Add CVE-2021-33909 mitigations (#466 )

* Add CVE-2021-33909 mitigations kernel.unprivileged_bpf_disabled: 1 kernel.unprivileged_userns_clone: 0 The first one is also used by Tails. Signed-off-by: Paweł Krawczyk <[email protected]> * Clean up whitespaces Signed-off-by: Paweł Krawczyk <[email protected]>
update changelog
2021-07-22 16:32:41 +02:00 · 2021-07-22 08:20:09 +00:00 · 2021-07-22 10:18:01 +02:00 · 2021-07-16 07:43:08 +00:00 · 2021-07-16 09:41:37 +02:00 · 2021-07-13 14:09:08 +00:00
98 changed files with 1725 additions and 506 deletions
@@ -0,0 +1,11 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "pip" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "daily"
@@ -24,7 +24,7 @@ jobs:
        molecule_distro:
          - centos7
          - centos8
-          - ubuntu1604
+          - rocky8
          - ubuntu1804
          - ubuntu2004
          - debian9
@@ -24,7 +24,7 @@ jobs:
        molecule_distro:
          - centos7
          - centos8
-          - ubuntu1604
+          - rocky8
          - ubuntu1804
          - ubuntu2004
          - debian9
@@ -24,7 +24,7 @@ jobs:
        molecule_distro:
          - centos7
          - centos8
-          - ubuntu1604
+          - rocky8
          - ubuntu1804
          - ubuntu2004
          - debian9
@@ -37,6 +37,7 @@ jobs:
          # since they break the changelog generation with the error:
          # "No common ancestor between ... and $version"
          exclude_tags_regex: '[0-6]\.\d\.\d'
+          issue_line_labels: mysql_hardening,os_hardening,ssh_hardening,nginx_hardening

      - name: push changelog
        uses: github-actions-x/[email protected]
@@ -53,19 +54,11 @@ jobs:
      # changelog gets updated but action works on old commit id
      - uses: actions/[email protected]
        with:
-          fetch-depth: 0
+          ref: master

      - name: Generate changelog for the release
-        uses: charmixer/auto-changelog-action@v1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          since_tag: ${{ steps.previoustag.outputs.tag }}
-          future_release: ${{ steps.version.outputs.next-version }}
-          output: CHANGELOGRELEASE.md
-          # this excludes all versions prior to the collection-release
-          # since they break the changelog generation with the error:
-          # "No common ancestor between ... and $version"
-          exclude_tags_regex: '[0-6]\.\d\.\d'
+        run: |
+          sed '/## \[${{ steps.previoustag.outputs.tag }}\]/Q' CHANGELOG.md > CHANGELOGRELEASE.md

      - name: Read CHANGELOG.md
        id: package
@@ -24,8 +24,8 @@ jobs:
        molecule_distro:
          - centos7
          - centos8
+          - rocky8
          - fedora
-          - ubuntu1604
          - ubuntu1804
          - ubuntu2004
          - debian9
@@ -0,0 +1 @@
+CHANGELOG.md
@@ -1,13 +1,187 @@
 # Changelog

+## [7.9.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.9.0) (2021-07-22)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.8.0...7.9.0)
+
+**Implemented enhancements:**
+
+- Allow configuration of password remember in pam [\#467](https://github.com/dev-sec/ansible-collection-hardening/pull/467) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([m41kc0d3](https://github.com/m41kc0d3))
+- Add SUB\_UID\_MIN/MAX/COUNT, SUB\_GID\_MIN/MAX/COUNT [\#463](https://github.com/dev-sec/ansible-collection-hardening/pull/463) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([elgalu](https://github.com/elgalu))
+- Add os\_auth\_uid\_max, os\_auth\_gid\_max [\#461](https://github.com/dev-sec/ansible-collection-hardening/pull/461) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([elgalu](https://github.com/elgalu))
+
+**Closed issues:**
+
+- MySQL hardening fails because of missing attribute [\#464](https://github.com/dev-sec/ansible-collection-hardening/issues/464)
+- devsec.hardenting.os\_hardening breaks pmlogger\_daily on Oracle Linux 8 \(maybe RHEL 8 too\) [\#460](https://github.com/dev-sec/ansible-collection-hardening/issues/460)
+- add "when" statements for every import\_tasks in hardening.yml [\#453](https://github.com/dev-sec/ansible-collection-hardening/issues/453)
+
+**Merged pull requests:**
+
+- update metadata to include community.mysql deps [\#465](https://github.com/dev-sec/ansible-collection-hardening/pull/465) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.8.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.8.0) (2021-07-01)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.7.0...7.8.0)
+
+**Implemented enhancements:**
+
+- SHA\_CRYPT\_MIN\_ROUNDS should be increased in login.defs [\#365](https://github.com/dev-sec/ansible-collection-hardening/issues/365) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Add support for Rocky Linux 8 [\#454](https://github.com/dev-sec/ansible-collection-hardening/pull/454) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([sherwind](https://github.com/sherwind))
+- make sha rounds configurable and increase no of rounds [\#452](https://github.com/dev-sec/ansible-collection-hardening/pull/452) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Fixed bugs:**
+
+- add tag always to os dependent vars task [\#456](https://github.com/dev-sec/ansible-collection-hardening/pull/456) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Use `include_tasks` for os\_hardening/main.yml [\#451](https://github.com/dev-sec/ansible-collection-hardening/pull/451) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([coadler](https://github.com/coadler))
+
+**Closed issues:**
+
+- Disable IPv6 | sysctl-18   net.ipv6.conf.all.disable\_ipv6: 1 [\#406](https://github.com/dev-sec/ansible-collection-hardening/issues/406) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+
+**Merged pull requests:**
+
+- Cleanup old OS-support and simplify vars [\#458](https://github.com/dev-sec/ansible-collection-hardening/pull/458) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add rocky linux 8 tests and make sure that all relevant tasks are execd [\#457](https://github.com/dev-sec/ansible-collection-hardening/pull/457) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add "when" statements in hardening.yml\(\#453\) [\#455](https://github.com/dev-sec/ansible-collection-hardening/pull/455) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([jqiuyin](https://github.com/jqiuyin))
+- enable ipv6 globally [\#450](https://github.com/dev-sec/ansible-collection-hardening/pull/450) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.7.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.7.0) (2021-05-24)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.6.0...7.7.0)
+
+**Implemented enhancements:**
+
+- Add tasks for new controls [\#123](https://github.com/dev-sec/ansible-collection-hardening/issues/123)
+- ssh\_allow\_tcp\_forwarding remote option added [\#447](https://github.com/dev-sec/ansible-collection-hardening/pull/447) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([alimli](https://github.com/alimli))
+
+**Fixed bugs:**
+
+- Warning: iptables-legacy tables present, Debian 10 [\#274](https://github.com/dev-sec/ansible-collection-hardening/issues/274)
+- Check for MariaDB Version when selecting users without passwords [\#444](https://github.com/dev-sec/ansible-collection-hardening/pull/444) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([neubi4](https://github.com/neubi4))
+- Adds dependency on ansible.posix and community.general [\#415](https://github.com/dev-sec/ansible-collection-hardening/pull/415) ([irl](https://github.com/irl))
+
+**Closed issues:**
+
+- No dependency on ansible.posix collection [\#414](https://github.com/dev-sec/ansible-collection-hardening/issues/414)
+- No dependency on community.general [\#413](https://github.com/dev-sec/ansible-collection-hardening/issues/413)
+- in lxc/docker/openvz IPv6 is always disabled by ufw-configuration [\#402](https://github.com/dev-sec/ansible-collection-hardening/issues/402)
+- Allow login\_unix\_socket to be specified [\#327](https://github.com/dev-sec/ansible-collection-hardening/issues/327)
+
+**Merged pull requests:**
+
+- Removed sysctl that tries to disable IPv6 [\#449](https://github.com/dev-sec/ansible-collection-hardening/pull/449) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lduesing](https://github.com/lduesing))
+- limit changelog labels to role names [\#448](https://github.com/dev-sec/ansible-collection-hardening/pull/448) ([schurzi](https://github.com/schurzi))
+- add back labels to changelog [\#446](https://github.com/dev-sec/ansible-collection-hardening/pull/446) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.6.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.6.0) (2021-04-27)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.5.0...7.6.0)
+
+**Implemented enhancements:**
+
+- ssh: Client HostKeyAlgorithms configuration variable [\#442](https://github.com/dev-sec/ansible-collection-hardening/pull/442) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([sepek](https://github.com/sepek))
+
+**Fixed bugs:**
+
+- mysql USER and HOST should be quoted for drop query [\#443](https://github.com/dev-sec/ansible-collection-hardening/pull/443) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([neubi4](https://github.com/neubi4))
+
+**Closed issues:**
+
+- Support HostKeyAlgorithms configuration for ssh\_client file [\#441](https://github.com/dev-sec/ansible-collection-hardening/issues/441)
+
+**Merged pull requests:**
+
+- fixed a typo in comments [\#439](https://github.com/dev-sec/ansible-collection-hardening/pull/439) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([ssttehrani](https://github.com/ssttehrani))
+
+## [7.5.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.5.0) (2021-04-01)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.4.0...7.5.0)
+
+**Implemented enhancements:**
+
+- Not accepting source routing for IPv6. This was already done for IPv4. [\#424](https://github.com/dev-sec/ansible-collection-hardening/pull/424) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+
+**Fixed bugs:**
+
+- SSH kex sntrup4591761x25519-sha512@tinyssh.org replaced [\#433](https://github.com/dev-sec/ansible-collection-hardening/issues/433)
+- Fix ssh kex sntrup761x25519-sha512@openssh.com for openssh \>= 8.5 [\#437](https://github.com/dev-sec/ansible-collection-hardening/pull/437) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([BenjaminBoehm](https://github.com/BenjaminBoehm))
+
+**Closed issues:**
+
+- Harden user home directories [\#276](https://github.com/dev-sec/ansible-collection-hardening/issues/276)
+
+**Merged pull requests:**
+
+-  remove secure-auth param if mysql \>= 8.0.3 [\#438](https://github.com/dev-sec/ansible-collection-hardening/pull/438) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Improved comments. [\#436](https://github.com/dev-sec/ansible-collection-hardening/pull/436) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- os\_auth\_pam\_pwquality\_options: Changed type to authtok\_type [\#432](https://github.com/dev-sec/ansible-collection-hardening/pull/432) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- add restart-auditd handler after configuration change [\#427](https://github.com/dev-sec/ansible-collection-hardening/pull/427) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add new tasks to delete mysql users without passwords [\#423](https://github.com/dev-sec/ansible-collection-hardening/pull/423) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Uppercased first letter of task names. [\#422](https://github.com/dev-sec/ansible-collection-hardening/pull/422) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([joubbi](https://github.com/joubbi))
+
+## [7.4.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.4.0) (2021-03-23)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.3.0...7.4.0)
+
+**Implemented enhancements:**
+
+- Harden user home dirs [\#428](https://github.com/dev-sec/ansible-collection-hardening/pull/428) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Closed issues:**
+
+- Errors in packer build for vagrant builder [\#244](https://github.com/dev-sec/ansible-collection-hardening/issues/244)
+
+**Merged pull requests:**
+
+- Use pam\_pwhistory.so instead of pam\_unix.so for remembering old passwords [\#431](https://github.com/dev-sec/ansible-collection-hardening/pull/431) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- Remove comments from PAM config file, but keep it in the template [\#430](https://github.com/dev-sec/ansible-collection-hardening/pull/430) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- add support for using a proxy to test with molecule [\#429](https://github.com/dev-sec/ansible-collection-hardening/pull/429) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Improve Documentation for sysctl defaults [\#418](https://github.com/dev-sec/ansible-collection-hardening/pull/418) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+
+## [7.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.3.0) (2021-03-16)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.2.0...7.3.0)
+
+**Implemented enhancements:**
+
+- pam\_tally2 is deprecated in RHEL8 and pam\_faillock should be used in EL7 and EL8 instead. [\#377](https://github.com/dev-sec/ansible-collection-hardening/issues/377) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Replace pam\_tally2 with pam\_faillock in Redhat [\#273](https://github.com/dev-sec/ansible-collection-hardening/issues/273) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Extend GSSAPI configuration support to ssh\_config [\#403](https://github.com/dev-sec/ansible-collection-hardening/pull/403) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([wzzrd](https://github.com/wzzrd))
+- add restart handler variable for mysql role [\#399](https://github.com/dev-sec/ansible-collection-hardening/pull/399) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- restructure PAM handling and update for currently supported Linux distributions [\#392](https://github.com/dev-sec/ansible-collection-hardening/pull/392) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+
+**Fixed bugs:**
+
+- Not able to use `sudo` command for user authenticated via ActiveDirectory [\#278](https://github.com/dev-sec/ansible-collection-hardening/issues/278) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- You shouldn't touch /etc/pam.d/system-auth-ac in RedHat/CentOS [\#252](https://github.com/dev-sec/ansible-collection-hardening/issues/252) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+
+**Closed issues:**
+
+- Netdata monitoring of docker in docker no longer possible [\#412](https://github.com/dev-sec/ansible-collection-hardening/issues/412)
+- Unable to connect with SSH \(Permission denied \(publickey\)\) [\#411](https://github.com/dev-sec/ansible-collection-hardening/issues/411)
+- TASK \[os\_hardening : configure auditd | package-08\] [\#410](https://github.com/dev-sec/ansible-collection-hardening/issues/410)
+- Collection throws undefined ansible\_role\_name error in auditd task [\#409](https://github.com/dev-sec/ansible-collection-hardening/issues/409)
+- Ensure permissions on /etc/crontab are configured [\#375](https://github.com/dev-sec/ansible-collection-hardening/issues/375) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Documentation should be updated [\#361](https://github.com/dev-sec/ansible-collection-hardening/issues/361)
+
+**Merged pull requests:**
+
+- Improve Release Action [\#421](https://github.com/dev-sec/ansible-collection-hardening/pull/421) ([schurzi](https://github.com/schurzi))
+- remove FQCN from roles in examples [\#420](https://github.com/dev-sec/ansible-collection-hardening/pull/420) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Ensure permissions on /etc/crontab are configured [\#405](https://github.com/dev-sec/ansible-collection-hardening/pull/405) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- remove FQCN from roles in examples [\#404](https://github.com/dev-sec/ansible-collection-hardening/pull/404) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- do not install mysql python package on target host [\#401](https://github.com/dev-sec/ansible-collection-hardening/pull/401) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- make wrong password fail task [\#400](https://github.com/dev-sec/ansible-collection-hardening/pull/400) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
 ## [7.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.2.0) (2021-02-10)

 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.1.1...7.2.0)

 **Implemented enhancements:**

- Add variable to specify SSH host RSA key size [\#394](https://github.com/dev-sec/ansible-collection-hardening/pull/394) ([Normo](https://github.com/Normo))
- Set default for ssh host key files only when hardening the server [\#393](https://github.com/dev-sec/ansible-collection-hardening/pull/393) ([Normo](https://github.com/Normo))
+- Add variable to specify SSH host RSA key size [\#394](https://github.com/dev-sec/ansible-collection-hardening/pull/394) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Normo](https://github.com/Normo))
+- Set default for ssh host key files only when hardening the server [\#393](https://github.com/dev-sec/ansible-collection-hardening/pull/393) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Normo](https://github.com/Normo))

 **Fixed bugs:**

@@ -16,12 +190,14 @@

 **Closed issues:**

+- Updating version in galaxy.yml should be part of the release process [\#396](https://github.com/dev-sec/ansible-collection-hardening/issues/396)
 - ssh\_hardening fail on keypair generation  [\#388](https://github.com/dev-sec/ansible-collection-hardening/issues/388)
 - The system must display the date and time of the last successful account logon upon an SSH logon. [\#362](https://github.com/dev-sec/ansible-collection-hardening/issues/362)
 - Error in "root password is present" step [\#326](https://github.com/dev-sec/ansible-collection-hardening/issues/326)

 **Merged pull requests:**

+- update ansible-lint to version 5 [\#397](https://github.com/dev-sec/ansible-collection-hardening/pull/397) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
 - fix minimum required ansible version in docs [\#390](https://github.com/dev-sec/ansible-collection-hardening/pull/390) ([schurzi](https://github.com/schurzi))

 ## [7.1.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.1.1) (2021-02-05)
@@ -30,7 +206,7 @@

 **Fixed bugs:**

- use fqcn for community.crypto.openssh\_keypair module [\#389](https://github.com/dev-sec/ansible-collection-hardening/pull/389) ([schurzi](https://github.com/schurzi))
+- use fqcn for community.crypto.openssh\_keypair module [\#389](https://github.com/dev-sec/ansible-collection-hardening/pull/389) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))

 **Closed issues:**

@@ -42,35 +218,35 @@

 **Implemented enhancements:**

- Default value for ssh\_max\_startups should be changed [\#366](https://github.com/dev-sec/ansible-collection-hardening/issues/366)
+- Default value for ssh\_max\_startups should be changed [\#366](https://github.com/dev-sec/ansible-collection-hardening/issues/366) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
 - Comment in configuration files should state which collection was there [\#345](https://github.com/dev-sec/ansible-collection-hardening/issues/345)
 - Error on applying the sysctl vars on Debian Jessy [\#230](https://github.com/dev-sec/ansible-collection-hardening/issues/230)
- add Support for OpenSSH HostCertificate config option [\#380](https://github.com/dev-sec/ansible-collection-hardening/pull/380) ([mpraeger](https://github.com/mpraeger))
- Syncookie [\#372](https://github.com/dev-sec/ansible-collection-hardening/pull/372) ([joubbi](https://github.com/joubbi))
- Sorted sysctl values and lists in READMEs alphabetically \(No functional changes\). [\#371](https://github.com/dev-sec/ansible-collection-hardening/pull/371) ([joubbi](https://github.com/joubbi))
- make auditd 'max\_log\_file' configurable [\#370](https://github.com/dev-sec/ansible-collection-hardening/pull/370) ([tgueldner-mms](https://github.com/tgueldner-mms))
- reduce maximum unauthenticated ssh sessions [\#368](https://github.com/dev-sec/ansible-collection-hardening/pull/368) ([schurzi](https://github.com/schurzi))
+- add Support for OpenSSH HostCertificate config option [\#380](https://github.com/dev-sec/ansible-collection-hardening/pull/380) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([mpraeger](https://github.com/mpraeger))
+- Syncookie [\#372](https://github.com/dev-sec/ansible-collection-hardening/pull/372) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- Sorted sysctl values and lists in READMEs alphabetically \(No functional changes\). [\#371](https://github.com/dev-sec/ansible-collection-hardening/pull/371) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- make auditd 'max\_log\_file' configurable [\#370](https://github.com/dev-sec/ansible-collection-hardening/pull/370) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([tgueldner-mms](https://github.com/tgueldner-mms))
+- reduce maximum unauthenticated ssh sessions [\#368](https://github.com/dev-sec/ansible-collection-hardening/pull/368) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
 - add a runtime.yml to declare minimum ansible version [\#363](https://github.com/dev-sec/ansible-collection-hardening/pull/363) ([rndmh3ro](https://github.com/rndmh3ro))
- change inclusion of os specific defaults [\#353](https://github.com/dev-sec/ansible-collection-hardening/pull/353) ([schurzi](https://github.com/schurzi))
- make the os\_env\_umask variable usable [\#351](https://github.com/dev-sec/ansible-collection-hardening/pull/351) ([sprat](https://github.com/sprat))
- Fix \#348: make ssh configuration files paths configurable [\#350](https://github.com/dev-sec/ansible-collection-hardening/pull/350) ([sprat](https://github.com/sprat))
- Removed Protocol statement in later versions of sshd, since the code … [\#342](https://github.com/dev-sec/ansible-collection-hardening/pull/342) ([joubbi](https://github.com/joubbi))
- Improvements of comments in opensshd.conf.j2  \#338 [\#339](https://github.com/dev-sec/ansible-collection-hardening/pull/339) ([joubbi](https://github.com/joubbi))
+- change inclusion of os specific defaults [\#353](https://github.com/dev-sec/ansible-collection-hardening/pull/353) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- make the os\_env\_umask variable usable [\#351](https://github.com/dev-sec/ansible-collection-hardening/pull/351) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([sprat](https://github.com/sprat))
+- Fix \#348: make ssh configuration files paths configurable [\#350](https://github.com/dev-sec/ansible-collection-hardening/pull/350) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([sprat](https://github.com/sprat))
+- Removed Protocol statement in later versions of sshd, since the code … [\#342](https://github.com/dev-sec/ansible-collection-hardening/pull/342) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([joubbi](https://github.com/joubbi))
+- Improvements of comments in opensshd.conf.j2  \#338 [\#339](https://github.com/dev-sec/ansible-collection-hardening/pull/339) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([joubbi](https://github.com/joubbi))

 **Fixed bugs:**

 - Comments in opensshd.conf.j2 should be improved [\#338](https://github.com/dev-sec/ansible-collection-hardening/issues/338)
- check for correct cpu vendor in initramfs-tools [\#374](https://github.com/dev-sec/ansible-collection-hardening/pull/374) ([schurzi](https://github.com/schurzi))
- set hidepid=0 on RHEL/CentOS 7 [\#369](https://github.com/dev-sec/ansible-collection-hardening/pull/369) ([schurzi](https://github.com/schurzi))
+- check for correct cpu vendor in initramfs-tools [\#374](https://github.com/dev-sec/ansible-collection-hardening/pull/374) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- set hidepid=0 on RHEL/CentOS 7 [\#369](https://github.com/dev-sec/ansible-collection-hardening/pull/369) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))

 **Closed issues:**

 - initramfs-tools modules.j2 does not seem to be able to detect AMD CPUs [\#373](https://github.com/dev-sec/ansible-collection-hardening/issues/373)
 - How do i install this on Centos 8? [\#367](https://github.com/dev-sec/ansible-collection-hardening/issues/367)
- hidepid=2 gives error when running systemctl on EL7 [\#364](https://github.com/dev-sec/ansible-collection-hardening/issues/364)
+- hidepid=2 gives error when running systemctl on EL7 [\#364](https://github.com/dev-sec/ansible-collection-hardening/issues/364) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
 - Allow putting the ssh/sshd config in alternative files [\#348](https://github.com/dev-sec/ansible-collection-hardening/issues/348)
 - os\_env\_umask has no effect [\#344](https://github.com/dev-sec/ansible-collection-hardening/issues/344)
- Don't modify /etc/sysctl.conf [\#343](https://github.com/dev-sec/ansible-collection-hardening/issues/343)
+- Don't modify /etc/sysctl.conf [\#343](https://github.com/dev-sec/ansible-collection-hardening/issues/343) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]

 **Merged pull requests:**

@@ -78,15 +254,15 @@
 - make release workflow manually runnable [\#384](https://github.com/dev-sec/ansible-collection-hardening/pull/384) ([schurzi](https://github.com/schurzi))
 - run labeler workflow with higher privileges [\#383](https://github.com/dev-sec/ansible-collection-hardening/pull/383) ([schurzi](https://github.com/schurzi))
 - remove issue labels from changelog [\#382](https://github.com/dev-sec/ansible-collection-hardening/pull/382) ([schurzi](https://github.com/schurzi))
- Added comment on top of templates about which role manages the file [\#378](https://github.com/dev-sec/ansible-collection-hardening/pull/378) ([joubbi](https://github.com/joubbi))
+- Added comment on top of templates about which role manages the file [\#378](https://github.com/dev-sec/ansible-collection-hardening/pull/378) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([joubbi](https://github.com/joubbi))
 - Regenerate RSA key with size 4096 bits [\#376](https://github.com/dev-sec/ansible-collection-hardening/pull/376) ([ssttehrani](https://github.com/ssttehrani))
 - fix second changelog generation task, too [\#349](https://github.com/dev-sec/ansible-collection-hardening/pull/349) ([rndmh3ro](https://github.com/rndmh3ro))
 - fix changelog generation [\#341](https://github.com/dev-sec/ansible-collection-hardening/pull/341) ([rndmh3ro](https://github.com/rndmh3ro))
- Improve README for ssh\_hardening [\#335](https://github.com/dev-sec/ansible-collection-hardening/pull/335) ([szEvEz](https://github.com/szEvEz))
+- Improve README for ssh\_hardening [\#335](https://github.com/dev-sec/ansible-collection-hardening/pull/335) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([szEvEz](https://github.com/szEvEz))

 ## [7.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.0.0) (2020-11-11)

-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/6.2.0...7.0.0)
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/a9591764206b79a4ed324bb8576151ebac0127b1...7.0.0)

 **Breaking changes:**

@@ -94,11 +270,21 @@

 **Implemented enhancements:**

- Breaking change in ansible-lint - set file permissions explicitly [\#299](https://github.com/dev-sec/ansible-collection-hardening/issues/299)
- Improve Documentation [\#315](https://github.com/dev-sec/ansible-collection-hardening/pull/315) ([schurzi](https://github.com/schurzi))
- Arch support [\#303](https://github.com/dev-sec/ansible-collection-hardening/pull/303) ([rndmh3ro](https://github.com/rndmh3ro))
- fix linting for molecule [\#301](https://github.com/dev-sec/ansible-collection-hardening/pull/301) ([schurzi](https://github.com/schurzi))
- file permissions explicitly defined [\#300](https://github.com/dev-sec/ansible-collection-hardening/pull/300) ([danielkubat](https://github.com/danielkubat))
+- Breaking change in ansible-lint - set file permissions explicitly [\#299](https://github.com/dev-sec/ansible-collection-hardening/issues/299) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Configure audit=1 for more accurate auid auditing [\#253](https://github.com/dev-sec/ansible-collection-hardening/issues/253)
+- Add Debian Buster support for ansible-os-hardening [\#233](https://github.com/dev-sec/ansible-collection-hardening/issues/233)
+- Add CentOS 8 support for ansible-os-hardening [\#232](https://github.com/dev-sec/ansible-collection-hardening/issues/232)
+- Speed up "minimize access on found files" task [\#208](https://github.com/dev-sec/ansible-collection-hardening/issues/208)
+- Fedora support? [\#163](https://github.com/dev-sec/ansible-collection-hardening/issues/163)
+- Update some RH settings in this role [\#155](https://github.com/dev-sec/ansible-collection-hardening/issues/155)
+- Add selinux configuration [\#154](https://github.com/dev-sec/ansible-collection-hardening/issues/154)
+- Warning about "include" for tasks for ansible-playbook 2.4.0 \(devel f0a5854e39\) [\#131](https://github.com/dev-sec/ansible-collection-hardening/issues/131)
+- Removal of core dump hardening configuration if core dumps are allowed [\#129](https://github.com/dev-sec/ansible-collection-hardening/issues/129)
+- Description of the Ansible roles of dev-sec says "This Ansible playbook" [\#97](https://github.com/dev-sec/ansible-collection-hardening/issues/97)
+- Improve Documentation [\#315](https://github.com/dev-sec/ansible-collection-hardening/pull/315) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- Arch support [\#303](https://github.com/dev-sec/ansible-collection-hardening/pull/303) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- fix linting for molecule [\#301](https://github.com/dev-sec/ansible-collection-hardening/pull/301) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- file permissions explicitly defined [\#300](https://github.com/dev-sec/ansible-collection-hardening/pull/300) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([danielkubat](https://github.com/danielkubat))
 - Optimize and unify when clause [\#295](https://github.com/dev-sec/ansible-collection-hardening/pull/295) ([Alexhha](https://github.com/Alexhha))
 - use find module instead of shell [\#294](https://github.com/dev-sec/ansible-collection-hardening/pull/294) ([danielkubat](https://github.com/danielkubat))
 - improve testing [\#287](https://github.com/dev-sec/ansible-collection-hardening/pull/287) ([schurzi](https://github.com/schurzi))
@@ -106,18 +292,172 @@
 - unify changelog and release actions [\#279](https://github.com/dev-sec/ansible-collection-hardening/pull/279) ([rndmh3ro](https://github.com/rndmh3ro))
 - purge insecure packages [\#275](https://github.com/dev-sec/ansible-collection-hardening/pull/275) ([chris-rock](https://github.com/chris-rock))
 - add changelog and release workflow [\#271](https://github.com/dev-sec/ansible-collection-hardening/pull/271) ([rndmh3ro](https://github.com/rndmh3ro))
+- github action for changelog generation [\#270](https://github.com/dev-sec/ansible-collection-hardening/pull/270) ([rndmh3ro](https://github.com/rndmh3ro))
+- Make useradd defaults in login.defs dependent on OS [\#266](https://github.com/dev-sec/ansible-collection-hardening/pull/266) ([aisbergg](https://github.com/aisbergg))
+- Add kernel hardening parameters from Tails and CIS Benchmark [\#263](https://github.com/dev-sec/ansible-collection-hardening/pull/263) ([kravietz](https://github.com/kravietz))
+- add ansible-lint [\#262](https://github.com/dev-sec/ansible-collection-hardening/pull/262) ([rndmh3ro](https://github.com/rndmh3ro))
+- Remove trailing space [\#261](https://github.com/dev-sec/ansible-collection-hardening/pull/261) ([kravietz](https://github.com/kravietz))
+- Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-collection-hardening/pull/259) ([jaredledvina](https://github.com/jaredledvina))
+- Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-collection-hardening/pull/254) ([kravietz](https://github.com/kravietz))
+- Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-collection-hardening/pull/251) ([dustinmiller](https://github.com/dustinmiller))
+- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
+- Make max\_log\_file\_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-collection-hardening/pull/246) ([jandd](https://github.com/jandd))
+- Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-collection-hardening/pull/240) ([ghost](https://github.com/ghost))
+- Fedora - Use new auto ansible\_python\_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-collection-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
+- add test support for CentOS8 [\#237](https://github.com/dev-sec/ansible-collection-hardening/pull/237) ([yeoldegrove](https://github.com/yeoldegrove))
+- Support configuring SELinux and default to enforcing [\#236](https://github.com/dev-sec/ansible-collection-hardening/pull/236) ([jaredledvina](https://github.com/jaredledvina))
+- Add test support for debian buster [\#234](https://github.com/dev-sec/ansible-collection-hardening/pull/234) ([123Haynes](https://github.com/123Haynes))
+- Changed local var name to a less common one [\#231](https://github.com/dev-sec/ansible-collection-hardening/pull/231) ([rgarrigue](https://github.com/rgarrigue))
+- Use ansible facts for vars [\#226](https://github.com/dev-sec/ansible-collection-hardening/pull/226) ([joshuatalb](https://github.com/joshuatalb))
+- Fix deprecation warnings in Ansible 2.8 [\#224](https://github.com/dev-sec/ansible-collection-hardening/pull/224) ([Normo](https://github.com/Normo))
+- add docs to find-task in minimize access. fix \#219 [\#220](https://github.com/dev-sec/ansible-collection-hardening/pull/220) ([rndmh3ro](https://github.com/rndmh3ro))
+- remove eol'd OS and add new [\#217](https://github.com/dev-sec/ansible-collection-hardening/pull/217) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add note about docker under warning [\#214](https://github.com/dev-sec/ansible-collection-hardening/pull/214) ([ChrisMcKee](https://github.com/ChrisMcKee))
+- change minimize access tasks to speed them up [\#209](https://github.com/dev-sec/ansible-collection-hardening/pull/209) ([rndmh3ro](https://github.com/rndmh3ro))
+- Added fedora support [\#206](https://github.com/dev-sec/ansible-collection-hardening/pull/206) ([jonaswre](https://github.com/jonaswre))
+- Pass package list directly to apt and yum modules without using with\_items loop [\#200](https://github.com/dev-sec/ansible-collection-hardening/pull/200) ([Normo](https://github.com/Normo))
+- add ubuntu 1804 support [\#196](https://github.com/dev-sec/ansible-collection-hardening/pull/196) ([rndmh3ro](https://github.com/rndmh3ro))
+- add option to disable auditd [\#192](https://github.com/dev-sec/ansible-collection-hardening/pull/192) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix problems with efi and vfat [\#190](https://github.com/dev-sec/ansible-collection-hardening/pull/190) ([rndmh3ro](https://github.com/rndmh3ro))
+- added os\_hardening\_enabled flag [\#186](https://github.com/dev-sec/ansible-collection-hardening/pull/186) ([jcheroske](https://github.com/jcheroske))
+- add amazon run opts to travis [\#183](https://github.com/dev-sec/ansible-collection-hardening/pull/183) ([rndmh3ro](https://github.com/rndmh3ro))
+- use package instead of yum and apt [\#180](https://github.com/dev-sec/ansible-collection-hardening/pull/180) ([rndmh3ro](https://github.com/rndmh3ro))
+- add oracle7 to travis [\#178](https://github.com/dev-sec/ansible-collection-hardening/pull/178) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix wrong permissions passwdqc \#170 [\#176](https://github.com/dev-sec/ansible-collection-hardening/pull/176) ([rndmh3ro](https://github.com/rndmh3ro))
+- ipv4 forwarding comment is inconsistent with example [\#174](https://github.com/dev-sec/ansible-collection-hardening/pull/174) ([carchrae](https://github.com/carchrae))
+- Rename pam\_passwdqd.j2 to pam\_passwdqc.j2 [\#172](https://github.com/dev-sec/ansible-collection-hardening/pull/172) ([martinbydefault](https://github.com/martinbydefault))
+- Use package state 'present' since 'installed' is deprecated [\#168](https://github.com/dev-sec/ansible-collection-hardening/pull/168) ([Normo](https://github.com/Normo))
+- Update syntax to Ansible 2.4 [\#161](https://github.com/dev-sec/ansible-collection-hardening/pull/161) ([thomasjpfan](https://github.com/thomasjpfan))
+- add amazon linux testing [\#160](https://github.com/dev-sec/ansible-collection-hardening/pull/160) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add support for Amazon Linux [\#158](https://github.com/dev-sec/ansible-collection-hardening/pull/158) ([woneill](https://github.com/woneill))
+- Don't create home for system accounts [\#156](https://github.com/dev-sec/ansible-collection-hardening/pull/156) ([oakey-b1](https://github.com/oakey-b1))
+- Prevent disabling of filesystems via whitelist [\#153](https://github.com/dev-sec/ansible-collection-hardening/pull/153) ([manuelprinz](https://github.com/manuelprinz))
+- Add kernel hardening settings from Ubuntu /etc/sysctl.d [\#150](https://github.com/dev-sec/ansible-collection-hardening/pull/150) ([kravietz](https://github.com/kravietz))
+- Removal of core dump hardening configuration if core dumps are allowed [\#146](https://github.com/dev-sec/ansible-collection-hardening/pull/146) ([martinbydefault](https://github.com/martinbydefault))
+- install and configure auditd - fix inspec package-08 [\#144](https://github.com/dev-sec/ansible-collection-hardening/pull/144) ([rndmh3ro](https://github.com/rndmh3ro))
+- add missing sysctl parameter [\#143](https://github.com/dev-sec/ansible-collection-hardening/pull/143) ([rndmh3ro](https://github.com/rndmh3ro))
+- update readme [\#139](https://github.com/dev-sec/ansible-collection-hardening/pull/139) ([rndmh3ro](https://github.com/rndmh3ro))
+- add modprobe template, control os-10 [\#138](https://github.com/dev-sec/ansible-collection-hardening/pull/138) ([rndmh3ro](https://github.com/rndmh3ro))
+- new task for delete netrc files, control os-09 [\#137](https://github.com/dev-sec/ansible-collection-hardening/pull/137) ([rndmh3ro](https://github.com/rndmh3ro))
+- add passwd task, control os-03 [\#136](https://github.com/dev-sec/ansible-collection-hardening/pull/136) ([rndmh3ro](https://github.com/rndmh3ro))
+- remove prelink package, control package-09 [\#135](https://github.com/dev-sec/ansible-collection-hardening/pull/135) ([rndmh3ro](https://github.com/rndmh3ro))
+- style update [\#134](https://github.com/dev-sec/ansible-collection-hardening/pull/134) ([rndmh3ro](https://github.com/rndmh3ro))
+- Remove deprecated include for static tasks and use instead import\_tasks fix \#131 [\#132](https://github.com/dev-sec/ansible-collection-hardening/pull/132) ([HelioCampos](https://github.com/HelioCampos))
+- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-collection-hardening/pull/130) ([fazlearefin](https://github.com/fazlearefin))
+- install initramfs-tools [\#114](https://github.com/dev-sec/ansible-collection-hardening/pull/114) ([rndmh3ro](https://github.com/rndmh3ro))
+- omit empty variables [\#106](https://github.com/dev-sec/ansible-collection-hardening/pull/106) ([rndmh3ro](https://github.com/rndmh3ro))
+- Supports --check mode [\#93](https://github.com/dev-sec/ansible-collection-hardening/pull/93) ([conorsch](https://github.com/conorsch))
+- Adds support for CentOS 7 [\#91](https://github.com/dev-sec/ansible-collection-hardening/pull/91) ([conorsch](https://github.com/conorsch))
+- Docker [\#90](https://github.com/dev-sec/ansible-collection-hardening/pull/90) ([rndmh3ro](https://github.com/rndmh3ro))
+- debian 8 support [\#88](https://github.com/dev-sec/ansible-collection-hardening/pull/88) ([rndmh3ro](https://github.com/rndmh3ro))
+- Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-collection-hardening/pull/85) ([fitz123](https://github.com/fitz123))
+- replace ignore\_errors to failed\_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-collection-hardening/pull/81) ([fitz123](https://github.com/fitz123))
+- fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-collection-hardening/pull/79) ([fitz123](https://github.com/fitz123))
+- update platforms in meta-file [\#69](https://github.com/dev-sec/ansible-collection-hardening/pull/69) ([rndmh3ro](https://github.com/rndmh3ro))
+- add webhook for ansible galaxy [\#68](https://github.com/dev-sec/ansible-collection-hardening/pull/68) ([rndmh3ro](https://github.com/rndmh3ro))
+- Move sysctl vars to defaults [\#67](https://github.com/dev-sec/ansible-collection-hardening/pull/67) ([rndmh3ro](https://github.com/rndmh3ro))
+- make sys\_uid and sys\_gid configurable [\#62](https://github.com/dev-sec/ansible-collection-hardening/pull/62) ([rndmh3ro](https://github.com/rndmh3ro))
+- Ansible 2.0 support [\#59](https://github.com/dev-sec/ansible-collection-hardening/pull/59) ([rndmh3ro](https://github.com/rndmh3ro))
+- use inspec as test framework [\#58](https://github.com/dev-sec/ansible-collection-hardening/pull/58) ([chris-rock](https://github.com/chris-rock))
+- Packages as attributes [\#57](https://github.com/dev-sec/ansible-collection-hardening/pull/57) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change categories to tags for upcoming ansible 2.0 [\#56](https://github.com/dev-sec/ansible-collection-hardening/pull/56) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add SINGLE and PROMPT parameters. [\#55](https://github.com/dev-sec/ansible-collection-hardening/pull/55) ([rndmh3ro](https://github.com/rndmh3ro))
+- add changelog generator [\#54](https://github.com/dev-sec/ansible-collection-hardening/pull/54) ([chris-rock](https://github.com/chris-rock))

 **Fixed bugs:**

 - Task "set 10.hardcore.conf perms to 0400 and root ownership" fails in check mode [\#313](https://github.com/dev-sec/ansible-collection-hardening/issues/313)
+- Inconsistent use of role vars/role defaults [\#284](https://github.com/dev-sec/ansible-collection-hardening/issues/284)
+- Is it safe to use on Debian 10? The build is failing. [\#281](https://github.com/dev-sec/ansible-collection-hardening/issues/281)
+- /etc/login.defs alters centos 7/8 default values [\#265](https://github.com/dev-sec/ansible-collection-hardening/issues/265)
+- Invalid Conditionals in user\_accounts.yml [\#255](https://github.com/dev-sec/ansible-collection-hardening/issues/255)
+- `auth-system` related files are created for non-RHEL systems \(e.g. Debian\) [\#247](https://github.com/dev-sec/ansible-collection-hardening/issues/247)
+- NSA website links are stale [\#227](https://github.com/dev-sec/ansible-collection-hardening/issues/227)
+- Running ansible on python3 throughs "TypeError: '\<=' not supported between instances of 'str' and 'int'"  [\#223](https://github.com/dev-sec/ansible-collection-hardening/issues/223)
+- \[lots of\] deprecation warnings in Ansible 2.8 [\#221](https://github.com/dev-sec/ansible-collection-hardening/issues/221)
+- `squash_actions` deprecation warning [\#218](https://github.com/dev-sec/ansible-collection-hardening/issues/218)
+- login.defs.j2 template: ENV\_PATH is missing ':' before variable substitution [\#202](https://github.com/dev-sec/ansible-collection-hardening/issues/202)
+- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-collection-hardening/issues/191)
+- Setting os\_security\_users\_allow has no effect [\#175](https://github.com/dev-sec/ansible-collection-hardening/issues/175)
+- minimize\_access: maximum recursion depth exceeded on Ansible 2.5 [\#171](https://github.com/dev-sec/ansible-collection-hardening/issues/171)
+- wrong permissions passwdqc [\#170](https://github.com/dev-sec/ansible-collection-hardening/issues/170)
+- 'sysctl\_rhel\_config' is undefined [\#167](https://github.com/dev-sec/ansible-collection-hardening/issues/167)
+- Update deprecated `include` statements [\#166](https://github.com/dev-sec/ansible-collection-hardening/issues/166)
+- Strongly recommend against disabling vfat by default [\#162](https://github.com/dev-sec/ansible-collection-hardening/issues/162)
+- bug in ufw.j2 template [\#151](https://github.com/dev-sec/ansible-collection-hardening/issues/151)
+- Add a "don't fail on error" switch ? [\#148](https://github.com/dev-sec/ansible-collection-hardening/issues/148)
+- System completely unresponsive after role execution [\#145](https://github.com/dev-sec/ansible-collection-hardening/issues/145)
+- Why is rsync removed? [\#141](https://github.com/dev-sec/ansible-collection-hardening/issues/141)
+- RHEL 7.4: Too many setuid bits removed [\#140](https://github.com/dev-sec/ansible-collection-hardening/issues/140)
+- Change system accounts not on the user provided ignore-list items are not JSON serializable [\#125](https://github.com/dev-sec/ansible-collection-hardening/issues/125)
+- playbook makes OS undetectable [\#124](https://github.com/dev-sec/ansible-collection-hardening/issues/124)
+- Centos7/RHEL7: Exec shield is enabled by default and not manageable anymore by sysctl.conf [\#118](https://github.com/dev-sec/ansible-collection-hardening/issues/118)
+- Could not find gem 'ruby \(\>= 2.1.0\)' [\#116](https://github.com/dev-sec/ansible-collection-hardening/issues/116)
+- os\_security\_kernel\_enable\_sysrq is not implemented [\#115](https://github.com/dev-sec/ansible-collection-hardening/issues/115)
+- The task sysctl fails when /etc/initramfs-tools is not present [\#111](https://github.com/dev-sec/ansible-collection-hardening/issues/111)
+- The role fails when conditionally included [\#105](https://github.com/dev-sec/ansible-collection-hardening/issues/105)
+- Deprecation warning always\_run [\#103](https://github.com/dev-sec/ansible-collection-hardening/issues/103)
+- CentOS 7 selinux dependencies [\#102](https://github.com/dev-sec/ansible-collection-hardening/issues/102)
+- ubuntu xenial warning during activate gpg-check for yum-repos [\#99](https://github.com/dev-sec/ansible-collection-hardening/issues/99)
+- rhel\_system\_auth.j2 is still using pam\_passwdqc.so for CentOS 7 [\#98](https://github.com/dev-sec/ansible-collection-hardening/issues/98)
+- Centos 7.1 fails at  \[Change various sysctl-settings on rhel-hosts...\] [\#74](https://github.com/dev-sec/ansible-collection-hardening/issues/74)
+- Enable pam\_pwquality in rhel-family \> 7 [\#73](https://github.com/dev-sec/ansible-collection-hardening/issues/73)
+- Hardening fails on Centos 7.1 at task 'minimize access' [\#71](https://github.com/dev-sec/ansible-collection-hardening/issues/71)
+- "irc" user always changed after reboot [\#53](https://github.com/dev-sec/ansible-collection-hardening/issues/53)
 - use touch for 10.hardcore.conf to avoid problems with dry-run [\#314](https://github.com/dev-sec/ansible-collection-hardening/pull/314) ([schurzi](https://github.com/schurzi))
 - use touch with no date changes [\#310](https://github.com/dev-sec/ansible-collection-hardening/pull/310) ([rndmh3ro](https://github.com/rndmh3ro))
 - do not touch sysctl file to avoid idempotency problems [\#309](https://github.com/dev-sec/ansible-collection-hardening/pull/309) ([rndmh3ro](https://github.com/rndmh3ro))
 - replace module parameter fixed [\#297](https://github.com/dev-sec/ansible-collection-hardening/pull/297) ([danielkubat](https://github.com/danielkubat))
+- Addressing issue \#255 [\#258](https://github.com/dev-sec/ansible-collection-hardening/pull/258) ([ljkimmel](https://github.com/ljkimmel))
+- Fix \#247, cleanup conditions [\#248](https://github.com/dev-sec/ansible-collection-hardening/pull/248) ([fernandezcuesta](https://github.com/fernandezcuesta))
+- Fix error on applying the sysctl vars on containers [\#243](https://github.com/dev-sec/ansible-collection-hardening/pull/243) ([ghost](https://github.com/ghost))
+- Update location of NSA RHEL 5 Guide [\#235](https://github.com/dev-sec/ansible-collection-hardening/pull/235) ([jaredledvina](https://github.com/jaredledvina))
+- Fix typo [\#212](https://github.com/dev-sec/ansible-collection-hardening/pull/212) ([ruslo](https://github.com/ruslo))
+- Update modprobe to 0644 [\#211](https://github.com/dev-sec/ansible-collection-hardening/pull/211) ([joshuatalb](https://github.com/joshuatalb))
+- Test Kitchen Vagrant Fixes [\#210](https://github.com/dev-sec/ansible-collection-hardening/pull/210) ([joshuatalb](https://github.com/joshuatalb))
+- \[readme\] Update documentation link [\#207](https://github.com/dev-sec/ansible-collection-hardening/pull/207) ([pmav99](https://github.com/pmav99))
+- fix ansible lint remarks [\#204](https://github.com/dev-sec/ansible-collection-hardening/pull/204) ([rndmh3ro](https://github.com/rndmh3ro))
+- add colon to user env paths - fix \#202 [\#203](https://github.com/dev-sec/ansible-collection-hardening/pull/203) ([rndmh3ro](https://github.com/rndmh3ro))
+- add /usr/bin/su to suid\_guid whitelist [\#199](https://github.com/dev-sec/ansible-collection-hardening/pull/199) ([ccolic](https://github.com/ccolic))
+- ensure that permissions to su-binary are not restricted to root user and group only, if os\_security\_users\_allow contains the value change\_user [\#197](https://github.com/dev-sec/ansible-collection-hardening/pull/197) ([szEvEz](https://github.com/szEvEz))
+- do not install passwdqc on amazon linux [\#189](https://github.com/dev-sec/ansible-collection-hardening/pull/189) ([rndmh3ro](https://github.com/rndmh3ro))
+- add back run opts for debian 8 in travis [\#184](https://github.com/dev-sec/ansible-collection-hardening/pull/184) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix core dump config file creation when core dumps are disabled [\#182](https://github.com/dev-sec/ansible-collection-hardening/pull/182) ([Normo](https://github.com/Normo))
+- change minimize access method [\#181](https://github.com/dev-sec/ansible-collection-hardening/pull/181) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix errors produced by ansible-lint [\#159](https://github.com/dev-sec/ansible-collection-hardening/pull/159) ([zbrojny120](https://github.com/zbrojny120))
+- replace single ticks with double ticks. fix \#151 [\#152](https://github.com/dev-sec/ansible-collection-hardening/pull/152) ([rndmh3ro](https://github.com/rndmh3ro))
+- fixed tag [\#149](https://github.com/dev-sec/ansible-collection-hardening/pull/149) ([martinbydefault](https://github.com/martinbydefault))
+- Remove rsync from package blacklist [\#142](https://github.com/dev-sec/ansible-collection-hardening/pull/142) ([duk3luk3](https://github.com/duk3luk3))
+- Updates "tags" parameters on includes in main.yml [\#66](https://github.com/dev-sec/ansible-collection-hardening/pull/66) ([conorsch](https://github.com/conorsch))
+- Suid set def var, fix \#64 [\#63](https://github.com/dev-sec/ansible-collection-hardening/pull/63) ([rndmh3ro](https://github.com/rndmh3ro))

 **Closed issues:**

 - Any planned support for RHEL/CentOS 8? [\#298](https://github.com/dev-sec/ansible-collection-hardening/issues/298)
+- Consider using find module instead of shell [\#293](https://github.com/dev-sec/ansible-collection-hardening/issues/293)
+- Optimize logical OR in when clause [\#292](https://github.com/dev-sec/ansible-collection-hardening/issues/292)
+- vfat added to dev-sec.conf, but efi is used [\#288](https://github.com/dev-sec/ansible-collection-hardening/issues/288)
+- The state of the galaxy release [\#269](https://github.com/dev-sec/ansible-collection-hardening/issues/269)
+- OpenSUSE Support [\#249](https://github.com/dev-sec/ansible-collection-hardening/issues/249)
+- ansible hardening fails on ubuntu 16.04 with msg": "ERROR! 'sysctl\_rhel\_config' is undefined [\#147](https://github.com/dev-sec/ansible-collection-hardening/issues/147)
+- Enhancement: Test with TestInfra and Molecule [\#128](https://github.com/dev-sec/ansible-collection-hardening/issues/128)
+- Enhancement: Pin python dependencies for development and testing [\#127](https://github.com/dev-sec/ansible-collection-hardening/issues/127)
+- Update readme to include baselines [\#122](https://github.com/dev-sec/ansible-collection-hardening/issues/122)
+- Error running on RHEL 7 due to syntax issues [\#112](https://github.com/dev-sec/ansible-collection-hardening/issues/112)
+- disable password age [\#109](https://github.com/dev-sec/ansible-collection-hardening/issues/109)
+- Permissions on /etc/shadow can lock out GUI users [\#86](https://github.com/dev-sec/ansible-collection-hardening/issues/86)
+- network related sysctl rewritten by ufw in ubuntu  [\#82](https://github.com/dev-sec/ansible-collection-hardening/issues/82)
+- ansible \>= 2.0 complains: Using bare variables is deprecated [\#78](https://github.com/dev-sec/ansible-collection-hardening/issues/78)
+- Hardening fails on Centos 7.1 at task 'remove suid/sgid bit from all binaries except in system and user whitelist' [\#72](https://github.com/dev-sec/ansible-collection-hardening/issues/72)
+- ansible 2.0 | "remove suid/sgid" task fails [\#64](https://github.com/dev-sec/ansible-collection-hardening/issues/64)
+- Custom sysctl [\#50](https://github.com/dev-sec/ansible-collection-hardening/issues/50)
+- Fix directory structure. [\#48](https://github.com/dev-sec/ansible-collection-hardening/issues/48)
+- pam auth update error [\#47](https://github.com/dev-sec/ansible-collection-hardening/issues/47)
+- ansible-os-hardening/tasks/minimize\_access.yml [\#38](https://github.com/dev-sec/ansible-collection-hardening/issues/38)
+- Role configuration. vars/main.yml? [\#34](https://github.com/dev-sec/ansible-collection-hardening/issues/34)
+- Sysctl reloading [\#18](https://github.com/dev-sec/ansible-collection-hardening/issues/18)
+- Add conditions for disabling of ip forwarding [\#15](https://github.com/dev-sec/ansible-collection-hardening/issues/15)
+- Disable System Accounts [\#6](https://github.com/dev-sec/ansible-collection-hardening/issues/6)

 **Merged pull requests:**

@@ -127,6 +467,60 @@
 - do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-collection-hardening/pull/289) ([schurzi](https://github.com/schurzi))
 - move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-collection-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
 - install procps in debian so sysctl.conf exists [\#282](https://github.com/dev-sec/ansible-collection-hardening/pull/282) ([rndmh3ro](https://github.com/rndmh3ro))
+- move defaults to os-specific vars [\#157](https://github.com/dev-sec/ansible-collection-hardening/pull/157) ([rndmh3ro](https://github.com/rndmh3ro))
+- Converts set to JSON-serializable list [\#126](https://github.com/dev-sec/ansible-collection-hardening/pull/126) ([pestaa](https://github.com/pestaa))
+- add more sysctl settings, allow overwriting [\#120](https://github.com/dev-sec/ansible-collection-hardening/pull/120) ([rndmh3ro](https://github.com/rndmh3ro))
+- remove execshield sysctl-parameter on rhel7 [\#119](https://github.com/dev-sec/ansible-collection-hardening/pull/119) ([rndmh3ro](https://github.com/rndmh3ro))
+- change shadow owner in debian systems [\#117](https://github.com/dev-sec/ansible-collection-hardening/pull/117) ([rndmh3ro](https://github.com/rndmh3ro))
+- Rhel7 [\#113](https://github.com/dev-sec/ansible-collection-hardening/pull/113) ([tyrken](https://github.com/tyrken))
+- use new Docker images [\#110](https://github.com/dev-sec/ansible-collection-hardening/pull/110) ([rndmh3ro](https://github.com/rndmh3ro))
+- Don’t refer to this role as "playbook" in the role description [\#104](https://github.com/dev-sec/ansible-collection-hardening/pull/104) ([ypid](https://github.com/ypid))
+- update template [\#101](https://github.com/dev-sec/ansible-collection-hardening/pull/101) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix deprecation warning for undefined error. \#99 [\#100](https://github.com/dev-sec/ansible-collection-hardening/pull/100) ([rndmh3ro](https://github.com/rndmh3ro))
+- add rhel7 pam\_pwquality. fix \#73 [\#94](https://github.com/dev-sec/ansible-collection-hardening/pull/94) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix a formatting issue in readme. [\#92](https://github.com/dev-sec/ansible-collection-hardening/pull/92) ([vivekagr](https://github.com/vivekagr))
+- Permits overriding permissions on /etc/shadow [\#89](https://github.com/dev-sec/ansible-collection-hardening/pull/89) ([conorsch](https://github.com/conorsch))
+- Release 3.0.0 [\#75](https://github.com/dev-sec/ansible-collection-hardening/pull/75) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add explicit role-path to kitchen.yml [\#52](https://github.com/dev-sec/ansible-collection-hardening/pull/52) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix pam passwdqc template [\#51](https://github.com/dev-sec/ansible-collection-hardening/pull/51) ([rndmh3ro](https://github.com/rndmh3ro))
+- New dir layout [\#49](https://github.com/dev-sec/ansible-collection-hardening/pull/49) ([rndmh3ro](https://github.com/rndmh3ro))
+- remove duplicate "update pam" task [\#46](https://github.com/dev-sec/ansible-collection-hardening/pull/46) ([fitz123](https://github.com/fitz123))
+- Fix stuck in case pam files was updated before by force update [\#45](https://github.com/dev-sec/ansible-collection-hardening/pull/45) ([fitz123](https://github.com/fitz123))
+- Fix nologin shell path [\#44](https://github.com/dev-sec/ansible-collection-hardening/pull/44) ([fitz123](https://github.com/fitz123))
+- improved travis-tests to cover more cases [\#42](https://github.com/dev-sec/ansible-collection-hardening/pull/42) ([rndmh3ro](https://github.com/rndmh3ro))
+- Update kitchen-ansible, remove separate debian install [\#40](https://github.com/dev-sec/ansible-collection-hardening/pull/40) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add mode to su-binary task. Fix \#38 [\#39](https://github.com/dev-sec/ansible-collection-hardening/pull/39) ([rndmh3ro](https://github.com/rndmh3ro))
+- update common kitchen.yml platforms \(ansible\), kitchen\_debian.yml platforms \(ansible\) [\#37](https://github.com/dev-sec/ansible-collection-hardening/pull/37) ([chris-rock](https://github.com/chris-rock))
+- Change oneliner if-statements to be more readable [\#36](https://github.com/dev-sec/ansible-collection-hardening/pull/36) ([rndmh3ro](https://github.com/rndmh3ro))
+- Separate system-vars from editable vars. Fix \#34 [\#35](https://github.com/dev-sec/ansible-collection-hardening/pull/35) ([rndmh3ro](https://github.com/rndmh3ro))
+- Create limits.d-directory if it does not exist. [\#33](https://github.com/dev-sec/ansible-collection-hardening/pull/33) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add correct CONTRIB-file [\#32](https://github.com/dev-sec/ansible-collection-hardening/pull/32) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add Ansible Galaxy badge [\#31](https://github.com/dev-sec/ansible-collection-hardening/pull/31) ([rndmh3ro](https://github.com/rndmh3ro))
+-  Update readme, todo, changelog, vars [\#30](https://github.com/dev-sec/ansible-collection-hardening/pull/30) ([rndmh3ro](https://github.com/rndmh3ro))
+- List-cleanup and follow symlinks added [\#29](https://github.com/dev-sec/ansible-collection-hardening/pull/29) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add module configuration [\#28](https://github.com/dev-sec/ansible-collection-hardening/pull/28) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix two sysctl-settings [\#27](https://github.com/dev-sec/ansible-collection-hardening/pull/27) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add meta-files for Ansible Galaxy [\#26](https://github.com/dev-sec/ansible-collection-hardening/pull/26) ([rndmh3ro](https://github.com/rndmh3ro))
+- Disable System Accounts. Fix \#6 [\#25](https://github.com/dev-sec/ansible-collection-hardening/pull/25) ([rndmh3ro](https://github.com/rndmh3ro))
+- Use changed\_when to avoid changed tasks [\#24](https://github.com/dev-sec/ansible-collection-hardening/pull/24) ([rndmh3ro](https://github.com/rndmh3ro))
+- Delete authconfig-task on rhel-systems [\#23](https://github.com/dev-sec/ansible-collection-hardening/pull/23) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add missing rhosts-include task [\#21](https://github.com/dev-sec/ansible-collection-hardening/pull/21) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change sysctl-task. Fix \#18 [\#20](https://github.com/dev-sec/ansible-collection-hardening/pull/20) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add travis-support [\#17](https://github.com/dev-sec/ansible-collection-hardening/pull/17) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add conditions for various tasks. Fix \#15 [\#16](https://github.com/dev-sec/ansible-collection-hardening/pull/16) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix configuration of playbook path [\#14](https://github.com/dev-sec/ansible-collection-hardening/pull/14) ([chris-rock](https://github.com/chris-rock))
+- Make tasks clearer [\#13](https://github.com/dev-sec/ansible-collection-hardening/pull/13) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add remove suid/sgid function [\#12](https://github.com/dev-sec/ansible-collection-hardening/pull/12) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add task to remove unused repos and pkgs [\#11](https://github.com/dev-sec/ansible-collection-hardening/pull/11) ([rndmh3ro](https://github.com/rndmh3ro))
+- Edit README to fit to os-hardening [\#10](https://github.com/dev-sec/ansible-collection-hardening/pull/10) ([rndmh3ro](https://github.com/rndmh3ro))
+- ignore RAs on Ipv6 [\#9](https://github.com/dev-sec/ansible-collection-hardening/pull/9) ([rndmh3ro](https://github.com/rndmh3ro))
+- Repair debian install script [\#8](https://github.com/dev-sec/ansible-collection-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
+- Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-collection-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
+- Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-collection-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-collection-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-collection-hardening/pull/3) ([arlimus](https://github.com/arlimus))
+- Add Securetty-support [\#2](https://github.com/dev-sec/ansible-collection-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-collection-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))



@@ -11,6 +11,7 @@ This collection provides battle tested hardening for:

 - Linux operating systems:
  - CentOS 7/8
+  - Rocky Linux 8
  - Debian 9/10
  - Ubuntu 16.04/18.04/20.04
  - Amazon Linux (some roles supported)
@@ -50,6 +51,12 @@ In progress, not working:
 - [apache_hardening](roles/apache_hardening/)
 - [windows_hardening](roles/windows_hardening/)

+## Installation
+
+Install the collection via ansible-galaxy:
+
+`ansible-galaxy collection install devsec.hardening`
+
 ## Using this collection

 Please refer to the examples in the readmes of the role.
@@ -1,36 +1,13 @@
-# The namespace of the collection. This can be a company/brand/organization or product namespace under which all
-# content lives. May only contain alphanumeric lowercase characters and underscores. Namespaces cannot start with
-# underscores or numbers and cannot contain consecutive underscores
 namespace: devsec
-
-# The name of the collection. Has the same character restrictions as 'namespace'
 name: hardening
-
-# The version of the collection. Must be compatible with semantic versioning
-version: 7.1.1
-
-# The path to the Markdown (.md) readme file. This path is relative to the root of the collection
+version: 7.8.0
 readme: README.md
-
-# A list of the collection's content authors. Can be just the name or in the format 'Full Name <email> (url)
-# @nicks:irc/im.site#channel'
 authors:
- dev-sec <[email protected]>
-
-# A short summary description of the collection
-description: This collection provides battle tested hardening for Linux, SSH, nginx, MySQL
-
-# Either a single license or a list of licenses for content inside of a collection. Ansible Galaxy currently only
-# accepts L(SPDX,https://spdx.org/licenses/) licenses. This key is mutually exclusive with 'license_file'
+  - dev-sec <[email protected]>
+description: 'This collection provides battle tested hardening for Linux, SSH, nginx, MySQL'
 license:
- GPL-2.0-or-later
-
-# The path to the license file for the collection. This path is relative to the root of the collection. This key is
-# mutually exclusive with 'license'
+  - GPL-2.0-or-later
 license_file: ''
-
-# A list of tags you want to associate with the collection for indexing/searching. A tag name has the same character
-# requirements as 'namespace' and 'name'
 tags:
  - devsec
  - hardening
@@ -40,24 +17,14 @@ tags:
  - nginx
  - mysql
  - openssh
-
-# Collections that this collection requires to be installed for it to be usable. The key of the dict is the
-# collection label 'namespace.name'. The value is a version range
-# L(specifiers,https://python-semanticversion.readthedocs.io/en/latest/#requirement-specification). Multiple version
-# range specifiers can be set and are separated by ','
 dependencies:
+  ansible.posix: '>=1.0.0'
  community.crypto: '>=1.0.0'
-
-# The URL of the originating SCM repository
-repository: https://github.com/dev-sec/ansible-os-hardening
-
-# The URL to the homepage of the collection/project
-homepage: https://dev-sec.io/
-
-# The URL to the collection issue tracker
-issues: https://github.com/dev-sec/ansible-os-hardening/issues
-
-# ignore files not needed for release
+  community.general: '>=1.0.0'
+  community.mysql: '>=1.3.0'
+repository: 'https://github.com/dev-sec/ansible-collection-hardening/'
+homepage: 'https://dev-sec.io/'
+issues: 'https://github.com/dev-sec/ansible-collection-hardening/issues'
 build_ignore:
  - codecov.yml
  - .github
@@ -2,6 +2,10 @@
 - name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
  hosts: all
  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
      set_fact:
@@ -18,9 +22,6 @@
        - mysql_python_package_debian is not defined
        - ansible_distribution != "Ubuntu"
        - ansible_distribution_major_version|int < 20
-    - include_role:
-        name: dev-sec.mysql
-
    - include_role:
        name: mysql_hardening
  vars:
@@ -3,6 +3,7 @@ dependency:
  name: galaxy
  options:
    role-file: molecule/mysql_hardening/requirements.yml
+    requirements-file: molecule/mysql_hardening/requirements.yml
 driver:
  name: docker
 lint: |
@@ -20,6 +21,11 @@ platforms:
      container: docker
    security_opts:
      - apparmor=unconfined
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
+      container: docker
 provisioner:
  name: ansible
  config_options:
@@ -3,6 +3,10 @@
 - name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
  hosts: all
  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Run the equivalent of "apt-get update && apt-get upgrade"
      apt:
@@ -21,3 +25,34 @@
      file:
        path: "/etc/mysql/conf.d"
        state: directory
+
+    - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
+      set_fact:
+        mysql_python_package_debian: "python3-pymysql"
+      when:
+        - mysql_python_package_debian is not defined
+        - ansible_distribution == "Ubuntu"
+        - ansible_distribution_major_version|int > 19
+
+    - name: Determine required MySQL Python libraries.
+      set_fact:
+        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
+      when:
+        - mysql_python_package_debian is not defined
+        - ansible_distribution != "Ubuntu"
+        - ansible_distribution_major_version|int < 20
+
+    - include_role:
+        name: dev-sec.mysql
+
+    - name: create a user with an empty password
+      community.mysql.mysql_query:
+        query:
+          - "CREATE USER foo@bar;"
+        login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  vars:
+    overwrite_global_mycnf: false
+    mysql_root_password: iloverandompasswordsbutthiswilldo
+    mysql_user_password: iloverandompasswordsbutthiswilldo
+    mysql_config_file: /etc/mysql/mariadb.cnf
+    mysql_root_password_update: true
@@ -2,6 +2,10 @@
 - name: Verify
  hosts: all
  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  roles:
    - geerlingguy.git
  tasks:
@@ -40,7 +44,7 @@
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"

    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/mysql-baseline.git"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit supermarket://dev-sec/mysql-baseline"
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -2,6 +2,10 @@
 - name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
  become: true
  hosts: all
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  vars:
    - nginx_ppa_use: true
    - nginx_ppa_version: stable
@@ -21,7 +21,10 @@ platforms:
    capabilities:
      - SYS_ADMIN
    tty: true
-    environment:
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
      container: docker
 provisioner:
  name: ansible
@@ -2,6 +2,10 @@
 - name: prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
  become: true
  hosts: all
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: install required tools on SuSE
      zypper:
@@ -2,6 +2,10 @@
 - name: Verify
  hosts: all
  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  roles:
    - geerlingguy.git
  tasks:
@@ -43,7 +47,7 @@
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"

    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/nginx-baseline.git"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit supermarket://dev-sec/nginx-baseline"
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -2,6 +2,10 @@
 - name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
  hosts: all
  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  collections:
    - devsec.hardening
  tasks:
@@ -15,6 +19,7 @@
    os_security_kernel_enable_core_dump: true
    os_security_suid_sgid_remove_from_unknown: true
    os_auth_pam_passwdqc_enable: false
+    os_auth_lockout_time: 15
    os_desktop_enable: true
    os_env_extra_user_paths: ['/home']
    os_auth_allow_homeless: true
@@ -32,7 +37,6 @@
      net.ipv4.icmp_ignore_bogus_error_responses: 1
      net.ipv4.icmp_ratelimit: 100
      net.ipv4.icmp_ratemask: 88089
-      net.ipv6.conf.all.disable_ipv6: 1
      net.ipv4.conf.all.arp_ignore: 1
      net.ipv4.conf.all.arp_announce: 2
      net.ipv4.conf.all.shared_media: 1
@@ -21,7 +21,10 @@ platforms:
    capabilities:
      - SYS_ADMIN
    tty: true
-    environment:
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
      container: docker
 provisioner:
  name: ansible
@@ -4,6 +4,10 @@
  become: true
  collections:
    - devsec.hardening
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
      set_fact:
@@ -2,6 +2,10 @@
 - name: Verify
  hosts: all
  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  roles:
    - geerlingguy.git
  tasks:
@@ -33,6 +37,10 @@
        name: procps
      when: ansible_facts.os_family == 'Debian'

+    - name: include PAM tests
+      include: verify_pam.yml
+      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+
    - name: download cinc-auditor
      get_url:
        url: https://omnitruck.cinc.sh/install.sh
@@ -43,7 +51,7 @@
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"

    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline.git"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit supermarket://dev-sec/linux-baseline"
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -0,0 +1,59 @@
+---
+- name: download pam-tester
+  get_url:
+    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
+    dest: /bin/pam-tester
+    mode: 0555
+
+- name: set password for test
+  set_fact:
+    test_pw: "myTest!pw"
+
+- name: set locale for test
+  set_fact:
+    locale: "en_US.UTF-8"
+  when:
+    - ansible_facts.os_family == 'RedHat'
+    - ansible_facts.distribution_major_version < '8'
+
+- name: create testuser
+  user:
+    name: testuser
+    password: "{{ test_pw | password_hash('sha512') }}"
+
+- name: check successfull login with correct password
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
+
+- name: check unsuccessfull login with incorrect password
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
+  with_sequence: count=6
+
+- name: check unsuccessfull login, with correct password (lockout)
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
+
+- name: wait for account to unlock
+  pause:
+    seconds: 20
+
+- name: check successfull login
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+  environment:
+    TMPDIR: /var/tmp
+    LC_ALL: "{{ locale | default('C.UTF-8') }}"
+    LANG: "{{ locale | default('C.UTF-8') }}"
@@ -2,6 +2,10 @@
 - name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
  hosts: all
  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  collections:
    - devsec.hardening
  tasks:
@@ -21,7 +21,10 @@ platforms:
    capabilities:
      - SYS_ADMIN
    tty: true
-    environment:
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
      container: docker
 provisioner:
  name: ansible
@@ -2,6 +2,10 @@
 - name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
  hosts: all
  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: use python3
      set_fact:
@@ -2,6 +2,10 @@
 - name: Verify
  hosts: all
  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  roles:
    - geerlingguy.git
  tasks:
@@ -38,7 +42,7 @@
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"

    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline.git"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit supermarket://dev-sec/nginx-baseline"
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -4,3 +4,4 @@ ansible
 ansible-lint
 docker
 flake8
+jmespath
@@ -9,7 +9,7 @@ This role provides security configurations for MySQL and its derivates. It is in
 It configures:

 - Permissions for the various configuration files and folders
- Removes anonymous users, root-users without a password and test databases
+- Removes anonymous users, users without a password or authentication_string and test databases
 - various hardening options inside MySQL

 ## Requirements
@@ -24,7 +24,7 @@ It configures:
  collections:
    - devsec.hardening
  roles:
-    - devsec.hardening.mysql_hardening
+    - mysql_hardening
 ```

 This role expects an existing installation of MySQL or MariaDB. Please ensure that the following variables are set accordingly:
@@ -75,5 +75,8 @@ This role expects an existing installation of MySQL or MariaDB. Please ensure th
 - `mysql_remove_test_database`
  - Default: true
  - Description: remove test database
+- `mysql_hardening_restart_mysql`
+  - Default: true
+  - Description: Restart mysql after running this role

 Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
@@ -4,6 +4,8 @@ mysql_hardening_enabled: true

 mysql_daemon_enabled: true

+mysql_hardening_restart_mysql: true
+
 # general configuration
 mysql_datadir: '/var/lib/mysql'
 mysql_hardening_mysql_hardening_conf_file: '{{mysql_hardening_mysql_confd_dir}}/hardening.cnf'
@@ -1,4 +1,7 @@
 ---

- name: restart mysql
-  service: name='{{ mysql_daemon }}' state=restarted
+- name: Restart mysql
+  service:
+    name: '{{ mysql_daemon }}'
+    state: restarted
+  when: mysql_hardening_restart_mysql | bool
@@ -1,5 +1,5 @@
 ---
- name: protect my.cnf
+- name: Protect my.cnf
  file:
    path: '{{ mysql_hardening_mysql_conf_file }}'
    mode: '0640'
@@ -8,7 +8,7 @@
    follow: true
    state: file

- name: ensure permissions on mysql-datadir are correct
+- name: Ensure permissions on mysql-datadir are correct
  file:
    path: '{{ mysql_datadir }}'
    state: directory
@@ -16,7 +16,7 @@
    group: '{{ mysql_hardening_user }}'
    mode: '0750'

- name: ensure permissions on mysql-logfile are correct
+- name: Ensure permissions on mysql-logfile are correct
  file:
    path: '{{ mysql_hardening_log_file }}'
    state: file
@@ -24,7 +24,7 @@
    group: '{{ mysql_hardening_group }}'
    mode: '0640'

- name: check mysql configuration-directory exists and has right permissions
+- name: Check mysql configuration-directory exists and has right permissions
  file:
    path: '{{ mysql_hardening_mysql_confd_dir }}'
    state: directory
@@ -32,25 +32,25 @@
    group: '{{ mysql_hardening_group }}'
    mode: '0750'

- name: check include-dir directive is present in my.cnf
+- name: Check include-dir directive is present in my.cnf
  lineinfile:
    dest: '{{ mysql_hardening_mysql_conf_file }}'
    line: '!includedir {{ mysql_hardening_mysql_confd_dir }}'
    insertafter: 'EOF'
    state: present
    backup: true
-  notify: restart mysql
+  notify: Restart mysql

- name: apply hardening configuration
+- name: Apply hardening configuration
  template:
    src: 'hardening.cnf.j2'
    dest: '{{ mysql_hardening_mysql_hardening_conf_file }}'
    owner: '{{ mysql_cnf_owner }}'
    group: '{{ mysql_cnf_group }}'
    mode: '0640'
-  notify: restart mysql
+  notify: Restart mysql

- name: enable mysql
+- name: Enable mysql
  service:
    name: '{{ mysql_daemon }}'
    enabled: '{{ mysql_daemon_enabled }}'
@@ -20,6 +20,30 @@
    '{{ item.key }}': '{{ item.value }}'
  when: "not lookup('varnames', '^' + item.key + '$')"
  with_dict: '{{ os_vars }}'
+  tags: always
+
+- name: Gather package facts to check for mysql/mariadb version
+  ansible.builtin.package_facts:
+    manager: auto
+
+- name: Check if MySQL or MariaDB is used
+  set_fact:
+    mysql_distribution: "{{ ansible_facts.packages['mysql-server'] is defined | ternary('mysql', 'mariadb') }}"
+
+- name: Check which MySQL/MariaDB version is used
+  community.mysql.mysql_info:
+    filter: version
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_version
+
+# see https://stackoverflow.com/a/59451077/2953919 for the
+# dict2items and vice versa magic
+- name: Drop the secure-auth parameter on MySQL >=8.0.3 (not mariadb)
+  set_fact:
+    mysql_hardening_options: "{{ mysql_hardening_options| dict2items | rejectattr('key', 'search', 'secure-auth') | list | items2dict }}"
+  when:
+    - mysql_version.version.full is version('8.0.3', '>=')
+    - mysql_distribution == "mysql"

 - include: configure.yml
  when: mysql_hardening_enabled | bool
@@ -1,46 +1,104 @@
 ---
- name: Install mysqld python libary for Ansible
-  package:
-    name: '{{ mysql_python_package }}'
-    state: present
-
- debug:
-    msg: 'WARNING - you have to change default mysql_root_password'
+- name: Fail the role if the mysql root password was not set
+  fail:
+    msg: 'ERROR - you have to change default mysql_root_password'
  when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'

- name: root password is present
-  mysql_user:
+- name: ensure that the root password is present
+  community.mysql.mysql_user:
    name: 'root'
    host_all: true
    password: '{{ mysql_root_password | mandatory }}'
    state: present
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"

- name: install .my.cnf with credentials
+- name: Install .my.cnf with credentials
  template:
    src: 'my.cnf.j2'
    dest: '{{ mysql_user_home }}/.my.cnf'
    mode: '0400'
  tags: my_cnf

- name: test database is absent
-  mysql_db:
+- name: ensure that the test database is absent
+  community.mysql.mysql_db:
    name: test
    state: absent
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_test_database

- name: anonymous users are absent
-  mysql_user:
+- name: ensure that anonymous users are absent
+  community.mysql.mysql_user:
    name: ''
    state: absent
    host_all: true
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_anonymous_users

- name: remove remote root
+- name: ensure that root can only login from localhost
  community.mysql.mysql_query:
    query:
-      - DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1')
+      - DELETE
+        FROM mysql.user
+        WHERE USER='root'
+          AND HOST NOT IN ('localhost',
+                          '127.0.0.1',
+                          '::1')
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_remote_root
+
+- name: get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
+  community.mysql.mysql_query:
+    query:
+      - SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
+        FROM mysql.user
+        WHERE (length(authentication_string)=0
+              OR authentication_string="")
+          AND USER NOT IN ('mysql.sys',
+                          'mysqlxsys',
+                          'mariadb.sys');
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_users_wo_passwords_or_auth_string
+  when:
+    - (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '>=')) or
+      (mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '>='))
+
+- name: get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
+  community.mysql.mysql_query:
+    query:
+      - SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
+        FROM mysql.user
+        WHERE (length(password)=0
+              OR password="")
+          AND (length(authentication_string)=0
+              OR authentication_string="")
+          AND USER NOT IN ('mysql.sys',
+                          'mysqlxsys',
+                          'mariadb.sys');
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_users_wo_passwords
+  when:
+    - (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '<')) or
+      (mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '<'))
+
+- name: create a fact for users without password or authentication_string
+  set_fact:
+    users_wo_auth: "{{ mysql_users_wo_passwords_or_auth_string.query_result.0.0 | community.general.json_query('users') }}"
+  when:
+    - mysql_users_wo_passwords_or_auth_string.query_result is defined
+    - mysql_users_wo_passwords_or_auth_string.query_result != ""  # noqa empty-string-compare
+
+- name: create a fact for users without password
+  set_fact:
+    users_wo_auth: "{{ mysql_users_wo_passwords.query_result.0.0 | community.general.json_query('users') }}"
+  when:
+    - mysql_users_wo_passwords.query_result is defined
+    - mysql_users_wo_passwords.query_result != ""  # noqa empty-string-compare
+
+- name: ensure that there are no users without password or authentication_string
+  community.mysql.mysql_query:
+    query:
+      - "DROP USER {{ users_wo_auth }}"
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  when:
+    - users_wo_auth is defined
+    - users_wo_auth != ""  # noqa empty-string-compare
@@ -10,5 +10,3 @@ mysql_hardening_group: 'adm'

 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_python_package: "python3-pymysql"
@@ -5,8 +5,6 @@ mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'

 mysql_hardening_log_file: '/var/log/mariadb/mariadb.log'

-mysql_python_package: 'MySQL-python'
-
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files

@@ -4,8 +4,6 @@ mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
 mysql_hardening_log_file: '/var/log/mariadb/mariadb.log'

-mysql_python_package: 'python3-mysqlclient'
-
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files

@@ -0,0 +1,10 @@
+---
+mysql_daemon: mariadb
+mysql_hardening_mysql_conf_file: '/etc/my.cnf'
+mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
+mysql_hardening_log_file: '/var/log/mariadb/mariadb.log'
+
+mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
+mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
+
+mysql_hardening_group: 'mysql'
@@ -10,5 +10,3 @@ mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files

 mysql_hardening_group: 'adm'
-
-mysql_python_package: "python-mysqldb"
@@ -10,5 +10,3 @@ mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files

 mysql_hardening_group: 'adm'
-
-mysql_python_package: "python-mysqldb"
@@ -10,5 +10,3 @@ mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files

 mysql_hardening_group: 'adm'
-
-mysql_python_package: "python3-mysqldb"
@@ -83,7 +83,7 @@ It works with the following nginx-roles, including, but not limited to:
  collections:
    - devsec.hardening
  roles:
-    - devsec.hardening.nginx_hardening
+    - nginx_hardening
 ```

 [nginx_client_body_buffer_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size
@@ -1,5 +1,5 @@
 ---
- name: restart nginx
+- name: Restart nginx
  service:
    name: "nginx"
    state: restarted
@@ -1,14 +1,14 @@
 ---
- name: create additional configuration
+- name: Create additional configuration
  template:
    src: "hardening.conf.j2"
    dest: "/etc/nginx/conf.d/90.hardening.conf"
    mode: '0600'
    owner: "root"
    group: "root"
-  notify: restart nginx
+  notify: Restart nginx

- name: change configuration in main nginx.conf
+- name: Change configuration in main nginx.conf
  lineinfile:
    dest: "/etc/nginx/nginx.conf"
    regexp: '^\s*server_tokens'
@@ -17,9 +17,9 @@
    mode: '0640'
    owner: "root"
    group: "root"
-  notify: restart nginx
+  notify: Restart nginx

- name: change ssl_protocols in main nginx.conf
+- name: Change ssl_protocols in main nginx.conf
  lineinfile:
    dest: "/etc/nginx/nginx.conf"
    regexp: '^\s*ssl_protocols'
@@ -28,9 +28,9 @@
    mode: '0640'
    owner: "root"
    group: "root"
-  notify: restart nginx
+  notify: Restart nginx

- name: change ssl_prefer_server_ciphers in main nginx.conf
+- name: Change ssl_prefer_server_ciphers in main nginx.conf
  lineinfile:
    dest: "/etc/nginx/nginx.conf"
    regexp: '^\s*ssl_prefer_server_ciphers'
@@ -39,9 +39,9 @@
    mode: '0640'
    owner: "root"
    group: "root"
-  notify: restart nginx
+  notify: Restart nginx

- name: change client_max_body_size in main nginx.conf
+- name: Change client_max_body_size in main nginx.conf
  lineinfile:
    dest: "/etc/nginx/nginx.conf"
    regexp: '^\s*client_max_body_size'
@@ -50,9 +50,9 @@
    mode: '0640'
    owner: "root"
    group: "root"
-  notify: restart nginx
+  notify: Restart nginx

- name: change client_body_buffer_size in main nginx.conf
+- name: Change client_body_buffer_size in main nginx.conf
  lineinfile:
    dest: "/etc/nginx/nginx.conf"
    regexp: '^\s*client_body_buffer_size'
@@ -61,9 +61,9 @@
    mode: '0640'
    owner: "root"
    group: "root"
-  notify: restart nginx
+  notify: Restart nginx

- name: change keepalive_timeout in main nginx.conf
+- name: Change keepalive_timeout in main nginx.conf
  lineinfile:
    dest: "/etc/nginx/nginx.conf"
    regexp: '^\s*keepalive_timeout'
@@ -72,23 +72,23 @@
    mode: '0640'
    owner: "root"
    group: "root"
-  notify: restart nginx
+  notify: Restart nginx

- name: remove default.conf
+- name: Remove default.conf
  file:
    path: "{{ item }}"
    state: absent
  when: nginx_remove_default_site
-  notify: restart nginx
+  notify: Restart nginx
  loop:
    - "/etc/nginx/conf.d/default.conf"
    - "/etc/nginx/sites-enabled/default"

- name: generate dh group
+- name: Generate dh group
  openssl_dhparam:
    path: "/etc/nginx/dh{{ nginx_dh_size }}.pem"
    size: "{{ nginx_dh_size }}"
    mode: '0640'
    owner: "root"
    group: "root"
-  notify: restart nginx
+  notify: Restart nginx
@@ -106,6 +106,9 @@ We know that this is the case on Raspberry Pi.
 - `os_auth_pw_min_age`
  - Default: `7`
  - Description: minimum password age (before allowing any other password change).
+- `os_auth_pw_remember`
+  - Default: `5`
+  - Description: how many used passwords are record.
 - `os_auth_retries`
  - Default: `5`
  - Description: the maximum number of authentication attempts, before the account is locked for some time.
@@ -124,6 +127,9 @@ We know that this is the case on Raspberry Pi.
 - `os_auth_pam_passwdqc_options`
  - Default: `min=disabled,disabled,16,12,8`
  - Description: set to any option line (as a string) that you want to pass to passwdqc.
+- `os_auth_pam_sssd_enable`
+  - Default: `false` (on RHEL8/CentOS8/Fedora `true`)
+  - Description: activate PAM auth support for sssd
 - `os_security_users_allow`
  - Default: `[]`
  - Description: list of things, that a user is allowed to do. May contain `change_user`.
@@ -145,6 +151,36 @@ We know that this is the case on Raspberry Pi.
 - `os_security_suid_sgid_remove_from_unknown`
  - Default: `false`
  - Description: true if you want to remove SUID/SGID bits from any file, that is not explicitly configured in a `blacklist`. This will make every Ansible-run search through the mounted filesystems looking for SUID/SGID bits that are not configured in the default and user blacklist. If it finds an SUID/SGID bit, it will be removed, unless this file is in your `whitelist`.
+- `os_auth_uid_min`
+  - Default: `1000`
+  - Description: minimum number for automatic uid selection in useradd.
+- `os_auth_uid_max`
+  - Default: `60000`
+  - Description: maximum number for automatic uid selection in useradd.
+- `os_auth_gid_min`
+  - Default: `1000`
+  - Description: minimum number for automatic gid selection in groupadd.
+- `os_auth_gid_max`
+  - Default: `60000`
+  - Description: maximum number for automatic gid selection in groupadd.
+- `os_auth_sub_uid_count`
+  - Default: `65536`
+  - Description: If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate user IDs) allocate SUB_UID_COUNT unused user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user. See also `os_auth_sub_uid_min` and `os_auth_sub_uid_max`.
+- `os_auth_sub_uid_min`.
+  - Default: `100000`
+  - Description: minimum number for automatic subordinate uid selection in useradd and newusers.
+- `os_auth_sub_uid_max`
+  - Default: `600100000`
+  - Description: maximum number for automatic subordinate uid selection in useradd and newusers.
+- `os_auth_sub_gid_count`
+  - Default: `65536`
+  - Description: If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate group IDs) allocate SUB_GID_COUNT unused group IDs from the range SUB_GID_MIN to SUB_GID_MAX for each new user. See also `os_auth_sub_gid_min` and `os_auth_sub_gid_max`.
+- `os_auth_sub_gid_min`
+  - Default: `100000`
+  - Description: minimum number for automatic subordinate gid selection in useradd and newusers.
+- `os_auth_sub_gid_max`
+  - Default: `600100000`
+  - Description: maximum number for automatic subordinate gid selection in useradd and newusers.
 - `os_security_packages_clean`
  - Default: `true`
  - Description: removes packages with known issues. See section packages.
@@ -169,6 +205,9 @@ We know that this is the case on Raspberry Pi.
 - `ufw_default_forward_policy`
  - Default: `DROP`
  - Description: set default forward policy of ufw to `DROP`.
+- `ufw_enable_ipv6`
+  - Default: `true`
+  - Description: Set to `true` to apply rules to support IPv6 (no means only IPv6 on loopback accepted).
 - `os_auditd_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring auditd.
@@ -184,6 +223,57 @@ We know that this is the case on Raspberry Pi.
 - `proc_mnt_options`
  - Default: `rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}`
  - Description: Mount proc with hardenized options, including `hidepid` with variable value.
+- `os_ignore_home_folder_users`
+  - Default: `lost+found`
+  - Description: specify user home folders in `/home` that shouldn't be chmodded to 700
+- `os_cron_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring cron.
+- `os_limits_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring limits.
+- `os_login_defs_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring login_defs.
+- `os_minimize_access_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring minimize_access.
+- `os_pam_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring pam.
+- `os_modprobe_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring modprobe.
+- `os_profile_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring profile.
+- `os_securetty_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring securetty.
+- `os_sysctl_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring sysctl.
+- `os_user_accounts_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring user_accounts.
+- `os_rhosts_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring rhosts.
+- `os_yum_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring yum.
+- `os_apt_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring apt.
+- `os_selinux_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring selinux.
+- `os_sha_crypt_min_rounds`
+  - Default: `640000`
+  - Description: Define the number of minimum SHA rounds. With a lot of rounds brute forcing the password is more difficult. But note also that it more CPU resources will be needed to authenticate users. The values must be inside the 1000-999999999 range.
+- `os_sha_crypt_max_rounds`
+  - Default: `640000`
+  - Description: Define the number of maximum SHA rounds. With a lot of rounds brute forcing the password is more difficult. But note also that it more CPU resources will be needed to authenticate users. The values must be inside the 1000-999999999 range.

 ## Packages

@@ -219,7 +309,7 @@ To prevent some of the filesystems from being disabled, add them to the `os_file
  collections:
    - devsec.hardening
  roles:
-    - devsec.hardening.os_hardening
+    - os_hardening
 ```

 ## Changing sysctl variables
@@ -232,7 +322,7 @@ So for example if you want to change the IPv4 traffic forwarding variable to `1`
  collections:
    - devsec.hardening
  roles:
-    - devsec.hardening.os_hardening
+    - os_hardening
  vars:
    sysctl_overwrite:
      # Enable IPv4 traffic forwarding.
@@ -249,6 +339,13 @@ For more information, please see this [upstream documentation](https://www.kerne

 ## More information

+We use specific PAM configuration for every linux distribution. This is a very diverse area, since every vendor seems to push their own system for managing PAM. We used following guides and sources for our configuration.
+
+- on Debian/Ubuntu we use [pam-config-framework](https://wiki.ubuntu.com/PAMConfigFrameworkSpec)
+- RHEL8 and compatible use information from [authselect](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_authentication_and_authorization_in_rhel/configuring-user-authentication-using-authselect_configuring-authentication-and-authorization-in-rhel), but our setup disables the configuration from authselect
+- RHEL 6/7 and compatible use [authconfig](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/authconfig-install), but our setup disables the configuration from authconfig
+- for RHEL 6/7 we also use information from [Desktop Security](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-hardening_your_system_with_tools_and_services#sec-Desktop_Security)
+
 This role is mostly based on guides by:

 - [Arch Linux wiki, Sysctl hardening](https://wiki.archlinux.org/index.php/Sysctl)
@@ -2,31 +2,38 @@
 os_desktop_enable: false
 os_env_extra_user_paths: []
 os_auth_pw_max_age: 60
-os_auth_pw_min_age: 7  # discourage password cycling
+os_auth_pw_min_age: 7  # Discourage password cycling
+os_auth_pw_remember: 5  # Specify how many used passwords are record
 os_auth_retries: 5
-os_auth_lockout_time: 600  # 10min
+os_auth_lockout_time: 600  # Seconds (600 = 10min)
 os_auth_timeout: 60
 os_auth_allow_homeless: false
 os_auth_pam_passwdqc_enable: true
-os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8'  # used in RHEL6
-os_auth_pam_pwquality_options: 'try_first_pass retry=3 type='  # used in RHEL7
+os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8'  # Used in RHEL6
+os_auth_pam_pwquality_options: 'try_first_pass retry=3 authtok_type='  # Used in RHEL7 and RHEL8
 os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]

 os_chfn_restrict: ''
-# may contain: change_user
+
+# Set to false to disable chmod /home folders to 700
+os_chmod_home_folders: true
+
+# May contain: change_user
 os_security_users_allow: []
-# specify system accounts those login should not be disabled and password not changed
+# Specify user home folders in /home that shouldn't be chmodded to 700
+os_ignore_home_folder_users: ['lost+found']
+# Specify system accounts whose login should not be disabled and password not changed
 os_ignore_users: ['vagrant', 'kitchen']
 os_security_kernel_enable_module_loading: true
 os_security_kernel_enable_core_dump: false
 os_security_suid_sgid_enforce: true
-# user-defined blacklist and whitelist
+# User-defined blacklist and whitelist
 os_security_suid_sgid_blacklist: []
 os_security_suid_sgid_whitelist: []
-# if this is true, remove any suid/sgid bits from files that were not in the whitelist
+# If this is true, remove any suid/sgid bits from files that are not in the whitelist
 os_security_suid_sgid_remove_from_unknown: false

-# remove packages with known issues
+# Remove packages with known security issues
 os_security_packages_clean: true
 os_security_packages_list: ['xinetd', 'inetd', 'ypserv', 'telnet-server', 'rsh-server', 'prelink']

@@ -39,9 +46,9 @@ os_security_init_single: false
 ufw_manage_defaults: true

 # Empty variable disables IPT_SYSCTL in /etc/default/ufw
-# by default in Ubuntu it set to: /etc/ufw/sysctl.conf
-# CAUTION
-# if you enable it - it'll overwrite /etc/sysctl.conf file, managed by hardening framework
+# By default in Ubuntu it is set to: /etc/ufw/sysctl.conf
+# CAUTION!
+# If you enable it - it overwrites /etc/sysctl.conf file, managed by hardening framework
 ufw_ipt_sysctl: ''

 # Default ufw variables
@@ -52,6 +59,10 @@ ufw_default_application_policy: 'SKIP'
 ufw_manage_builtins: 'no'
 ufw_ipt_modules: 'nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns'

+# Set to true to apply rules to support IPv6 (no means only IPv6 on loopback
+# accepted).
+ufw_enable_ipv6: true
+
 sysctl_config:
  # These settings eliminate an entire class of security vulnerabilities:
  # time-of-check-time-of-use cross-privilege attacks using guessable
@@ -137,10 +148,17 @@ sysctl_config:
  # kernel.yama.ptrace_scope = 1
  kernel.yama.ptrace_scope: 1

-  # Disable IPv4 traffic forwarding. | sysctl-01
+  # Disable traffic forwarding.
+  # Setting the flag to 0 ensures that a system with multiple interfaces (for example, a hard
+  # proxy), will never be able to forward packets, and therefore, never serve as a router.
+  # | sysctl-01 | sysctl-19
  net.ipv4.ip_forward: 0
+  net.ipv6.conf.all.forwarding: 0

-  # Enable RFC-recommended source validation feature. | sysctl-02
+  # Enable RFC-recommended source validation feature.
+  # If the return packet does not go out the same interface that the corresponding
+  # source packet came from, the packet is dropped (and logged if log_martians is set).
+  # | sysctl-02
  net.ipv4.conf.all.rp_filter: 1
  net.ipv4.conf.default.rp_filter: 1

@@ -148,7 +166,9 @@ sysctl_config:
  # Make sure to ignore ECHO broadcasts, which are only required in broad network analysis.
  net.ipv4.icmp_echo_ignore_broadcasts: 1

-  # There is no reason to accept bogus error responses from ICMP, so ignore them instead. | sysctl-03
+  # Some routers (and some attackers) will send responses that violate RFC-1122 and attempt
+  # to fill up a log file system with many useless error messages.
+  # | sysctl-03
  net.ipv4.icmp_ignore_bogus_error_responses: 1

  # Limit the amount of traffic the system uses for ICMP. | sysctl-05
@@ -158,7 +178,7 @@ sysctl_config:
  # source quench, ime exceed, param problem, timestamp reply, information reply | sysctl-06
  net.ipv4.icmp_ratemask: 88089

-  # Protect against wrapping sequence numbers at gigabit speeds | sysctl-07
+  # Disable TCP timestamps in order to not reveal system uptime. | sysctl-07
  net.ipv4.tcp_timestamps: 0

  # Define restriction level for announcing the local source IP | sysctl-08
@@ -187,17 +207,33 @@ sysctl_config:
  # so disable it if not needed. | sysctl-13
  net.ipv4.conf.all.accept_source_route: 0
  net.ipv4.conf.default.accept_source_route: 0
+  net.ipv6.conf.all.accept_source_route: 0
+  net.ipv6.conf.default.accept_source_route: 0

-  # For non-routers: don't send redirects, these settings are 0 | sysctl-16
+  # For non-routers: don't send redirects.
+  # An attacker could use a compromised host to send invalid ICMP redirects to other
+  # router devices in an attempt to corrupt routing and have users access a system
+  # set up by the attacker as opposed to a valid system.
+  # | sysctl-16
  net.ipv4.conf.all.send_redirects: 0
  net.ipv4.conf.default.send_redirects: 0

-  # log martian packets | sysctl-17
+  # Log martian packets
+  # This feature logs packets with un-routable source addresses to the kernel log.
+  # Enabling this feature and logging these packets allows an administrator to investigate
+  # the possibility that an attacker is sending spoofed packets to their system.
+  # | sysctl-17
  net.ipv4.conf.all.log_martians: 1
  net.ipv4.conf.default.log_martians: 1

  # Accepting redirects can lead to malicious networking behavior, so disable
-  # it if not needed. | sysctl-13 | sysctl-14 | sysctl-15 | sysctl-20
+  # it if not needed.
+  # Attackers could use bogus ICMP redirect messages to maliciously alter the system
+  # routing tables and get them to send packets to incorrect networks and allow
+  # your system packets to be captured.
+  # Setting net.ipv4.conf.all.secure_redirects to 0 protects the system from
+  # routing table updates by possibly compromised known gateways.
+  # | sysctl-13 | sysctl-14 | sysctl-15 | sysctl-20
  net.ipv4.conf.default.accept_redirects: 0
  net.ipv4.conf.all.accept_redirects: 0
  net.ipv4.conf.all.secure_redirects: 0
@@ -205,13 +241,7 @@ sysctl_config:
  net.ipv6.conf.default.accept_redirects: 0
  net.ipv6.conf.all.accept_redirects: 0

-  # Disable IPv6 | sysctl-18
-  net.ipv6.conf.all.disable_ipv6: 1
-
-  # Disable IPv6 traffic forwarding. | sysctl-19
-  net.ipv6.conf.all.forwarding: 0
-
-  # ignore RAs on Ipv6. | sysctl-25
+  # Ignore RAs on Ipv6. | sysctl-25
  net.ipv6.conf.all.accept_ra: 0
  net.ipv6.conf.default.accept_ra: 0

@@ -252,11 +282,19 @@ sysctl_config:
  vm.mmap_rnd_bits: 32
  vm.mmap_rnd_compat_bits: 16

+  # Disable unprivileged users from loading eBPF programs into the kernel.
+  # One of mitigations against CVE-2021-33909. | Tail-2
+  kernel.unprivileged_bpf_disabled: 1
+
+  # Reduce attack surface by disabling unprivileged user namespaces.
+  # Mitigates CVE-2021-33909 and other exploits.
+  kernel.unprivileged_userns_clone: 0
+
 # Do not delete the following line or otherwise the playbook will fail
 # at task 'create a combined sysctl-dict if overwrites are defined'
 sysctl_overwrite:

-# disable unused filesystems
+# Disable unused filesystems
 os_unused_filesystems:
  - "cramfs"
  - "freevxfs"
@@ -273,7 +311,7 @@ os_unused_filesystems:
  - "sctp"  # CIS 3.5.2
  - "tipc"  # CIS 3.5.4

-# whitelist for used filesystems
+# Whitelist for used filesystems
 os_filesystem_whitelist: []

 # Set to false to turn the role into a no-op. Useful when using
@@ -285,9 +323,58 @@ os_auditd_enabled: true
 os_auditd_max_log_file: 6
 os_auditd_max_log_file_action: keep_logs

-# Set the SELinux state, can be either disabled, permissive, or enforcing.
+# Set the SELinux state, which can be either disabled, permissive, or enforcing.
 os_selinux_state: enforcing
 # Set the SELinux polixy.
 os_selinux_policy: targeted

+# Mount options for proc in /etc/fstab.
 proc_mnt_options: 'rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}'
+
+# Set to false to disable installing and configuring cron.
+os_cron_enabled: true
+
+# Set to false to disable installing and configuring limits.
+os_limits_enabled: true
+
+# Set to false to disable installing and configuring login_defs.
+os_login_defs_enabled: true
+
+# Set to false to disable installing and configuring minimize_access.
+os_minimize_access_enabled: true
+
+# Set to false to disable installing and configuring pam.
+os_pam_enabled: true
+
+# Set to false to disable installing and configuring modprobe.
+os_modprobe_enabled: true
+
+# Set to false to disable installing and configuring profile.
+os_profile_enabled: true
+
+# Set to false to disable installing and configuring securetty.
+os_securetty_enabled: true
+
+# Set to false to disable installing and configuring sysctl.
+os_sysctl_enabled: true
+
+# Set to false to disable installing and configuring user_accounts.
+os_user_accounts_enabled: true
+
+# Set to false to disable installing and configuring rhosts.
+os_rhosts_enabled: true
+
+# Set to false to disable installing and configuring yum.
+os_yum_enabled: true
+
+# Set to false to disable installing and configuring apt.
+os_apt_enabled: true
+
+# Set to false to disable installing and configuring selinux.
+os_selinux_enabled: true
+
+# Define the number of SHA rounds.
+# With a lot of rounds brute forcing the password is more difficult. But note also that it more CPU resources will be needed to authenticate users.
+# The values must be inside the 1000-999999999 range.
+os_sha_crypt_min_rounds: "640000"
+os_sha_crypt_max_rounds: "640000"
@@ -1,3 +1,9 @@
 ---
- name: update-initramfs
+- name: Update-initramfs
  command: 'update-initramfs -u'
+
+- name: restart-auditd
+  command:
+    cmd: 'service auditd restart'  # rhel: see: https://access.redhat.com/solutions/2664811
+    warn: false  # sadly 'service' module fails in that case also by using 'use: service'
+  when: molecule_yml is not defined  # restarting auditd in a container does not work
@@ -1,5 +1,5 @@
 ---
- name: remove deprecated or insecure packages | package-01 - package-09
+- name: Remove deprecated or insecure packages | package-01 - package-09
  apt:
    name: '{{ os_security_packages_list }}'
    state: 'absent'
@@ -1,13 +1,16 @@
 ---
- name: install auditd package | package-08
+- name: Install auditd package | package-08
  package:
    name: '{{ auditd_package }}'
    state: 'present'
+  tags: auditd

- name: configure auditd | package-08
+- name: Configure auditd | package-08
  template:
    src: 'etc/audit/auditd.conf.j2'
    dest: '/etc/audit/auditd.conf'
    owner: 'root'
    group: 'root'
    mode: '0640'
+  notify: 'restart-auditd'
+  tags: auditd
@@ -0,0 +1,28 @@
+---
+# Granting write access to this directory for non-privileged users could provide
+# them the means for gaining unauthorized elevated privileges.
+# Granting read access to this directory could give an unprivileged user insight
+# in how to gain elevated privileges or circumvent auditing controls.
+# CIS 5.1.2 - CIS 5.1.7
+#
+- name: Find cron files and directories
+  find:
+    paths:
+      - /etc
+    patterns:
+      - cron.hourly
+      - cron.daily
+      - cron.weekly
+      - cron.monthly
+      - cron.d
+      - crontab
+    file_type: any
+  register: cron_directories
+
+- name: Ensure permissions on cron files and directories are configured
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    owner: root
+    group: root
+    mode: og-rwx
+  with_items: "{{ cron_directories.files }}"
@@ -14,37 +14,49 @@

 # we only override variables with our default, if they have not been specified already
 # by default the lookup functions finds all varnames containing the string, therefore
-# we add ^ and $ to denote start and end of string, so this returns only exact maches
+# we add ^ and $ to denote start and end of string, so this returns only exact matches
 - name: Set OS dependent variables, if not already defined by user
  set_fact:
    '{{ item.key }}': '{{ item.value }}'
  when: "not lookup('varnames', '^' + item.key + '$')"
  with_dict: '{{ os_vars }}'
+  tags: always

 - import_tasks: auditd.yml
  tags: auditd
  when: os_auditd_enabled | bool

+- import_tasks: cron.yml
+  tags: cron
+  when: os_cron_enabled | bool
+
 - import_tasks: limits.yml
  tags: limits
+  when: os_limits_enabled | bool

 - import_tasks: login_defs.yml
  tags: login_defs
+  when: os_login_defs_enabled | bool

 - import_tasks: minimize_access.yml
  tags: minimize_access
+  when: os_minimize_access_enabled | bool

 - import_tasks: pam.yml
  tags: pam
+  when: os_pam_enabled | bool

 - import_tasks: modprobe.yml
  tags: modprobe
+  when: os_modprobe_enabled | bool

 - import_tasks: profile.yml
  tags: profile
+  when: os_profile_enabled | bool

 - import_tasks: securetty.yml
  tags: securetty
+  when: os_securetty_enabled | bool

 - import_tasks: suid_sgid.yml
  when: os_security_suid_sgid_enforce  | bool
@@ -52,21 +64,30 @@

 - import_tasks: sysctl.yml
  tags: sysctl
+  when: os_sysctl_enabled | bool

 - import_tasks: user_accounts.yml
  tags: user_accounts
+  when: os_user_accounts_enabled | bool

 - import_tasks: rhosts.yml
  tags: rhosts
+  when: os_rhosts_enabled | bool

 - import_tasks: yum.yml
-  when: ansible_facts.os_family == 'RedHat'
  tags: yum
+  when:
+    - ansible_facts.os_family == 'RedHat'
+    - os_yum_enabled | bool

 - import_tasks: apt.yml
-  when: ansible_facts.distribution in ['Debian', 'Ubuntu']
  tags: apt
+  when:
+    - ansible_facts.os_family == 'Debian'
+    - os_apt_enabled | bool

 - import_tasks: selinux.yml
  tags: selinux
-  when: ansible_facts.selinux.status == 'enabled'
+  when:
+    - ansible_facts.selinux.status == 'enabled'
+    - os_selinux_enabled | bool
@@ -1,6 +1,6 @@
 ---
 - block:
-  - name: create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
+  - name: Create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
    file:
      path: '/etc/security/limits.d'
      owner: 'root'
@@ -8,7 +8,7 @@
      mode: '0755'
      state: 'directory'

-  - name: create additional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
+  - name: Create additional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
    pam_limits:
      dest: '/etc/security/limits.d/10.hardcore.conf'
      domain: '*'
@@ -17,7 +17,7 @@
      value: '0'
      comment: Prevent core dumps for all users. These are usually not needed and may contain sensitive information

-  - name: set 10.hardcore.conf perms to 0400 and root ownership
+  - name: Set 10.hardcore.conf perms to 0400 and root ownership
    file:
      path: /etc/security/limits.d/10.hardcore.conf
      owner: 'root'
@@ -29,7 +29,7 @@

  when: not os_security_kernel_enable_core_dump | bool

- name: remove 10.hardcore.conf config file
+- name: Remove 10.hardcore.conf config file
  file:
    path: /etc/security/limits.d/10.hardcore.conf
    state: absent
@@ -1,5 +1,5 @@
 ---
- name: create login.defs | os-05, os-05b
+- name: Create login.defs | os-05, os-05b
  template:
    src: 'etc/login.defs.j2'
    dest: '/etc/login.defs'
@@ -1,3 +1,3 @@
 ---
- import_tasks: hardening.yml
+- include_tasks: hardening.yml
  when: os_hardening_enabled | bool
@@ -4,7 +4,7 @@
 # still getting found and the permissions minimized in the next task.
 # This is also the reason why there's ignore_errors: true on the task.
 # also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
- name: find files with write-permissions for group
+- name: Find files with write-permissions for group
  shell: "find -L {{ item }} -perm /go+w -type f"  # noqa command-instead-of-shell
  with_flattened:
    - '/usr/local/sbin'
@@ -18,7 +18,7 @@
  ignore_errors: true
  changed_when: false

- name: minimize access on found files
+- name: Minimize access on found files
  file:
    path: '{{ item.1 }}'
    mode: 'go-w'
@@ -27,21 +27,21 @@
    - "{{ minimize_access_directories.results }}"
    - stdout_lines

- name: change shadow ownership to root and mode to 0600 | os-02
+- name: Change shadow ownership to root and mode to 0600 | os-02
  file:
    dest: '/etc/shadow'
    owner: '{{ os_shadow_perms.owner }}'
    group: '{{ os_shadow_perms.group }}'
    mode: '{{ os_shadow_perms.mode }}'

- name: change passwd ownership to root and mode to 0644 | os-03
+- name: Change passwd ownership to root and mode to 0644 | os-03
  file:
    dest: '/etc/passwd'
    owner: '{{ os_passwd_perms.owner }}'
    group: '{{ os_passwd_perms.group }}'
    mode: '{{ os_passwd_perms.mode }}'

- name: change su-binary to only be accessible to user and group root
+- name: Change su-binary to only be accessible to user and group root
  file:
    dest: '/bin/su'
    owner: 'root'
@@ -49,7 +49,7 @@
    mode: '0750'
  when: '"change_user" not in os_security_users_allow'

- name: set option hidepid for proc filesystem
+- name: Set option hidepid for proc filesystem
  mount:
    path: /proc
    src: proc
@@ -1,28 +1,26 @@
 ---
- name: install modprobe to disable filesystems | os-10
+- name: Install modprobe to disable filesystems | os-10
  package:
    name: '{{ modprobe_package }}'
    state: 'present'

- name: check if efi is installed
+- name: Check if efi is installed
  stat:
    path: "/sys/firmware/efi"
  register: efi_installed

- name: remove vfat from fs-list if efi is used
+- name: Remove vfat from fs-list if efi is used
  set_fact:
    os_unused_filesystems: "{{ os_unused_filesystems | difference('vfat') }}"
  when:
    - efi_installed.stat.isdir is defined
    - efi_installed.stat.isdir

- name: remove used filesystems from fs-list
+- name: Remove used filesystems from fs-list
  set_fact:
    os_unused_filesystems: "{{ os_unused_filesystems | difference(ansible_mounts | map(attribute='fstype') | list) }}"
-  # we cannot do this on el6 and below, because these systems don't support the map function
-  when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')

- name: disable unused filesystems | os-10
+- name: Disable unused filesystems | os-10
  template:
    src: 'etc/modprobe.d/modprobe.j2'
    dest: '/etc/modprobe.d/dev-sec.conf'
@@ -1,125 +1,4 @@
 ---
- name: update pam on Debian systems
-  command: 'pam-auth-update --package'
-  when: ansible_facts.distribution in ['Debian', 'Ubuntu']
-  changed_when: false
-  environment:
-    DEBIAN_FRONTEND: noninteractive
-
-# the reason for this is so a user cannot connect to a server,
-# that isn't connected to an LDAP server anymore.
-# normally caching credentials shouldn't be necessary for most machines.
-# removing it provides some more security while not removing usability.
- name: remove pam ccreds to disable password caching
-  package:
-    name: '{{ os_packages_pam_ccreds }}'
-    state: 'absent'
-  when:
-    - ansible_facts.os_family != 'Archlinux'
-
- name: remove pam_cracklib, because it does not play nice with passwdqc
-  apt:
-    name: '{{ os_packages_pam_cracklib }}'
-    state: 'absent'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - os_auth_pam_passwdqc_enable
-
- name: install the package for strong password checking
-  apt:
-    name: '{{ os_packages_pam_passwdqc }}'
-    state: 'present'
-    update_cache: 'yes'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - os_auth_pam_passwdqc_enable
-
- name: configure passwdqc
-  template:
-    src: 'usr/share/pam-configs/pam_passwdqd.j2'
-    dest: '{{ passwdqc_path }}'
-    mode: '0644'
-    owner: 'root'
-    group: 'root'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - os_auth_pam_passwdqc_enable
-
- name: remove passwdqc
-  apt:
-    name: '{{ os_packages_pam_passwdqc }}'
-    state: 'absent'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-
- name: install tally2
-  apt:
-    name: 'libpam-modules'
-    state: 'present'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-    - os_auth_retries > 0
-
- name: configure tally2
-  template:
-    src: 'usr/share/pam-configs/pam_tally2.j2'
-    dest: '{{ tally2_path }}'
-    mode: '0644'
-    owner: 'root'
-    group: 'root'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-    - os_auth_retries > 0
-
- name: delete tally2 when retries is 0
-  file:
-    path: '{{ tally2_path }}'
-    state: 'absent'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-    - os_auth_retries == 0
-
- name: remove pam_cracklib, because it does not play nice with passwdqc
-  yum:
-    name: '{{ os_packages_pam_cracklib }}'
-    state: 'absent'
-  when:
-    - ansible_facts.os_family == 'RedHat'
-    - ansible_facts.distribution_major_version|int is version('7', '<')
-    - ansible_facts.distribution != 'Amazon'
-    - os_auth_pam_passwdqc_enable
-
- name: install the package for strong password checking
-  yum:
-    name: '{{ os_packages_pam_passwdqc }}'
-    state: 'present'
-  when:
-    - ansible_facts.os_family == 'RedHat'
-    - ansible_facts.distribution_major_version|int is version('7', '<')
-    - ansible_facts.distribution != 'Amazon'
-    - os_auth_pam_passwdqc_enable
-
- name: remove passwdqc
-  yum:
-    name: '{{ os_packages_pam_passwdqc }}'
-    state: 'absent'
-  when:
-    - ansible_facts.os_family == 'RedHat'
-    - not os_auth_pam_passwdqc_enable
-
- name: configure passwdqc and tally via central system-auth confic
-  template:
-    src: 'etc/pam.d/rhel_system_auth.j2'
-    dest: '/etc/pam.d/system-auth-ac'
-    mode: '0640'
-    owner: 'root'
-    group: 'root'
-  when: ansible_facts.os_family == 'RedHat'
-
 - name: Gather package facts
  package_facts:
    manager: auto
@@ -127,6 +6,25 @@
    - ansible_facts.os_family != 'Suse'
    - ansible_facts.os_family != 'Archlinux'

+# the reason for this is so a user cannot connect to a server,
+# that isn't connected to an LDAP server anymore.
+# normally caching credentials shouldn't be necessary for most machines.
+# removing it provides some more security while not removing usability.
+- name: Remove pam ccreds to disable password caching
+  package:
+    name: '{{ os_packages_pam_ccreds }}'
+    state: 'absent'
+  when:
+    - ansible_facts.os_family != 'Archlinux'
+
+- import_tasks: pam_debian.yml
+  when:
+    - ansible_facts.os_family == 'Debian'
+
+- import_tasks: pam_rhel.yml
+  when:
+    - ansible_facts.os_family == 'RedHat'
+
 - name: NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
  template:
    src: 'etc/libuser.conf.j2'
@@ -0,0 +1,120 @@
+---
+- name: Install the package for strong password checking
+  apt:
+    name: 'libpam-passwdqc'
+    state: 'present'
+    update_cache: 'yes'
+  when:
+    - os_auth_pam_passwdqc_enable
+
+- name: Configure passwdqc
+  template:
+    src: 'usr/share/pam-configs/pam_passwdqc.j2'
+    dest: '{{ passwdqc_path }}'
+    mode: '0644'
+    owner: 'root'
+    group: 'root'
+  when:
+    - os_auth_pam_passwdqc_enable
+
+- name: Install tally2
+  apt:
+    name: 'libpam-modules'
+    state: 'present'
+  when:
+    - os_auth_retries > 0
+
+- name: Manage tally on Debian stable
+  block:
+    - name: Configure tally2
+      template:
+        src: 'usr/share/pam-configs/pam_tally2.j2'
+        dest: '{{ tally2_path }}'
+        mode: '0644'
+        owner: 'root'
+        group: 'root'
+      when:
+        - os_auth_retries > 0
+
+    - name: Delete tally2 when retries is 0
+      file:
+        path: '{{ tally2_path }}'
+        state: 'absent'
+      when:
+        - os_auth_retries == 0
+  when:
+    - "'libpam-modules' in ansible_facts.packages"
+    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '<')"
+
+- name: Manage tally/faillock on Debian unstable
+  block:
+    - name: Delete tally2
+      file:
+        path: '{{ tally2_path }}'
+        state: 'absent'
+
+    - name:  create tally directory
+      file:
+        path: '/var/run/faillock'
+        state: 'directory'
+        mode: '0755'
+        owner: 'root'
+        group: 'root'
+
+    - name: Configure faillock
+      template:
+        src: 'etc/security/faillock.conf.j2'
+        dest: '/etc/security/faillock.conf'
+        mode: '0644'
+        owner: 'root'
+        group: 'root'
+
+    - name: Configure faillock pam
+      template:
+        src: 'usr/share/pam-configs/pam_faillock.j2'
+        dest: '/usr/share/pam-configs/faillock'
+        mode: '0644'
+        owner: 'root'
+        group: 'root'
+      when:
+        - os_auth_retries > 0
+
+    - name: Configure faillock pam authfail
+      template:
+        src: 'usr/share/pam-configs/pam_faillock_authfail.j2'
+        dest: '/usr/share/pam-configs/faillock_authfail'
+        mode: '0644'
+        owner: 'root'
+        group: 'root'
+      when:
+        - os_auth_retries > 0
+
+    - name: Delete faillock when retries is 0
+      file:
+        path: '/usr/share/pam-configs/faillock'
+        state: 'absent'
+      when:
+        - os_auth_retries == 0
+
+    - name: Delete faillock authfail when retries is 0
+      file:
+        path: '/usr/share/pam-configs/faillock_authfail'
+        state: 'absent'
+      when:
+        - os_auth_retries == 0
+  when:
+    - "'libpam-modules' in ansible_facts.packages"
+    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '>=')"
+
+- name: Update pam on Debian systems
+  command: 'pam-auth-update --package'
+  environment:
+    DEBIAN_FRONTEND: noninteractive
+  changed_when: false
+
+- name: Remove passwdqc
+  apt:
+    name: 'libpam-passwdqc'
+    state: 'absent'
+  when:
+    - not os_auth_pam_passwdqc_enable
@@ -0,0 +1,43 @@
+---
+- name: Install sssd-clients
+  yum:
+    name: sssd-client
+    state: 'present'
+  when:
+    - os_auth_pam_sssd_enable | bool
+
+- name: Configure passwdqc and faillock via central system-auth config
+  template:
+    src: 'etc/pam.d/rhel_auth.j2'
+    dest: '/etc/pam.d/system-auth-local'
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
+
+- name: Enable our config for system-auth
+  file:
+    src: /etc/pam.d/system-auth-local
+    dest: /etc/pam.d/system-auth
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
+    state: link
+    force: true
+
+- name: Configure passwdqc and faillock via central password-auth config
+  template:
+    src: 'etc/pam.d/rhel_auth.j2'
+    dest: '/etc/pam.d/password-auth-local'
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
+
+- name: Enable our config for password-auth
+  file:
+    src: /etc/pam.d/password-auth-local
+    dest: /etc/pam.d/password-auth
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
+    state: link
+    force: true
@@ -1,5 +1,5 @@
 ---
- name: add pinerolo_profile.sh to profile.d
+- name: Add pinerolo_profile.sh to profile.d
  template:
    src: 'etc/profile.d/profile.conf.j2'
    dest: '/etc/profile.d/pinerolo_profile.sh'
@@ -8,7 +8,7 @@
    mode: '0750'
  when: not os_security_kernel_enable_core_dump | bool

- name: remove pinerolo_profile.sh from profile.d
+- name: Remove pinerolo_profile.sh from profile.d
  file:
    path: /etc/profile.d/pinerolo_profile.sh
    state: absent
@@ -5,18 +5,18 @@
  check_mode: false
  register: users_accounts

- name: delete rhosts-files from system | os-09
+- name: Delete rhosts-files from system | os-09
  file:
    dest: '~{{ item }}/.rhosts'
    state: 'absent'
  with_flattened: '{{ users_accounts.stdout_lines | default([]) }}'

- name: delete hosts.equiv from system | os-01
+- name: Delete hosts.equiv from system | os-01
  file:
    dest: '/etc/hosts.equiv'
    state: 'absent'

- name: delete .netrc-files from system | os-09
+- name: Delete .netrc-files from system | os-09
  file:
    dest: '~{{ item }}/.netrc'
    state: 'absent'
@@ -1,5 +1,5 @@
 ---
- name: create securetty
+- name: Create securetty
  template:
    src: 'etc/securetty.j2'
    dest: '/etc/securetty'
@@ -1,5 +1,5 @@
 ---
- name: configure selinux | selinux-01
+- name: Configure selinux | selinux-01
  selinux:
    policy: "{{ os_selinux_policy }}"
    state: "{{ os_selinux_state }}"
@@ -1,5 +1,5 @@
 ---
- name: remove suid/sgid bit from binaries in blacklist | os-06
+- name: Remove suid/sgid bit from binaries in blacklist | os-06
  file:
    path: '{{ item }}'
    mode: 'a-s'
@@ -10,18 +10,18 @@
    - '{{ os_security_suid_sgid_system_blacklist }}'
    - '{{ os_security_suid_sgid_blacklist }}'

- name: find binaries with suid/sgid set | os-06
+- name: Find binaries with suid/sgid set | os-06
  shell: find / -xdev \( -perm -4000 -o -perm -2000 \) -type f ! -path '/proc/*' -print 2>/dev/null
  register: sbit_binaries
  when: os_security_suid_sgid_remove_from_unknown | bool
  changed_when: false

- name: gather files from which to remove suids/sgids and remove system white-listed files | os-06
+- name: Gather files from which to remove suids/sgids and remove system white-listed files | os-06
  set_fact:
    suid: '{{ sbit_binaries.stdout_lines | difference(os_security_suid_sgid_system_whitelist) }}'
  when: os_security_suid_sgid_remove_from_unknown | bool

- name: remove suid/sgid bit from all binaries except in system and user whitelist | os-06
+- name: Remove suid/sgid bit from all binaries except in system and user whitelist | os-06
  file:
    path: '{{ item }}'
    mode: 'a-s'
@@ -1,5 +1,5 @@
 ---
- name: protect sysctl.conf
+- name: Protect sysctl.conf
  file:
    path: '/etc/sysctl.conf'
    owner: 'root'
@@ -9,16 +9,16 @@
    modification_time: preserve
    access_time: preserve

- name: set Daemon umask, do config for rhel-family | NSA 2.2.4.1
+- name: Set Daemon umask, do config for rhel-family | NSA 2.2.4.1
  template:
    src: 'etc/sysconfig/rhel_sysconfig_init.j2'
    dest: '/etc/sysconfig/init'
    owner: 'root'
    group: 'root'
    mode: '0544'
-  when: ansible_facts.distribution in ['Amazon', 'CentOS', 'Fedora', 'RedHat']
+  when: ansible_facts.os_family == 'RedHat'

- name: install initramfs-tools
+- name: Install initramfs-tools
  apt:
    name: 'initramfs-tools'
    state: 'present'
@@ -27,7 +27,7 @@
    - ansible_facts.os_family == 'Debian'
    - os_security_kernel_enable_module_loading

- name: rebuild initramfs with starting pack of modules, if module loading at runtime is disabled
+- name: Rebuild initramfs with starting pack of modules, if module loading at runtime is disabled
  template:
    src: 'etc/initramfs-tools/modules.j2'
    dest: '/etc/initramfs-tools/modules'
@@ -35,15 +35,15 @@
    group: 'root'
    mode: '0440'
  notify:
-    - update-initramfs
+    - Update-initramfs
  when:
    - ansible_facts.os_family == 'Debian'
    - os_security_kernel_enable_module_loading
  register: initramfs

- name: change sysctls
+- name: Change sysctls
  block:
-    - name: create a combined sysctl-dict if overwrites are defined
+    - name: Create a combined sysctl-dict if overwrites are defined
      set_fact:
        sysctl_config: '{{ sysctl_config | combine(sysctl_overwrite) }}'
      when: sysctl_overwrite | default()
@@ -58,7 +58,7 @@
        ignoreerrors: true
      with_dict: '{{ sysctl_config }}'

-    - name: Change various sysctl-settings on rhel6-hosts or older, look at the sysctl-vars file for documentation
+    - name: Change various sysctl-settings on Amazon Linux, look at the sysctl-vars file for documentation
      sysctl:
        name: '{{ item.key }}'
        value: '{{ item.value }}'
@@ -66,8 +66,7 @@
        reload: true
        ignoreerrors: true
      with_dict: '{{ sysctl_rhel_config }}'
-      when: ((ansible_facts.distribution in ['CentOS', 'Fedora', 'RedHat']) and
-            ansible_distribution_version|int is version('7', '<')) or ansible_facts.distribution == 'Amazon'
+      when: ansible_facts.distribution == 'Amazon'

  when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']

@@ -78,5 +77,5 @@
    mode: '0644'
  when:
    - ufw_manage_defaults
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
+    - ansible_facts.os_family == 'Debian'
  tags: ufw
@@ -1,5 +1,5 @@
 ---
- name: get UID_MIN from login.defs
+- name: Get UID_MIN from login.defs
  shell: awk '/^\s*UID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs
  args:
    removes: /etc/login.defs
@@ -7,24 +7,24 @@
  check_mode: false
  changed_when: false

- name: calculate UID_MAX from UID_MIN by substracting 1
+- name: Calculate UID_MAX from UID_MIN by substracting 1
  set_fact:
    uid_max: '{{ uid_min.stdout | int - 1 }}'
  when: uid_min.stdout|int > 0

- name: set UID_MAX on Debian-systems if no login.defs exist
+- name: Set UID_MAX on Debian-systems if no login.defs exist
  set_fact:
    uid_max: '999'
  when:
    - ansible_facts.os_family == 'Debian'
    - uid_max is not defined

- name: set UID_MAX on other systems if no login.defs exist
+- name: Set UID_MAX on other systems if no login.defs exist
  set_fact:
    uid_max: '499'
  when: uid_max is not defined

- name: get all system accounts
+- name: Get all system accounts
  command: awk -F'':'' '{ if ( $3 <= {{ uid_max|quote }} ) print $1}' /etc/passwd
  args:
    removes: /etc/passwd
@@ -32,12 +32,12 @@
  check_mode: false
  register: sys_accs

- name: remove always ignored system accounts from list
+- name: Remove always ignored system accounts from list
  set_fact:
    sys_accs_cond: '{{ sys_accs.stdout_lines | difference(os_always_ignore_users) }}'
  check_mode: false

- name: change system accounts not on the user provided ignore-list
+- name: Change system accounts not on the user provided ignore-list
  user:
    name: '{{ item }}'
    shell: '{{ os_nologin_shell_path }}'
@@ -45,3 +45,20 @@
    createhome: false
  with_flattened:
    - '{{ sys_accs_cond | default([]) | difference(os_ignore_users) | list }}'
+
+- name: get all home directories in /home, but skip ignored users
+  find:
+    paths: /home/
+    recurse: false
+    file_type: directory
+    excludes: "{{ os_ignore_home_folder_users | join(',') }}"
+  register: home_directories
+  when: os_chmod_home_folders | bool
+
+- name: set ownership of /home directories to 0700
+  file:
+    mode: 0700
+    path: "{{ item.path }}"
+    state: directory
+  loop: "{{ home_directories.files }}"
+  when: os_chmod_home_folders | bool
@@ -1,5 +1,5 @@
 ---
- name: remove unused repositories
+- name: Remove unused repositories
  file:
    name: '/etc/yum.repos.d/{{ item }}.repo'
    state: 'absent'
@@ -9,7 +9,7 @@
    - 'CentOS-Vault'
  when: os_security_packages_clean | bool

- name: get yum-repository-files
+- name: Get yum-repository-files
  find:
    paths: '/etc/yum.repos.d'
    patterns: '*.repo'
@@ -18,7 +18,7 @@
 # for the 'default([])' see here:
 # https://github.com/dev-sec/ansible-os-hardening/issues/99 and
 # https://stackoverflow.com/questions/37067827/ansible-deprecation-warning-for-undefined-variable-despite-when-clause
- name: activate gpg-check for yum-repository-files
+- name: Activate gpg-check for yum-repository-files
  replace:
    path: '{{ item.path }}'
    regexp: '^\s*gpgcheck.*'
@@ -30,7 +30,7 @@
 # failed_when is needed because by default replace module will fail if the file doesn't exists.
 # status.rc is only defined if an error accrued and only error code (rc) 257 will be ignored.
 # All other errors will still be raised.
- name: activate gpg-check for config files
+- name: Activate gpg-check for config files
  replace:
    path: '{{ item }}'
    regexp: '^\s*gpgcheck\W.*'
@@ -43,7 +43,7 @@
    - '/etc/dnf/dnf.conf'
    - '/etc/yum/pluginconf.d/rhnplugin.conf'

- name: remove deprecated or insecure packages | package-01 - package-09
+- name: Remove deprecated or insecure packages | package-01 - package-09
  yum:
    name: '{{ os_security_packages_list }}'
    state: 'absent'
@@ -7,7 +7,7 @@
 # Set to yes to apply rules to support IPv6 (no means only IPv6 on loopback
 # accepted). You will need to 'disable' and then 'enable' the firewall for
 # the changes to take affect.
-IPV6={{ 'no' if sysctl_config['net.ipv6.conf.all.disable_ipv6'] is defined and sysctl_config['net.ipv6.conf.all.disable_ipv6'] == 1 else 'yes' }}
+IPV6={{ 'yes' if ufw_enable_ipv6 else 'no' }}

 # Set the default input policy to ACCEPT, DROP, or REJECT. Please note that if
 # you change this you will most likely want to adjust your rules.
@@ -114,18 +114,28 @@ PASS_WARN_AGE     7

 # Min/max values for automatic uid selection in useradd
 UID_MIN           {{ os_auth_uid_min }}
-UID_MAX           60000
+UID_MAX           {{ os_auth_uid_max }}
 # System accounts
 SYS_UID_MIN       {{ os_auth_sys_uid_min }}
 SYS_UID_MAX       {{ os_auth_sys_uid_max }}

 # Min/max values for automatic gid selection in groupadd
 GID_MIN           {{ os_auth_gid_min }}
-GID_MAX           60000
+GID_MAX           {{ os_auth_gid_max }}
 # System accounts
 SYS_GID_MIN       {{ os_auth_sys_gid_min }}
 SYS_GID_MAX       {{ os_auth_sys_gid_max }}

+# If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate user IDs)
+# allocate SUB_UID_COUNT unused user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user.
+# The default values for SUB_UID_MIN, SUB_UID_MAX, SUB_UID_COUNT are respectively 100000, 600100000 and 65536.
+SUB_UID_MIN       {{ os_auth_sub_uid_min }}
+SUB_UID_MAX       {{ os_auth_sub_uid_max }}
+SUB_UID_COUNT     {{ os_auth_sub_uid_count }}
+SUB_GID_MIN       {{ os_auth_sub_gid_min }}
+SUB_GID_MAX       {{ os_auth_sub_gid_max }}
+SUB_GID_COUNT     {{ os_auth_sub_gid_count }}
+
 # Max number of login retries if password is bad. This will most likely be overriden by PAM, since the default pam_unix module has it's own built in of 3 retries. However, this is a safe fallback in case you are using an authentication module that does not enforce PAM_MAXTRIES.
 LOGIN_RETRIES     {{ os_auth_retries }}

@@ -170,11 +180,11 @@ MD5_CRYPT_ENAB    no
 ENCRYPT_METHOD    SHA512

 # Only used if `ENCRYPT_METHOD` is set to `SHA256` or `SHA512`: Define the number of SHA rounds.
-# With a lot of rounds, it is more difficult to brute forcing the password. But note also that it more CPU resources will be needed to authenticate users.
+# With a lot of rounds brute forcing the password is more difficult. But note also that it more CPU resources will be needed to authenticate users.
 # If not specified, the libc will choose the default number of rounds (5000). The values must be inside the 1000-999999999 range. If only one of the MIN or MAX values is set, then this value will be used.
 # If MIN > MAX, the highest value will be used.
-#SHA_CRYPT_MIN_ROUNDS    5000
-#SHA_CRYPT_MAX_ROUNDS    5000
+SHA_CRYPT_MIN_ROUNDS    {{ os_sha_crypt_min_rounds }}
+SHA_CRYPT_MAX_ROUNDS    {{ os_sha_crypt_max_rounds }}


 # Obsoleted by PAM
@@ -0,0 +1,54 @@
+{{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}
+
+#%PAM-1.0
+auth        required      pam_env.so
+auth        required      pam_faildelay.so delay=2000000
+{% if os_auth_retries > 0 %}
+auth        required      pam_faillock.so preauth silent audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
+{% endif %}
+{% if (os_auth_pam_sssd_enable | bool) %}
+auth        [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
+auth        [default=1 ignore=ignore success=ok] pam_localuser.so
+{% endif %}
+auth        sufficient    pam_unix.so nullok try_first_pass
+{% if (os_auth_pam_sssd_enable | bool) %}
+auth        [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
+auth        sufficient    pam_sss.so forward_pass
+{% endif %}
+{% if os_auth_retries > 0 %}
+auth        required      pam_faillock.so authfail audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
+{% endif %}
+auth        required      pam_deny.so
+
+{% if os_auth_retries > 0 %}
+account     required      pam_faillock.so
+{% endif %}
+account     required      pam_unix.so
+account     sufficient    pam_localuser.so
+account     sufficient    pam_succeed_if.so uid < 1000 quiet
+{% if (os_auth_pam_sssd_enable | bool) %}
+account     [default=bad success=ok user_unknown=ignore] pam_sss.so
+{% endif %}
+account     required      pam_permit.so
+
+{% if (os_auth_pam_passwdqc_enable | bool) %}
+password    requisite     pam_pwquality.so {{ os_auth_pam_pwquality_options }}
+{% endif %}
+{# NSA 2.3.3.6 Limit Password Reuse #}
+password    requisite     pam_pwhistory.so remember={{ os_auth_pw_remember }} use_authtok
+{# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512 #}
+password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok rounds={{ os_sha_crypt_min_rounds }}
+{% if (os_auth_pam_sssd_enable | bool) %}
+password    sufficient    pam_sss.so use_authtok
+{% endif %}
+password    required      pam_deny.so
+
+session     optional      pam_keyinit.so revoke
+session     required      pam_limits.so
+-session    optional      pam_systemd.so
+session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+session     required      pam_unix.so
+{% if (os_auth_pam_sssd_enable | bool) %}
+session     optional      pam_sss.so
+{% endif %}
@@ -1,40 +0,0 @@
-{{ ansible_managed | comment }}
-# Generated by Ansible role {{ ansible_role_name }}
-
-#%PAM-1.0
-{% if os_auth_retries > 0 %}
-auth        required      pam_tally2.so deny={{ os_auth_retries }} onerr=fail unlock_time={{ os_auth_lockout_time }}
-{% endif %}
-auth        required      pam_env.so
-auth        sufficient    pam_unix.so nullok try_first_pass
-auth        requisite     pam_succeed_if.so uid >= 500 quiet
-auth        required      pam_deny.so
-
-{% if os_auth_retries > 0 %}
-account     required      pam_tally2.so
-{% endif %}
-account     required      pam_unix.so
-account     sufficient    pam_localuser.so
-account     sufficient    pam_succeed_if.so uid < 500 quiet
-account     required      pam_permit.so
-
-{% if (os_auth_pam_passwdqc_enable|bool) %}
-  {%- if ((ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_version|int is version('7', '>=')) or ansible_facts.distribution == 'Amazon') %}
-password    required      pam_pwquality.so {{ os_auth_pam_pwquality_options }}
-  {%- else %}
-password    requisite     pam_passwdqc.so {{ os_auth_pam_passwdqc_options }}
-  {%- endif %}
-{% else %}
-password    requisite     pam_cracklib.so try_first_pass retry=3 type=
-{% endif %}
-
-
-# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
-# NSA 2.3.3.6 Limit Password Reuse
-password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
-password    required      pam_deny.so
-
-session     optional      pam_keyinit.so revoke
-session     required      pam_limits.so
-session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
-session     required      pam_unix.so
@@ -0,0 +1,65 @@
+{{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}
+#
+# Configuration for locking the user after multiple failed
+# authentication attempts.
+#
+# The directory where the user files with the failure records are kept.
+# The default is /var/run/faillock.
+# dir = /var/run/faillock
+#
+# Will log the user name into the system log if the user is not found.
+# Enabled if option is present.
+# audit
+#
+# Don't print informative messages.
+# Enabled if option is present.
+# silent
+#
+# Don't log informative messages via syslog.
+# Enabled if option is present.
+# no_log_info
+#
+# Only track failed user authentications attempts for local users
+# in /etc/passwd and ignore centralized (AD, IdM, LDAP, etc.) users.
+# The `faillock` command will also no longer track user failed
+# authentication attempts. Enabling this option will prevent a
+# double-lockout scenario where a user is locked out locally and
+# in the centralized mechanism.
+# Enabled if option is present.
+# local_users_only
+#
+# Deny access if the number of consecutive authentication failures
+# for this user during the recent interval exceeds n tries.
+# The default is 3.
+deny = {{ os_auth_retries }}
+#
+# The length of the interval during which the consecutive
+# authentication failures must happen for the user account
+# lock out is <replaceable>n</replaceable> seconds.
+# The default is 900 (15 minutes).
+# fail_interval = 900
+#
+# The access will be re-enabled after n seconds after the lock out.
+# The value 0 has the same meaning as value `never` - the access
+# will not be re-enabled without resetting the faillock
+# entries by the `faillock` command.
+# The default is 600 (10 minutes).
+unlock_time = {{ os_auth_lockout_time }}
+#
+# Root account can become locked as well as regular accounts.
+# Enabled if option is present.
+even_deny_root
+#
+# This option implies the `even_deny_root` option.
+# Allow access after n seconds to root account after the
+# account is locked. In case the option is not specified
+# the value is the same as of the `unlock_time` option.
+# root_unlock_time = 900
+#
+# If a group name is specified with this option, members
+# of the group will be handled by this module the same as
+# the root account (the options `even_deny_root>` and
+# `root_unlock_time` will apply to them.
+# By default, the option is not set.
+# admin_group = <admin_group_name>
@@ -0,0 +1,12 @@
+{{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}
+
+Name: faillock boilerplate
+Default: yes
+Priority: 1024
+Auth-Type: Primary
+Auth:
+  required           pam_faillock.so preauth
+Account-Type: Primary
+Account:
+  required           pam_faillock.so
@@ -0,0 +1,10 @@
+{{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}
+
+Name: faillock lockout after failed attempts enforcement
+Default: yes
+Priority: 0
+Auth-Type: Primary
+Auth:
+  required           pam_faillock.so authfail
+
@@ -1,8 +1,6 @@
 ---

 os_packages_pam_ccreds: 'pam_ccreds'
-os_packages_pam_passwdqc: 'pam_passwdqc'
-os_packages_pam_cracklib: 'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'

 # Different distros use different standards for /etc/shadow perms, e.g.
@@ -21,11 +19,21 @@ os_passwd_perms:
 os_env_umask: '077'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 201
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536
+
+os_auth_pam_sssd_enable: false

 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
@@ -15,11 +15,19 @@ os_passwd_perms:
 os_env_umask: '027'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 500
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 500
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 modprobe_package: 'kmod'
 auditd_package: 'audit'
@@ -1,8 +1,6 @@
 ---

 os_packages_pam_ccreds: 'libpam-ccreds'
-os_packages_pam_passwdqc: 'libpam-passwdqc'
-os_packages_pam_cracklib: 'libpam-cracklib'
 os_nologin_shell_path: '/usr/sbin/nologin'

 # Different distros use different standards for /etc/shadow perms, e.g.
@@ -21,11 +19,19 @@ os_passwd_perms:
 os_env_umask: '027'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 100
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 100
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 # defaults for useradd
 os_useradd_mail_dir: /var/mail
@@ -1,8 +1,6 @@
 ---

 os_packages_pam_ccreds: 'pam_ccreds'
-os_packages_pam_passwdqc: 'pam_passwdqc'
-os_packages_pam_cracklib: 'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'

 # Different distros use different standards for /etc/shadow perms, e.g.
@@ -21,11 +19,21 @@ os_passwd_perms:
 os_env_umask: '027'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 201
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536
+
+os_auth_pam_sssd_enable: true

 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
@@ -1,8 +1,6 @@
 ---

 os_packages_pam_ccreds: 'pam_ccreds'
-os_packages_pam_passwdqc: 'pam_passwdqc'
-os_packages_pam_cracklib: 'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'

 # Different distros use different standards for /etc/shadow perms, e.g.
@@ -21,11 +19,21 @@ os_passwd_perms:
 os_env_umask: '077'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 201
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536
+
+os_auth_pam_sssd_enable: false

 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
@@ -1,8 +1,6 @@
 ---

 os_packages_pam_ccreds: 'pam_ccreds'
-os_packages_pam_passwdqc: 'pam_passwdqc'
-os_packages_pam_cracklib: 'pam_cracklib'
 os_nologin_shell_path: '/sbin/nologin'

 # Different distros use different standards for /etc/shadow perms, e.g.
@@ -21,11 +19,21 @@ os_passwd_perms:
 os_env_umask: '077'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 201
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536
+
+os_auth_pam_sssd_enable: false

 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
@@ -0,0 +1,45 @@
+---
+
+os_packages_pam_ccreds: 'pam_ccreds'
+os_nologin_shell_path: '/sbin/nologin'
+
+# Different distros use different standards for /etc/shadow perms, e.g.
+# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
+# You must provide key/value pairs for owner, group, and mode if overriding.
+os_shadow_perms:
+  owner: root
+  group: root
+  mode: '0000'
+
+os_passwd_perms:
+  owner: root
+  group: root
+  mode: '0644'
+
+os_env_umask: '077'
+
+os_auth_uid_min: 1000
+os_auth_uid_max: 60000
+os_auth_gid_min: 1000
+os_auth_gid_max: 60000
+os_auth_sys_uid_min: 201
+os_auth_sys_uid_max: 999
+os_auth_sys_gid_min: 201
+os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536
+
+os_auth_pam_sssd_enable: true
+
+# defaults for useradd
+os_useradd_mail_dir: /var/spool/mail
+os_useradd_create_home: true
+
+modprobe_package: 'module-init-tools'
+auditd_package: 'audit'
+
+hidepid_option: '2'  # allowed values: 0, 1, 2
@@ -0,0 +1,45 @@
+---
+
+os_packages_pam_ccreds: 'pam_ccreds'
+os_nologin_shell_path: '/sbin/nologin'
+
+# Different distros use different standards for /etc/shadow perms, e.g.
+# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
+# You must provide key/value pairs for owner, group, and mode if overriding.
+os_shadow_perms:
+  owner: root
+  group: root
+  mode: '0000'
+
+os_passwd_perms:
+  owner: root
+  group: root
+  mode: '0644'
+
+os_env_umask: '077'
+
+os_auth_uid_min: 1000
+os_auth_uid_max: 60000
+os_auth_gid_min: 1000
+os_auth_gid_max: 60000
+os_auth_sys_uid_min: 201
+os_auth_sys_uid_max: 999
+os_auth_sys_gid_min: 201
+os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536
+
+os_auth_pam_sssd_enable: true
+
+# defaults for useradd
+os_useradd_mail_dir: /var/spool/mail
+os_useradd_create_home: true
+
+modprobe_package: 'module-init-tools'
+auditd_package: 'audit'
+
+hidepid_option: '2'  # allowed values: 0, 1, 2
@@ -1,8 +1,6 @@
 ---

 os_packages_pam_ccreds: 'pam_ccreds'
-os_packages_pam_passwdqc: 'pam_passwdqc'
-os_packages_pam_cracklib: 'cracklib'
 os_nologin_shell_path: '/sbin/nologin'

 # Different distros use different standards for /etc/shadow perms, e.g.
@@ -21,11 +19,19 @@ os_passwd_perms:
 os_env_umask: '027'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 100
 os_auth_sys_uid_max: 499
 os_auth_sys_gid_min: 100
 os_auth_sys_gid_max: 499
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 # defaults for useradd
 os_useradd_create_home: false
@@ -15,8 +15,8 @@ Warning: This role disables root-login on the target server! Please make sure yo
 ## Role Variables

 - `network_ipv6_enable`
-  - Default: `false`
-  - Description: true if IPv6 is needed. `ssh_listen_to` must also be set to listen to IPv6 addresses (for example `[::]`).
+  - Default: `true`
+  - Description: false if IPv6 is not needed. `ssh_listen_to` must also be set to listen to IPv6 addresses (for example `[::]`).
 - `ssh_client_config_file`
  - Default: `'/etc/ssh/ssh_config'`
  - Description: path of the ssh client configuration file, e.g. `/etc/ssh/ssh_config.d/custom.conf`.
@@ -40,7 +40,10 @@ Warning: This role disables root-login on the target server! Please make sure yo
  - Description: Specifies the number of bits in the private host RSA key to create.
 - `ssh_host_key_algorithms`
  - Default: `[]`
-  - Description: Host key algorithms that the server offers. If empty the [default list](https://man.openbsd.org/sshd_config#HostKeyAlgorithms) will be used, otherwise overrides the setting with specified list of algorithms.
+  - Description: Host key algorithms that the server offers. If empty the default list will be used. Otherwise overrides the setting with specified list of algorithms. Check `man sshd_config`, `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make sure you check the correct version!
+- `ssh_client_host_key_algorithms`
+  - Default: `[]`
+  - Description: Specifies the host key algorithms that the client wants to use in order of preference. If empty the default list will be used. Otherwise overrides the setting with specified list of algorithms. Check `man ssh_config`, `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make sure you check the correct version!.
 - `ssh_client_alive_interval`
  - Default: `600`
  - Description: specifies an interval for sending keepalive messages.
@@ -58,7 +61,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
  - Description: Disable root-login. Set to `'without-password'` or `'yes'` to enable root-login - The quotes are required!
 - `ssh_allow_tcp_forwarding`
  - Default: `no`
-  - Description: `'no'` to disable TCP Forwarding. Set to `'yes'` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all'` or `'local'`. <br> _Note_: values passed to this variable must be strings, thus values `'yes'` and `'no'` should be passed with quotes.
+  - Description: `'no'` to disable TCP Forwarding. Set to `'yes'` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all', `'local'`or`'remote'`. <br> _Note_: values passed to this variable must be strings, thus values `'yes'`and`'no'` should be passed with quotes.
 - `ssh_gateway_ports`
  - Default: `false`
  - Description: `false` to disable binding forwarded ports to non-loopback addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified` to allow the client to specify which address to bind to.
@@ -76,7 +79,10 @@ Warning: This role disables root-login on the target server! Please make sure yo
  - Description: false to disable pam authentication.
 - `ssh_gssapi_support`
  - Default: `false`
-  - Description: true if SSH has GSSAPI support.
+  - Description: Set to true to enable GSSAPI authentication (both client and server).
+- `ssh_gssapi_delegation`
+  - Default: `false`
+  - Description: Set to true to enable GSSAPI credential forwarding.
 - `ssh_kerberos_support`
  - Default: `true`
  - Description: true if SSH has Kerberos support.
@@ -241,7 +247,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
  collections:
    - devsec.hardening
  roles:
-    - devsec.hardening.ssh_hardening
+    - ssh_hardening
 ```

 ## Configuring settings not listed in role-variables
@@ -255,7 +261,7 @@ Example playbook:
  collections:
    - devsec.hardening
  roles:
-    - devsec.hardening.ssh_hardening
+    - ssh_hardening
  vars:
    ssh_custom_options:
      - "Include /etc/ssh/ssh_config.d/*"
@@ -1,6 +1,6 @@
 ---
 # true if IPv6 is needed
-network_ipv6_enable: false          # sshd + ssh
+network_ipv6_enable: true          # sshd + ssh

 # Paths of the config files
 ssh_client_config_file: /etc/ssh/ssh_config   # ssh
@@ -45,6 +45,9 @@ ssh_host_certificates: []           # sshd
 # Specifies the host key algorithms that the server offers
 ssh_host_key_algorithms: []         # sshd

+# Specifies the host key algorithms order the client will try
+ssh_client_host_key_algorithms: []  # ssh
+
 # specifies the time allowed for successful authentication to the SSH server
 ssh_login_grace_time: 30s

@@ -91,9 +94,12 @@ ssh_use_pam: true                   # sshd
 # specify AuthenticationMethods
 sshd_authenticationmethods: 'publickey'

-# true if SSH support GSSAPI
+# Set to true to enable GSSAPI authentication (both client and server)
 ssh_gssapi_support: false

+# Set to true to enable GSSAPI credential forwarding
+ssh_gssapi_delegation: false
+
 # if specified, login is disallowed for user names that match one of the patterns.
 ssh_deny_users: ''                  # sshd

@@ -185,7 +191,6 @@ ssh_server_accept_env_vars: ''
 # maximum number of concurrent unauthenticated connections to the SSH daemon
 ssh_max_startups: '10:30:60'       # sshd

-ssh_ps53: 'yes'
 ssh_ps59: 'sandbox'

 ssh_macs: []
@@ -1,5 +1,5 @@
 ---
- name: restart sshd
+- name: Restart sshd
  service:
    name: '{{ sshd_service_name }}'
    state: restarted
@@ -1,14 +1,14 @@
 ---
- name: set ssh CA pub keys
+- name: Set ssh CA pub keys
  template:
    src: 'trusted_user_ca_keys.j2'
    dest: '{{ ssh_trusted_user_ca_keys_file }}'
    mode: '0644'
    owner: '{{ ssh_owner }}'
    group: '{{ ssh_group }}'
-  notify: restart sshd
+  notify: Restart sshd

- name: create ssh authorized principals directories
+- name: Create ssh authorized principals directories
  file:
    path: '{{ item.path | dirname }}'
    mode: '{{ item.directorymode | default(0700) }}'
@@ -17,7 +17,7 @@
    state: directory
  loop: '{{ ssh_authorized_principals }}'

- name: set ssh authorized principals
+- name: Set ssh authorized principals
  template:
    src: 'authorized_principals.j2'
    dest: '{{ item.path }}'
@@ -1,10 +1,10 @@
 ---
- name: set ciphers according to openssh-version if openssh >= 5.3
+- name: Set ciphers according to openssh-version if openssh >= 5.3
  set_fact:
    ssh_ciphers: '{{ ssh_ciphers_53_default }}'
  when: sshd_version is version('5.3', '>=')

- name: set ciphers according to openssh-version if openssh >= 6.6
+- name: Set ciphers according to openssh-version if openssh >= 6.6
  set_fact:
    ssh_ciphers: '{{ ssh_ciphers_66_default }}'
  when: sshd_version is version('6.6', '>=')
@@ -1,5 +1,5 @@
 ---
- name: replace default 2048 bits RSA keypair
+- name: Replace default 2048 bits RSA keypair
  community.crypto.openssh_keypair:
    state: present
    type: rsa
@@ -10,28 +10,28 @@

 # In RHEL and Fedora, the 'ssh_keys' group is the group owner of the host private SSH keys.
 # Since the openssh_keypair module needs to read the key to provide idempotency, we need to set ownership and group based on specific OS vars.
- name: change host private key ownership, group and permissions
+- name: Change host private key ownership, group and permissions
  file:
    path: "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
    owner: "{{ ssh_host_keys_owner }}"
    group: "{{ ssh_host_keys_group }}"
    mode: "0640"
-  when: "ansible_facts.distribution in ['CentOS', 'OracleLinux', 'RedHat']"
+  when: "ansible_facts.os_family == 'RedHat'"

- name: set hostkeys according to openssh-version if openssh >= 5.3
+- name: Set hostkeys according to openssh-version if openssh >= 5.3
  set_fact:
    ssh_host_key_files:
      - "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
  when: sshd_version is version('5.3', '>=')

- name: set hostkeys according to openssh-version if openssh >= 6.0
+- name: Set hostkeys according to openssh-version if openssh >= 6.0
  set_fact:
    ssh_host_key_files:
      - "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
      - "{{ ssh_host_keys_dir }}/ssh_host_ecdsa_key"
  when: sshd_version is version('6.0', '>=')

- name: set hostkeys according to openssh-version if openssh >= 6.3
+- name: Set hostkeys according to openssh-version if openssh >= 6.3
  set_fact:
    ssh_host_key_files:
      - "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
@@ -1,15 +1,20 @@
 ---
- name: set kex according to openssh-version if openssh >= 5.9
+- name: Set kex according to openssh-version if openssh >= 5.9
  set_fact:
    ssh_kex: '{{ ssh_kex_59_default }}'
  when: sshd_version is version('5.9', '>=')

- name: set kex according to openssh-version if openssh >= 6.6
+- name: Set kex according to openssh-version if openssh >= 6.6
  set_fact:
    ssh_kex: '{{ ssh_kex_66_default }}'
  when: sshd_version is version('6.6', '>=')

- name: set kex according to openssh-version if openssh >= 8.0
+- name: Set kex according to openssh-version if openssh >= 8.0
  set_fact:
    ssh_kex: '{{ ssh_kex_80_default }}'
  when: sshd_version is version('8.0', '>=')
+
+- name: Set kex according to openssh-version if openssh >= 8.5
+  set_fact:
+    ssh_kex: '{{ ssh_kex_85_default }}'
+  when: sshd_version is version('8.5', '>=')
@@ -1,27 +1,20 @@
 ---
- name: set macs according to openssh-version if openssh >= 5.3
+- name: Set macs according to openssh-version if openssh >= 5.3
  set_fact:
    ssh_macs: '{{ ssh_macs_53_default }}'
  when: sshd_version is version('5.3', '>=')

- name: set macs for Enterprise Linux >= 6.5 (openssh 5.3 with backports)
-  set_fact:
-    ssh_macs: '{{ ssh_macs_53_el_6_5_default }}'
-  when:
-    - ansible_facts.distribution in ['CentOS', 'OracleLinux', 'RedHat']
-    - ansible_facts.distribution_version is version('6.5', '>=')
-
- name: set macs according to openssh-version if openssh >= 5.9
+- name: Set macs according to openssh-version if openssh >= 5.9
  set_fact:
    ssh_macs: '{{ ssh_macs_59_default }}'
  when: sshd_version is version('5.9', '>=')

- name: set macs according to openssh-version if openssh >= 6.6
+- name: Set macs according to openssh-version if openssh >= 6.6
  set_fact:
    ssh_macs: '{{ ssh_macs_66_default }}'
  when: sshd_version is version('6.6', '>=')

- name: set macs according to openssh-version if openssh >= 7.6
+- name: Set macs according to openssh-version if openssh >= 7.6
  set_fact:
    ssh_macs: '{{ ssh_macs_76_default }}'
  when: sshd_version is version('7.6', '>=')
@@ -14,52 +14,53 @@

 # we only override variables with our default, if they have not been specified already
 # by default the lookup functions finds all varnames containing the string, therefore
-# we add ^ and $ to denote start and end of string, so this returns only exact maches
+# we add ^ and $ to denote start and end of string, so this returns only exact matches
 - name: Set OS dependent variables, if not already defined by user
  set_fact:
    '{{ item.key }}': '{{ item.value }}'
  when: "not lookup('varnames', '^' + item.key + '$')"
  with_dict: '{{ os_vars }}'
+  tags: always

- name: get openssh-version
+- name: Get openssh-version
  command: ssh -V
  register: sshd_version_raw
  changed_when: false
  check_mode: false

- name: parse openssh-version
+- name: Parse openssh-version
  set_fact:
    sshd_version: "{{ sshd_version_raw.stderr | regex_replace('.*_([0-9]*.[0-9]).*', '\\1') }}"

- name: set default for ssh_host_key_files if not supplied
+- name: Set default for ssh_host_key_files if not supplied
  include_tasks: crypto_hostkeys.yml
  when:
    - ssh_server_hardening | bool
    - not ssh_host_key_files

- name: set default for ssh_macs if not supplied
+- name: Set default for ssh_macs if not supplied
  include_tasks: crypto_macs.yml
  when: not ssh_macs

- name: set default for ssh_ciphers if not supplied
+- name: Set default for ssh_ciphers if not supplied
  include_tasks: crypto_ciphers.yml
  when: not ssh_ciphers

- name: set default for ssh_kex if not supplied
+- name: Set default for ssh_kex if not supplied
  include_tasks: crypto_kex.yml
  when: not ssh_kex

- name: create revoked_keys and set permissions to root/600
+- name: Create revoked_keys and set permissions to root/600
  template:
    src: 'revoked_keys.j2'
    dest: '/etc/ssh/revoked_keys'
    mode: '0600'
    owner: '{{ ssh_owner }}'
    group: '{{ ssh_group }}'
-  notify: restart sshd
+  notify: Restart sshd
  when: ssh_server_hardening | bool

- name: create sshd_config and set permissions to root/600
+- name: Create sshd_config and set permissions to root/600
  template:
    src: 'opensshd.conf.j2'
    dest: "{{ ssh_server_config_file }}"
@@ -67,10 +68,10 @@
    owner: '{{ ssh_owner }}'
    group: '{{ ssh_group }}'
    validate: '{{ sshd_path }} -T -C user=root -C host=localhost -C addr=localhost -C lport=22 -f %s'
-  notify: restart sshd
+  notify: Restart sshd
  when: ssh_server_hardening | bool

- name: disable dynamic MOTD
+- name: Disable dynamic MOTD
  pamd:
    name: sshd
    type: session
@@ -83,7 +84,7 @@
    - ssh_pam_support | bool
    - not (ssh_print_pam_motd | bool)

- name: create ssh_config and set permissions to root/644
+- name: Create ssh_config and set permissions to root/644
  template:
    src: 'openssh.conf.j2'
    dest: "{{ ssh_client_config_file }}"
@@ -92,36 +93,36 @@
    group: '{{ ssh_group }}'
  when: ssh_client_hardening | bool

- name: check if {{ sshd_moduli_file }} contains weak DH parameters
+- name: Check if {{ sshd_moduli_file }} contains weak DH parameters
  shell: awk '$5 < {{ sshd_moduli_minimum }}' {{ sshd_moduli_file }}
  register: sshd_register_moduli
  changed_when: false
  check_mode: false
  when: ssh_server_hardening | bool

- name: remove all small primes
+- name: Remove all small primes
  shell: awk '$5 >= {{ sshd_moduli_minimum }}' {{ sshd_moduli_file }} > {{ sshd_moduli_file }}.new ;
         [ -r {{ sshd_moduli_file }}.new -a -s {{ sshd_moduli_file }}.new ] && mv {{ sshd_moduli_file }}.new {{ sshd_moduli_file }} || true
-  notify: restart sshd
+  notify: Restart sshd
  when:
    - ssh_server_hardening | bool
    - sshd_register_moduli.stdout

- name: include tasks to setup ca keys and principals
+- name: Include tasks to setup ca keys and principals
  include_tasks: ca_keys_and_principals.yml
  when: ssh_trusted_user_ca_keys_file | length > 0

- name: include selinux specific tasks
+- name: Include selinux specific tasks
  include_tasks: selinux.yml
  when: ansible_facts.selinux and ansible_facts.selinux.status == "enabled"

- name: gather package facts
+- name: Gather package facts
  package_facts:
  check_mode: false
  when:
    - sshd_disable_crypto_policy | bool

- name: disable SSH server CRYPTO_POLICY
+- name: Disable SSH server CRYPTO_POLICY
  copy:
    src: sshd
    dest: /etc/sysconfig/sshd
@@ -1,10 +1,10 @@
 ---
- name: install selinux dependencies when selinux is installed
+- name: Install selinux dependencies when selinux is installed
  package:
    name: '{{ ssh_selinux_packages }}'
    state: present

- name: authorize {{ ssh_server_ports }} ports for selinux
+- name: Authorize {{ ssh_server_ports }} ports for selinux
  seport:
    ports: '{{ item }}'
    proto: tcp
@@ -12,7 +12,7 @@
    state: present
  loop: '{{ ssh_server_ports }}'

- name: check if ssh_password module is already installed
+- name: Check if ssh_password module is already installed
  shell: 'set -o pipefail && semodule -l | grep ssh_password'
  args:
    executable: /bin/bash
@@ -28,7 +28,7 @@
    - not (ssh_use_pam | bool)
    - ('ssh_password' not in ssh_password_module.stdout)
  block:
-    - name: create selinux custom policy drop folder
+    - name: Create selinux custom policy drop folder
      file:
        path: '{{ ssh_custom_selinux_dir }}'
        state: 'directory'
@@ -36,7 +36,7 @@
        group: 'root'
        mode: '0750'

-    - name: distributing custom selinux policies
+    - name: Distributing custom selinux policies
      copy:
        src: 'ssh_password'
        dest: '{{ ssh_custom_selinux_dir }}'
@@ -44,20 +44,20 @@
        group: 'root'
        mode: '0600'

-    - name: check and compile policy
+    - name: Check and compile policy
      command: checkmodule -M -m -o {{ ssh_custom_selinux_dir }}/ssh_password.mod {{ ssh_custom_selinux_dir }}/ssh_password

-    - name: create selinux policy module package
+    - name: Create selinux policy module package
      command: semodule_package -o {{ ssh_custom_selinux_dir }}/ssh_password.pp  -m {{ ssh_custom_selinux_dir }}/ssh_password.mod

-    - name: install selinux policy
+    - name: Install selinux policy
      command: semodule -i {{ ssh_custom_selinux_dir }}/ssh_password.pp


 # The following tasks only get executed when selinux is installed, UsePam is
 # 'yes' and the ssh_password module is installed. See
 # http://danwalsh.livejournal.com/12333.html for more info
- name: remove selinux-policy when Pam is used, because Allowing sshd to read the shadow file directly is considered a potential security risk
+- name: Remove selinux-policy when Pam is used, because Allowing sshd to read the shadow file directly is considered a potential security risk
  command: semodule -r ssh_password
  when:
    - ssh_use_pam | bool
@@ -81,6 +81,9 @@ StrictHostKeyChecking ask
 {# This outputs 'KexAlgorithms <list-of-algos>' if ssh_kex is defined or '#KexAlgorithms' if ssh_kex is undefined #}
 {{ 'KexAlgorithms ' ~ ssh_kex|join(',') if ssh_kex else 'KexAlgorithms'|comment }}

+# Specifies the host key algorithms that the client wants to use in order of preference.
+{{ "HostKeyAlgorithms " ~ ssh_client_host_key_algorithms|join(',') if ssh_client_host_key_algorithms else "HostKeyAlgorithms"|comment }}
+
 {% if sshd_version is version('5.9', '<') %}
 # Alternative setting, if OpenSSH version is below v5.9
 #MACs hmac-ripemd160
@@ -104,8 +107,8 @@ RSAAuthentication yes
 PasswordAuthentication {{ 'yes' if ssh_client_password_login else 'no' }}

 # Only use GSSAPIAuthentication if implemented on the network.
-GSSAPIAuthentication no
-GSSAPIDelegateCredentials no
+GSSAPIAuthentication {{ 'yes' if (ssh_gssapi_support|bool) else 'no' }}
+GSSAPIDelegateCredentials {{ 'yes' if (ssh_gssapi_delegation|bool) else 'no' }}

 # Disable tunneling
 Tunnel no
@@ -103,11 +103,7 @@ LogLevel {{ sshd_log_level }}
 UseLogin no
 {% endif %}
 {% if sshd_version is version('7.5', '<') %}
-UsePrivilegeSeparation {{
-  (ansible_facts.distribution == 'Debian' and ansible_facts.distribution_major_version <= '6')
-  or (ansible_facts.os_family in ['Oracle Linux', 'RedHat'] and ansible_facts.distribution_major_version <= '6' and not ansible_facts.distribution == 'Amazon')
-  | ternary(ssh_ps53, ssh_ps59)
-}}
+UsePrivilegeSeparation {{ ssh_ps59 }}
 {% endif %}

 LoginGraceTime {{ ssh_login_grace_time }}
@@ -198,7 +194,7 @@ PermitTunnel {{ 'yes' if (ssh_permit_tunnel|bool) else 'no' }}
 # Disable forwarding tcp connections.
 # no real advantage without denied shell access
 {% if sshd_version is version('6.2', '>=') %}
-AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no', 'local', 'all')) else 'no' }}
+AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no', 'local', 'all', 'remote')) else 'no' }}
 {% else %}
 AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no')) else 'no' }}
 {% endif %}
@@ -0,0 +1,23 @@
+---
+sshd_path: /usr/sbin/sshd
+ssh_host_keys_dir: '/etc/ssh'
+sshd_service_name: sshd
+ssh_owner: root
+ssh_group: root
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'ssh_keys'
+ssh_selinux_packages:
+  - python3-policycoreutils
+  - checkpolicy
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: '/etc/ssh/moduli'
+
+# disable CRYPTO_POLICY to take settings from sshd configuration
+# see: https://access.redhat.com/solutions/4410591
+sshd_disable_crypto_policy: true
@@ -3,10 +3,6 @@ ssh_macs_53_default:
  - hmac-ripemd160
  - hmac-sha1

-ssh_macs_53_el_6_5_default:
-  - hmac-sha2-512
-  - hmac-sha2-256
-
 ssh_macs_59_default:
  - hmac-sha2-512
  - hmac-sha2-256
@@ -50,3 +46,8 @@ ssh_kex_80_default:
  - [email protected]
  - [email protected]
  - diffie-hellman-group-exchange-sha256
+
+ssh_kex_85_default:
+  - [email protected]
+  - [email protected]
+  - diffie-hellman-group-exchange-sha256