:
    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"
  with_sequence: count=6
 - name: check unsuccessfull login, with correct password (lockout)
  shell:
    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"
 - name: wait for account to unlock
  pause:
    seconds: 20
 - name: check successfull login
  shell:
    cmd: "pam-tester --user testuser --password {{ test_pw }}"
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"
@@ -0,0 +1,8 @@
 ---
 - name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
  command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
  changed_when: false
 - name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
  command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
  changed_when: false
@@ -1,7 +1,6 @@
 ---
 - name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
@@ -11,3 +10,5 @@
  tasks:
    - include_role:
        name: ssh_hardening
  vars:
    sftp_enabled: false
@@ -10,14 +10,14 @@ platforms:
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
-    tmpfs:
+    cgroupns_mode: host
-      - /tmp
+    pre_build_image: true
-      - /run
+    environment:
-    capabilities:
+      container: docker
-      - SYS_ADMIN
+    security_opts:
-    tty: true
+      - apparmor=unconfined
    env:
      http_proxy: "${http_proxy}"
      https_proxy: "${https_proxy}"
@@ -25,10 +25,18 @@ platforms:
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
      callback_whitelist: profile_tasks, timer, yaml
  inventory:
    host_vars:
      # https://molecule.readthedocs.io/en/latest/examples.html#docker-with-non-privileged-user
      # setting for the platform instance named 'instance'
      instance:
        ansible_user: ansible
 verifier:
  name: ansible
@@ -12,7 +12,7 @@
        ansible_python_interpreter: /usr/bin/python3
      when: ansible_facts.distribution == 'Fedora'
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
      yum:
        name:
          - openssh-clients
@@ -22,7 +22,7 @@
        update_cache: true
      ignore_errors: true
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
      dnf:
        name:
          - openssh-clients
@@ -32,7 +32,7 @@
        update_cache: true
      ignore_errors: true
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
      apt:
        name:
          - openssh-client
@@ -66,7 +66,7 @@
        path: "/var/run/sshd"
        state: directory
-    - name: create ssh host keys
+    - name: create ssh host keys  # noqa ignore-errors
      command: "ssh-keygen -A"
      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
            ansible_facts.distribution == "Fedora" or
@@ -48,7 +48,6 @@
    ssh_print_last_log: true
    ssh_banner: true
    ssh_server_password_login: true
    sftp_enabled: true
    sftp_chroot: true
    # ssh_server_enabled: false
    ssh_server_ports:
@@ -10,14 +10,14 @@ platforms:
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
-    tmpfs:
+    cgroupns_mode: host
-      - /tmp
+    pre_build_image: true
-      - /run
+    environment:
-    capabilities:
+      container: docker
-      - SYS_ADMIN
+    security_opts:
-    tty: true
+      - apparmor=unconfined
    env:
      http_proxy: "${http_proxy}"
      https_proxy: "${https_proxy}"
@@ -25,6 +25,8 @@ platforms:
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
@@ -12,7 +12,7 @@
        ansible_python_interpreter: /usr/bin/python3
      when: ansible_facts.distribution == 'Fedora'
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
      yum:
        name:
          - openssh-clients
@@ -22,7 +22,7 @@
        update_cache: true
      ignore_errors: true
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
      dnf:
        name:
          - openssh-clients
@@ -32,7 +32,7 @@
        update_cache: true
      ignore_errors: true
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
      apt:
        name:
          - openssh-client
@@ -66,7 +66,7 @@
        path: "/var/run/sshd"
        state: directory
-    - name: create ssh host keys
+    - name: create ssh host keys  # noqa ignore-errors
      command: "ssh-keygen -A"
      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
            ansible_facts.distribution == "Fedora" or
@@ -16,6 +16,7 @@ It configures:
 - Ansible 2.9.0
 - An existing MySQL installation
 - python-jmespath on the ansible host
 ### Example playbook
@@ -7,9 +7,9 @@ mysql_daemon_enabled: true
 mysql_hardening_restart_mysql: true
 # general configuration
-mysql_hardening_mysql_hardening_conf_file: '{{mysql_hardening_mysql_confd_dir}}/hardening.cnf'
+mysql_hardening_mysql_hardening_conf_file: "{{ mysql_hardening_mysql_confd_dir }}/hardening.cnf"
 # You have to change this to your own strong enough mysql root password
-mysql_root_password: '-----====>SetR00tPa$$wordH3r3!!!<====-----'
+mysql_root_password: "-----====>SetR00tPa$$wordH3r3!!!<====-----"
 # There .my.cnf with mysql root credentials will be installed
 mysql_user_home: "{{ ansible_env.HOME }}"
@@ -48,6 +48,6 @@ mysql_hardening_options:
  automatic-sp-privileges: 0
  # @see https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option-mysqld-secure-file-priv
-  secure-file-priv: '/tmp'
+  secure-file-priv: /tmp
  # @see https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_user
-  user: '{{mysql_hardening_user}}'
+  user: "{{ mysql_hardening_user }}"
@@ -1,7 +1,6 @@
 ---
 - name: Restart mysql
-  service:
+  ansible.builtin.service:
-    name: '{{ mysql_daemon }}'
+    name: "{{ mysql_daemon }}"
    state: restarted
  when: mysql_hardening_restart_mysql | bool
@@ -1,22 +1,24 @@
 ---
 galaxy_info:
-  author: "Sebastian Gumprich"
+  author: Sebastian Gumprich
-  description: 'This Ansible playbook provides security configuration for mysql.'
+  description: This Ansible playbook provides security configuration for mysql.
  company: Hardening Framework Team
  license: Apache License 2.0
-  min_ansible_version: '2.9.10'
+  min_ansible_version: 2.9.10
  platforms:
    - name: EL
      versions:
-        - 6
+        - "7"
-        - 7
+        - "8"
    - name: Ubuntu
      versions:
        - xenial
        - bionic
        - focal
        - jammy
    - name: Debian
      versions:
-        - jessie
+        - bullseye
        - buster
    - name: Amazon
    - name: Fedora
  galaxy_tags:
@@ -1,64 +1,64 @@
 ---
 - name: Protect my.cnf
-  file:
+  ansible.builtin.file:
-    path: '{{ mysql_hardening_mysql_conf_file }}'
+    path: "{{ mysql_hardening_mysql_conf_file }}"
-    mode: '0640'
+    mode: "0640"
-    owner: '{{ mysql_cnf_owner }}'
+    owner: "{{ mysql_cnf_owner }}"
-    group: '{{ mysql_cnf_group }}'
+    group: "{{ mysql_cnf_group }}"
    follow: true
    state: file
 - name: Ensure permissions on mysql-datadir are correct
-  file:
+  ansible.builtin.file:
-    path: '{{ item }}'
+    path: "{{ item }}"
    state: directory
-    owner: '{{ mysql_hardening_user }}'
+    owner: "{{ mysql_hardening_user }}"
-    group: '{{ mysql_hardening_user }}'
+    group: "{{ mysql_hardening_user }}"
-    mode: '0750'
+    mode: "0750"
  when: item is defined and item != ""
  loop:
-    - '{{ mysql_settings.settings.datadir }}'
+    - "{{ mysql_settings.settings.datadir }}"
    - '{{ mysql_datadir | default("") }}'
 - name: Ensure permissions on mysql-logfile are correct
-  file:
+  ansible.builtin.file:
-    path: '{{ item }}'
+    path: "{{ item }}"
    state: file
-    owner: '{{ mysql_hardening_user }}'
+    owner: "{{ mysql_hardening_user }}"
-    group: '{{ mysql_hardening_group }}'
+    group: "{{ mysql_hardening_group }}"
-    mode: '0640'
+    mode: "0640"
  when: item is defined and item != ""
  loop:
-    - '{{ mysql_settings.settings.log_error }}'
+    - "{{ mysql_settings.settings.log_error }}"
    - '{{ mysql_hardening_log_file | default("") }}'
 - name: Check mysql configuration-directory exists and has right permissions
-  file:
+  ansible.builtin.file:
-    path: '{{ mysql_hardening_mysql_confd_dir }}'
+    path: "{{ mysql_hardening_mysql_confd_dir }}"
    state: directory
-    owner: '{{ mysql_hardening_user }}'
+    owner: "{{ mysql_hardening_user }}"
-    group: '{{ mysql_hardening_group }}'
+    group: "{{ mysql_hardening_group }}"
-    mode: '0750'
+    mode: "0750"
 - name: Check include-dir directive is present in my.cnf
-  lineinfile:
+  ansible.builtin.lineinfile:
-    dest: '{{ mysql_hardening_mysql_conf_file }}'
+    dest: "{{ mysql_hardening_mysql_conf_file }}"
-    line: '!includedir {{ mysql_hardening_mysql_confd_dir }}'
+    line: "!includedir {{ mysql_hardening_mysql_confd_dir }}"
-    insertafter: 'EOF'
+    insertafter: EOF
    state: present
    backup: true
  notify: Restart mysql
 - name: Apply hardening configuration
-  template:
+  ansible.builtin.template:
-    src: 'hardening.cnf.j2'
+    src: hardening.cnf.j2
-    dest: '{{ mysql_hardening_mysql_hardening_conf_file }}'
+    dest: "{{ mysql_hardening_mysql_hardening_conf_file }}"
-    owner: '{{ mysql_cnf_owner }}'
+    owner: "{{ mysql_cnf_owner }}"
-    group: '{{ mysql_cnf_group }}'
+    group: "{{ mysql_cnf_group }}"
-    mode: '0640'
+    mode: "0640"
  notify: Restart mysql
 - name: Enable mysql
-  service:
+  ansible.builtin.service:
-    name: '{{ mysql_daemon }}'
+    name: "{{ mysql_daemon }}"
-    enabled: '{{ mysql_daemon_enabled }}'
+    enabled: "{{ mysql_daemon_enabled }}"
@@ -1,14 +1,14 @@
 ---
 - name: Fetch OS dependent variables
-  include_vars:
+  ansible.builtin.include_vars:
-    file: '{{ item }}'
+    file: "{{ item }}"
-    name: 'os_vars'
+    name: os_vars
  with_first_found:
    - files:
-        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - "{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml"
-        - '{{ ansible_facts.distribution }}.yml'
+        - "{{ ansible_facts.distribution }}.yml"
-        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - "{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml"
-        - '{{ ansible_facts.os_family }}.yml'
+        - "{{ ansible_facts.os_family }}.yml"
      skip: true
  tags: always
@@ -16,16 +16,16 @@
 # by default the lookup functions finds all varnames containing the string, therefore
 # we add ^ and $ to denote start and end of string, so this returns only exact maches.
 - name: Set OS dependent variables, if not already defined by user # noqa var-naming
-  set_fact:
+  ansible.builtin.set_fact:
-    '{{ item.key }}': '{{ item.value }}'
+    "{{ item.key }}": "{{ item.value }}"
-  when: "not lookup('varnames', '^' + item.key + '$')"
+  when: not lookup('varnames', '^' + item.key + '$')
-  with_dict: '{{ os_vars }}'
+  with_dict: "{{ os_vars }}"
  tags: always
 - name: Check that the variable mysql_distribution is set correctly
  ansible.builtin.assert:
    that: mysql_distribution == 'mysql' or mysql_distribution == 'mariadb'
-    fail_msg: 'mysql_distribution must be set to either mysql or mariadb!'
+    fail_msg: mysql_distribution must be set to either mysql or mariadb!
  when: mysql_distribution is defined
 - name: Gather package facts to check for mysql/mariadb version
@@ -34,7 +34,7 @@
  when: not mysql_distribution is defined
 - name: Check if MySQL or MariaDB is used
-  set_fact:
+  ansible.builtin.set_fact:
    mysql_distribution: "{{ ansible_facts.packages['mysql-server'] is defined | ternary('mysql', 'mariadb') }}"
  when: not mysql_distribution is defined
@@ -53,18 +53,20 @@
 # see https://stackoverflow.com/a/59451077/2953919 for the
 # dict2items and vice versa magic
 - name: Drop the secure-auth parameter on MySQL >=8.0.3 (not mariadb)
-  set_fact:
+  ansible.builtin.set_fact:
    mysql_hardening_options: "{{ mysql_hardening_options | dict2items | rejectattr('key', 'search', 'secure-auth') | list | items2dict }}"
  when:
    - mysql_version.version.full is version('8.0.3', '>=')
    - mysql_distribution == "mysql"
- include: configure.yml
+- name: Include tasks for configuration
  ansible.builtin.import_tasks: configure.yml
  when: mysql_hardening_enabled | bool
  tags:
    - mysql_hardening
- include: mysql_secure_installation.yml
+- name: Include tasks to secure mysql installation
  ansible.builtin.import_tasks: mysql_secure_installation.yml
  when: mysql_hardening_enabled | bool
  tags:
    - mysql_hardening
@@ -1,71 +1,73 @@
 ---
 - name: Fail the role if the mysql root password was not set
-  fail:
+  ansible.builtin.fail:
-    msg: 'ERROR - you have to change default mysql_root_password'
+    msg: ERROR - you have to change default mysql_root_password
  when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'
- name: ensure that the root password is present
+- name: Ensure that the root password is present
  community.mysql.mysql_user:
-    name: 'root'
+    name: root
    host_all: true
-    password: '{{ mysql_root_password | mandatory }}'
+    password: "{{ mysql_root_password | mandatory }}"
    state: present
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
 - name: Install .my.cnf with credentials
-  template:
+  ansible.builtin.template:
-    src: 'my.cnf.j2'
+    src: my.cnf.j2
-    dest: '{{ mysql_user_home }}/.my.cnf'
+    dest: "{{ mysql_user_home }}/.my.cnf"
-    mode: '0400'
+    mode: "0400"
  tags: my_cnf
- name: ensure that the test database is absent
+- name: Ensure that the test database is absent
  community.mysql.mysql_db:
    name: test
    state: absent
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_test_database
- name: ensure that anonymous users are absent
+- name: Ensure that anonymous users are absent
  community.mysql.mysql_user:
-    name: ''
+    name: ""
    state: absent
    host_all: true
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_anonymous_users
- name: ensure that root can only login from localhost
+- name: Ensure that root can only login from localhost
  community.mysql.mysql_query:
-    query:
+    query: >
-      - DELETE
+      DELETE
      FROM mysql.user
      WHERE USER='root'
        AND HOST NOT IN ('localhost',
                         '127.0.0.1',
-                          '::1')
+                         '::1');
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_remote_root
- name: get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
+- name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
  community.mysql.mysql_query:
-    query:
+    query: >
-      - SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
+      SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
      FROM mysql.user
      WHERE (length(authentication_string)=0
             OR authentication_string="")
        AND USER NOT IN ('mysql.sys',
                         'mysqlxsys',
                         'mariadb.sys');
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_users_wo_passwords_or_auth_string
-  when:
+  when: >
-    - (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '>=')) or
+    (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '>=')) or
-      (mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '>='))
+    (mysql_distribution == "mariadb" and mysql_version.version.full
    is version('10.4.0', '>='))
- name: get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
+- name: Get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
  community.mysql.mysql_query:
-    query:
+    query: >
-      - SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
+      SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
      FROM mysql.user
      WHERE (length(password)=0
             OR password="")
@@ -76,28 +78,29 @@
                         'mariadb.sys');
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_users_wo_passwords
-  when:
+  when: >
-    - (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '<')) or
+    (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '<')) or
-      (mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '<'))
+    (mysql_distribution == "mariadb" and mysql_version.version.full is
    version('10.4.0', '<'))
- name: create a fact for users without password or authentication_string
+- name: Create a fact for users without password or authentication_string
-  set_fact:
+  ansible.builtin.set_fact:
    users_wo_auth: "{{ mysql_users_wo_passwords_or_auth_string.query_result.0.0 | community.general.json_query('users') }}"
  when:
    - mysql_users_wo_passwords_or_auth_string.query_result is defined
    - mysql_users_wo_passwords_or_auth_string.query_result != "" # noqa empty-string-compare
- name: create a fact for users without password
+- name: Create a fact for users without password
-  set_fact:
+  ansible.builtin.set_fact:
    users_wo_auth: "{{ mysql_users_wo_passwords.query_result.0.0 | community.general.json_query('users') }}"
  when:
    - mysql_users_wo_passwords.query_result is defined
    - mysql_users_wo_passwords.query_result != "" # noqa empty-string-compare
- name: ensure that there are no users without password or authentication_string
+- name: Ensure that there are no users without password or authentication_string
  community.mysql.mysql_query:
    query:
-      - "DROP USER {{ users_wo_auth }}"
+      - DROP USER {{ users_wo_auth }}
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when:
    - users_wo_auth is defined
@@ -1,10 +1,10 @@
 ---
-mysql_daemon: mysql
+mysql_daemon: mariadb
-mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
+mysql_hardening_mysql_conf_file: /etc/mysql/my.cnf
-mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
+mysql_hardening_mysql_confd_dir: /etc/mysql/conf.d
-mysql_hardening_group: 'adm'
+mysql_hardening_group: adm
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
+mysql_cnf_owner: root # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
+mysql_cnf_group: mysql # owner of /etc/mysql/*.cnf files
@@ -1,4 +1,4 @@
 ---
 mysql_daemon: mysqld
-mysql_hardening_mysql_conf_file: '/etc/my.cnf'
+mysql_hardening_mysql_conf_file: /etc/my.cnf
-mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
+mysql_hardening_mysql_confd_dir: /etc/my.cnf.d
@@ -1,10 +1,10 @@
 ---
 mysql_daemon: mysql-server
-mysql_hardening_mysql_conf_file: '/usr/local/etc/mysql/my.cnf'
+mysql_hardening_mysql_conf_file: /usr/local/etc/mysql/my.cnf
-mysql_hardening_mysql_confd_dir: '/usr/local/etc/mysql/conf.d'
+mysql_hardening_mysql_confd_dir: /usr/local/etc/mysql/conf.d
-mysql_hardening_group: 'mysql'
+mysql_hardening_group: mysql
-mysql_cnf_owner: 'root'  # owner of /usr/local/etc/mysql/*.cnf files
+mysql_cnf_owner: root # owner of /usr/local/etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /usr/local/etc/mysql/*.cnf files
+mysql_cnf_group: mysql # owner of /usr/local/etc/mysql/*.cnf files
@@ -1,7 +1,7 @@
 ---
 mysql_daemon: mysqld
-mysql_hardening_mysql_conf_file: '/etc/my.cnf'
+mysql_hardening_mysql_conf_file: /etc/my.cnf
-mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
+mysql_hardening_mysql_confd_dir: /etc/my.cnf.d
-mysql_hardening_group: 'adm'
+mysql_hardening_group: adm
@@ -0,0 +1,9 @@
 ---
 mysql_daemon: mariadb
 mysql_hardening_mysql_conf_file: /etc/my.cnf
 mysql_hardening_mysql_confd_dir: /etc/my.cnf.d
 mysql_cnf_owner: root # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: mysql # owner of /etc/mysql/*.cnf files
 mysql_hardening_group: mysql
@@ -1,9 +0,0 @@
 ---
 mysql_daemon: mariadb
 mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
 mysql_hardening_group: 'mysql'
@@ -1,9 +0,0 @@
 ---
 mysql_daemon: mariadb
 mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
 mysql_hardening_group: 'mysql'
@@ -1,9 +0,0 @@
 ---
 mysql_daemon: mariadb
 mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
 mysql_hardening_group: 'mysql'
@@ -0,0 +1,10 @@
 ---
 mysql_daemon: mariadb
 mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
 mysql_cnf_owner: 'root'  # owner of /etc/my.cnf.d/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/my.cnf.d/*.cnf files
 mysql_hardening_group: 'mysql'
 login_unix_socket: '/run/mysql/mysql.sock'
@@ -0,0 +1,10 @@
 ---
 mysql_daemon: mysql
 mysql_hardening_mysql_conf_file: /etc/mysql/my.cnf
 mysql_hardening_mysql_confd_dir: /etc/mysql/conf.d
 mysql_cnf_owner: root # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: mysql # owner of /etc/mysql/*.cnf files
 mysql_hardening_group: adm
@@ -1,10 +0,0 @@
 ---
 mysql_daemon: mysql
 mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
 mysql_hardening_group: 'adm'
@@ -1,10 +0,0 @@
 ---
 mysql_daemon: mysql
 mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
 mysql_hardening_group: 'adm'
@@ -1,10 +0,0 @@
 ---
 mysql_daemon: mysql
 mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
 mysql_hardening_group: 'adm'
@@ -1,3 +1,2 @@
 ---
-
+mysql_hardening_user: mysql # owner of data
 mysql_hardening_user: 'mysql'  # owner of data
@@ -61,7 +61,7 @@ It works with the following nginx-roles, including, but not limited to:
  - Default: `default 5`
  - Description: Sets the shared memory zone and the maximum allowed number of connections for a given key value.
 - [nginx_add_header][]
-  - Default: `[ "X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"" ]`
+  - Default: `[ "X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"", Content-Security-Policy \"script-src 'self'; object-src 'self'\" ]`
  - Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307.
 - [nginx_ssl_protocols][]
  - Default: `TLSv1.2`
@@ -75,6 +75,18 @@ It works with the following nginx-roles, including, but not limited to:
 - [nginx_dh_size][]
  - Default: `2048`
  - Description: Specifies the length of DH parameters for EDH ciphers.
 - [nginx_configuration_dir][]
  - default: "/etc/nginx"
  - Description: The main location for all nginx configuration files
 - [nginx_configuration_hardening_dir][]
  - default: "/etc/nginx"
  - Description: The location for the nginx hardening configuration file (Could be different e.g. when used in jails)
 - [nginx_owner_user][]
  - default: "root"
  - Description: The owner user of the nginx configuration files
 - [nginx_owner_group][]
  - default: "root"
  - Description: The owner group of the nginx configuration files
 ## Example Playbook
@@ -1,29 +1,34 @@
 ---
-nginx_client_body_buffer_size: '1k'
+nginx_client_body_buffer_size: 1k
 nginx_remove_default_site: true
-nginx_client_max_body_size: '1k'
+nginx_client_max_body_size: 1k
-nginx_keepalive_timeout: '5 5'
+nginx_keepalive_timeout: 5 5
-nginx_server_tokens: 'off'
+nginx_server_tokens: "off"
-nginx_client_header_buffer_size: "1k"
+nginx_client_header_buffer_size: 1k
-nginx_large_client_header_buffers: "2 1k"
+nginx_large_client_header_buffers: 2 1k
 nginx_client_body_timeout: "10"
 nginx_client_header_timeout: "10"
 nginx_send_timeout: "10"
-nginx_limit_conn_zone: "$binary_remote_addr zone=default:10m"
+nginx_limit_conn_zone: $binary_remote_addr zone=default:10m
-nginx_limit_conn: "default 5"
+nginx_limit_conn: default 5
-nginx_add_header: [
+nginx_configuration_dir: /etc/nginx
-# vvoid clickjacking
+nginx_configuration_hardening_dir: /etc/nginx
-"X-Frame-Options SAMEORIGIN",
+nginx_owner_user: root
 nginx_owner_group: root
 nginx_add_header:
  # avoid clickjacking
  - X-Frame-Options SAMEORIGIN
  # disable content-type sniffing
-"X-Content-Type-Options nosniff",
+  - X-Content-Type-Options nosniff
  # XSS filter
-"X-XSS-Protection \"1; mode=block\"",
+  - X-XSS-Protection "1; mode=block"
-"Strict-Transport-Security max-age=15768000",
+  - Strict-Transport-Security max-age=15768000
-"Content-Security-Policy \"script-src 'self'; object-src 'self'\"" ]
+  - Content-Security-Policy "script-src 'self'; object-src 'self'"
 nginx_set_cookie_flag: "* HttpOnly secure"
 nginx_ssl_prefer_server_ciphers: "on"
-nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
+nginx_ssl_protocols: TLSv1.2 TLSv1.3
-nginx_ssl_ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
+# yamllint disable-line rule:line-length
 nginx_ssl_ciphers: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
 nginx_ssl_session_tickets: "off"
-nginx_dh_size: "2048"
+nginx_dh_size: "4096"
@@ -1,5 +1,5 @@
 ---
 - name: Restart nginx
-  service:
+  ansible.builtin.service:
-    name: "nginx"
+    name: nginx
    state: restarted
@@ -1,23 +1,24 @@
 ---
 galaxy_info:
-  author: "Sebastian Gumprich"
+  author: Sebastian Gumprich
-  description: 'This Ansible role provides secure nginx configurations. http://dev-sec.io/'
+  description: This Ansible role provides secure nginx configurations. http://dev-sec.io/
  company: Hardening Framework Team
  license: Apache License 2.0
-  min_ansible_version: '2.9.10'
+  min_ansible_version: 2.9.10
  platforms:
    - name: EL
      versions:
-        - 6
+        - "7"
-        - 7
+        - "8"
    - name: Ubuntu
      versions:
        - xenial
        - bionic
        - focal
        - jammy
    - name: Debian
      versions:
        - stretch
        - buster
        - bullseye
  galaxy_tags:
    - system
    - security
@@ -1,94 +1,94 @@
 ---
 - name: Create additional configuration
-  template:
+  ansible.builtin.template:
-    src: "hardening.conf.j2"
+    src: hardening.conf.j2
-    dest: "/etc/nginx/conf.d/90.hardening.conf"
+    dest: "{{ nginx_configuration_dir }}/conf.d/90.hardening.conf"
-    mode: '0600'
+    mode: "0600"
-    owner: "root"
+    owner: "{{ nginx_owner_user }}"
-    group: "root"
+    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Change configuration in main nginx.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
-    regexp: '^\s*server_tokens'
+    regexp: ^\s*server_tokens
    line: "    server_tokens {{ nginx_server_tokens }};"
-    insertafter: "http {"
+    insertafter: http {
-    mode: '0640'
+    mode: "0640"
-    owner: "root"
+    owner: "{{ nginx_owner_user }}"
-    group: "root"
+    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Change ssl_protocols in main nginx.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
-    regexp: '^\s*ssl_protocols'
+    regexp: ^\s*ssl_protocols
    line: "    ssl_protocols {{ nginx_ssl_protocols }};"
-    insertafter: "http {"
+    insertafter: http {
-    mode: '0640'
+    mode: "0640"
-    owner: "root"
+    owner: "{{ nginx_owner_user }}"
-    group: "root"
+    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Change ssl_prefer_server_ciphers in main nginx.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
-    regexp: '^\s*ssl_prefer_server_ciphers'
+    regexp: ^\s*ssl_prefer_server_ciphers
    line: "    ssl_prefer_server_ciphers {{ nginx_ssl_prefer_server_ciphers }};"
-    insertafter: "http {"
+    insertafter: http {
-    mode: '0640'
+    mode: "0640"
-    owner: "root"
+    owner: "{{ nginx_owner_user }}"
-    group: "root"
+    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Change client_max_body_size in main nginx.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
-    regexp: '^\s*client_max_body_size'
+    regexp: ^\s*client_max_body_size
    line: "    client_max_body_size {{ nginx_client_max_body_size }};"
-    insertafter: "http {"
+    insertafter: http {
-    mode: '0640'
+    mode: "0640"
-    owner: "root"
+    owner: "{{ nginx_owner_user }}"
-    group: "root"
+    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Change client_body_buffer_size in main nginx.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
-    regexp: '^\s*client_body_buffer_size'
+    regexp: ^\s*client_body_buffer_size
    line: "    client_body_buffer_size {{ nginx_client_body_buffer_size }};"
-    insertafter: "http {"
+    insertafter: http {
-    mode: '0640'
+    mode: "0640"
-    owner: "root"
+    owner: "{{ nginx_owner_user }}"
-    group: "root"
+    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Change keepalive_timeout in main nginx.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
-    regexp: '^\s*keepalive_timeout'
+    regexp: ^\s*keepalive_timeout
    line: "    keepalive_timeout {{ nginx_keepalive_timeout }};"
-    insertafter: "http {"
+    insertafter: http {
-    mode: '0640'
+    mode: "0640"
-    owner: "root"
+    owner: "{{ nginx_owner_user }}"
-    group: "root"
+    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
 - name: Remove default.conf
-  file:
+  ansible.builtin.file:
    path: "{{ item }}"
    state: absent
  when: nginx_remove_default_site
  notify: Restart nginx
  loop:
-    - "/etc/nginx/conf.d/default.conf"
+    - "{{ nginx_configuration_dir }}/conf.d/default.conf"
-    - "/etc/nginx/sites-enabled/default"
+    - "{{ nginx_configuration_dir }}/sites-enabled/default"
 - name: Generate dh group
-  openssl_dhparam:
+  community.crypto.openssl_dhparam:
-    path: "/etc/nginx/dh{{ nginx_dh_size }}.pem"
+    path: "{{ nginx_configuration_dir }}/dh{{ nginx_dh_size }}.pem"
    size: "{{ nginx_dh_size }}"
-    mode: '0640'
+    mode: "0640"
-    owner: "root"
+    owner: "{{ nginx_owner_user }}"
-    group: "root"
+    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
@@ -11,7 +11,7 @@ limit_conn_zone             {{ nginx_limit_conn_zone }};
 limit_conn                  {{ nginx_limit_conn }};
 ssl_ciphers                 '{{ nginx_ssl_ciphers }}';
 ssl_session_tickets         {{ nginx_ssl_session_tickets }};
-ssl_dhparam                 /etc/nginx/dh{{ nginx_dh_size }}.pem;
+ssl_dhparam                 {{ nginx_configuration_hardening_dir }}/dh{{ nginx_dh_size }}.pem;
 {% for header in nginx_add_header %}
 add_header                  {{ header }};
 {% endfor %}
@@ -1 +0,0 @@
 ---
@@ -1,6 +1,7 @@
 # devsec.os_hardening
 ![devsec.os_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening/badge.svg)
 ![devsec.os_hardening VM](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening%20VM/badge.svg)
 ## Looking for the old ansible-os-hardening role?
@@ -106,6 +107,9 @@ We know that this is the case on Raspberry Pi.
 - `os_auth_pw_min_age`
  - Default: `7`
  - Description: minimum password age (before allowing any other password change).
 - `os_auth_pw_warn_age`
  - Default: `7`
  - Description: number of days of warning before password expires.
 - `os_auth_pw_remember`
  - Default: `5`
  - Description: how many used passwords are record.
@@ -136,6 +140,7 @@ We know that this is the case on Raspberry Pi.
 - `os_security_kernel_enable_module_loading`
  - Default: `true`
  - Description: true if you want to allowed to change kernel modules once the system is running (eg `modprobe`, `rmmod`).
  - WARNING: Rebuilding initramfs is deprecated and will be removed in the next major release. For more information take a look at this issue: <https://github.com/dev-sec/ansible-collection-hardening/pull/591>
 - `os_security_kernel_enable_core_dump`
  - Default: `false`
  - Description: kernel is crashing or otherwise misbehaving and a kernel core dump is created.
@@ -217,15 +222,39 @@ We know that this is the case on Raspberry Pi.
 - `os_auditd_max_log_file`
  - Default: `6`
  - Description: This keyword specifies the maximum file size in megabytes. When this limit is reached, it will trigger a configurable action. The value given must be numeric.
 - `os_auditd_num_logs`
  - Default: `5`
  - Description: This keyword specifies the number of log files to keep if `rotate` is given as the max_log_file_action. The value given must be numeric.
 - `hidepid_option`
  - Default: `2` (on RHEL/CentOS7 `0`, see known limitations)
  - Description: `0`: This is the default setting and gives you the default behaviour. `1`: With this option an normal user would not see other processes but their own about ps, top etc, but he is still able to see process IDs in /proc. `2`: Users are only able too see their own processes (like with hidepid=1), but also the other process IDs are hidden for them in /proc.
 - `proc_mnt_options`
  - Default: `rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}`
  - Description: Mount proc with hardenized options, including `hidepid` with variable value.
 - `os_ignore_users`
  - Default: `['vagrant', 'kitchen']`
  - Description: Specify system accounts whose login should not be disabled and password not changed
 - `os_chmod_home_folders`
  - Default: `true`
  - Description: Set to `false` to disable "chmod 700" of home folders for regular users
 - `os_ignore_home_folder_users`
-  - Default: `lost+found`
+  - Default: `[]`
-  - Description: specify user home folders in `/home` that shouldn't be chmodded to 700
+  - Description: Specify user accounts, whose home folders shouldn't be chmodded to 700 when "os_chmod_home_folders" is enabled.
 - `os_chmod_rootuser_home_folder`
  - Default: `true`
  - Description: Set to `false` to disable "chmod 700" of root's home folder
 - `os_rootuser_pw_ageing`
  - Default: `false`
  - Description: Set to true to enforce password age settings for root user(s)
 - `os_remove_additional_root_users`
  - Default: `false`
  - Description: When enabled and there are multiple users with UID=0, only "root" will be kept. Others will be deleted.
 - `os_user_pw_ageing`
  - Default: `true`
  - Description: Set to false to disable password age enforcement on existing users
 - `os_users_without_password_ageing`
  - Default: `[]`
  - Description: List of users, where password ageing should not be enforced even if "os_user_pw_ageing" is enabled
 - `os_cron_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring cron.
@@ -237,7 +266,7 @@ We know that this is the case on Raspberry Pi.
  - Description: Set to false to disable installing and configuring limits.
 - `os_login_defs_enabled`
  - Default: `true`
-  - Description: Set to false to disable installing and configuring login_defs.
+  - Description: Set to false to disable installing and configuring login_defs for newly created users.
 - `os_minimize_access_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring minimize_access.
@@ -250,6 +279,9 @@ We know that this is the case on Raspberry Pi.
 - `os_profile_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring profile.
 - `os_security_auto_logout`
  - Default: `0`
  - Description: Set timeout in seconds for logout users automatically after time. Setting this to `0` disables the timeout.
 - `os_securetty_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring securetty.
@@ -280,6 +312,246 @@ We know that this is the case on Raspberry Pi.
 - `os_sha_crypt_max_rounds`
  - Default: `640000`
  - Description: Define the number of maximum SHA rounds. With a lot of rounds brute forcing the password is more difficult. But note also that it more CPU resources will be needed to authenticate users. The values must be inside the 1000-999999999 range.
 - `os_auditd_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring `auditd`.
 - `os_auditd_flush`
  - Default: `INCREMENTAL`
  - Description: Valid values are none, incremental, incremental_async, data, and sync.
 - `os_auditd_max_log_file`
  - Default: 6
  - Description: This keyword specifies the maximum file size in megabytes. When this limit is reached, it will trigger a configurable action.
 - `os_auditd_max_log_file_action`
  - Default: `keep_logs`
  - Description: This parameter tells the system what action to take when the system has detected that the max file size limit has been reached. Valid values are ignore, syslog, suspend, rotate and keep_logs.
 - `os_auditd_admin_space_left`
  - Default: 50
  - Description: This is a numeric value in megabytes that tells the audit daemon when to perform a configurable action because the system is running low on disk space.
 - `os_auditd_space_left`
  - Default: 75
  - Description: If the free space in the filesystem containing log_file drops below this value, the audit daemon takes the action specified by space_left_action.
 - `os_auditd_space_left_action`
  - Default: SYSLOG
  - Description: This parameter tells the system what action to take when the system has detected that it is starting to get low on disk space.
 - `os_auditd_log_format`
  - Default: `RAW`
  - Description: The log format describes how the information should be stored on disk. There are 2 options: raw and enriched. If set to `RAW`, the audit records will be stored in a format exactly as the kernel sends it. The `ENRICHED` option will resolve all uid, gid, syscall, architecture, and socket address information before writing the event to disk. This aids in making sense of events created on one system but reported/analyzed on another system.
 - `os_mnt_boot_dir_mode`
  - Default: `0700`
  - Description: Set default perimissions for /boot
 - `os_mnt_boot_enabled`
  - Default: `false`
  - Description: Set to true to configure /boot mountpoint
 - `os_mnt_boot_src`
  - Default: `''`
  - Description: Set mount source for /boot
 - `os_mnt_boot_options`
  - Default: `rw,nosuid,nodev,noexec`
  - Description: Configure mount options for /boot
 - `os_mnt_boot_filesystem`
  - Default: `""`
  - Description: Configure file system for fstab entry /boot. If empty, the current file system type will be used.
 - `os_mnt_boot_dump`
  - Default: ext3 + ext4 `1` / other `0`
  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_boot_passno`
  - Default: ext3 + ext4 `2` / other `0`
  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_dev_dir_mode`
  - Default: `0755`
  - Description: Set default perimissions for /dev
 - `os_mnt_dev_enabled`
  - Default: `true`
  - Description: Set to false to ignore /dev mountpoint
 - `os_mnt_dev_src`
  - Default: `devtmpfs`
  - Description: Set mount source for /dev
 - `os_mnt_dev_options`
  - Default: `'rw,nosuid,noexec'`
  - Description: Configure mount options for /dev
 - `os_mnt_dev_filesystem`
  - Default: `devtmpfs`
  - Description: Configure file system for fstab entry /dev
 - `os_mnt_dev_dump`
  - Default: `0`
  - Description: Configure dump for fstab entry /var/tmp.
 - `os_mnt_dev_passno`
  - Default: `0`
  - Description: Configure passno for fstab entry /var/tmp.
 - `os_mnt_dev_shm_dir_mode`
  - Default: `1777`
  - Description: Set default perimissions for /dev/shm
 - `os_mnt_dev_shm_enabled`
  - Default: `true`
  - Description: Set to false to ignore /dev/shm mountpoint
 - `os_mnt_dev_shm_src`
  - Default: `tmpfs`
  - Description: Set mount source for /dev/shm
 - `os_mnt_dev_shm_options`
  - Default: `rw,nosuid,nodev,noexec`
  - Description: Configure mount options for /dev/shm
 - `os_mnt_dev_shm_filesystem`
  - Default: `tmpfs`
  - Description: Configure file system for fstab entry /dev/shm
 - `os_mnt_dev_shm_dump`
  - Default: `0`
  - Description: Configure dump for fstab entry /var/tmp.
 - `os_mnt_dev_shm_passno`
  - Default: `0`
  - Description: Configure passno for fstab entry /var/tmp.
 - `os_mnt_home_dir_mode`
  - Default: `0755`
  - Description: Set default perimissions for /home
 - `os_mnt_home_enabled`
  - Default: `false`
  - Description: Set to true to configure /home mountpoint
 - `os_mnt_home_src`
  - Default: `""`
  - Description: Set mount source for /home. If empty, the current file system source device will be used.
 - `os_mnt_home_options`
  - Default: `rw,nosuid,nodev`
  - Description: Configure mount options for /home
 - `os_mnt_home_filesystem`
  - Default: `""`
  - Description: Configure file system for fstab entry /home. If empty, the current file system type will be used.
 - `os_mnt_home_dump`
  - Default: ext3 + ext4 `1` / other `0`
  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_home_passno`
  - Default: ext3 + ext4 `2` / other `0`
  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_run_dir_mode`
  - Default: `0755`
  - Description: Set default perimissions for /run
 - `os_mnt_run_enabled`
  - Default: `true`
  - Description: Set to false to ignore /run mountpoint
 - `os_mnt_run_src`
  - Default: `tmpfs`
  - Description: Set mount source for /run
 - `os_mnt_run_options`
  - Default: `rw,nosuid,nodev`
  - Description: Configure mount options for /run
 - `os_mnt_run_filesystem`
  - Default: `tmpfs`
  - Description: Configure file system for fstab entry /run
 - `os_mnt_run_dump`
  - Default: `0`
  - Description: Configure dump for fstab entry /var/tmp.
 - `os_mnt_run_passno`
  - Default: `0`
  - Description: Configure passno for fstab entry /var/tmp.
 - `os_mnt_tmp_dir_mode`
  - Default: `1777`
  - Description: Set default perimissions for /tmp
 - `os_mnt_tmp_enabled`
  - Default: `false`
  - Description: Set to true to configure /tmp mountpoint
 - `os_mnt_tmp_src`
  - Default: `""`
  - Description: Set mount source for /tmp. If empty, the current file system source device will be used.
 - `os_mnt_tmp_options`
  - Default: `rw,nosuid,nodev,noexec`
  - Description: Configure mount options for /tmp
 - `os_mnt_tmp_filesystem`
  - Default: `""`
  - Description: Configure file system for fstab entry /tmp. If empty, the current file system type will be used.
 - `os_mnt_tmp_dump`
  - Default: ext3 + ext4 `1` / other `0`
  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_tmp_passno`
  - Default: ext3 + ext4 `2` / other `0`
  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_var_dir_mode`
  - Default: `0755`
  - Description: Set default perimissions for /var
 - `os_mnt_var_enabled`
  - Default: `false`
  - Description: Set to true to configure /var mountpoint
 - `os_mnt_var_src`
  - Default: `""`
  - Description: Set mount source for /var. If empty, the current file system source device will be used.
 - `os_mnt_var_options`
  - Default: `rw,nosuid,nodev`
  - Description: Configure mount options for /var
 - `os_mnt_var_filesystem`
  - Default: `""`
  - Description: Configure file system for fstab entry /var. If empty, the current file system type will be used.
 - `os_mnt_var_dump`
  - Default: ext3 + ext4 `1` / other `0`
  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_var_passno`
  - Default: ext3 + ext4 `2` / other `0`
  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_var_log_dir_mode`
  - Default: `0755`
  - Description: Set default perimissions for /var/log
 - `os_mnt_var_log_enabled`
  - Default: `false`
  - Description: Set to true to configure /var/log mountpoint
 - `os_mnt_var_log_src`
  - Default: `""`
  - Description: Set mount source for /var/log. If empty, the current file system source device will be used.
 - `os_mnt_var_log_options`
  - Default: `rw,nosuid,nodev,noexec`
  - Description: Configure mount options for /var/log
 - `os_mnt_var_log_filesystem`
  - Default: `""`
  - Description: Configure file system for fstab entry /var/log. If empty, the current file system type will be used.
 - `os_mnt_var_log_dump`
  - Default: ext3 + ext4 `1` / other `0`
  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_var_log_passno`
  - Default: ext3 + ext4 `2` / other `0`
  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_var_log_audit_dir_mode`
  - Default: `0640`
  - Description: Set default perimissions for /var/log/audit
 - `os_mnt_var_log_audit_enabled`
  - Default: `false`
  - Description: Set to true to configure /var/log/audit mountpoint
 - `os_mnt_var_log_audit_src`
  - Default: `""`
  - Description: Set mount source for /var/log/audit. If empty, the current file system source device will be used.
 - `os_mnt_var_log_audit_options`
  - Default: `rw,nosuid,nodev,noexec`
  - Description: Configure mount options for /var/log/audit
 - `os_mnt_var_log_audit_filesystem`
  - Default: `""`
  - Description: Configure file system for fstab entry /var/log/audit. If empty, the current file system type will be used.
 - `os_mnt_var_log_audit_dump`
  - Default: ext3 + ext4 `1` / other `0`
  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_var_log_audit_passno`
  - Default: ext3 + ext4 `2` / other `0`
  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_var_tmp_dir_mode`
  - Default: `1777`
  - Description: Set default perimissions for /var/tmp
 - `os_mnt_var_tmp_enabled`
  - Default: `false`
  - Description: Set to true to configure /var/tmp mountpoint
 - `os_mnt_var_tmp_src`
  - Default: `""`
  - Description: Set mount source for /var/tmp. If empty, the current file system source device will be used.
 - `os_mnt_var_tmp_options`
  - Default: `rw,nosuid,nodev,noexec`
  - Description: Configure mount options for /var/tmp
 - `os_mnt_var_tmp_filesystem`
  - Default: `""`
  - Description: Configure file system for fstab entry /var/tmp. If empty, the current file system type will be used.
 - `os_mnt_var_tmp_dump`
  - Default: ext3 + ext4 `1` / other `0`
  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_var_tmp_passno`
  - Default: ext3 + ext4 `2` / other `0`
  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_netrc_enabled`
  - Default: `True`
  - Description: Configure filesystem for existence of .netrc file in homedir
 - `os_netrc_whitelist_user`
  - Default: ``
  - Description: Add list of user to allow creation of .netrc in users homedir
 ## Packages
@@ -3,27 +3,41 @@ os_desktop_enable: false
 os_env_extra_user_paths: []
 os_auth_pw_max_age: 60
 os_auth_pw_min_age: 7 # Discourage password cycling
 os_auth_pw_warn_age: 7
 os_auth_pw_remember: 5 # Specify how many used passwords are record
 os_auth_retries: 5
 os_auth_lockout_time: 600 # Seconds (600 = 10min)
 os_auth_timeout: 60
 os_auth_allow_homeless: false
 os_auth_pam_passwdqc_enable: true
-os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8'  # Used in RHEL6
+os_auth_pam_passwdqc_options: min=disabled,disabled,16,12,8 # Used in Debian
-os_auth_pam_pwquality_options: 'try_first_pass retry=3 authtok_type='  # Used in RHEL7 and RHEL8
+os_auth_pam_pwquality_options: try_first_pass retry=3 authtok_type= # Used in RHEL7 and RHEL8
 os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]
 os_chfn_restrict: ""
-os_chfn_restrict: ''
+# Set to `false` to disable "chmod 700" of home folders for regular users
-
+os_chmod_rootuser_home_folder: true
 # Set to false to disable chmod /home folders to 700
 os_chmod_home_folders: true
 # Specify user accounts, whose home folders shouldn't be chmodded to 700 when "os_chmod_home_folders" is enabled.
 os_ignore_home_folder_users: []
 # May contain: change_user
 os_security_users_allow: []
-# Specify user home folders in /home that shouldn't be chmodded to 700
+
-os_ignore_home_folder_users: ['lost+found']
+# Set to false to disable password age enforcement on existing users
 os_rootuser_pw_ageing: false
 # When enabled and there are multiple users with UID=0, only "root" will be kept. Others will be deleted.
 os_remove_additional_root_users: false
 # Set to false to disable password age enforcement on existing users
 os_user_pw_ageing: true
 # List of users, where password ageing should not be enforced even if "os_user_pw_ageing" is enabled
 os_users_without_password_ageing: []
 # Specify system accounts whose login should not be disabled and password not changed
-os_ignore_users: ['vagrant', 'kitchen']
+os_ignore_users: [vagrant, kitchen]
 os_security_kernel_enable_module_loading: true
 os_security_kernel_enable_core_dump: false
 os_security_suid_sgid_enforce: true
@@ -35,8 +49,7 @@ os_security_suid_sgid_remove_from_unknown: false
 # Remove packages with known security issues
 os_security_packages_clean: true
-os_security_packages_list: ['xinetd', 'inetd', 'ypserv', 'telnet-server', 'rsh-server', 'prelink']
+os_security_packages_list: [xinetd, inetd, ypserv, telnet-server, rsh-server, prelink]
 # Allow interactive startup (rhel, centos)
 os_security_init_prompt: true
 # Require root password for single user mode. (rhel, centos)
@@ -49,15 +62,15 @@ ufw_manage_defaults: true
 # By default in Ubuntu it is set to: /etc/ufw/sysctl.conf
 # CAUTION!
 # If you enable it - it overwrites /etc/sysctl.conf file, managed by hardening framework
-ufw_ipt_sysctl: ''
+ufw_ipt_sysctl: ""
 # Default ufw variables
-ufw_default_input_policy: 'DROP'
+ufw_default_input_policy: DROP
-ufw_default_output_policy: 'ACCEPT'
+ufw_default_output_policy: ACCEPT
-ufw_default_forward_policy: 'DROP'
+ufw_default_forward_policy: DROP
-ufw_default_application_policy: 'SKIP'
+ufw_default_application_policy: SKIP
-ufw_manage_builtins: 'no'
+ufw_manage_builtins: "no"
-ufw_ipt_modules: 'nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns'
+ufw_ipt_modules: nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns
 # Set to true to apply rules to support IPv6 (no means only IPv6 on loopback
 # accepted).
@@ -70,6 +83,12 @@ sysctl_config:
  fs.protected_hardlinks: 1
  fs.protected_symlinks: 1
  # For more info on the following settings see: https://www.kernel.org/doc/html/latest/admin-guide/sysctl/fs.html
  # Restrict FIFO special device creation behavior
  fs.protected_fifos: 1
  # Restrict regular files creation behavior
  fs.protected_regular: 2
  # Prevent core dumps with SUID. These are usually only
  # needed by developers and may contain sensitive information. | sysctl-31
  fs.suid_dumpable: 0
@@ -247,6 +266,7 @@ sysctl_config:
  # Disable acceptance of IPv6 router solicitations messages | sysctl-21
  net.ipv6.conf.default.router_solicitations: 0
  net.ipv6.conf.all.router_solicitations: 0
  # Disable Accept Router Preference from router advertisement | sysctl-22
  net.ipv6.conf.default.accept_ra_rtr_pref: 0
@@ -259,6 +279,7 @@ sysctl_config:
  # Disable IPv6 autoconfiguration | sysctl-26
  net.ipv6.conf.default.autoconf: 0
  net.ipv6.conf.all.autoconf: 0
  # Disable neighbor solicitations to send out per address | sysctl-27
  net.ipv6.conf.default.dad_transmits: 0
@@ -282,56 +303,46 @@ sysctl_config:
  vm.mmap_rnd_bits: 32
  vm.mmap_rnd_compat_bits: 16
  # Disable unprivileged users from loading eBPF programs into the kernel.
  # One of mitigations against CVE-2021-33909. | Tail-2
  kernel.unprivileged_bpf_disabled: 1
  # Reduce attack surface by disabling unprivileged user namespaces.
  # Mitigates CVE-2021-33909 and other exploits.
  kernel.unprivileged_userns_clone: 0
  # For more info on the following settings see: https://www.kernel.org/doc/html/latest/admin-guide/sysctl/fs.html
  # Restrict FIFO special device creation behavior
  fs.protected_fifos: 1
  # Restrict hardlink creation behavior
  fs.protected_hardlinks: 1
  # Restrict regular files creation behavior
  fs.protected_regular: 2
  # Restrict symlink following behavior
  fs.protected_symlinks: 1
 # Do not delete the following line or otherwise the playbook will fail
 # at task 'create a combined sysctl-dict if overwrites are defined'
 sysctl_overwrite:
 # Disable unused filesystems
 os_unused_filesystems:
-  - "cramfs"
+  - cramfs
-  - "freevxfs"
+  - freevxfs
-  - "jffs2"
+  - jffs2
-  - "hfs"
+  - hfs
-  - "hfsplus"
+  - hfsplus
-  - "squashfs"
+  - squashfs
-  - "udf"
+  - udf
-  - "vfat"
+  - vfat
  # Obsolete network protocols that should be disabled
  # per CIS Oracle Linux 6 Benchmark (2016)
-  - "dccp"  # CIS 3.5.1
+  - dccp # CIS 3.5.1
-  - "rds"   # CIS 3.5.3
+  - rds # CIS 3.5.3
-  - "sctp"  # CIS 3.5.2
+  - sctp # CIS 3.5.2
-  - "tipc"  # CIS 3.5.4
+  - tipc # CIS 3.5.4
 # Whitelist for used filesystems
 os_filesystem_whitelist: []
 # Set to false to turn the role into a no-op. Useful when using
 # the Ansible role dependency mechanism.
 os_hardening_enabled: true
 # Set to false to disable installing and configuring auditd.
 os_auditd_enabled: true
 os_auditd_flush: INCREMENTAL
 os_auditd_max_log_file: 6
 os_auditd_max_log_file_action: keep_logs
 os_auditd_log_format: RAW
 os_auditd_admin_space_left: 50
 os_auditd_space_left: 75
 os_auditd_space_left_action: SYSLOG
 os_auditd_admin_space_left_action: SUSPEND
 os_auditd_disk_full_action: SUSPEND
 os_auditd_disk_error_action: SUSPEND
 os_auditd_log_group: root
 os_auditd_num_logs: 5
 # Set the SELinux state, which can be either disabled, permissive, or enforcing.
 os_selinux_state: enforcing
@@ -339,7 +350,7 @@ os_selinux_state: enforcing
 os_selinux_policy: targeted
 # Mount options for proc in /etc/fstab.
-proc_mnt_options: 'rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}'
+proc_mnt_options: rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}
 # Set to false to disable installing and configuring cron.
 os_cron_enabled: true
@@ -350,7 +361,7 @@ os_ctrlaltdel_disabled: false
 # Set to false to disable installing and configuring limits.
 os_limits_enabled: true
-# Set to false to disable installing and configuring login_defs.
+# Set to false to disable installing and configuring login_defs for newly created users.
 os_login_defs_enabled: true
 # Set to false to disable installing and configuring minimize_access.
@@ -368,6 +379,9 @@ os_profile_enabled: true
 # Set to false to disable installing and configuring securetty.
 os_securetty_enabled: true
 # Set timeout in seconds for logout users automatically after time. Setting this to `0` disables the timeout.
 os_security_auto_logout: 0
 # Set to false to disable installing and configuring sysctl.
 os_sysctl_enabled: true
@@ -382,7 +396,6 @@ os_yum_enabled: true
 # List of yum repository files under /etc/yum.repos.d/ which should not be altered.
 os_yum_repo_file_whitelist: []
 # Set to false to disable installing and configuring apt.
 os_apt_enabled: true
@@ -394,3 +407,89 @@ os_selinux_enabled: true
 # The values must be inside the 1000-999999999 range.
 os_sha_crypt_min_rounds: "640000"
 os_sha_crypt_max_rounds: "640000"
 os_mnt_boot_dir_mode: "0700"
 os_mnt_boot_enabled: false
 os_mnt_boot_src: ""
 os_mnt_boot_options: rw,nosuid,nodev,noexec
 os_mnt_boot_filesystem: ""
 os_mnt_boot_dump: ""
 os_mnt_boot_passno: ""
 os_mnt_dev_dir_mode: "0755"
 os_mnt_dev_enabled: true
 os_mnt_dev_src: devtmpfs
 os_mnt_dev_options: rw,nosuid,noexec
 os_mnt_dev_filesystem: devtmpfs
 os_mnt_dev_dump: ""
 os_mnt_dev_passno: ""
 os_mnt_dev_shm_dir_mode: "1777"
 os_mnt_dev_shm_enabled: true
 os_mnt_dev_shm_src: tmpfs
 os_mnt_dev_shm_options: rw,nosuid,nodev,noexec
 os_mnt_dev_shm_filesystem: tmpfs
 os_mnt_dev_shm_dump: ""
 os_mnt_dev_shm_passno: ""
 os_mnt_home_dir_mode: "0755"
 os_mnt_home_enabled: false
 os_mnt_home_src: ""
 os_mnt_home_options: rw,nosuid,nodev
 os_mnt_home_filesystem: ""
 os_mnt_home_dump: ""
 os_mnt_home_passno: ""
 os_mnt_run_dir_mode: "0755"
 os_mnt_run_enabled: true
 os_mnt_run_src: tmpfs
 os_mnt_run_options: rw,nosuid,nodev
 os_mnt_run_filesystem: tmpfs
 os_mnt_run_dump: ""
 os_mnt_run_passno: ""
 os_mnt_tmp_dir_mode: "1777"
 os_mnt_tmp_enabled: false
 os_mnt_tmp_src: ""
 os_mnt_tmp_options: rw,nosuid,nodev,noexec
 os_mnt_tmp_filesystem: ""
 os_mnt_tmp_dump: ""
 os_mnt_tmp_passno: ""
 os_mnt_var_dir_mode: "0755"
 os_mnt_var_enabled: false
 os_mnt_var_src: ""
 os_mnt_var_options: rw,nosuid,nodev
 os_mnt_var_filesystem: ""
 os_mnt_var_dump: ""
 os_mnt_var_passno: ""
 os_mnt_var_log_dir_mode: "0755"
 os_mnt_var_log_enabled: false
 os_mnt_var_log_src: ""
 os_mnt_var_log_options: rw,nosuid,nodev,noexec
 os_mnt_var_log_filesystem: ""
 os_mnt_var_log_dump: ""
 os_mnt_var_log_passno: ""
 os_mnt_var_log_audit_dir_mode: "0700"
 os_mnt_var_log_audit_enabled: false
 os_mnt_var_log_audit_src: ""
 os_mnt_var_log_audit_options: rw,nosuid,nodev,noexec
 os_mnt_var_log_audit_filesystem: ""
 os_mnt_var_log_audit_dump: ""
 os_mnt_var_log_audit_passno: ""
 os_mnt_var_tmp_dir_mode: "1777"
 os_mnt_var_tmp_enabled: false
 os_mnt_var_tmp_src: ""
 os_mnt_var_tmp_options: rw,nosuid,nodev,noexec
 os_mnt_var_tmp_filesystem: ""
 os_mnt_var_tmp_dump: ""
 os_mnt_var_tmp_passno: ""
 #
 # .netrc User whitelist
 # keep .netrc file for users in whitelist
 os_netrc_enabled: true
 os_netrc_whitelist_user: []
@@ -1,9 +1,18 @@
 ---
 - name: Update-initramfs
-  command: 'update-initramfs -u'
+  ansible.builtin.command: update-initramfs -u
- name: restart-auditd
+- name: Restart auditd # noqa command-instead-of-module
-  command:
+  ansible.builtin.command:
-    cmd: 'service auditd restart'  # rhel: see: https://access.redhat.com/solutions/2664811
+    cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
    warn: false  # sadly 'service' module fails in that case also by using 'use: service'
  when: molecule_yml is not defined # restarting auditd in a container does not work
 - name: Reload systemd
  ansible.builtin.systemd:
    daemon_reload: true
 - name: Remount filesystems
  ansible.posix.mount:
    path: "{{ item }}"
    state: remounted
  loop: "{{ mountpoints_changed }}"
@@ -1,28 +1,29 @@
 ---
 galaxy_info:
-  author: "Sebastian Gumprich"
+  author: Sebastian Gumprich
-  description: 'This Ansible role provides numerous security-related ssh configurations, providing all-round base protection.'
+  description: This Ansible role provides numerous security-related ssh configurations, providing all-round base protection.
  company: Hardening Framework Team
  license: Apache License 2.0
-  min_ansible_version: '2.9.10'
+  min_ansible_version: 2.9.10
  platforms:
    - name: EL
      versions:
-        - 7
+        - "7"
-        - 8
+        - "8"
    - name: Ubuntu
      versions:
        - xenial
        - bionic
        - focal
        - jammy
    - name: Debian
      versions:
        - stretch
        - buster
        - bullseye
    - name: Amazon
    - name: Fedora
-    - name: Archlinux
+    - name: ArchLinux
    - name: SmartOS
-    - name: openSUSE
+    - name: opensuse
  galaxy_tags:
    - system
    - security
@@ -1,7 +1,7 @@
 ---
 - name: Remove deprecated or insecure packages | package-01 - package-09
-  apt:
+  ansible.builtin.apt:
-    name: '{{ os_security_packages_list }}'
+    name: "{{ os_security_packages_list }}"
-    state: 'absent'
+    state: absent
-    purge: 'yes'
+    purge: true
  when: os_security_packages_clean | bool
@@ -1,16 +1,16 @@
 ---
 - name: Install auditd package | package-08
-  package:
+  ansible.builtin.package:
-    name: '{{ auditd_package }}'
+    name: "{{ auditd_package }}"
-    state: 'present'
+    state: present
  tags: auditd
 - name: Configure auditd | package-08
-  template:
+  ansible.builtin.template:
-    src: 'etc/audit/auditd.conf.j2'
+    src: etc/audit/auditd.conf.j2
-    dest: '/etc/audit/auditd.conf'
+    dest: /etc/audit/auditd.conf
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
-    mode: '0640'
+    mode: "0640"
-  notify: 'restart-auditd'
+  notify: Restart auditd
  tags: auditd
@@ -6,7 +6,7 @@
 # CIS 5.1.2 - CIS 5.1.7
 #
 - name: Find cron files and directories
-  find:
+  ansible.builtin.find:
    paths:
      - /etc
    patterns:
@@ -1,7 +1,7 @@
 ---
 - name: Disable CTRL-ALT-DEL
-  systemd:
+  ansible.builtin.systemd:
    name: ctrl-alt-del.target
-    masked: yes
+    masked: true
-    daemon_reload: yes
+    daemon_reload: true
  when: ansible_service_mgr == "systemd"
@@ -1,14 +1,14 @@
 ---
 - name: Fetch OS dependent variables
-  include_vars:
+  ansible.builtin.include_vars:
-    file: '{{ item }}'
+    file: "{{ item }}"
-    name: 'os_vars'
+    name: os_vars
  with_first_found:
    - files:
-        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - "{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml"
-        - '{{ ansible_facts.distribution }}.yml'
+        - "{{ ansible_facts.distribution }}.yml"
-        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - "{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml"
-        - '{{ ansible_facts.os_family }}.yml'
+        - "{{ ansible_facts.os_family }}.yml"
      skip: true
  tags: always
@@ -16,82 +16,114 @@
 # by default the lookup functions finds all varnames containing the string, therefore
 # we add ^ and $ to denote start and end of string, so this returns only exact matches
 - name: Set OS dependent variables, if not already defined by user # noqa var-naming
-  set_fact:
+  ansible.builtin.set_fact:
-    '{{ item.key }}': '{{ item.value }}'
+    "{{ item.key }}": "{{ item.value }}"
-  when: "not lookup('varnames', '^' + item.key + '$')"
+  when: not lookup('varnames', '^' + item.key + '$')
-  with_dict: '{{ os_vars }}'
+  with_dict: "{{ os_vars }}"
  tags: always
- import_tasks: auditd.yml
+- name: Import tasks for auditd
  ansible.builtin.import_tasks: auditd.yml
  tags: auditd
  when: os_auditd_enabled | bool
- import_tasks: cron.yml
+- name: Import tasks for cron
  ansible.builtin.import_tasks: cron.yml
  tags: cron
  when: os_cron_enabled | bool
- import_tasks: ctrlaltdel.yml
+- name: Import tasks to configure ctrl+alt+del
  ansible.builtin.import_tasks: ctrlaltdel.yml
  tags: ctrlaltdel
  when: os_ctrlaltdel_disabled | bool
- import_tasks: limits.yml
+- name: Import tasks to configure limits
  ansible.builtin.import_tasks: limits.yml
  tags: limits
  when: os_limits_enabled | bool
- import_tasks: login_defs.yml
+- name: Import tasks to configure login_defs
  ansible.builtin.import_tasks: login_defs.yml
  tags: login_defs
  when: os_login_defs_enabled | bool
- import_tasks: minimize_access.yml
+- name: Import tasks to minimize access permissions
  ansible.builtin.import_tasks: minimize_access.yml
  tags: minimize_access
  when: os_minimize_access_enabled | bool
- import_tasks: pam.yml
+- name: Import tasks to configure PAM
  ansible.builtin.import_tasks: pam.yml
  tags: pam
  when: os_pam_enabled | bool
- import_tasks: modprobe.yml
+- name: Import tasks to configure modules
  ansible.builtin.import_tasks: modprobe.yml
  tags: modprobe
  when: os_modprobe_enabled | bool
- import_tasks: profile.yml
+- name: Import tasks to configure profile
  ansible.builtin.import_tasks: profile.yml
  tags: profile
  when: os_profile_enabled | bool
- import_tasks: securetty.yml
+- name: Import tasks to configure securetty
  ansible.builtin.import_tasks: securetty.yml
  tags: securetty
  when: os_securetty_enabled | bool
- import_tasks: suid_sgid.yml
+- name: Import tasks to set suid and sgid
  ansible.builtin.import_tasks: suid_sgid.yml
  when: os_security_suid_sgid_enforce  | bool
  tags: suid_sgid
- import_tasks: sysctl.yml
+- name: Import tasks to configure sysctl
  ansible.builtin.import_tasks: sysctl.yml
  tags: sysctl
  when: os_sysctl_enabled | bool
- import_tasks: user_accounts.yml
+- name: Import tasks to harden user accounts
  ansible.builtin.import_tasks: user_accounts.yml
  tags: user_accounts
  when: os_user_accounts_enabled | bool
- import_tasks: rhosts.yml
+- name: Import tasks to configure rhosts
  ansible.builtin.import_tasks: rhosts.yml
  tags: rhosts
  when: os_rhosts_enabled | bool
- import_tasks: yum.yml
+- name: Import tasks to configure netrc
  ansible.builtin.import_tasks: netrc.yml
  tags: netrc
  when: os_netrc_enabled | bool
 - name: Import tasks to configure yum
  ansible.builtin.import_tasks: yum.yml
  tags: yum
  when:
    - ansible_facts.os_family == 'RedHat'
    - os_yum_enabled | bool
- import_tasks: apt.yml
+- name: Import tasks to configure apt
  ansible.builtin.import_tasks: apt.yml
  tags: apt
  when:
    - ansible_facts.os_family == 'Debian'
    - os_apt_enabled | bool
- import_tasks: selinux.yml
+- name: Import tasks to configure selinux
  ansible.builtin.import_tasks: selinux.yml
  tags: selinux
  when:
    - ansible_facts.selinux.status == 'enabled'
    - os_selinux_enabled | bool
 - name: Raise deprecation warning for initramfs tasks  # noqa ignore-errors
  ansible.builtin.fail:
    msg: "WARNING: Rebuilding initramfs is deprecated and will be removed
          in the next major release. For more information take a look at this issue:
          https://github.com/dev-sec/ansible-collection-hardening/pull/591"
  when:
    - os_security_kernel_enable_module_loading
  ignore_errors: true
  tags: always
@@ -1,36 +1,64 @@
 ---
- block:
+- name: Disable coredumps
  when: not os_security_kernel_enable_core_dump | bool
  block:
    - name: Create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
-    file:
+      ansible.builtin.file:
-      path: '/etc/security/limits.d'
+        path: /etc/security/limits.d
-      owner: 'root'
+        owner: root
-      group: 'root'
+        group: root
-      mode: '0755'
+        mode: "0755"
-      state: 'directory'
+        state: directory
    - name: Create additional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
-    pam_limits:
+      community.general.pam_limits:
-      dest: '/etc/security/limits.d/10.hardcore.conf'
+        dest: /etc/security/limits.d/10.hardcore.conf
-      domain: '*'
+        domain: "*"
        limit_type: hard
        limit_item: core
-      value: '0'
+        value: "0"
        comment: Prevent core dumps for all users. These are usually not needed and may contain sensitive information
    - name: Set 10.hardcore.conf perms to 0400 and root ownership
-    file:
+      ansible.builtin.file:
        path: /etc/security/limits.d/10.hardcore.conf
-      owner: 'root'
+        owner: root
-      group: 'root'
+        group: root
-      mode: '0440'
+        mode: "0440"
        state: touch
        modification_time: preserve
        access_time: preserve
-  when: not os_security_kernel_enable_core_dump | bool
+    - name: Create coredump.conf.d-directory if it does not exist
      ansible.builtin.file:
        path: /etc/systemd/coredump.conf.d
        owner: root
        group: root
        mode: 0755
        state: directory
      when: ansible_service_mgr == "systemd"
    - name: Create custom.conf for disabling coredumps
      ansible.builtin.template:
        src: etc/systemd/coredump.conf.d/coredumps.conf.j2
        dest: /etc/systemd/coredump.conf.d/custom.conf
        owner: root
        group: root
        mode: 0644
      when: ansible_service_mgr == "systemd"
      notify: Reload systemd
 - name: Enable coredumps
  when: os_security_kernel_enable_core_dump | bool
  block:
    - name: Remove coredump.conf.d directory with files
      ansible.builtin.file:
        path: /etc/systemd/coredump.conf.d
        state: absent
      when: ansible_service_mgr == "systemd"
      notify: Reload systemd
    - name: Remove 10.hardcore.conf config file
-  file:
+      ansible.builtin.file:
        path: /etc/security/limits.d/10.hardcore.conf
        state: absent
  when: os_security_kernel_enable_core_dump | bool
`@@ -1,2 +1,2 @@`
	`---`	`---`
	`requires_ansible: '>=2.9.10'`	`requires_ansible: ">=2.9.10"`