Merge pull request #594 from dlouzan/fix/type-cast-variables

fix(os_hardening): cast expected int types in pam tasks
2022-10-27 20:43:17 +02:00 · 2022-10-27 16:50:08 +02:00 · 2022-10-26 08:33:13 +00:00 · 2022-10-26 10:13:40 +02:00 · 2022-10-25 18:59:11 +02:00 · 2022-10-25 18:59:11 +02:00
68 changed files with 615 additions and 561 deletions
@@ -11,6 +11,7 @@ exclude_paths:

 skip_list:
  - fqcn-builtins
+  - name[template]

 mock_roles:
  - geerlingguy.git
@@ -1,7 +1,13 @@
 ---
 name: Ansible Lint  # feel free to pick your own name

-on: [push, pull_request]   # yamllint disable-line rule:truthy
+on:  # yamllint disable-line rule:truthy
+  # Run CI against all pushes (direct commits, also merged PRs), Pull Requests
+  push:
+    branches: [master]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master]

 jobs:
  ansible-lint:
@@ -15,43 +21,4 @@ jobs:
        # replace "master" with any valid ref
        uses: ansible/ansible-lint-action@main
        with:
-          # [required]
-          # Paths to ansible files (i.e., playbooks, tasks, handlers etc..)
-          # or valid Ansible directories according to the Ansible role
-          # directory structure.
-          # If you want to lint multiple ansible files, use the following syntax
-          # targets: |
-          #   playbook_1.yml
-          #   playbook_2.yml
-          targets: "roles/"
-          # [optional]
-          # Arguments to override a package and its version to be set explicitly.
-          # Must follow the example syntax.
-          # override-deps: |
-          #   ansible==2.9
-          #   ansible-lint==4.2.0
-          override-deps: |
-            rich>=9.5.1,<11.0.0
-          # [optional]
-          # Arguments to be passed to the ansible-lint
-
-          # Options:
-          #   -q                    quieter, although not silent output
-          #   -p                    parseable output in the format of pep8
-          #   --parseable-severity  parseable output including severity of rule
-          #   -r RULESDIR           specify one or more rules directories using one or
-          #                         more -r arguments. Any -r flags override the default
-          #                         rules in ansiblelint/rules, unless -R is also used.
-          #   -R                    Use default rules in ansiblelint/rules in addition to
-          #                         any extra
-          #                         rules directories specified with -r. There is no need
-          #                         to specify this if no -r flags are used
-          #   -t TAGS               only check rules whose id/tags match these values
-          #   -x SKIP_LIST          only check rules whose id/tags do not match these
-          #                         values
-          #   --nocolor             disable colored output
-          #   --exclude=EXCLUDE_PATHS
-          #                         path to directories or files to skip. This option is
-          #                         repeatable.
-          #   -c C                  Specify configuration file to use. Defaults to ".ansible-lint"
-          args: ""
+          path: "roles/"
@@ -6,6 +6,7 @@ on:  # yamllint disable-line rule:truthy
    types: [labeled, unlabeled, opened, edited, synchronize]
 jobs:
  enforce-label:
+    if: github.repository == 'dev-sec/ansible-collection-hardening'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/labeler@main
@@ -8,6 +8,7 @@ on:  # yamllint disable-line rule:truthy

 jobs:
  deploy:
+    if: github.repository == 'dev-sec/ansible-collection-hardening'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
@@ -1,13 +1,16 @@
 ---
 name: "devsec.mysql_hardening"
+
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
+    branches: [master]
    paths:
      - 'roles/mysql_hardening/**'
      - 'molecule/mysql_hardening/**'
      - '.github/workflows/mysql_hardening.yml'
  pull_request:
+    branches: [master]
    paths:
      - 'roles/mysql_hardening/**'
      - 'molecule/mysql_hardening/**'
@@ -23,7 +26,10 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
+          - centosstream8
+          - centosstream9
          - rocky8
+          - rocky9
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
@@ -3,11 +3,13 @@ name: "devsec.nginx_hardening"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
+    branches: [master]
    paths:
      - 'roles/nginx_hardening/**'
      - 'molecule/nginx_hardening/**'
      - '.github/workflows/nginx_hardening.yml'
  pull_request:
+    branches: [master]
    paths:
      - 'roles/nginx_hardening/**'
      - 'molecule/nginx_hardening/**'
@@ -23,7 +25,10 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
+          - centosstream8
+          - centosstream9
          - rocky8
+          - rocky9
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
@@ -3,11 +3,13 @@ name: "devsec.os_hardening"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
+    branches: [master]
    paths:
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening/**'
      - '.github/workflows/os_hardening.yml'
  pull_request:
+    branches: [master]
    paths:
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening/**'
@@ -23,7 +25,10 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
+          - centosstream8
+          - centosstream9
          - rocky8
+          - rocky9
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
@@ -3,11 +3,13 @@ name: "devsec.os_hardening VM"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
+    branches: [master]
    paths:
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening_vm/**'
      - '.github/workflows/os_hardening_vm.yml'
  pull_request:
+    branches: [master]
    paths:
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening_vm/**'
@@ -23,14 +25,17 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
+          - centos8s
+          # - centos9s  # problems with vagrant
          - rocky8
+          # - rocky9  # problems with vagrant
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
          - debian10
          - debian11
          # - opensuse42  # opensuse currently cannot get an ip address
-          # - arch  - arch is currently not supported by cinc-auditor
+          # - arch  # arch is currently not supported by cinc-auditor
    steps:
      - name: Checkout repo
        uses: actions/checkout@v3
@@ -4,11 +4,13 @@ name: Prettier markdown files

 on:  # yamllint disable-line rule:truthy
  push:
+    branches: [master]
    paths:
      - '**.md'

 jobs:
  prettier-md:
+    if: github.repository == 'dev-sec/ansible-collection-hardening'
    runs-on: ubuntu-latest
    timeout-minutes: 1

@@ -9,8 +9,9 @@ on:  # yamllint disable-line rule:truthy

 jobs:
  generate_changelog:
-    runs-on: ubuntu-latest
    name: create release draft
+    if: github.repository == 'dev-sec/ansible-collection-hardening'
+    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
@@ -3,11 +3,13 @@ name: "devsec.ssh_hardening"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
+    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening/**'
      - '.github/workflows/ssh_hardening.yml'
  pull_request:
+    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening/**'
@@ -23,7 +25,10 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
+          - centosstream8
+          - centosstream9
          - rocky8
+          - rocky9
          - fedora
          - ubuntu1804
          - ubuntu2004
@@ -3,11 +3,13 @@ name: "devsec.ssh_hardening with custom tests"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
+    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening_custom_tests/**'
      - '.github/workflows/ssh_hardening_custom_tests.yml'
  pull_request:
+    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening_custom_tests/**'
@@ -23,7 +25,10 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
+          - centosstream8
+          - centosstream9
          - rocky8
+          - rocky9
          - fedora
          - ubuntu1804
          - ubuntu2004
@@ -1,8 +1,79 @@
 # Changelog

-## [Unreleased](https://github.com/dev-sec/ansible-collection-hardening/tree/HEAD)
+## [8.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.3.0) (2022-10-26)

-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.15.1...HEAD)
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.2.0...8.3.0)
+
+**Implemented enhancements:**
+
+- add hardening of root user account\(s\) [\#579](https://github.com/dev-sec/ansible-collection-hardening/pull/579) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([donestefan](https://github.com/donestefan))
+
+**Fixed bugs:**
+
+- do not manage trusted user ca keys if none exist [\#580](https://github.com/dev-sec/ansible-collection-hardening/pull/580) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([hollow](https://github.com/hollow))
+
+**Closed issues:**
+
+- Trying to run the os\_hardening on Debian 11, but fails on privilege escalation [\#587](https://github.com/dev-sec/ansible-collection-hardening/issues/587)
+- auditd increasing logfiles [\#586](https://github.com/dev-sec/ansible-collection-hardening/issues/586)
+- Path to nginx.conf should be configurable in a variable  [\#577](https://github.com/dev-sec/ansible-collection-hardening/issues/577)
+
+**Merged pull requests:**
+
+- adopt all current suggestions from ansible-lint [\#592](https://github.com/dev-sec/ansible-collection-hardening/pull/592) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Support more os [\#588](https://github.com/dev-sec/ansible-collection-hardening/pull/588) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- run tests only on pushes to master or to PRs [\#581](https://github.com/dev-sec/ansible-collection-hardening/pull/581) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [8.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.2.0) (2022-09-08)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.1.0...8.2.0)
+
+**Implemented enhancements:**
+
+- Add nginx variables for config-path and owner/group [\#578](https://github.com/dev-sec/ansible-collection-hardening/pull/578) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([hagenbauer](https://github.com/hagenbauer))
+- add centos \>8 Support [\#573](https://github.com/dev-sec/ansible-collection-hardening/pull/573) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([sbaerlocher](https://github.com/sbaerlocher))
+- add always-tag to include so other tags can be used [\#569](https://github.com/dev-sec/ansible-collection-hardening/pull/569) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Closed issues:**
+
+- Bug using os\_hardening "tags" [\#567](https://github.com/dev-sec/ansible-collection-hardening/issues/567)
+
+## [8.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.1.0) (2022-08-26)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.0.0...8.1.0)
+
+**Closed issues:**
+
+- dev-sec CI bot should not update CHANGELOG.md in fork repository [\#566](https://github.com/dev-sec/ansible-collection-hardening/issues/566)
+
+**Merged pull requests:**
+
+- update supported OS in meta and fix linting [\#572](https://github.com/dev-sec/ansible-collection-hardening/pull/572) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- fix misleading comment [\#571](https://github.com/dev-sec/ansible-collection-hardening/pull/571) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([donestefan](https://github.com/donestefan))
+- only run release actions on upstream-repo [\#568](https://github.com/dev-sec/ansible-collection-hardening/pull/568) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [8.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.0.0) (2022-08-22)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.16.0...8.0.0)
+
+**Breaking changes:**
+
+- change default to allow SFTP [\#564](https://github.com/dev-sec/ansible-collection-hardening/pull/564) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+
+**Implemented enhancements:**
+
+- add possibility to keep .netrc files in users homedir [\#563](https://github.com/dev-sec/ansible-collection-hardening/pull/563) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([PhilippFunk](https://github.com/PhilippFunk))
+- rework filesystem hardening [\#555](https://github.com/dev-sec/ansible-collection-hardening/pull/555) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([divialth](https://github.com/divialth))
+
+**Closed issues:**
+
+- Error in Task 'Create sshd\_config and set permissions to root/600' [\#565](https://github.com/dev-sec/ansible-collection-hardening/issues/565) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
+- \[ssh\_hardening\] Debian 11 - Ansible cannot transfer files [\#557](https://github.com/dev-sec/ansible-collection-hardening/issues/557)
+- Add the old SFTP-Reminder to the stable ssh\_hardening role for ansible [\#521](https://github.com/dev-sec/ansible-collection-hardening/issues/521)
+
+## [7.16.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.16.0) (2022-08-16)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.15.1...7.16.0)

 **Implemented enhancements:**

@@ -38,7 +38,7 @@ The roles are now part of the hardening-collection.
 We have kept the old releases of the `os-hardening` role in this repository, so you can find the them by exploring older tags.
 The last release of the standalone role was [6.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/6.2.0).

-The other roles are in separate archives repositories
+The other roles are in separate archives repositories:

 - [apache_hardening](https://github.com/dev-sec/ansible-apache-hardening)
 - [mysql_hardening](https://github.com/dev-sec/ansible-mysql-hardening)
@@ -86,8 +86,8 @@ See the [changelog](https://github.com/dev-sec/ansible-os-hardening/tree/master/

 Todos:

- Work on [apache_hardening](roles/apache_hardening/) and [windows_hardening](roles/windows_hardening/).
- Add support for more operating systems,
+- Work on [apache_hardening](roles/apache_hardening/) and [windows_hardening](roles/windows_hardening/)
+- Add support for more operating systems

 ## More information

@@ -1,7 +1,6 @@
---
 namespace: devsec
 name: hardening
-version: 7.15.1
+version: 8.2.0
 readme: README.md
 authors:
  - dev-sec <[email protected]>
@@ -27,6 +27,7 @@
    os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
    os_filesystem_whitelist: []
    os_yum_repo_file_whitelist: ['foo.repo']
+    os_netrc_enabled: false
    sysctl_config:
      net.ipv4.ip_forward: 0
      net.ipv6.conf.all.forwarding: 0
@@ -58,3 +58,7 @@
    - name: include YUM prepare tasks
      include_tasks: prepare_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'
+
+    - name: include YUM prepare tasks
+      include_tasks: prepare_tasks/netrc.yml
+
@@ -0,0 +1,9 @@
+---
+- name: create '.netrc' in /root
+  ansible.builtin.copy:
+    dest: '/root/.netrc'
+    mode: '0600'
+    content: |
+      machine localhost
+      login root
+      password ipsum
@@ -37,6 +37,9 @@
        name: procps
      when: ansible_facts.os_family == 'Debian'

+    - name: include netrc tests
+      include_tasks: verify_tasks/netrc.yml
+
    - name: include PAM tests
      include_tasks: verify_tasks/pam.yml
      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
@@ -0,0 +1,19 @@
+---
+- name: test that .netrc in root homedir exists
+  ansible.builtin.file:
+    path: '/root/.netrc'
+    state: file
+  register: result_test_netrc
+
+- name: output result if .netrc for user root exists
+  ansible.builtin.assert:
+    that:
+      - "result_test_netrc.state == 'file'"
+    fail_msg: ".netrc in /root/ not present"
+    success_msg: ".netrc exists in /root/"
+
+- name: delete '.netrc' in /root
+  ansible.builtin.file:
+    path: '/root/.netrc'
+    state: absent
+  when: result_test_netrc.state == 'file'
@@ -16,8 +16,6 @@

    - name: Run the equivalent of "apt-get update && apt-get upgrade"
      apt:
-        name: "*"
-        state: latest
        update_cache: true
      when: ansible_os_family == 'Debian'

@@ -10,3 +10,5 @@
  tasks:
    - include_role:
        name: ssh_hardening
+  vars:
+    sftp_enabled: false
@@ -48,7 +48,6 @@
    ssh_print_last_log: true
    ssh_banner: true
    ssh_server_password_login: true
-    sftp_enabled: true
    sftp_chroot: true
    # ssh_server_enabled: false
    ssh_server_ports:
@@ -8,15 +8,17 @@ galaxy_info:
  platforms:
    - name: EL
      versions:
-        - 6
-        - 7
+        - "7"
+        - "8"
    - name: Ubuntu
      versions:
-        - xenial
        - bionic
+        - focal
+        - jammy
    - name: Debian
      versions:
-        - jessie
+        - bullseye
+        - buster
    - name: Amazon
    - name: Fedora
  galaxy_tags:
@@ -59,12 +59,14 @@
    - mysql_version.version.full is version('8.0.3', '>=')
    - mysql_distribution == "mysql"

- include: configure.yml
+- name: Include tasks for configuration
+  import_tasks: configure.yml
  when: mysql_hardening_enabled | bool
  tags:
    - mysql_hardening

- include: mysql_secure_installation.yml
+- name: Include tasks to secure mysql installation
+  import_tasks: mysql_secure_installation.yml
  when: mysql_hardening_enabled | bool
  tags:
    - mysql_hardening
@@ -4,7 +4,7 @@
    msg: 'ERROR - you have to change default mysql_root_password'
  when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'

- name: ensure that the root password is present
+- name: Ensure that the root password is present
  community.mysql.mysql_user:
    name: 'root'
    host_all: true
@@ -19,14 +19,14 @@
    mode: '0400'
  tags: my_cnf

- name: ensure that the test database is absent
+- name: Ensure that the test database is absent
  community.mysql.mysql_db:
    name: test
    state: absent
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_test_database

- name: ensure that anonymous users are absent
+- name: Ensure that anonymous users are absent
  community.mysql.mysql_user:
    name: ''
    state: absent
@@ -34,7 +34,7 @@
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_anonymous_users

- name: ensure that root can only login from localhost
+- name: Ensure that root can only login from localhost
  community.mysql.mysql_query:
    query:
      - DELETE
@@ -46,7 +46,7 @@
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_remote_root

- name: get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
+- name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
  community.mysql.mysql_query:
    query:
      - SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
@@ -62,7 +62,7 @@
    - (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '>=')) or
      (mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '>='))

- name: get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
+- name: Get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
  community.mysql.mysql_query:
    query:
      - SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
@@ -80,21 +80,21 @@
    - (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '<')) or
      (mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '<'))

- name: create a fact for users without password or authentication_string
+- name: Create a fact for users without password or authentication_string
  set_fact:
    users_wo_auth: "{{ mysql_users_wo_passwords_or_auth_string.query_result.0.0 | community.general.json_query('users') }}"
  when:
    - mysql_users_wo_passwords_or_auth_string.query_result is defined
    - mysql_users_wo_passwords_or_auth_string.query_result != ""  # noqa empty-string-compare

- name: create a fact for users without password
+- name: Create a fact for users without password
  set_fact:
    users_wo_auth: "{{ mysql_users_wo_passwords.query_result.0.0 | community.general.json_query('users') }}"
  when:
    - mysql_users_wo_passwords.query_result is defined
    - mysql_users_wo_passwords.query_result != ""  # noqa empty-string-compare

- name: ensure that there are no users without password or authentication_string
+- name: Ensure that there are no users without password or authentication_string
  community.mysql.mysql_query:
    query:
      - "DROP USER {{ users_wo_auth }}"
@@ -1,9 +0,0 @@
---
-mysql_daemon: mariadb
-mysql_hardening_mysql_conf_file: '/etc/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'mysql'
@@ -1,9 +0,0 @@
---
-mysql_daemon: mariadb
-mysql_hardening_mysql_conf_file: '/etc/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'mysql'
@@ -1,10 +0,0 @@
---
-mysql_daemon: mysql
-
-mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'adm'
@@ -1,10 +0,0 @@
---
-mysql_daemon: mysql
-
-mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'adm'
@@ -1,10 +0,0 @@
---
-mysql_daemon: mysql
-
-mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'adm'
@@ -75,6 +75,18 @@ It works with the following nginx-roles, including, but not limited to:
 - [nginx_dh_size][]
  - Default: `2048`
  - Description: Specifies the length of DH parameters for EDH ciphers.
+- [nginx_configuration_dir][]
+  - default: "/etc/nginx"
+  - Description: The main location for all nginx configuration files
+- [nginx_configuration_hardening_dir][]
+  - default: "/etc/nginx"
+  - Description: The location for the nginx hardening configuration file (Could be different e.g. when used in jails)
+- [nginx_owner_user][]
+  - default: "root"
+  - Description: The owner user of the nginx configuration files
+- [nginx_owner_group][]
+  - default: "root"
+  - Description: The owner group of the nginx configuration files

 ## Example Playbook

@@ -11,6 +11,10 @@ nginx_client_header_timeout: "10"
 nginx_send_timeout: "10"
 nginx_limit_conn_zone: "$binary_remote_addr zone=default:10m"
 nginx_limit_conn: "default 5"
+nginx_configuration_dir: "/etc/nginx"
+nginx_configuration_hardening_dir: "/etc/nginx"
+nginx_owner_user: "root"
+nginx_owner_group: "root"
 nginx_add_header:
  # avoid clickjacking
  - X-Frame-Options SAMEORIGIN
@@ -8,15 +8,15 @@ galaxy_info:
  platforms:
    - name: EL
      versions:
-        - 6
-        - 7
+        - "7"
+        - "8"
    - name: Ubuntu
      versions:
-        - xenial
        - bionic
+        - focal
+        - jammy
    - name: Debian
      versions:
-        - stretch
        - buster
        - bullseye
  galaxy_tags:
@@ -2,76 +2,76 @@
 - name: Create additional configuration
  template:
    src: "hardening.conf.j2"
-    dest: "/etc/nginx/conf.d/90.hardening.conf"
+    dest: "{{ nginx_configuration_dir }}/conf.d/90.hardening.conf"
    mode: '0600'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
  notify: Restart nginx

 - name: Change configuration in main nginx.conf
  lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
    regexp: '^\s*server_tokens'
    line: "    server_tokens {{ nginx_server_tokens }};"
    insertafter: "http {"
    mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
  notify: Restart nginx

 - name: Change ssl_protocols in main nginx.conf
  lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
    regexp: '^\s*ssl_protocols'
    line: "    ssl_protocols {{ nginx_ssl_protocols }};"
    insertafter: "http {"
    mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
  notify: Restart nginx

 - name: Change ssl_prefer_server_ciphers in main nginx.conf
  lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
    regexp: '^\s*ssl_prefer_server_ciphers'
    line: "    ssl_prefer_server_ciphers {{ nginx_ssl_prefer_server_ciphers }};"
    insertafter: "http {"
    mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
  notify: Restart nginx

 - name: Change client_max_body_size in main nginx.conf
  lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
    regexp: '^\s*client_max_body_size'
    line: "    client_max_body_size {{ nginx_client_max_body_size }};"
    insertafter: "http {"
    mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
  notify: Restart nginx

 - name: Change client_body_buffer_size in main nginx.conf
  lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
    regexp: '^\s*client_body_buffer_size'
    line: "    client_body_buffer_size {{ nginx_client_body_buffer_size }};"
    insertafter: "http {"
    mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
  notify: Restart nginx

 - name: Change keepalive_timeout in main nginx.conf
  lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
    regexp: '^\s*keepalive_timeout'
    line: "    keepalive_timeout {{ nginx_keepalive_timeout }};"
    insertafter: "http {"
    mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
  notify: Restart nginx

 - name: Remove default.conf
@@ -81,14 +81,14 @@
  when: nginx_remove_default_site
  notify: Restart nginx
  loop:
-    - "/etc/nginx/conf.d/default.conf"
-    - "/etc/nginx/sites-enabled/default"
+    - "{{ nginx_configuration_dir }}/conf.d/default.conf"
+    - "{{ nginx_configuration_dir }}/sites-enabled/default"

 - name: Generate dh group
  openssl_dhparam:
-    path: "/etc/nginx/dh{{ nginx_dh_size }}.pem"
+    path: "{{ nginx_configuration_dir }}/dh{{ nginx_dh_size }}.pem"
    size: "{{ nginx_dh_size }}"
    mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
  notify: Restart nginx
@@ -11,7 +11,7 @@ limit_conn_zone             {{ nginx_limit_conn_zone }};
 limit_conn                  {{ nginx_limit_conn }};
 ssl_ciphers                 '{{ nginx_ssl_ciphers }}';
 ssl_session_tickets         {{ nginx_ssl_session_tickets }};
-ssl_dhparam                 /etc/nginx/dh{{ nginx_dh_size }}.pem;
+ssl_dhparam                 {{ nginx_configuration_hardening_dir }}/dh{{ nginx_dh_size }}.pem;
 {% for header in nginx_add_header %}
 add_header                  {{ header }};
 {% endfor %}
@@ -230,6 +230,15 @@ We know that this is the case on Raspberry Pi.
 - `os_ignore_home_folder_users`
  - Default: `lost+found`
  - Description: specify user home folders in `/home` that shouldn't be chmodded to 700
+- `os_chmod_rootuser_home_folder`
+  - Default: `true`
+  - Description: Set to `false` to disable "chmod 700" of root's home folder
+- `os_rootuser_pw_ageing`
+  - Default: `false`
+  - Description: Set to true to enforce password age settings for root user(s)
+- `os_remove_additional_root_users`
+  - Default: `false`
+  - Description: When enabled and there are multiple users with UID=0, only "root" will be kept. Others will be deleted.
 - `os_cron_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring cron.
@@ -241,7 +250,7 @@ We know that this is the case on Raspberry Pi.
  - Description: Set to false to disable installing and configuring limits.
 - `os_login_defs_enabled`
  - Default: `true`
-  - Description: Set to false to disable installing and configuring login_defs.
+  - Description: Set to false to disable installing and configuring login_defs for newly created users.
 - `os_minimize_access_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring minimize_access.
@@ -300,8 +309,14 @@ We know that this is the case on Raspberry Pi.
  - Default: `rw,nosuid,nodev,noexec`
  - Description: Configure mount options for /boot
 - `os_mnt_boot_filesystem`
-  - Default: `ext4`
-  - Description: Configure file system for fstab entry /boot
+  - Default: `""`
+  - Description: Configure file system for fstab entry /boot. If empty, the current file system type will be used.
+- `os_mnt_boot_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_boot_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_dev_dir_mode`
  - Default: `0755`
  - Description: Set default perimissions for /dev
@@ -315,8 +330,14 @@ We know that this is the case on Raspberry Pi.
  - Default: `'rw,nosuid,noexec'`
  - Description: Configure mount options for /dev
 - `os_mnt_dev_filesystem`
-  - Default: `ext4`
+  - Default: `devtmpfs`
  - Description: Configure file system for fstab entry /dev
+- `os_mnt_dev_dump`
+  - Default: `0`
+  - Description: Configure dump for fstab entry /var/tmp.
+- `os_mnt_dev_passno`
+  - Default: `0`
+  - Description: Configure passno for fstab entry /var/tmp.
 - `os_mnt_dev_shm_dir_mode`
  - Default: `1777`
  - Description: Set default perimissions for /dev/shm
@@ -330,8 +351,14 @@ We know that this is the case on Raspberry Pi.
  - Default: `rw,nosuid,nodev,noexec`
  - Description: Configure mount options for /dev/shm
 - `os_mnt_dev_shm_filesystem`
-  - Default: `ext4`
+  - Default: `tmpfs`
  - Description: Configure file system for fstab entry /dev/shm
+- `os_mnt_dev_shm_dump`
+  - Default: `0`
+  - Description: Configure dump for fstab entry /var/tmp.
+- `os_mnt_dev_shm_passno`
+  - Default: `0`
+  - Description: Configure passno for fstab entry /var/tmp.
 - `os_mnt_home_dir_mode`
  - Default: `0755`
  - Description: Set default perimissions for /home
@@ -340,13 +367,19 @@ We know that this is the case on Raspberry Pi.
  - Description: Set to true to configure /home mountpoint
 - `os_mnt_home_src`
  - Default: `""`
-  - Description: Set mount source for /home
+  - Description: Set mount source for /home. If empty, the current file system source device will be used.
 - `os_mnt_home_options`
  - Default: `rw,nosuid,nodev`
  - Description: Configure mount options for /home
 - `os_mnt_home_filesystem`
-  - Default: `ext4`
-  - Description: Configure file system for fstab entry /home
+  - Default: `""`
+  - Description: Configure file system for fstab entry /home. If empty, the current file system type will be used.
+- `os_mnt_home_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_home_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_run_dir_mode`
  - Default: `0755`
  - Description: Set default perimissions for /run
@@ -360,8 +393,35 @@ We know that this is the case on Raspberry Pi.
  - Default: `rw,nosuid,nodev`
  - Description: Configure mount options for /run
 - `os_mnt_run_filesystem`
-  - Default: `ext4`
+  - Default: `tmpfs`
  - Description: Configure file system for fstab entry /run
+- `os_mnt_run_dump`
+  - Default: `0`
+  - Description: Configure dump for fstab entry /var/tmp.
+- `os_mnt_run_passno`
+  - Default: `0`
+  - Description: Configure passno for fstab entry /var/tmp.
+- `os_mnt_tmp_dir_mode`
+  - Default: `1777`
+  - Description: Set default perimissions for /tmp
+- `os_mnt_tmp_enabled`
+  - Default: `false`
+  - Description: Set to true to configure /tmp mountpoint
+- `os_mnt_tmp_src`
+  - Default: `""`
+  - Description: Set mount source for /tmp. If empty, the current file system source device will be used.
+- `os_mnt_tmp_options`
+  - Default: `rw,nosuid,nodev,noexec`
+  - Description: Configure mount options for /tmp
+- `os_mnt_tmp_filesystem`
+  - Default: `""`
+  - Description: Configure file system for fstab entry /tmp. If empty, the current file system type will be used.
+- `os_mnt_tmp_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_tmp_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_var_dir_mode`
  - Default: `0755`
  - Description: Set default perimissions for /var
@@ -370,13 +430,19 @@ We know that this is the case on Raspberry Pi.
  - Description: Set to true to configure /var mountpoint
 - `os_mnt_var_src`
  - Default: `""`
-  - Description: Set mount source for /var
+  - Description: Set mount source for /var. If empty, the current file system source device will be used.
 - `os_mnt_var_options`
  - Default: `rw,nosuid,nodev`
  - Description: Configure mount options for /var
 - `os_mnt_var_filesystem`
-  - Default: `ext4`
-  - Description: Configure file system for fstab entry /var
+  - Default: `""`
+  - Description: Configure file system for fstab entry /var. If empty, the current file system type will be used.
+- `os_mnt_var_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_var_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_var_log_dir_mode`
  - Default: `0755`
  - Description: Set default perimissions for /var/log
@@ -385,13 +451,19 @@ We know that this is the case on Raspberry Pi.
  - Description: Set to true to configure /var/log mountpoint
 - `os_mnt_var_log_src`
  - Default: `""`
-  - Description: Set mount source for /var/log
+  - Description: Set mount source for /var/log. If empty, the current file system source device will be used.
 - `os_mnt_var_log_options`
  - Default: `rw,nosuid,nodev,noexec`
  - Description: Configure mount options for /var/log
 - `os_mnt_var_log_filesystem`
-  - Default: `ext4`
-  - Description: Configure file system for fstab entry /var/log
+  - Default: `""`
+  - Description: Configure file system for fstab entry /var/log. If empty, the current file system type will be used.
+- `os_mnt_var_log_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_var_log_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_var_log_audit_dir_mode`
  - Default: `0640`
  - Description: Set default perimissions for /var/log/audit
@@ -400,13 +472,19 @@ We know that this is the case on Raspberry Pi.
  - Description: Set to true to configure /var/log/audit mountpoint
 - `os_mnt_var_log_audit_src`
  - Default: `""`
-  - Description: Set mount source for /var/log/audit
+  - Description: Set mount source for /var/log/audit. If empty, the current file system source device will be used.
 - `os_mnt_var_log_audit_options`
  - Default: `rw,nosuid,nodev,noexec`
  - Description: Configure mount options for /var/log/audit
 - `os_mnt_var_log_audit_filesystem`
-  - Default: `ext4`
-  - Description: Configure file system for fstab entry /var/log/audit
+  - Default: `""`
+  - Description: Configure file system for fstab entry /var/log/audit. If empty, the current file system type will be used.
+- `os_mnt_var_log_audit_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_var_log_audit_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_var_tmp_dir_mode`
  - Default: `1777`
  - Description: Set default perimissions for /var/tmp
@@ -415,13 +493,25 @@ We know that this is the case on Raspberry Pi.
  - Description: Set to true to configure /var/tmp mountpoint
 - `os_mnt_var_tmp_src`
  - Default: `""`
-  - Description: Set mount source for /var/tmp
+  - Description: Set mount source for /var/tmp. If empty, the current file system source device will be used.
 - `os_mnt_var_tmp_options`
  - Default: `rw,nosuid,nodev,noexec`
  - Description: Configure mount options for /var/tmp
 - `os_mnt_var_tmp_filesystem`
-  - Default: `ext4`
-  - Description: Configure file system for fstab entry /var/tmp
+  - Default: `""`
+  - Description: Configure file system for fstab entry /var/tmp. If empty, the current file system type will be used.
+- `os_mnt_var_tmp_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_var_tmp_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_netrc_enabled`
+  - Default: `True`
+  - Description: Configure filesystem for existence of .netrc file in homedir
+- `os_netrc_whitelist_user`
+  - Default: ``
+  - Description: Add list of user to allow creation of .netrc in users homedir

 ## Packages

@@ -9,19 +9,27 @@ os_auth_lockout_time: 600  # Seconds (600 = 10min)
 os_auth_timeout: 60
 os_auth_allow_homeless: false
 os_auth_pam_passwdqc_enable: true
-os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8'  # Used in RHEL6
+os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8'  # Used in Debian
 os_auth_pam_pwquality_options: 'try_first_pass retry=3 authtok_type='  # Used in RHEL7 and RHEL8
 os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]

 os_chfn_restrict: ''

-# Set to false to disable chmod /home folders to 700
+# Set to false to disable chmod userhome folders to 700
+os_chmod_rootuser_home_folder: true
 os_chmod_home_folders: true

 # May contain: change_user
 os_security_users_allow: []
 # Specify user home folders in /home that shouldn't be chmodded to 700
 os_ignore_home_folder_users: ['lost+found']
+
+# Set to false to disable password age enforcement on existing users
+os_rootuser_pw_ageing: false
+
+# When enabled and there are multiple users with UID=0, only "root" will be kept. Others will be deleted.
+os_remove_additional_root_users: false
+
 # Specify system accounts whose login should not be disabled and password not changed
 os_ignore_users: ['vagrant', 'kitchen']
 os_security_kernel_enable_module_loading: true
@@ -338,7 +346,7 @@ os_ctrlaltdel_disabled: false
 # Set to false to disable installing and configuring limits.
 os_limits_enabled: true

-# Set to false to disable installing and configuring login_defs.
+# Set to false to disable installing and configuring login_defs for newly created users.
 os_login_defs_enabled: true

 # Set to false to disable installing and configuring minimize_access.
@@ -390,52 +398,84 @@ os_mnt_boot_dir_mode: '0700'
 os_mnt_boot_enabled: false
 os_mnt_boot_src: ""
 os_mnt_boot_options: 'rw,nosuid,nodev,noexec'
-os_mnt_boot_filesystem: 'ext4'
+os_mnt_boot_filesystem: ""
+os_mnt_boot_dump: ""
+os_mnt_boot_passno: ""

 os_mnt_dev_dir_mode: '0755'
 os_mnt_dev_enabled: true
 os_mnt_dev_src: "devtmpfs"
 os_mnt_dev_options: 'rw,nosuid,noexec'
 os_mnt_dev_filesystem: "devtmpfs"
+os_mnt_dev_dump: ""
+os_mnt_dev_passno: ""

 os_mnt_dev_shm_dir_mode: '1777'
 os_mnt_dev_shm_enabled: true
 os_mnt_dev_shm_src: "tmpfs"
 os_mnt_dev_shm_options: 'rw,nosuid,nodev,noexec'
 os_mnt_dev_shm_filesystem: "tmpfs"
+os_mnt_dev_shm_dump: ""
+os_mnt_dev_shm_passno: ""

 os_mnt_home_dir_mode: '0755'
 os_mnt_home_enabled: false
 os_mnt_home_src: ""
 os_mnt_home_options: 'rw,nosuid,nodev'
-os_mnt_home_filesystem: "ext4"
+os_mnt_home_filesystem: ""
+os_mnt_home_dump: ""
+os_mnt_home_passno: ""

 os_mnt_run_dir_mode: '0755'
 os_mnt_run_enabled: true
 os_mnt_run_src: "tmpfs"
 os_mnt_run_options: 'rw,nosuid,nodev'
 os_mnt_run_filesystem: "tmpfs"
+os_mnt_run_dump: ""
+os_mnt_run_passno: ""
+
+os_mnt_tmp_dir_mode: '1777'
+os_mnt_tmp_enabled: false
+os_mnt_tmp_src: ""
+os_mnt_tmp_options: 'rw,nosuid,nodev,noexec'
+os_mnt_tmp_filesystem: ""
+os_mnt_tmp_dump: ""
+os_mnt_tmp_passno: ""

 os_mnt_var_dir_mode: '0755'
 os_mnt_var_enabled: false
 os_mnt_var_src: ""
 os_mnt_var_options: 'rw,nosuid,nodev'
-os_mnt_var_filesystem: "ext4"
+os_mnt_var_filesystem: ""
+os_mnt_var_dump: ""
+os_mnt_var_passno: ""

 os_mnt_var_log_dir_mode: '0755'
 os_mnt_var_log_enabled: false
 os_mnt_var_log_src: ""
 os_mnt_var_log_options: 'rw,nosuid,nodev,noexec'
-os_mnt_var_log_filesystem: "ext4"
+os_mnt_var_log_filesystem: ""
+os_mnt_var_log_dump: ""
+os_mnt_var_log_passno: ""

 os_mnt_var_log_audit_dir_mode: '0700'
 os_mnt_var_log_audit_enabled: false
 os_mnt_var_log_audit_src: ""
 os_mnt_var_log_audit_options: 'rw,nosuid,nodev,noexec'
-os_mnt_var_log_audit_filesystem: "ext4"
+os_mnt_var_log_audit_filesystem: ""
+os_mnt_var_log_audit_dump: ""
+os_mnt_var_log_audit_passno: ""

 os_mnt_var_tmp_dir_mode: '1777'
 os_mnt_var_tmp_enabled: false
 os_mnt_var_tmp_src: ""
 os_mnt_var_tmp_options: 'rw,nosuid,nodev,noexec'
-os_mnt_var_tmp_filesystem: "ext4"
+os_mnt_var_tmp_filesystem: ""
+os_mnt_var_tmp_dump: ""
+os_mnt_var_tmp_passno: ""
+
+#
+# .netrc User whitelist
+# keep .netrc file for users in whitelist
+os_netrc_enabled: true
+os_netrc_whitelist_user: []
@@ -2,7 +2,7 @@
 - name: Update-initramfs
  command: 'update-initramfs -u'

- name: restart-auditd
+- name: Restart auditd
  command:
    cmd: 'service auditd restart'  # rhel: see: https://access.redhat.com/solutions/2664811
    warn: false  # sadly 'service' module fails in that case also by using 'use: service'
@@ -11,3 +11,9 @@
 - name: Reload systemd
  systemd:
    daemon_reload: true
+
+- name: Remount filesystems
+  mount:
+    path: "{{ item }}"
+    state: remounted
+  loop: "{{ mountpoints_changed }}"
@@ -8,22 +8,22 @@ galaxy_info:
  platforms:
    - name: EL
      versions:
-        - 7
-        - 8
+        - "7"
+        - "8"
    - name: Ubuntu
      versions:
-        - xenial
        - bionic
+        - focal
+        - jammy
    - name: Debian
      versions:
-        - stretch
        - buster
        - bullseye
    - name: Amazon
    - name: Fedora
-    - name: Archlinux
+    - name: ArchLinux
    - name: SmartOS
-    - name: openSUSE
+    - name: opensuse
  galaxy_tags:
    - system
    - security
@@ -12,5 +12,5 @@
    owner: 'root'
    group: 'root'
    mode: '0640'
-  notify: 'restart-auditd'
+  notify: Restart auditd
  tags: auditd
@@ -22,75 +22,97 @@
  with_dict: '{{ os_vars }}'
  tags: always

- import_tasks: auditd.yml
+- name: Import tasks for auditd
+  import_tasks: auditd.yml
  tags: auditd
  when: os_auditd_enabled | bool

- import_tasks: cron.yml
+- name: Import tasks for cron
+  import_tasks: cron.yml
  tags: cron
  when: os_cron_enabled | bool

- import_tasks: ctrlaltdel.yml
+- name: Import tasks to configure ctrl+alt+del
+  import_tasks: ctrlaltdel.yml
  tags: ctrlaltdel
  when: os_ctrlaltdel_disabled | bool

- import_tasks: limits.yml
+- name: Import tasks to configure limits
+  import_tasks: limits.yml
  tags: limits
  when: os_limits_enabled | bool

- import_tasks: login_defs.yml
+- name: Import tasks to configure login_defs
+  import_tasks: login_defs.yml
  tags: login_defs
  when: os_login_defs_enabled | bool

- import_tasks: minimize_access.yml
+- name: Import tasks to minimize access permissions
+  import_tasks: minimize_access.yml
  tags: minimize_access
  when: os_minimize_access_enabled | bool

- import_tasks: pam.yml
+- name: Import tasks to configure PAM
+  import_tasks: pam.yml
  tags: pam
  when: os_pam_enabled | bool

- import_tasks: modprobe.yml
+- name: Import tasks to configure modules
+  import_tasks: modprobe.yml
  tags: modprobe
  when: os_modprobe_enabled | bool

- import_tasks: profile.yml
+- name: Import tasks to configure profile
+  import_tasks: profile.yml
  tags: profile
  when: os_profile_enabled | bool

- import_tasks: securetty.yml
+- name: Import tasks to configure securetty
+  import_tasks: securetty.yml
  tags: securetty
  when: os_securetty_enabled | bool

- import_tasks: suid_sgid.yml
+- name: Import tasks to set suid and sgid
+  import_tasks: suid_sgid.yml
  when: os_security_suid_sgid_enforce  | bool
  tags: suid_sgid

- import_tasks: sysctl.yml
+- name: Import tasks to configure sysctl
+  import_tasks: sysctl.yml
  tags: sysctl
  when: os_sysctl_enabled | bool

- import_tasks: user_accounts.yml
+- name: Import tasks to harden user accounts
+  import_tasks: user_accounts.yml
  tags: user_accounts
  when: os_user_accounts_enabled | bool

- import_tasks: rhosts.yml
+- name: Import tasks to configure rhosts
+  import_tasks: rhosts.yml
  tags: rhosts
  when: os_rhosts_enabled | bool

- import_tasks: yum.yml
+- name: Import tasks to configure netrc
+  import_tasks: netrc.yml
+  tags: netrc
+  when: os_netrc_enabled | bool
+
+- name: Import tasks to configure yum
+  import_tasks: yum.yml
  tags: yum
  when:
    - ansible_facts.os_family == 'RedHat'
    - os_yum_enabled | bool

- import_tasks: apt.yml
+- name: Import tasks to configure apt
+  import_tasks: apt.yml
  tags: apt
  when:
    - ansible_facts.os_family == 'Debian'
    - os_apt_enabled | bool

- import_tasks: selinux.yml
+- name: Import tasks to configure selinux
+  import_tasks: selinux.yml
  tags: selinux
  when:
    - ansible_facts.selinux.status == 'enabled'
@@ -1,5 +1,6 @@
 ---
- name: disable coredumps
+- name: Disable coredumps
+  when: not os_security_kernel_enable_core_dump | bool
  block:
  - name: Create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
    file:
@@ -28,7 +29,7 @@
      modification_time: preserve
      access_time: preserve

-  - name: create coredump.conf.d-directory if it does not exist
+  - name: Create coredump.conf.d-directory if it does not exist
    file:
      path: '/etc/systemd/coredump.conf.d'
      owner: root
@@ -37,7 +38,7 @@
      state: directory
    when: ansible_service_mgr == "systemd"

-  - name: create custom.conf for disabling coredumps
+  - name: Create custom.conf for disabling coredumps
    template:
      src: 'etc/systemd/coredump.conf.d/coredumps.conf.j2'
      dest: '/etc/systemd/coredump.conf.d/custom.conf'
@@ -47,9 +48,8 @@
    when: ansible_service_mgr == "systemd"
    notify: Reload systemd

-  when: not os_security_kernel_enable_core_dump | bool
-
- name: enable coredumps
+- name: Enable coredumps
+  when: os_security_kernel_enable_core_dump | bool
  block:
    - name: Remove coredump.conf.d directory with files
      file:
@@ -62,4 +62,3 @@
      file:
        path: /etc/security/limits.d/10.hardcore.conf
        state: absent
-  when: os_security_kernel_enable_core_dump | bool
@@ -1,3 +1,6 @@
 ---
- include_tasks: hardening.yml
+- name: Include hardening tasks
+  include_tasks: hardening.yml
  when: os_hardening_enabled | bool
+  tags:
+    - always
@@ -6,7 +6,7 @@
 # also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
 - name: Find files with write-permissions for group
  shell: "find -L {{ item }} -perm /go+w -type f"  # noqa command-instead-of-shell
-  with_flattened:
+  with_community.general.flattened:
    - '/usr/local/sbin'
    - '/usr/local/bin'
    - '/usr/sbin'
@@ -81,194 +81,26 @@
    opts: '{{ proc_mnt_options }}'
    state: mounted

- name: Check if boot exists
-  stat:
-    path: /boot
-  register: boot_exists
+- name: Generate list of current available mounted filesystems on the system
+  set_fact:
+    mountpoints_list: "{{ ansible_mounts | map(attribute='mount') | list }}"

- name: Mount /boot with hardened options
-  mount:
-    path: /boot
-    src: '{{ os_mnt_boot_src }}'
-    fstype: '{{ os_mnt_boot_filesystem }}'
-    opts: '{{ os_mnt_boot_options }}'
-    state: present
-  register: bootmount
-  when:
-    - os_mnt_boot_enabled | bool
-    - boot_exists.stat.exists | bool
+- name: Append special devices list to valid mountpoint list
+  set_fact:
+    mountpoints_list: "{{ mountpoints_list + ['/dev', '/dev/shm', '/run'] }}"

- name: Harden permissions for /boot directory
-  file:
-    dest: /boot
-    owner: 'root'
-    group: 'root'
-    mode: '{{ os_mnt_boot_dir_mode }}'
-  when:  boot_exists.stat.exists | bool
-
- name: Mount /dev with hardened options
-  mount:
-    path: /dev
-    src: '{{ os_mnt_dev_src }}'
-    fstype: '{{ os_mnt_dev_filesystem }}'
-    opts: '{{ os_mnt_dev_options }}'
-    state: present
-  register: devmount
-  when: os_mnt_dev_enabled | bool
-
- name: Harden permissions for /dev directory
-  file:
-    dest: /dev
-    owner: 'root'
-    group: 'root'
-    mode: '{{ os_mnt_dev_dir_mode }}'
-
- name: Mount /dev/shm with hardened options
-  mount:
-    path: /dev/shm
-    src: '{{ os_mnt_dev_shm_src }}'
-    fstype: '{{ os_mnt_dev_shm_filesystem }}'
-    opts: '{{ os_mnt_dev_shm_options }}'
-    state: present
-  register: devshmmount
-  when: os_mnt_dev_shm_enabled | bool
-
- name: Harden permissions for /dev/shm directory
-  file:
-    dest: /dev/shm
-    owner: 'root'
-    group: 'root'
-    mode: '{{ os_mnt_dev_shm_dir_mode }}'
-
- name: Mount /home with hardened options
-  mount:
-    path: /home
-    src: '{{ os_mnt_home_src }}'
-    fstype: '{{ os_mnt_home_filesystem }}'
-    opts: '{{ os_mnt_home_options }}'
-    state: present
-  register: homemount
-  when: os_mnt_home_enabled | bool
-
- name: Harden permissions for /home directory
-  file:
-    dest: /home
-    owner: 'root'
-    group: 'root'
-    mode: '{{ os_mnt_home_dir_mode }}'
-
- name: Mount /run with hardened options
-  mount:
-    path: /run
-    src: '{{ os_mnt_run_src }}'
-    fstype: '{{ os_mnt_run_filesystem }}'
-    opts: '{{ os_mnt_run_options }}'
-    state: present
-  register: runmount
-  when: os_mnt_run_enabled | bool
-
- name: Harden permissions for /run directory
-  file:
-    dest: /run
-    owner: 'root'
-    group: 'root'
-    mode: '{{ os_mnt_run_dir_mode }}'
-
- name: Mount /var with hardened options
-  mount:
-    path: /var
-    src: '{{ os_mnt_var_src }}'
-    fstype: '{{ os_mnt_var_filesystem }}'
-    opts: '{{ os_mnt_var_options }}'
-    state: present
-  register: varmount
-  when: os_mnt_var_enabled | bool
-
- name: Harden permissions for /var directory
-  file:
-    dest: /var
-    owner: 'root'
-    group: 'root'
-    mode: '{{ os_mnt_var_dir_mode }}'
-
- name: Mount /var/log with hardened options
-  mount:
-    path: /var/log
-    src: '{{ os_mnt_var_log_src }}'
-    fstype: '{{ os_mnt_var_log_filesystem }}'
-    opts: '{{ os_mnt_var_log_options }}'
-    state: present
-  register: varlogmount
-  when: os_mnt_var_log_enabled | bool
-
- name: Harden permissions for /var/log directory
-  file:
-    dest: /var/log
-    owner: 'root'
-    group: 'root'
-    mode: '{{ os_mnt_var_log_dir_mode }}'
-
- name: Check if /var/log/audit exists
-  stat:
-    path: /var/log/audit
-  register: var_log_audit_exists
-
- name: Mount /var/log/audit with hardened options
-  mount:
-    path: /var/log/audit
-    src: '{{ os_mnt_var_log_audit_src }}'
-    fstype: '{{ os_mnt_var_log_audit_filesystem }}'
-    opts: '{{ os_mnt_var_log_audit_options }}'
-    state: present
-  register: varlogauditmount
-  when:
-    - os_mnt_var_log_audit_enabled | bool
-    - var_log_audit_exists.stat.exists | bool
-    - os_auditd_enabled | bool
-
- name: Harden permissions for /var/log/audit directory
-  file:
-    dest: /var/log/audit
-    owner: 'root'
-    group: 'root'
-    mode: '{{ os_mnt_var_log_audit_dir_mode }}'
-  when:
-    - os_mnt_var_log_audit_enabled | bool
-    - var_log_audit_exists.stat.exists | bool
-    - os_auditd_enabled | bool
-
- name: Mount /var/tmp with hardened options
-  mount:
-    path: /var/tmp
-    src: '{{ os_mnt_var_tmp_src }}'
-    fstype: '{{ os_mnt_var_tmp_filesystem }}'
-    opts: '{{ os_mnt_var_tmp_options }}'
-    state: present
-  register: vartmpmount
-  when: os_mnt_var_tmp_enabled | bool
-
- name: Harden permissions for /var/tmp directory
-  file:
-    dest: /var/tmp
-    owner: 'root'
-    group: 'root'
-    mode: '{{ os_mnt_var_tmp_dir_mode }}'
-
- name: remount all changed mountpoints
-  mount:
-    path: "{{ item.path }}"
-    src: "{{ item.src }}"
-    fstype: "{{ item.fstype }}"
-    opts: "{{ item.opts }}"
-    state: remounted
-  when: item.when | bool
+- name: Minimize access for filesystems
+  include_tasks: minimize_access_fs.yml
  loop:
-    - { path: '/boot', src: '{{ os_mnt_boot_src }}', fstype: '{{ os_mnt_boot_filesystem }}', opts: '{{ os_mnt_boot_options }}', when: "{{ bootmount.changed }}" }
-    - { path: '/dev', src: '{{ os_mnt_dev_src }}', fstype: '{{ os_mnt_dev_filesystem }}', opts: '{{ os_mnt_dev_options }}', when: "{{ devmount.changed }}" }
-    - { path: '/dev/shm', src: '{{ os_mnt_dev_shm_src }}', fstype: '{{ os_mnt_dev_shm_filesystem }}', opts: '{{ os_mnt_dev_shm_options }}', when: "{{ devshmmount.changed }}" }
-    - { path: '/home', src: '{{ os_mnt_home_src }}', fstype: '{{ os_mnt_home_filesystem }}', opts: '{{ os_mnt_home_options }}', when: "{{ homemount.changed }}" }
-    - { path: '/run', src: '{{ os_mnt_run_src }}', fstype: '{{ os_mnt_run_filesystem }}', opts: '{{ os_mnt_run_options }}', when: "{{ runmount.changed }}" }
-    - { path: '/var', src: '{{ os_mnt_var_src }}', fstype: '{{ os_mnt_var_filesystem }}', opts: '{{ os_mnt_var_options }}', when: "{{ varmount.changed }}" }
-    - { path: '/var/log', src: '{{ os_mnt_var_log_src }}', fstype: '{{ os_mnt_var_log_filesystem }}', opts: '{{ os_mnt_var_log_options }}', when: "{{ varlogmount.changed }}" }
-    - { path: '/var/log/audit', src: '{{ os_mnt_var_log_audit_src }}', fstype: '{{ os_mnt_var_log_audit_filesystem }}', opts: '{{ os_mnt_var_log_audit_options }}', when: "{{ varlogauditmount.changed }}" }
-    - { path: '/var/tmp', src: '{{ os_mnt_var_tmp_src }}', fstype: '{{ os_mnt_var_tmp_filesystem }}', opts: '{{ os_mnt_var_tmp_options }}', when: "{{ vartmpmount.changed }}" }
+    - { path: '/boot', src: '{{ os_mnt_boot_src }}', fstype: '{{ os_mnt_boot_filesystem }}', opts: '{{ os_mnt_boot_options }}', enabled: "{{ os_mnt_boot_enabled }}", mode: "{{ os_mnt_boot_dir_mode }}", dump: "{{ os_mnt_boot_dump }}", passno: "{{ os_mnt_boot_passno }}" }
+    - { path: '/dev', src: '{{ os_mnt_dev_src }}', fstype: '{{ os_mnt_dev_filesystem }}', opts: '{{ os_mnt_dev_options }}', enabled: "{{ os_mnt_dev_enabled }}", mode: "{{ os_mnt_dev_dir_mode }}", dump: "{{ os_mnt_dev_dump }}", passno: "{{ os_mnt_dev_passno }}" }
+    - { path: '/dev/shm', src: '{{ os_mnt_dev_shm_src }}', fstype: '{{ os_mnt_dev_shm_filesystem }}', opts: '{{ os_mnt_dev_shm_options }}', enabled: "{{ os_mnt_dev_shm_enabled }}", mode: "{{ os_mnt_dev_shm_dir_mode }}", dump: "{{ os_mnt_dev_shm_dump }}", passno: "{{ os_mnt_dev_shm_passno }}" }
+    - { path: '/home', src: '{{ os_mnt_home_src }}', fstype: '{{ os_mnt_home_filesystem }}', opts: '{{ os_mnt_home_options }}', enabled: "{{ os_mnt_home_enabled }}", mode: "{{ os_mnt_home_dir_mode }}", dump: "{{ os_mnt_home_dump }}", passno: "{{ os_mnt_home_passno }}" }
+    - { path: '/run', src: '{{ os_mnt_run_src }}', fstype: '{{ os_mnt_run_filesystem }}', opts: '{{ os_mnt_run_options }}', enabled: "{{ os_mnt_run_enabled }}", mode: "{{ os_mnt_run_dir_mode }}", dump: "{{ os_mnt_run_dump }}", passno: "{{ os_mnt_run_passno }}" }
+    - { path: '/tmp', src: '{{ os_mnt_tmp_src }}', fstype: '{{ os_mnt_tmp_filesystem }}', opts: '{{ os_mnt_tmp_options }}', enabled: "{{ os_mnt_tmp_enabled }}", mode: "{{ os_mnt_tmp_dir_mode }}", dump: "{{ os_mnt_tmp_dump }}", passno: "{{ os_mnt_tmp_passno }}" }
+    - { path: '/var', src: '{{ os_mnt_var_src }}', fstype: '{{ os_mnt_var_filesystem }}', opts: '{{ os_mnt_var_options }}', enabled: "{{ os_mnt_var_enabled }}", mode: "{{ os_mnt_var_dir_mode }}", dump: "{{ os_mnt_var_dump }}", passno: "{{ os_mnt_var_passno }}" }
+    - { path: '/var/log', src: '{{ os_mnt_var_log_src }}', fstype: '{{ os_mnt_var_log_filesystem }}', opts: '{{ os_mnt_var_log_options }}', enabled: "{{ os_mnt_var_log_enabled }}", mode: "{{ os_mnt_var_log_dir_mode }}", dump: "{{ os_mnt_var_log_dump }}", passno: "{{ os_mnt_var_log_passno }}" }
+    - { path: '/var/log/audit', src: '{{ os_mnt_var_log_audit_src }}', fstype: '{{ os_mnt_var_log_audit_filesystem }}', opts: '{{ os_mnt_var_log_audit_options }}', enabled: "{{ os_mnt_var_log_audit_enabled }}", mode: "{{ os_mnt_var_log_audit_dir_mode }}", dump: "{{ os_mnt_var_log_audit_dump }}", passno: "{{ os_mnt_var_log_audit_passno }}" }
+    - { path: '/var/tmp', src: '{{ os_mnt_var_tmp_src }}', fstype: '{{ os_mnt_var_tmp_filesystem }}', opts: '{{ os_mnt_var_tmp_options }}', enabled: "{{ os_mnt_var_tmp_enabled }}", mode: "{{ os_mnt_var_tmp_dir_mode }}", dump: "{{ os_mnt_var_tmp_dump }}", passno: "{{ os_mnt_var_tmp_passno }}" }
+  loop_control:
+    loop_var: mount
@@ -0,0 +1,36 @@
+---
+- name: "Configure mount {{ mount.path }} with hardened options"
+  mount:
+    path: "{{ mount.path }}"
+    src: "{{ mount.src | default(mountinfo.device, true) }}"
+    fstype: "{{ mount.fstype | default(mountinfo.fstype, true) }}"
+    opts: "{{ mount.opts }}"
+    dump: "{{ mount.dump | default('1' if mount.fstype | default(mountinfo.fstype, true) in ['ext3', 'ext4'] else '0', true) }}"
+    passno: "{{ mount.passno | default('2' if mount.fstype | default(mountinfo.fstype, true) in ['ext3', 'ext4'] else '0', true) }}"
+    state: present
+  register: mountpoint
+  when:
+    - mount.enabled | bool
+    - mount.path in mountpoints_list
+  vars:
+    mountinfo: "{{ ansible_mounts | selectattr('mount', 'equalto', mount.path) | list | first | default(None) }}"
+  notify: Remount filesystems
+
+- name: "Check if {{ mount.path }} exists"
+  stat:
+    path: "{{ mount.path }}"
+  register: mountpoint_exists
+
+- name: "Harden permissions for {{ mount.path }} directory"
+  file:
+    dest: "{{ mount.path }}"
+    owner: 'root'
+    group: 'root'
+    mode: "{{ mount.mode }}"
+  when:
+    - mountpoint_exists.stat.exists | bool
+
+- name: "Register changed mountpoints"
+  set_fact:
+    mountpoints_changed: "{{ mountpoints_changed | default([]) + [mount.path] }}"
+  when: mountpoint.changed  # noqa no-handler
@@ -0,0 +1,13 @@
+---
+- name: Get user accounts | os-09
+  command: "awk -F: '{print $1}' /etc/passwd"
+  changed_when: false
+  check_mode: false
+  register: users_accounts
+
+- name: Delete .netrc-files from system | os-09
+  file:
+    dest: '~{{ item }}/.netrc'
+    state: 'absent'
+  loop: '{{ users_accounts.stdout_lines | flatten | default([]) }}'
+  when: item not in os_netrc_whitelist_user
@@ -17,11 +17,13 @@
  when:
    - ansible_facts.os_family != 'Archlinux'

- import_tasks: pam_debian.yml
+- name: Import tasks for Debian PAM
+  import_tasks: pam_debian.yml
  when:
    - ansible_facts.os_family == 'Debian'

- import_tasks: pam_rhel.yml
+- name: Import tasks for RedHat PAM
+  import_tasks: pam_rhel.yml
  when:
    - ansible_facts.os_family == 'RedHat'

@@ -22,9 +22,12 @@
    name: 'libpam-modules'
    state: 'present'
  when:
-    - os_auth_retries > 0
+    - os_auth_retries|int > 0

 - name: Manage tally on Debian stable
+  when:
+    - "'libpam-modules' in ansible_facts.packages"
+    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '<')"
  block:
    - name: Configure tally2
      template:
@@ -34,26 +37,26 @@
        owner: 'root'
        group: 'root'
      when:
-        - os_auth_retries > 0
+        - os_auth_retries|int > 0

    - name: Delete tally2 when retries is 0
      file:
        path: '{{ tally2_path }}'
        state: 'absent'
      when:
-        - os_auth_retries == 0
-  when:
-    - "'libpam-modules' in ansible_facts.packages"
-    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '<')"
+        - os_auth_retries|int == 0

 - name: Manage tally/faillock on Debian unstable
+  when:
+    - "'libpam-modules' in ansible_facts.packages"
+    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '>=')"
  block:
    - name: Delete tally2
      file:
        path: '{{ tally2_path }}'
        state: 'absent'

-    - name:  create tally directory
+    - name: Create tally directory
      file:
        path: '/var/run/faillock'
        state: 'directory'
@@ -77,7 +80,7 @@
        owner: 'root'
        group: 'root'
      when:
-        - os_auth_retries > 0
+        - os_auth_retries|int > 0

    - name: Configure faillock pam authfail
      template:
@@ -87,24 +90,21 @@
        owner: 'root'
        group: 'root'
      when:
-        - os_auth_retries > 0
+        - os_auth_retries|int > 0

    - name: Delete faillock when retries is 0
      file:
        path: '/usr/share/pam-configs/faillock'
        state: 'absent'
      when:
-        - os_auth_retries == 0
+        - os_auth_retries|int == 0

    - name: Delete faillock authfail when retries is 0
      file:
        path: '/usr/share/pam-configs/faillock_authfail'
        state: 'absent'
      when:
-        - os_auth_retries == 0
-  when:
-    - "'libpam-modules' in ansible_facts.packages"
-    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '>=')"
+        - os_auth_retries|int == 0

 - name: Update pam on Debian systems
  command: 'pam-auth-update --package'
@@ -9,15 +9,9 @@
  file:
    dest: '~{{ item }}/.rhosts'
    state: 'absent'
-  with_flattened: '{{ users_accounts.stdout_lines | default([]) }}'
+  loop: '{{ users_accounts.stdout_lines | flatten | default([]) }}'

 - name: Delete hosts.equiv from system | os-01
  file:
    dest: '/etc/hosts.equiv'
    state: 'absent'
-
- name: Delete .netrc-files from system | os-09
-  file:
-    dest: '~{{ item }}/.netrc'
-    state: 'absent'
-  with_flattened: '{{ users_accounts.stdout_lines | default([]) }}'
@@ -6,7 +6,7 @@
    state: 'file'
    follow: 'yes'
  failed_when: false
-  with_flattened:
+  with_community.general.flattened:
    - '{{ os_security_suid_sgid_system_blacklist }}'
    - '{{ os_security_suid_sgid_blacklist }}'

@@ -27,6 +27,6 @@
    mode: 'a-s'
    state: 'file'
    follow: 'yes'
-  with_flattened:
+  with_community.general.flattened:
    - '{{ suid | default([]) | difference(os_security_suid_sgid_whitelist) }}'
  when: os_security_suid_sgid_remove_from_unknown | bool
@@ -42,6 +42,7 @@
  register: initramfs

 - name: Change sysctls
+  when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']
  block:
    - name: Create a combined sysctl-dict if os-dependent sysctls are defined
      set_fact:
@@ -69,7 +70,6 @@
        ignoreerrors: true
      with_dict: '{{ sysctl_config }}'
      when: item.key not in sysctl_unsupported_entries | default()
-  when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']

 - name: Apply ufw defaults
  template:
@@ -1,4 +1,45 @@
 ---
+- name: Read local linux user database
+  getent:
+    database: passwd
+    # creates a dict for each user containing UID/HOMEDIR etc...
+  when: getent_passwd is undefined  # skip this task if "getent" has run before
+
+- name: Extract root account(s) from local user database
+  loop: "{{ getent_passwd.keys() | list }}"
+  when:
+    - getent_passwd[item][1]|int == 0
+  set_fact:
+    root_users: "{{ root_users | default([]) + [item] }}"
+
+- name: Set ownership of root user home directory(s) to 0700
+  file:
+    mode: 0700
+    owner: "{{ item }}"
+    path: "{{ getent_passwd[item][4] }}"
+    state: directory
+  loop: "{{ root_users }}"
+  when:
+    - os_chmod_rootuser_home_folder | bool
+
+- name: Set password ageing for root user(s)
+  user:
+    name: "{{ item }}"
+    password_expire_min: "{{ os_auth_pw_min_age }}"
+    password_expire_max: "{{ os_auth_pw_max_age }}"
+  loop: "{{ root_users }}"
+  when: os_rootuser_pw_ageing|bool
+
+- name: Remove additional users with UID=0 ("root" user is not touched)
+  user:
+    name: "{{ item }}"
+    state: absent
+  loop: "{{ root_users }}"
+  when:
+    - os_remove_additional_root_users|bool
+    - root_users|length > 1
+    - item != "root"
+
 - name: Get UID_MIN from login.defs
  shell: awk '/^\s*UID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs
  args:
@@ -25,7 +66,7 @@
  when: uid_max is not defined

 - name: Get all system accounts
-  command: awk -F'':'' '{ if ( $3 <= {{ uid_max|quote }} ) print $1}' /etc/passwd
+  command: awk -F'':'' '{ if ( $3 <= {{ uid_max | quote }} ) print $1}' /etc/passwd
  args:
    removes: /etc/passwd
  changed_when: false
@@ -43,10 +84,10 @@
    shell: '{{ os_nologin_shell_path }}'
    password: '*'
    createhome: false
-  with_flattened:
+  with_community.general.flattened:
    - '{{ sys_accs_cond | default([]) | difference(os_ignore_users) | list }}'

- name: get all home directories in /home, but skip ignored users
+- name: Get all home directories in /home, but skip ignored users
  find:
    paths: /home/
    recurse: false
@@ -55,7 +96,7 @@
  register: home_directories
  when: os_chmod_home_folders | bool

- name: set ownership of /home directories to 0700
+- name: Set ownership of /home directories to 0700
  file:
    mode: 0700
    path: "{{ item.path }}"
@@ -4,7 +4,7 @@
 #%PAM-1.0
 auth        required      pam_env.so
 auth        required      pam_faildelay.so delay=2000000
-{% if os_auth_retries > 0 %}
+{% if os_auth_retries|int > 0 %}
 auth        required      pam_faillock.so preauth silent audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
 {% endif %}
 {% if (os_auth_pam_sssd_enable | bool) %}
@@ -16,12 +16,12 @@ auth        sufficient    pam_unix.so nullok try_first_pass
 auth        [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
 auth        sufficient    pam_sss.so forward_pass
 {% endif %}
-{% if os_auth_retries > 0 %}
+{% if os_auth_retries|int > 0 %}
 auth        required      pam_faillock.so authfail audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
 {% endif %}
 auth        required      pam_deny.so

-{% if os_auth_retries > 0 %}
+{% if os_auth_retries|int > 0 %}
 account     required      pam_faillock.so
 {% endif %}
 account     required      pam_unix.so
@@ -33,7 +33,7 @@ os_auth_sub_gid_min: 100000
 os_auth_sub_gid_max: 600100000
 os_auth_sub_gid_count: 65536

-os_auth_pam_sssd_enable: false
+os_auth_pam_sssd_enable: true

 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
@@ -1,45 +0,0 @@
---
-
-os_packages_pam_ccreds: 'pam_ccreds'
-os_nologin_shell_path: '/sbin/nologin'
-
-# Different distros use different standards for /etc/shadow perms, e.g.
-# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
-# You must provide key/value pairs for owner, group, and mode if overriding.
-os_shadow_perms:
-  owner: root
-  group: root
-  mode: '0000'
-
-os_passwd_perms:
-  owner: root
-  group: root
-  mode: '0644'
-
-os_env_umask: '077'
-
-os_auth_uid_min: 1000
-os_auth_uid_max: 60000
-os_auth_gid_min: 1000
-os_auth_gid_max: 60000
-os_auth_sys_uid_min: 201
-os_auth_sys_uid_max: 999
-os_auth_sys_gid_min: 201
-os_auth_sys_gid_max: 999
-os_auth_sub_uid_min: 100000
-os_auth_sub_uid_max: 600100000
-os_auth_sub_uid_count: 65536
-os_auth_sub_gid_min: 100000
-os_auth_sub_gid_max: 600100000
-os_auth_sub_gid_count: 65536
-
-os_auth_pam_sssd_enable: true
-
-# defaults for useradd
-os_useradd_mail_dir: /var/spool/mail
-os_useradd_create_home: true
-
-modprobe_package: 'module-init-tools'
-auditd_package: 'audit'
-
-hidepid_option: '2'  # allowed values: 0, 1, 2
@@ -1,45 +0,0 @@
---
-
-os_packages_pam_ccreds: 'pam_ccreds'
-os_nologin_shell_path: '/sbin/nologin'
-
-# Different distros use different standards for /etc/shadow perms, e.g.
-# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
-# You must provide key/value pairs for owner, group, and mode if overriding.
-os_shadow_perms:
-  owner: root
-  group: root
-  mode: '0000'
-
-os_passwd_perms:
-  owner: root
-  group: root
-  mode: '0644'
-
-os_env_umask: '077'
-
-os_auth_uid_min: 1000
-os_auth_uid_max: 60000
-os_auth_gid_min: 1000
-os_auth_gid_max: 60000
-os_auth_sys_uid_min: 201
-os_auth_sys_uid_max: 999
-os_auth_sys_gid_min: 201
-os_auth_sys_gid_max: 999
-os_auth_sub_uid_min: 100000
-os_auth_sub_uid_max: 600100000
-os_auth_sub_uid_count: 65536
-os_auth_sub_gid_min: 100000
-os_auth_sub_gid_max: 600100000
-os_auth_sub_gid_count: 65536
-
-os_auth_pam_sssd_enable: true
-
-# defaults for useradd
-os_useradd_mail_dir: /var/spool/mail
-os_useradd_create_home: true
-
-modprobe_package: 'module-init-tools'
-auditd_package: 'audit'
-
-hidepid_option: '2'  # allowed values: 0, 1, 2
@@ -126,8 +126,8 @@ As this role requires root-privileges, we added `become: true` to all tasks. So
  - Default: `false`
  - Description: false to disable display of last login information.
 - `sftp_enabled`
-  - Default: `false`
-  - Description: true to enable sftp configuration.
+  - Default: `true`
+  - Description: false to disable sftp configuration.
 - `sftp_umask`
  - Default: `'0027'`
  - Description: Specifies the umask for sftp.
@@ -272,6 +272,10 @@ Example playbook:
      - "AcceptEnv LANG"
 ```

+## After using the role Ansibles template/copy/file module does not work anymore
+
+If you use this role to disable SFTP (`sftp_enabled: false`) you will get errors. Ansible uses by default SFTP to transfer files to the remote hosts. You have to set `scp_if_ssh = True` in your ansible.cfg. This way Ansible uses SCP to copy files. If your control node uses OpenSSH version 9.0 or above, you also need to set `scp_extra_args = "-O"`, since starting with that version the `scp` utility also defaults to using SFTP.
+
 ## Changing the default port and idempotency

 This role uses the default port 22 or the port configured in the inventory to connect to the server. If the default `ssh` port is changed via `ssh_server_ports`, once the ssh server is restarted, it will still try to connect using the previous port. In order to run this role again on the same server the inventory will have to be updated to use the new ssh port.
@@ -158,8 +158,8 @@ ssh_banner_path: '/etc/ssh/banner.txt'
 # false to disable distribution version leakage during initial protocol handshake
 ssh_print_debian_banner: false      # sshd (Debian OS family only)

-# true to enable sftp configuration
-sftp_enabled: false
+# false to disable sftp configuration
+sftp_enabled: true

 # false to disable sftp chroot
 sftp_chroot: true
@@ -8,21 +8,22 @@ galaxy_info:
  platforms:
    - name: EL
      versions:
-        - 7
-        - 8
+        - "7"
+        - "8"
    - name: Ubuntu
      versions:
-        - xenial
        - bionic
+        - focal
+        - jammy
    - name: Debian
      versions:
-        - stretch
        - buster
+        - bullseye
    - name: Amazon
    - name: Fedora
-    - name: Archlinux
+    - name: ArchLinux
    - name: SmartOS
-    - name: openSUSE
+    - name: opensuse
  galaxy_tags:
    - system
    - security
@@ -110,7 +110,9 @@

 - name: Include tasks to setup ca keys and principals
  include_tasks: ca_keys_and_principals.yml
-  when: ssh_trusted_user_ca_keys_file | length > 0
+  when:
+    - ssh_trusted_user_ca_keys_file | length > 0
+    - ssh_trusted_user_ca_keys | length > 0

 - name: Include selinux specific tasks
  include_tasks: selinux.yml
@@ -1,5 +1,6 @@
 ---
- include_tasks: hardening.yml
+- name: Include hardening tasks
+  include_tasks: hardening.yml
  args:
    apply:
      become: true
@@ -24,7 +24,7 @@
 # The following tasks only get executed when selinux is in state enforcing,
 # UsePam is 'no' and the ssh_password module is not installed. See this issue for
 # more info: https://github.com/hardening-io/ansible-ssh-hardening/issues/23
- name: run selinux tasks
+- name: Run selinux tasks
  when:
    - not (ssh_use_pam | bool)
    - ('ssh_password' not in ssh_password_module.stdout)
@@ -7,7 +7,7 @@ ssh_group: root
 ssh_host_keys_owner: 'root'
 ssh_host_keys_group: 'ssh_keys'
 ssh_selinux_packages:
-  - policycoreutils-python
+  - policycoreutils-python-utils
  - checkpolicy

 # true if SSH support Kerberos
@@ -7,7 +7,7 @@ ssh_group: root
 ssh_host_keys_owner: 'root'
 ssh_host_keys_group: 'ssh_keys'
 ssh_selinux_packages:
-  - python3-policycoreutils
+  - policycoreutils-python
  - checkpolicy

 # true if SSH support Kerberos
@@ -1,23 +0,0 @@
---
-sshd_path: /usr/sbin/sshd
-ssh_host_keys_dir: '/etc/ssh'
-sshd_service_name: sshd
-ssh_owner: root
-ssh_group: root
-ssh_host_keys_owner: 'root'
-ssh_host_keys_group: 'ssh_keys'
-ssh_selinux_packages:
-  - python3-policycoreutils
-  - checkpolicy
-
-# true if SSH support Kerberos
-ssh_kerberos_support: true
-
-# true if SSH has PAM support
-ssh_pam_support: true
-
-sshd_moduli_file: '/etc/ssh/moduli'
-
-# disable CRYPTO_POLICY to take settings from sshd configuration
-# see: https://access.redhat.com/solutions/4410591
-sshd_disable_crypto_policy: true
Author	SHA1	Message	Date
schurzi	99fe8b6969	Merge pull request #594 from dlouzan/fix/type-cast-variables fix(os_hardening): cast expected int types in pam tasks	2022-10-27 20:43:17 +02:00
Diego Louzán	f8295d5248	fix(os_hardening): cast expected int types in pam tasks Signed-off-by: Diego Louzán <[email protected]>	2022-10-27 16:50:08 +02:00
dev-sec CI	a1f75f877b	update changelog	2022-10-26 08:33:13 +00:00
schurzi	901923bac2	Merge pull request #588 from dev-sec/support_more_os Support more os	2022-10-26 10:13:40 +02:00
Martin Schurz	c30ef42355	exclude el9 from vm tests Signed-off-by: Martin Schurz <[email protected]>	2022-10-25 18:59:11 +02:00
Sebastian Gumprich	e2b963d711	change baselines back to master Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-25 18:59:11 +02:00
Sebastian Gumprich	414efd6125	use correct centos stream images, try to fix prepare step for debian tests Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-25 18:59:11 +02:00
Sebastian Gumprich	87a461fc57	use forked mysql-baseline Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-25 18:59:11 +02:00
Sebastian Gumprich	dac66f4a88	simplify OS-vars files Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-25 18:59:11 +02:00
Sebastian Gumprich	3b8b394f10	add ssh-vars for new OS Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-25 18:59:11 +02:00
Sebastian Gumprich	b27ffd08b0	add mysql-vars for new OS Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-25 18:58:53 +02:00
dev-sec CI	8ee946a537	update changelog	2022-10-24 08:04:42 +00:00
Sebastian Gumprich	a176443f22	add support for centos stream 8 and 9, rocky 9 Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-24 10:03:07 +02:00
Sebastian Gumprich	9d75e3b00e	test crypto changes from ssh-baseline Signed-off-by: Sebastian Gumprich <[email protected]>	2022-10-24 10:03:07 +02:00
schurzi	a1b80fe657	adopt all current suggestions from ansible-lint (#592 )	2022-10-24 09:42:23 +02:00
dev-sec CI	53be805099	update changelog	2022-10-21 09:07:46 +00:00
donestefan	464d8df8e8	add hardening of root user account(s) (#579 )	2022-10-21 11:05:43 +02:00
dev-sec CI	f1ea1e52f3	update changelog	2022-10-20 13:00:42 +00:00
Benedikt Böhm	802bad48e6	do not manage trusted user ca keys if none exist (#580 ) Signed-off-by: Benedikt Böhm <[email protected]> Signed-off-by: Benedikt Böhm <[email protected]>	2022-10-20 14:44:14 +02:00
dev-sec CI	d3acab585e	update changelog	2022-09-28 08:54:32 +00:00
Sebastian Gumprich	44489dea5f	run tests only on pushes to master or to PRs (#581 ) Signed-off-by: Sebastian Gumprich <[email protected]> Signed-off-by: Sebastian Gumprich <[email protected]>	2022-09-28 10:44:31 +02:00
dev-sec CI	64b5d82c5f	update galaxy.yml with new version	2022-09-08 13:03:43 +00:00
dev-sec CI	f96c2dd8c9	update changelog	2022-09-08 13:00:02 +00:00
hagenbauer	500cd24beb	nginx variables for configuration and owner (#578 ) Signed-off-by: [email protected] <[email protected]> Signed-off-by: [email protected] <[email protected]>	2022-09-08 14:58:10 +02:00
dev-sec CI	3835b2a18c	update changelog	2022-09-06 14:38:23 +00:00
Simon Baerlocher	883effef82	add centos >8 Support (#573 ) Signed-off-by: Simon Baerlocher <[email protected]> Signed-off-by: Simon Baerlocher <[email protected]>	2022-09-06 16:31:43 +02:00
dev-sec CI	9cc0b254f6	update galaxy.yml with new version	2022-08-26 13:11:17 +00:00
dev-sec CI	80960d5703	update changelog	2022-08-26 11:46:34 +00:00
Sebastian Gumprich	9ac01fb358	add always-tag to include so other tags can be used (#569 ) Signed-off-by: Sebastian Gumprich <[email protected]> Signed-off-by: Sebastian Gumprich <[email protected]>	2022-08-26 13:45:05 +02:00
Sebastian Gumprich	11d187e62e	update supported OS in meta and fix linting (#572 ) Signed-off-by: Sebastian Gumprich <[email protected]> Signed-off-by: Sebastian Gumprich <[email protected]>	2022-08-26 13:44:51 +02:00
Sebastian Gumprich	fbea75ad18	only run release actions on upstream-repo (#568 ) fixes #566 Signed-off-by: Sebastian Gumprich <[email protected]> Signed-off-by: Sebastian Gumprich <[email protected]>	2022-08-26 09:40:59 +02:00
dev-sec CI	40913a3e6d	update changelog	2022-08-26 07:19:56 +00:00
donestefan	38e1c3bbeb	fix misleading comment (#571 ) also RHEL6 is not supported anymore	2022-08-26 09:17:54 +02:00
dev-sec CI	d981a4e545	update galaxy.yml with new version	2022-08-22 11:19:25 +00:00
dev-sec CI	627634d95f	update changelog	2022-08-22 10:41:10 +00:00
Sebastian Gumprich	720d7786b5	fix typo	2022-08-22 12:39:21 +02:00
Sebastian Gumprich	84412e99c2	fix typo	2022-08-22 11:25:08 +02:00
dev-sec CI	516f4cfb01	update changelog	2022-08-22 09:18:59 +00:00
divialth	fb8b9142c8	rework filesystem hardening (#555 ) * rework filesystem hardening - removed a lot duplicated code by using a loop - added new hardening options for /tmp - added new options "passno" and "dump" for every filesystem. currently ansible changed that values to 0 for every fs new default depends on fstype, can be overwriten in config - removed default fstype in config the type will now be autodetected, can be overwriten in config - mount src setting is now optional the source will now be autodetected, can be overwriten in config - it will be now checked, if it is really a mount - changed fs reload to handler - removed check os_auditd_enabled on /var/log/audit Signed-off-by: divialth <[email protected]> * fix lint errors Signed-off-by: divialth <[email protected]> * implemented the name suggestions Signed-off-by: divialth <[email protected]> Signed-off-by: divialth <[email protected]>	2022-08-22 11:16:57 +02:00
dev-sec CI	ca266d25df	update changelog	2022-08-22 08:05:50 +00:00
schurzi	c1cd6c5ac3	change default to allow SFTP (#564 ) * change default to allow SFTP Signed-off-by: Martin Schurz <[email protected]> * add documentation Signed-off-by: Martin Schurz <[email protected]> * diasble sftp for default tests Signed-off-by: Martin Schurz <[email protected]> * extend documentation Signed-off-by: Martin Schurz <[email protected]> * fix typo Signed-off-by: Martin Schurz <[email protected]> * correct ssh version Signed-off-by: Martin Schurz <[email protected]> Signed-off-by: Martin Schurz <[email protected]>	2022-08-22 10:03:37 +02:00
dev-sec CI	5e220525cb	update changelog	2022-08-17 07:11:00 +00:00
PhilippFunkandPhilipp Funk	fd3fc1cfba	add option to bypass .netrc check function (#563 ) add option to whitelist specific user that need a .netrc file in there home dirs add test for .netrc files if option os_netrc_enabled is false Signed-off-by: Philipp Funk <[email protected]> Signed-off-by: Philipp Funk <[email protected]> Co-authored-by: Philipp Funk <[email protected]>	2022-08-17 09:09:00 +02:00
dev-sec CI	6aa01f040a	update galaxy.yml with new version	2022-08-16 15:27:27 +00:00
dev-sec CI	e3b861bc6c	update changelog	2022-08-16 15:23:18 +00:00