feat(os_hardening): extend file permission tasks to cover more files (#489 )

The tasks `Change shadow ownership to root and mode to 0600` and `Change passwd ownership to root and mode to 0644` only handle `/etc/shadow` and `/etc/passwd` respectively. But there multiple adjacent files that should be handled with these rules as well: - `/etc/gshadow` - `/etc/shadow-` - `/etc/gshadow-` - `/etc/group` - `/etc/shadow-` - `/etc/group-` This change adds those files to the rules, so that permissions are handled in the same way. Closes: #488 Signed-off-by: Claudius Heine <[email protected]>
update changelog
2021-10-21 09:51:20 +02:00 · 2021-10-18 19:14:34 +00:00 · 2021-10-18 21:04:05 +02:00 · 2021-10-18 18:57:06 +00:00 · 2021-10-18 20:55:24 +02:00 · 2021-10-18 20:28:19 +02:00
89 changed files with 1454 additions and 330 deletions
@@ -0,0 +1,56 @@
+name: Ansible Lint  # feel free to pick your own name
+
+on: [push, pull_request]
+
+jobs:
+  ansible-lint:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    # Important: This sets up your GITHUB_WORKSPACE environment variable
+    - uses: actions/checkout@v2
+
+    - name: Lint Ansible Playbook
+      # replace "master" with any valid ref
+      uses: ansible/ansible-lint-action@master
+      with:
+        # [required]
+        # Paths to ansible files (i.e., playbooks, tasks, handlers etc..)
+        # or valid Ansible directories according to the Ansible role
+        # directory structure.
+        # If you want to lint multiple ansible files, use the following syntax
+        # targets: |
+        #   playbook_1.yml
+        #   playbook_2.yml
+        targets: "roles/"
+        # [optional]
+        # Arguments to override a package and its version to be set explicitly.
+        # Must follow the example syntax.
+        # override-deps: |
+        #   ansible==2.9
+        #   ansible-lint==4.2.0
+        # [optional]
+        # Arguments to be passed to the ansible-lint
+
+        # Options:
+        #   -q                    quieter, although not silent output
+        #   -p                    parseable output in the format of pep8
+        #   --parseable-severity  parseable output including severity of rule
+        #   -r RULESDIR           specify one or more rules directories using one or
+        #                         more -r arguments. Any -r flags override the default
+        #                         rules in ansiblelint/rules, unless -R is also used.
+        #   -R                    Use default rules in ansiblelint/rules in addition to
+        #                         any extra
+        #                         rules directories specified with -r. There is no need
+        #                         to specify this if no -r flags are used
+        #   -t TAGS               only check rules whose id/tags match these values
+        #   -x SKIP_LIST          only check rules whose id/tags do not match these
+        #                         values
+        #   --nocolor             disable colored output
+        #   --exclude=EXCLUDE_PATHS
+        #                         path to directories or files to skip. This option is
+        #                         repeatable.
+        #   -c C                  Specify configuration file to use. Defaults to ".ansible-lint"
+        args: ""
+
@@ -24,7 +24,7 @@ jobs:
        molecule_distro:
          - centos7
          - centos8
-          - ubuntu1604
+          - rocky8
          - ubuntu1804
          - ubuntu2004
          - debian9
@@ -24,7 +24,7 @@ jobs:
        molecule_distro:
          - centos7
          - centos8
-          - ubuntu1604
+          - rocky8
          - ubuntu1804
          - ubuntu2004
          - debian9
@@ -24,7 +24,7 @@ jobs:
        molecule_distro:
          - centos7
          - centos8
-          - ubuntu1604
+          - rocky8
          - ubuntu1804
          - ubuntu2004
          - debian9
@@ -37,6 +37,7 @@ jobs:
          # since they break the changelog generation with the error:
          # "No common ancestor between ... and $version"
          exclude_tags_regex: '[0-6]\.\d\.\d'
+          issue_line_labels: mysql_hardening,os_hardening,ssh_hardening,nginx_hardening

      - name: push changelog
        uses: github-actions-x/[email protected]
@@ -24,8 +24,8 @@ jobs:
        molecule_distro:
          - centos7
          - centos8
+          - rocky8
          - fedora
-          - ubuntu1604
          - ubuntu1804
          - ubuntu2004
          - debian9
@@ -1,19 +1,198 @@
 # Changelog

+## [7.11.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.11.1) (2021-10-18)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.11.0...7.11.1)
+
+**Fixed bugs:**
+
+- change baseline urls to full zip-url [\#490](https://github.com/dev-sec/ansible-collection-hardening/pull/490) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- fix filter error in ansible.builtin.file mode parameter [\#486](https://github.com/dev-sec/ansible-collection-hardening/pull/486) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([ssttehrani](https://github.com/ssttehrani))
+
+**Closed issues:**
+
+- os\_hardening fails on "Create a combined sysctl-dict if overwrites are defined" task [\#482](https://github.com/dev-sec/ansible-collection-hardening/issues/482)
+- Improve changelog generation [\#381](https://github.com/dev-sec/ansible-collection-hardening/issues/381)
+
+## [7.11.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.11.0) (2021-08-30)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.10.0...7.11.0)
+
+**Implemented enhancements:**
+
+- Use `log_error` file and `datadir` from mysql\_info settings instead of variables `mysql_datadir` and `mysql_hardening_log_file` [\#478](https://github.com/dev-sec/ansible-collection-hardening/pull/478) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([123quhiwiwk](https://github.com/123quhiwiwk))
+- Execute check of MySQL error logfile permissions on Debian 11 only when log\_error is defined [\#477](https://github.com/dev-sec/ansible-collection-hardening/pull/477) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([123quhiwiwk](https://github.com/123quhiwiwk))
+- \[mysql\_hardening\] Setup defaults for MySQL on FreeBSD [\#474](https://github.com/dev-sec/ansible-collection-hardening/pull/474) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([sdwilsh](https://github.com/sdwilsh))
+
+**Closed issues:**
+
+- MariaDB hardening fails, because log\_error file is missing \[Debian 11\] [\#476](https://github.com/dev-sec/ansible-collection-hardening/issues/476)
+
+**Merged pull requests:**
+
+- ssh\_allow\_tcp\_forwarding is not a boolean [\#480](https://github.com/dev-sec/ansible-collection-hardening/pull/480) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([ReinerNippes](https://github.com/ReinerNippes))
+- chore\(ssh\_hardening\): set min\_ansible\_version to \>=2.9.10 [\#479](https://github.com/dev-sec/ansible-collection-hardening/pull/479) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([bufferoverflow](https://github.com/bufferoverflow))
+
+## [7.10.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.10.0) (2021-08-15)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.9.0...7.10.0)
+
+**Implemented enhancements:**
+
+- use Ansible lint in separate task [\#475](https://github.com/dev-sec/ansible-collection-hardening/pull/475) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- \[mysql\_hardening\] Allow setting the mysql\_distribution [\#473](https://github.com/dev-sec/ansible-collection-hardening/pull/473) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([sdwilsh](https://github.com/sdwilsh))
+
+**Fixed bugs:**
+
+- mysql\_hardening cannot work with mysql on freebsd [\#472](https://github.com/dev-sec/ansible-collection-hardening/issues/472)
+
+**Closed issues:**
+
+- run ansible-lint only once in Github Actions [\#398](https://github.com/dev-sec/ansible-collection-hardening/issues/398)
+
+**Merged pull requests:**
+
+- SSH Hardening: backtick typo [\#471](https://github.com/dev-sec/ansible-collection-hardening/pull/471) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Slamdunk](https://github.com/Slamdunk))
+- fix license in galaxy [\#469](https://github.com/dev-sec/ansible-collection-hardening/pull/469) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.9.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.9.0) (2021-07-22)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.8.0...7.9.0)
+
+**Implemented enhancements:**
+
+- Allow configuration of password remember in pam [\#467](https://github.com/dev-sec/ansible-collection-hardening/pull/467) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([m41kc0d3](https://github.com/m41kc0d3))
+- Add CVE-2021-33909 mitigations [\#466](https://github.com/dev-sec/ansible-collection-hardening/pull/466) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([kravietz](https://github.com/kravietz))
+- Add SUB\_UID\_MIN/MAX/COUNT, SUB\_GID\_MIN/MAX/COUNT [\#463](https://github.com/dev-sec/ansible-collection-hardening/pull/463) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([elgalu](https://github.com/elgalu))
+- Add os\_auth\_uid\_max, os\_auth\_gid\_max [\#461](https://github.com/dev-sec/ansible-collection-hardening/pull/461) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([elgalu](https://github.com/elgalu))
+
+**Closed issues:**
+
+- MySQL hardening fails because of missing attribute [\#464](https://github.com/dev-sec/ansible-collection-hardening/issues/464)
+- add "when" statements for every import\_tasks in hardening.yml [\#453](https://github.com/dev-sec/ansible-collection-hardening/issues/453)
+
+**Merged pull requests:**
+
+- update metadata to include community.mysql deps [\#465](https://github.com/dev-sec/ansible-collection-hardening/pull/465) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.8.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.8.0) (2021-07-01)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.7.0...7.8.0)
+
+**Implemented enhancements:**
+
+- SHA\_CRYPT\_MIN\_ROUNDS should be increased in login.defs [\#365](https://github.com/dev-sec/ansible-collection-hardening/issues/365) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Add support for Rocky Linux 8 [\#454](https://github.com/dev-sec/ansible-collection-hardening/pull/454) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([sherwind](https://github.com/sherwind))
+- make sha rounds configurable and increase no of rounds [\#452](https://github.com/dev-sec/ansible-collection-hardening/pull/452) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Fixed bugs:**
+
+- add tag always to os dependent vars task [\#456](https://github.com/dev-sec/ansible-collection-hardening/pull/456) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Use `include_tasks` for os\_hardening/main.yml [\#451](https://github.com/dev-sec/ansible-collection-hardening/pull/451) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([coadler](https://github.com/coadler))
+
+**Closed issues:**
+
+- Disable IPv6 | sysctl-18   net.ipv6.conf.all.disable\_ipv6: 1 [\#406](https://github.com/dev-sec/ansible-collection-hardening/issues/406) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+
+**Merged pull requests:**
+
+- Cleanup old OS-support and simplify vars [\#458](https://github.com/dev-sec/ansible-collection-hardening/pull/458) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add rocky linux 8 tests and make sure that all relevant tasks are execd [\#457](https://github.com/dev-sec/ansible-collection-hardening/pull/457) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add "when" statements in hardening.yml\(\#453\) [\#455](https://github.com/dev-sec/ansible-collection-hardening/pull/455) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([jqiuyin](https://github.com/jqiuyin))
+- enable ipv6 globally [\#450](https://github.com/dev-sec/ansible-collection-hardening/pull/450) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.7.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.7.0) (2021-05-24)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.6.0...7.7.0)
+
+**Implemented enhancements:**
+
+- Add tasks for new controls [\#123](https://github.com/dev-sec/ansible-collection-hardening/issues/123)
+- ssh\_allow\_tcp\_forwarding remote option added [\#447](https://github.com/dev-sec/ansible-collection-hardening/pull/447) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([alimli](https://github.com/alimli))
+
+**Fixed bugs:**
+
+- Warning: iptables-legacy tables present, Debian 10 [\#274](https://github.com/dev-sec/ansible-collection-hardening/issues/274)
+- Check for MariaDB Version when selecting users without passwords [\#444](https://github.com/dev-sec/ansible-collection-hardening/pull/444) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([neubi4](https://github.com/neubi4))
+- Adds dependency on ansible.posix and community.general [\#415](https://github.com/dev-sec/ansible-collection-hardening/pull/415) ([irl](https://github.com/irl))
+
+**Closed issues:**
+
+- No dependency on ansible.posix collection [\#414](https://github.com/dev-sec/ansible-collection-hardening/issues/414)
+- No dependency on community.general [\#413](https://github.com/dev-sec/ansible-collection-hardening/issues/413)
+- in lxc/docker/openvz IPv6 is always disabled by ufw-configuration [\#402](https://github.com/dev-sec/ansible-collection-hardening/issues/402)
+- Allow login\_unix\_socket to be specified [\#327](https://github.com/dev-sec/ansible-collection-hardening/issues/327)
+
+**Merged pull requests:**
+
+- Removed sysctl that tries to disable IPv6 [\#449](https://github.com/dev-sec/ansible-collection-hardening/pull/449) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lduesing](https://github.com/lduesing))
+- limit changelog labels to role names [\#448](https://github.com/dev-sec/ansible-collection-hardening/pull/448) ([schurzi](https://github.com/schurzi))
+- add back labels to changelog [\#446](https://github.com/dev-sec/ansible-collection-hardening/pull/446) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.6.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.6.0) (2021-04-27)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.5.0...7.6.0)
+
+**Implemented enhancements:**
+
+- ssh: Client HostKeyAlgorithms configuration variable [\#442](https://github.com/dev-sec/ansible-collection-hardening/pull/442) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([sepek](https://github.com/sepek))
+
+**Fixed bugs:**
+
+- mysql USER and HOST should be quoted for drop query [\#443](https://github.com/dev-sec/ansible-collection-hardening/pull/443) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([neubi4](https://github.com/neubi4))
+
+**Closed issues:**
+
+- Support HostKeyAlgorithms configuration for ssh\_client file [\#441](https://github.com/dev-sec/ansible-collection-hardening/issues/441)
+
+**Merged pull requests:**
+
+- fixed a typo in comments [\#439](https://github.com/dev-sec/ansible-collection-hardening/pull/439) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([ssttehrani](https://github.com/ssttehrani))
+
+## [7.5.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.5.0) (2021-04-01)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.4.0...7.5.0)
+
+**Implemented enhancements:**
+
+- Not accepting source routing for IPv6. This was already done for IPv4. [\#424](https://github.com/dev-sec/ansible-collection-hardening/pull/424) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+
+**Fixed bugs:**
+
+- SSH kex sntrup4591761x25519-sha512@tinyssh.org replaced [\#433](https://github.com/dev-sec/ansible-collection-hardening/issues/433)
+- Fix ssh kex sntrup761x25519-sha512@openssh.com for openssh \>= 8.5 [\#437](https://github.com/dev-sec/ansible-collection-hardening/pull/437) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([BenjaminBoehm](https://github.com/BenjaminBoehm))
+
+**Closed issues:**
+
+- Harden user home directories [\#276](https://github.com/dev-sec/ansible-collection-hardening/issues/276)
+
+**Merged pull requests:**
+
+-  remove secure-auth param if mysql \>= 8.0.3 [\#438](https://github.com/dev-sec/ansible-collection-hardening/pull/438) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Improved comments. [\#436](https://github.com/dev-sec/ansible-collection-hardening/pull/436) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- os\_auth\_pam\_pwquality\_options: Changed type to authtok\_type [\#432](https://github.com/dev-sec/ansible-collection-hardening/pull/432) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- add restart-auditd handler after configuration change [\#427](https://github.com/dev-sec/ansible-collection-hardening/pull/427) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add new tasks to delete mysql users without passwords [\#423](https://github.com/dev-sec/ansible-collection-hardening/pull/423) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Uppercased first letter of task names. [\#422](https://github.com/dev-sec/ansible-collection-hardening/pull/422) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([joubbi](https://github.com/joubbi))
+
 ## [7.4.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.4.0) (2021-03-23)

 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.3.0...7.4.0)

+**Implemented enhancements:**
+
+- Harden user home dirs [\#428](https://github.com/dev-sec/ansible-collection-hardening/pull/428) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
 **Closed issues:**

 - Errors in packer build for vagrant builder [\#244](https://github.com/dev-sec/ansible-collection-hardening/issues/244)

 **Merged pull requests:**

- Remove comments from PAM config file, but keep it in the template [\#430](https://github.com/dev-sec/ansible-collection-hardening/pull/430) ([joubbi](https://github.com/joubbi))
- add support for using a proxy to test with molecule [\#429](https://github.com/dev-sec/ansible-collection-hardening/pull/429) ([rndmh3ro](https://github.com/rndmh3ro))
- Harden user home dirs [\#428](https://github.com/dev-sec/ansible-collection-hardening/pull/428) ([rndmh3ro](https://github.com/rndmh3ro))
- Improve Documentation for sysctl defaults [\#418](https://github.com/dev-sec/ansible-collection-hardening/pull/418) ([joubbi](https://github.com/joubbi))
+- Use pam\_pwhistory.so instead of pam\_unix.so for remembering old passwords [\#431](https://github.com/dev-sec/ansible-collection-hardening/pull/431) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- Remove comments from PAM config file, but keep it in the template [\#430](https://github.com/dev-sec/ansible-collection-hardening/pull/430) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- add support for using a proxy to test with molecule [\#429](https://github.com/dev-sec/ansible-collection-hardening/pull/429) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Improve Documentation for sysctl defaults [\#418](https://github.com/dev-sec/ansible-collection-hardening/pull/418) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))

 ## [7.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.3.0) (2021-03-16)

@@ -21,16 +200,16 @@

 **Implemented enhancements:**

- pam\_tally2 is deprecated in RHEL8 and pam\_faillock should be used in EL7 and EL8 instead. [\#377](https://github.com/dev-sec/ansible-collection-hardening/issues/377)
- Replace pam\_tally2 with pam\_faillock in Redhat [\#273](https://github.com/dev-sec/ansible-collection-hardening/issues/273)
- Extend GSSAPI configuration support to ssh\_config [\#403](https://github.com/dev-sec/ansible-collection-hardening/pull/403) ([wzzrd](https://github.com/wzzrd))
- add restart handler variable for mysql role [\#399](https://github.com/dev-sec/ansible-collection-hardening/pull/399) ([rndmh3ro](https://github.com/rndmh3ro))
- restructure PAM handling and update for currently supported Linux distributions [\#392](https://github.com/dev-sec/ansible-collection-hardening/pull/392) ([schurzi](https://github.com/schurzi))
+- pam\_tally2 is deprecated in RHEL8 and pam\_faillock should be used in EL7 and EL8 instead. [\#377](https://github.com/dev-sec/ansible-collection-hardening/issues/377) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Replace pam\_tally2 with pam\_faillock in Redhat [\#273](https://github.com/dev-sec/ansible-collection-hardening/issues/273) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Extend GSSAPI configuration support to ssh\_config [\#403](https://github.com/dev-sec/ansible-collection-hardening/pull/403) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([wzzrd](https://github.com/wzzrd))
+- add restart handler variable for mysql role [\#399](https://github.com/dev-sec/ansible-collection-hardening/pull/399) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- restructure PAM handling and update for currently supported Linux distributions [\#392](https://github.com/dev-sec/ansible-collection-hardening/pull/392) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))

 **Fixed bugs:**

- Not able to use `sudo` command for user authenticated via ActiveDirectory [\#278](https://github.com/dev-sec/ansible-collection-hardening/issues/278)
- You shouldn't touch /etc/pam.d/system-auth-ac in RedHat/CentOS [\#252](https://github.com/dev-sec/ansible-collection-hardening/issues/252)
+- Not able to use `sudo` command for user authenticated via ActiveDirectory [\#278](https://github.com/dev-sec/ansible-collection-hardening/issues/278) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- You shouldn't touch /etc/pam.d/system-auth-ac in RedHat/CentOS [\#252](https://github.com/dev-sec/ansible-collection-hardening/issues/252) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]

 **Closed issues:**

@@ -38,17 +217,17 @@
 - Unable to connect with SSH \(Permission denied \(publickey\)\) [\#411](https://github.com/dev-sec/ansible-collection-hardening/issues/411)
 - TASK \[os\_hardening : configure auditd | package-08\] [\#410](https://github.com/dev-sec/ansible-collection-hardening/issues/410)
 - Collection throws undefined ansible\_role\_name error in auditd task [\#409](https://github.com/dev-sec/ansible-collection-hardening/issues/409)
- Ensure permissions on /etc/crontab are configured [\#375](https://github.com/dev-sec/ansible-collection-hardening/issues/375)
+- Ensure permissions on /etc/crontab are configured [\#375](https://github.com/dev-sec/ansible-collection-hardening/issues/375) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
 - Documentation should be updated [\#361](https://github.com/dev-sec/ansible-collection-hardening/issues/361)

 **Merged pull requests:**

 - Improve Release Action [\#421](https://github.com/dev-sec/ansible-collection-hardening/pull/421) ([schurzi](https://github.com/schurzi))
- remove FQCN from roles in examples [\#420](https://github.com/dev-sec/ansible-collection-hardening/pull/420) ([schurzi](https://github.com/schurzi))
- Ensure permissions on /etc/crontab are configured [\#405](https://github.com/dev-sec/ansible-collection-hardening/pull/405) ([joubbi](https://github.com/joubbi))
- remove FQCN from roles in examples [\#404](https://github.com/dev-sec/ansible-collection-hardening/pull/404) ([schurzi](https://github.com/schurzi))
- do not install mysql python package on target host [\#401](https://github.com/dev-sec/ansible-collection-hardening/pull/401) ([rndmh3ro](https://github.com/rndmh3ro))
- make wrong password fail task [\#400](https://github.com/dev-sec/ansible-collection-hardening/pull/400) ([rndmh3ro](https://github.com/rndmh3ro))
+- remove FQCN from roles in examples [\#420](https://github.com/dev-sec/ansible-collection-hardening/pull/420) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Ensure permissions on /etc/crontab are configured [\#405](https://github.com/dev-sec/ansible-collection-hardening/pull/405) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- remove FQCN from roles in examples [\#404](https://github.com/dev-sec/ansible-collection-hardening/pull/404) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- do not install mysql python package on target host [\#401](https://github.com/dev-sec/ansible-collection-hardening/pull/401) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- make wrong password fail task [\#400](https://github.com/dev-sec/ansible-collection-hardening/pull/400) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))

 ## [7.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.2.0) (2021-02-10)

@@ -56,8 +235,8 @@

 **Implemented enhancements:**

- Add variable to specify SSH host RSA key size [\#394](https://github.com/dev-sec/ansible-collection-hardening/pull/394) ([Normo](https://github.com/Normo))
- Set default for ssh host key files only when hardening the server [\#393](https://github.com/dev-sec/ansible-collection-hardening/pull/393) ([Normo](https://github.com/Normo))
+- Add variable to specify SSH host RSA key size [\#394](https://github.com/dev-sec/ansible-collection-hardening/pull/394) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Normo](https://github.com/Normo))
+- Set default for ssh host key files only when hardening the server [\#393](https://github.com/dev-sec/ansible-collection-hardening/pull/393) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Normo](https://github.com/Normo))

 **Fixed bugs:**

@@ -73,7 +252,7 @@

 **Merged pull requests:**

- update ansible-lint to version 5 [\#397](https://github.com/dev-sec/ansible-collection-hardening/pull/397) ([schurzi](https://github.com/schurzi))
+- update ansible-lint to version 5 [\#397](https://github.com/dev-sec/ansible-collection-hardening/pull/397) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
 - fix minimum required ansible version in docs [\#390](https://github.com/dev-sec/ansible-collection-hardening/pull/390) ([schurzi](https://github.com/schurzi))

 ## [7.1.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.1.1) (2021-02-05)
@@ -82,7 +261,7 @@

 **Fixed bugs:**

- use fqcn for community.crypto.openssh\_keypair module [\#389](https://github.com/dev-sec/ansible-collection-hardening/pull/389) ([schurzi](https://github.com/schurzi))
+- use fqcn for community.crypto.openssh\_keypair module [\#389](https://github.com/dev-sec/ansible-collection-hardening/pull/389) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))

 **Closed issues:**

@@ -94,35 +273,35 @@

 **Implemented enhancements:**

- Default value for ssh\_max\_startups should be changed [\#366](https://github.com/dev-sec/ansible-collection-hardening/issues/366)
+- Default value for ssh\_max\_startups should be changed [\#366](https://github.com/dev-sec/ansible-collection-hardening/issues/366) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
 - Comment in configuration files should state which collection was there [\#345](https://github.com/dev-sec/ansible-collection-hardening/issues/345)
 - Error on applying the sysctl vars on Debian Jessy [\#230](https://github.com/dev-sec/ansible-collection-hardening/issues/230)
- add Support for OpenSSH HostCertificate config option [\#380](https://github.com/dev-sec/ansible-collection-hardening/pull/380) ([mpraeger](https://github.com/mpraeger))
- Syncookie [\#372](https://github.com/dev-sec/ansible-collection-hardening/pull/372) ([joubbi](https://github.com/joubbi))
- Sorted sysctl values and lists in READMEs alphabetically \(No functional changes\). [\#371](https://github.com/dev-sec/ansible-collection-hardening/pull/371) ([joubbi](https://github.com/joubbi))
- make auditd 'max\_log\_file' configurable [\#370](https://github.com/dev-sec/ansible-collection-hardening/pull/370) ([tgueldner-mms](https://github.com/tgueldner-mms))
- reduce maximum unauthenticated ssh sessions [\#368](https://github.com/dev-sec/ansible-collection-hardening/pull/368) ([schurzi](https://github.com/schurzi))
+- add Support for OpenSSH HostCertificate config option [\#380](https://github.com/dev-sec/ansible-collection-hardening/pull/380) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([mpraeger](https://github.com/mpraeger))
+- Syncookie [\#372](https://github.com/dev-sec/ansible-collection-hardening/pull/372) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- Sorted sysctl values and lists in READMEs alphabetically \(No functional changes\). [\#371](https://github.com/dev-sec/ansible-collection-hardening/pull/371) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
+- make auditd 'max\_log\_file' configurable [\#370](https://github.com/dev-sec/ansible-collection-hardening/pull/370) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([tgueldner-mms](https://github.com/tgueldner-mms))
+- reduce maximum unauthenticated ssh sessions [\#368](https://github.com/dev-sec/ansible-collection-hardening/pull/368) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
 - add a runtime.yml to declare minimum ansible version [\#363](https://github.com/dev-sec/ansible-collection-hardening/pull/363) ([rndmh3ro](https://github.com/rndmh3ro))
- change inclusion of os specific defaults [\#353](https://github.com/dev-sec/ansible-collection-hardening/pull/353) ([schurzi](https://github.com/schurzi))
- make the os\_env\_umask variable usable [\#351](https://github.com/dev-sec/ansible-collection-hardening/pull/351) ([sprat](https://github.com/sprat))
- Fix \#348: make ssh configuration files paths configurable [\#350](https://github.com/dev-sec/ansible-collection-hardening/pull/350) ([sprat](https://github.com/sprat))
- Removed Protocol statement in later versions of sshd, since the code … [\#342](https://github.com/dev-sec/ansible-collection-hardening/pull/342) ([joubbi](https://github.com/joubbi))
- Improvements of comments in opensshd.conf.j2  \#338 [\#339](https://github.com/dev-sec/ansible-collection-hardening/pull/339) ([joubbi](https://github.com/joubbi))
+- change inclusion of os specific defaults [\#353](https://github.com/dev-sec/ansible-collection-hardening/pull/353) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- make the os\_env\_umask variable usable [\#351](https://github.com/dev-sec/ansible-collection-hardening/pull/351) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([sprat](https://github.com/sprat))
+- Fix \#348: make ssh configuration files paths configurable [\#350](https://github.com/dev-sec/ansible-collection-hardening/pull/350) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([sprat](https://github.com/sprat))
+- Removed Protocol statement in later versions of sshd, since the code … [\#342](https://github.com/dev-sec/ansible-collection-hardening/pull/342) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([joubbi](https://github.com/joubbi))
+- Improvements of comments in opensshd.conf.j2  \#338 [\#339](https://github.com/dev-sec/ansible-collection-hardening/pull/339) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([joubbi](https://github.com/joubbi))

 **Fixed bugs:**

 - Comments in opensshd.conf.j2 should be improved [\#338](https://github.com/dev-sec/ansible-collection-hardening/issues/338)
- check for correct cpu vendor in initramfs-tools [\#374](https://github.com/dev-sec/ansible-collection-hardening/pull/374) ([schurzi](https://github.com/schurzi))
- set hidepid=0 on RHEL/CentOS 7 [\#369](https://github.com/dev-sec/ansible-collection-hardening/pull/369) ([schurzi](https://github.com/schurzi))
+- check for correct cpu vendor in initramfs-tools [\#374](https://github.com/dev-sec/ansible-collection-hardening/pull/374) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- set hidepid=0 on RHEL/CentOS 7 [\#369](https://github.com/dev-sec/ansible-collection-hardening/pull/369) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))

 **Closed issues:**

 - initramfs-tools modules.j2 does not seem to be able to detect AMD CPUs [\#373](https://github.com/dev-sec/ansible-collection-hardening/issues/373)
 - How do i install this on Centos 8? [\#367](https://github.com/dev-sec/ansible-collection-hardening/issues/367)
- hidepid=2 gives error when running systemctl on EL7 [\#364](https://github.com/dev-sec/ansible-collection-hardening/issues/364)
+- hidepid=2 gives error when running systemctl on EL7 [\#364](https://github.com/dev-sec/ansible-collection-hardening/issues/364) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
 - Allow putting the ssh/sshd config in alternative files [\#348](https://github.com/dev-sec/ansible-collection-hardening/issues/348)
 - os\_env\_umask has no effect [\#344](https://github.com/dev-sec/ansible-collection-hardening/issues/344)
- Don't modify /etc/sysctl.conf [\#343](https://github.com/dev-sec/ansible-collection-hardening/issues/343)
+- Don't modify /etc/sysctl.conf [\#343](https://github.com/dev-sec/ansible-collection-hardening/issues/343) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]

 **Merged pull requests:**

@@ -130,15 +309,15 @@
 - make release workflow manually runnable [\#384](https://github.com/dev-sec/ansible-collection-hardening/pull/384) ([schurzi](https://github.com/schurzi))
 - run labeler workflow with higher privileges [\#383](https://github.com/dev-sec/ansible-collection-hardening/pull/383) ([schurzi](https://github.com/schurzi))
 - remove issue labels from changelog [\#382](https://github.com/dev-sec/ansible-collection-hardening/pull/382) ([schurzi](https://github.com/schurzi))
- Added comment on top of templates about which role manages the file [\#378](https://github.com/dev-sec/ansible-collection-hardening/pull/378) ([joubbi](https://github.com/joubbi))
+- Added comment on top of templates about which role manages the file [\#378](https://github.com/dev-sec/ansible-collection-hardening/pull/378) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([joubbi](https://github.com/joubbi))
 - Regenerate RSA key with size 4096 bits [\#376](https://github.com/dev-sec/ansible-collection-hardening/pull/376) ([ssttehrani](https://github.com/ssttehrani))
 - fix second changelog generation task, too [\#349](https://github.com/dev-sec/ansible-collection-hardening/pull/349) ([rndmh3ro](https://github.com/rndmh3ro))
 - fix changelog generation [\#341](https://github.com/dev-sec/ansible-collection-hardening/pull/341) ([rndmh3ro](https://github.com/rndmh3ro))
- Improve README for ssh\_hardening [\#335](https://github.com/dev-sec/ansible-collection-hardening/pull/335) ([szEvEz](https://github.com/szEvEz))
+- Improve README for ssh\_hardening [\#335](https://github.com/dev-sec/ansible-collection-hardening/pull/335) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([szEvEz](https://github.com/szEvEz))

 ## [7.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.0.0) (2020-11-11)

-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/6.2.0...7.0.0)
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/a9591764206b79a4ed324bb8576151ebac0127b1...7.0.0)

 **Breaking changes:**

@@ -146,11 +325,21 @@

 **Implemented enhancements:**

- Breaking change in ansible-lint - set file permissions explicitly [\#299](https://github.com/dev-sec/ansible-collection-hardening/issues/299)
- Improve Documentation [\#315](https://github.com/dev-sec/ansible-collection-hardening/pull/315) ([schurzi](https://github.com/schurzi))
- Arch support [\#303](https://github.com/dev-sec/ansible-collection-hardening/pull/303) ([rndmh3ro](https://github.com/rndmh3ro))
- fix linting for molecule [\#301](https://github.com/dev-sec/ansible-collection-hardening/pull/301) ([schurzi](https://github.com/schurzi))
- file permissions explicitly defined [\#300](https://github.com/dev-sec/ansible-collection-hardening/pull/300) ([danielkubat](https://github.com/danielkubat))
+- Breaking change in ansible-lint - set file permissions explicitly [\#299](https://github.com/dev-sec/ansible-collection-hardening/issues/299) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
+- Configure audit=1 for more accurate auid auditing [\#253](https://github.com/dev-sec/ansible-collection-hardening/issues/253)
+- Add Debian Buster support for ansible-os-hardening [\#233](https://github.com/dev-sec/ansible-collection-hardening/issues/233)
+- Add CentOS 8 support for ansible-os-hardening [\#232](https://github.com/dev-sec/ansible-collection-hardening/issues/232)
+- Speed up "minimize access on found files" task [\#208](https://github.com/dev-sec/ansible-collection-hardening/issues/208)
+- Fedora support? [\#163](https://github.com/dev-sec/ansible-collection-hardening/issues/163)
+- Update some RH settings in this role [\#155](https://github.com/dev-sec/ansible-collection-hardening/issues/155)
+- Add selinux configuration [\#154](https://github.com/dev-sec/ansible-collection-hardening/issues/154)
+- Warning about "include" for tasks for ansible-playbook 2.4.0 \(devel f0a5854e39\) [\#131](https://github.com/dev-sec/ansible-collection-hardening/issues/131)
+- Removal of core dump hardening configuration if core dumps are allowed [\#129](https://github.com/dev-sec/ansible-collection-hardening/issues/129)
+- Description of the Ansible roles of dev-sec says "This Ansible playbook" [\#97](https://github.com/dev-sec/ansible-collection-hardening/issues/97)
+- Improve Documentation [\#315](https://github.com/dev-sec/ansible-collection-hardening/pull/315) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- Arch support [\#303](https://github.com/dev-sec/ansible-collection-hardening/pull/303) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- fix linting for molecule [\#301](https://github.com/dev-sec/ansible-collection-hardening/pull/301) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- file permissions explicitly defined [\#300](https://github.com/dev-sec/ansible-collection-hardening/pull/300) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([danielkubat](https://github.com/danielkubat))
 - Optimize and unify when clause [\#295](https://github.com/dev-sec/ansible-collection-hardening/pull/295) ([Alexhha](https://github.com/Alexhha))
 - use find module instead of shell [\#294](https://github.com/dev-sec/ansible-collection-hardening/pull/294) ([danielkubat](https://github.com/danielkubat))
 - improve testing [\#287](https://github.com/dev-sec/ansible-collection-hardening/pull/287) ([schurzi](https://github.com/schurzi))
@@ -158,18 +347,172 @@
 - unify changelog and release actions [\#279](https://github.com/dev-sec/ansible-collection-hardening/pull/279) ([rndmh3ro](https://github.com/rndmh3ro))
 - purge insecure packages [\#275](https://github.com/dev-sec/ansible-collection-hardening/pull/275) ([chris-rock](https://github.com/chris-rock))
 - add changelog and release workflow [\#271](https://github.com/dev-sec/ansible-collection-hardening/pull/271) ([rndmh3ro](https://github.com/rndmh3ro))
+- github action for changelog generation [\#270](https://github.com/dev-sec/ansible-collection-hardening/pull/270) ([rndmh3ro](https://github.com/rndmh3ro))
+- Make useradd defaults in login.defs dependent on OS [\#266](https://github.com/dev-sec/ansible-collection-hardening/pull/266) ([aisbergg](https://github.com/aisbergg))
+- Add kernel hardening parameters from Tails and CIS Benchmark [\#263](https://github.com/dev-sec/ansible-collection-hardening/pull/263) ([kravietz](https://github.com/kravietz))
+- add ansible-lint [\#262](https://github.com/dev-sec/ansible-collection-hardening/pull/262) ([rndmh3ro](https://github.com/rndmh3ro))
+- Remove trailing space [\#261](https://github.com/dev-sec/ansible-collection-hardening/pull/261) ([kravietz](https://github.com/kravietz))
+- Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-collection-hardening/pull/259) ([jaredledvina](https://github.com/jaredledvina))
+- Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-collection-hardening/pull/254) ([kravietz](https://github.com/kravietz))
+- Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-collection-hardening/pull/251) ([dustinmiller](https://github.com/dustinmiller))
+- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
+- Make max\_log\_file\_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-collection-hardening/pull/246) ([jandd](https://github.com/jandd))
+- Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-collection-hardening/pull/240) ([ghost](https://github.com/ghost))
+- Fedora - Use new auto ansible\_python\_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-collection-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
+- add test support for CentOS8 [\#237](https://github.com/dev-sec/ansible-collection-hardening/pull/237) ([yeoldegrove](https://github.com/yeoldegrove))
+- Support configuring SELinux and default to enforcing [\#236](https://github.com/dev-sec/ansible-collection-hardening/pull/236) ([jaredledvina](https://github.com/jaredledvina))
+- Add test support for debian buster [\#234](https://github.com/dev-sec/ansible-collection-hardening/pull/234) ([123Haynes](https://github.com/123Haynes))
+- Changed local var name to a less common one [\#231](https://github.com/dev-sec/ansible-collection-hardening/pull/231) ([rgarrigue](https://github.com/rgarrigue))
+- Use ansible facts for vars [\#226](https://github.com/dev-sec/ansible-collection-hardening/pull/226) ([joshuatalb](https://github.com/joshuatalb))
+- Fix deprecation warnings in Ansible 2.8 [\#224](https://github.com/dev-sec/ansible-collection-hardening/pull/224) ([Normo](https://github.com/Normo))
+- add docs to find-task in minimize access. fix \#219 [\#220](https://github.com/dev-sec/ansible-collection-hardening/pull/220) ([rndmh3ro](https://github.com/rndmh3ro))
+- remove eol'd OS and add new [\#217](https://github.com/dev-sec/ansible-collection-hardening/pull/217) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add note about docker under warning [\#214](https://github.com/dev-sec/ansible-collection-hardening/pull/214) ([ChrisMcKee](https://github.com/ChrisMcKee))
+- change minimize access tasks to speed them up [\#209](https://github.com/dev-sec/ansible-collection-hardening/pull/209) ([rndmh3ro](https://github.com/rndmh3ro))
+- Added fedora support [\#206](https://github.com/dev-sec/ansible-collection-hardening/pull/206) ([jonaswre](https://github.com/jonaswre))
+- Pass package list directly to apt and yum modules without using with\_items loop [\#200](https://github.com/dev-sec/ansible-collection-hardening/pull/200) ([Normo](https://github.com/Normo))
+- add ubuntu 1804 support [\#196](https://github.com/dev-sec/ansible-collection-hardening/pull/196) ([rndmh3ro](https://github.com/rndmh3ro))
+- add option to disable auditd [\#192](https://github.com/dev-sec/ansible-collection-hardening/pull/192) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix problems with efi and vfat [\#190](https://github.com/dev-sec/ansible-collection-hardening/pull/190) ([rndmh3ro](https://github.com/rndmh3ro))
+- added os\_hardening\_enabled flag [\#186](https://github.com/dev-sec/ansible-collection-hardening/pull/186) ([jcheroske](https://github.com/jcheroske))
+- add amazon run opts to travis [\#183](https://github.com/dev-sec/ansible-collection-hardening/pull/183) ([rndmh3ro](https://github.com/rndmh3ro))
+- use package instead of yum and apt [\#180](https://github.com/dev-sec/ansible-collection-hardening/pull/180) ([rndmh3ro](https://github.com/rndmh3ro))
+- add oracle7 to travis [\#178](https://github.com/dev-sec/ansible-collection-hardening/pull/178) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix wrong permissions passwdqc \#170 [\#176](https://github.com/dev-sec/ansible-collection-hardening/pull/176) ([rndmh3ro](https://github.com/rndmh3ro))
+- ipv4 forwarding comment is inconsistent with example [\#174](https://github.com/dev-sec/ansible-collection-hardening/pull/174) ([carchrae](https://github.com/carchrae))
+- Rename pam\_passwdqd.j2 to pam\_passwdqc.j2 [\#172](https://github.com/dev-sec/ansible-collection-hardening/pull/172) ([martinbydefault](https://github.com/martinbydefault))
+- Use package state 'present' since 'installed' is deprecated [\#168](https://github.com/dev-sec/ansible-collection-hardening/pull/168) ([Normo](https://github.com/Normo))
+- Update syntax to Ansible 2.4 [\#161](https://github.com/dev-sec/ansible-collection-hardening/pull/161) ([thomasjpfan](https://github.com/thomasjpfan))
+- add amazon linux testing [\#160](https://github.com/dev-sec/ansible-collection-hardening/pull/160) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add support for Amazon Linux [\#158](https://github.com/dev-sec/ansible-collection-hardening/pull/158) ([woneill](https://github.com/woneill))
+- Don't create home for system accounts [\#156](https://github.com/dev-sec/ansible-collection-hardening/pull/156) ([oakey-b1](https://github.com/oakey-b1))
+- Prevent disabling of filesystems via whitelist [\#153](https://github.com/dev-sec/ansible-collection-hardening/pull/153) ([manuelprinz](https://github.com/manuelprinz))
+- Add kernel hardening settings from Ubuntu /etc/sysctl.d [\#150](https://github.com/dev-sec/ansible-collection-hardening/pull/150) ([kravietz](https://github.com/kravietz))
+- Removal of core dump hardening configuration if core dumps are allowed [\#146](https://github.com/dev-sec/ansible-collection-hardening/pull/146) ([martinbydefault](https://github.com/martinbydefault))
+- install and configure auditd - fix inspec package-08 [\#144](https://github.com/dev-sec/ansible-collection-hardening/pull/144) ([rndmh3ro](https://github.com/rndmh3ro))
+- add missing sysctl parameter [\#143](https://github.com/dev-sec/ansible-collection-hardening/pull/143) ([rndmh3ro](https://github.com/rndmh3ro))
+- update readme [\#139](https://github.com/dev-sec/ansible-collection-hardening/pull/139) ([rndmh3ro](https://github.com/rndmh3ro))
+- add modprobe template, control os-10 [\#138](https://github.com/dev-sec/ansible-collection-hardening/pull/138) ([rndmh3ro](https://github.com/rndmh3ro))
+- new task for delete netrc files, control os-09 [\#137](https://github.com/dev-sec/ansible-collection-hardening/pull/137) ([rndmh3ro](https://github.com/rndmh3ro))
+- add passwd task, control os-03 [\#136](https://github.com/dev-sec/ansible-collection-hardening/pull/136) ([rndmh3ro](https://github.com/rndmh3ro))
+- remove prelink package, control package-09 [\#135](https://github.com/dev-sec/ansible-collection-hardening/pull/135) ([rndmh3ro](https://github.com/rndmh3ro))
+- style update [\#134](https://github.com/dev-sec/ansible-collection-hardening/pull/134) ([rndmh3ro](https://github.com/rndmh3ro))
+- Remove deprecated include for static tasks and use instead import\_tasks fix \#131 [\#132](https://github.com/dev-sec/ansible-collection-hardening/pull/132) ([HelioCampos](https://github.com/HelioCampos))
+- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-collection-hardening/pull/130) ([fazlearefin](https://github.com/fazlearefin))
+- install initramfs-tools [\#114](https://github.com/dev-sec/ansible-collection-hardening/pull/114) ([rndmh3ro](https://github.com/rndmh3ro))
+- omit empty variables [\#106](https://github.com/dev-sec/ansible-collection-hardening/pull/106) ([rndmh3ro](https://github.com/rndmh3ro))
+- Supports --check mode [\#93](https://github.com/dev-sec/ansible-collection-hardening/pull/93) ([conorsch](https://github.com/conorsch))
+- Adds support for CentOS 7 [\#91](https://github.com/dev-sec/ansible-collection-hardening/pull/91) ([conorsch](https://github.com/conorsch))
+- Docker [\#90](https://github.com/dev-sec/ansible-collection-hardening/pull/90) ([rndmh3ro](https://github.com/rndmh3ro))
+- debian 8 support [\#88](https://github.com/dev-sec/ansible-collection-hardening/pull/88) ([rndmh3ro](https://github.com/rndmh3ro))
+- Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-collection-hardening/pull/85) ([fitz123](https://github.com/fitz123))
+- replace ignore\_errors to failed\_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-collection-hardening/pull/81) ([fitz123](https://github.com/fitz123))
+- fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-collection-hardening/pull/79) ([fitz123](https://github.com/fitz123))
+- update platforms in meta-file [\#69](https://github.com/dev-sec/ansible-collection-hardening/pull/69) ([rndmh3ro](https://github.com/rndmh3ro))
+- add webhook for ansible galaxy [\#68](https://github.com/dev-sec/ansible-collection-hardening/pull/68) ([rndmh3ro](https://github.com/rndmh3ro))
+- Move sysctl vars to defaults [\#67](https://github.com/dev-sec/ansible-collection-hardening/pull/67) ([rndmh3ro](https://github.com/rndmh3ro))
+- make sys\_uid and sys\_gid configurable [\#62](https://github.com/dev-sec/ansible-collection-hardening/pull/62) ([rndmh3ro](https://github.com/rndmh3ro))
+- Ansible 2.0 support [\#59](https://github.com/dev-sec/ansible-collection-hardening/pull/59) ([rndmh3ro](https://github.com/rndmh3ro))
+- use inspec as test framework [\#58](https://github.com/dev-sec/ansible-collection-hardening/pull/58) ([chris-rock](https://github.com/chris-rock))
+- Packages as attributes [\#57](https://github.com/dev-sec/ansible-collection-hardening/pull/57) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change categories to tags for upcoming ansible 2.0 [\#56](https://github.com/dev-sec/ansible-collection-hardening/pull/56) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add SINGLE and PROMPT parameters. [\#55](https://github.com/dev-sec/ansible-collection-hardening/pull/55) ([rndmh3ro](https://github.com/rndmh3ro))
+- add changelog generator [\#54](https://github.com/dev-sec/ansible-collection-hardening/pull/54) ([chris-rock](https://github.com/chris-rock))

 **Fixed bugs:**

 - Task "set 10.hardcore.conf perms to 0400 and root ownership" fails in check mode [\#313](https://github.com/dev-sec/ansible-collection-hardening/issues/313)
+- Inconsistent use of role vars/role defaults [\#284](https://github.com/dev-sec/ansible-collection-hardening/issues/284)
+- Is it safe to use on Debian 10? The build is failing. [\#281](https://github.com/dev-sec/ansible-collection-hardening/issues/281)
+- /etc/login.defs alters centos 7/8 default values [\#265](https://github.com/dev-sec/ansible-collection-hardening/issues/265)
+- Invalid Conditionals in user\_accounts.yml [\#255](https://github.com/dev-sec/ansible-collection-hardening/issues/255)
+- `auth-system` related files are created for non-RHEL systems \(e.g. Debian\) [\#247](https://github.com/dev-sec/ansible-collection-hardening/issues/247)
+- NSA website links are stale [\#227](https://github.com/dev-sec/ansible-collection-hardening/issues/227)
+- Running ansible on python3 throughs "TypeError: '\<=' not supported between instances of 'str' and 'int'"  [\#223](https://github.com/dev-sec/ansible-collection-hardening/issues/223)
+- \[lots of\] deprecation warnings in Ansible 2.8 [\#221](https://github.com/dev-sec/ansible-collection-hardening/issues/221)
+- `squash_actions` deprecation warning [\#218](https://github.com/dev-sec/ansible-collection-hardening/issues/218)
+- login.defs.j2 template: ENV\_PATH is missing ':' before variable substitution [\#202](https://github.com/dev-sec/ansible-collection-hardening/issues/202)
+- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-collection-hardening/issues/191)
+- Setting os\_security\_users\_allow has no effect [\#175](https://github.com/dev-sec/ansible-collection-hardening/issues/175)
+- minimize\_access: maximum recursion depth exceeded on Ansible 2.5 [\#171](https://github.com/dev-sec/ansible-collection-hardening/issues/171)
+- wrong permissions passwdqc [\#170](https://github.com/dev-sec/ansible-collection-hardening/issues/170)
+- 'sysctl\_rhel\_config' is undefined [\#167](https://github.com/dev-sec/ansible-collection-hardening/issues/167)
+- Update deprecated `include` statements [\#166](https://github.com/dev-sec/ansible-collection-hardening/issues/166)
+- Strongly recommend against disabling vfat by default [\#162](https://github.com/dev-sec/ansible-collection-hardening/issues/162)
+- bug in ufw.j2 template [\#151](https://github.com/dev-sec/ansible-collection-hardening/issues/151)
+- Add a "don't fail on error" switch ? [\#148](https://github.com/dev-sec/ansible-collection-hardening/issues/148)
+- System completely unresponsive after role execution [\#145](https://github.com/dev-sec/ansible-collection-hardening/issues/145)
+- Why is rsync removed? [\#141](https://github.com/dev-sec/ansible-collection-hardening/issues/141)
+- RHEL 7.4: Too many setuid bits removed [\#140](https://github.com/dev-sec/ansible-collection-hardening/issues/140)
+- Change system accounts not on the user provided ignore-list items are not JSON serializable [\#125](https://github.com/dev-sec/ansible-collection-hardening/issues/125)
+- playbook makes OS undetectable [\#124](https://github.com/dev-sec/ansible-collection-hardening/issues/124)
+- Centos7/RHEL7: Exec shield is enabled by default and not manageable anymore by sysctl.conf [\#118](https://github.com/dev-sec/ansible-collection-hardening/issues/118)
+- Could not find gem 'ruby \(\>= 2.1.0\)' [\#116](https://github.com/dev-sec/ansible-collection-hardening/issues/116)
+- os\_security\_kernel\_enable\_sysrq is not implemented [\#115](https://github.com/dev-sec/ansible-collection-hardening/issues/115)
+- The task sysctl fails when /etc/initramfs-tools is not present [\#111](https://github.com/dev-sec/ansible-collection-hardening/issues/111)
+- The role fails when conditionally included [\#105](https://github.com/dev-sec/ansible-collection-hardening/issues/105)
+- Deprecation warning always\_run [\#103](https://github.com/dev-sec/ansible-collection-hardening/issues/103)
+- CentOS 7 selinux dependencies [\#102](https://github.com/dev-sec/ansible-collection-hardening/issues/102)
+- ubuntu xenial warning during activate gpg-check for yum-repos [\#99](https://github.com/dev-sec/ansible-collection-hardening/issues/99)
+- rhel\_system\_auth.j2 is still using pam\_passwdqc.so for CentOS 7 [\#98](https://github.com/dev-sec/ansible-collection-hardening/issues/98)
+- Centos 7.1 fails at  \[Change various sysctl-settings on rhel-hosts...\] [\#74](https://github.com/dev-sec/ansible-collection-hardening/issues/74)
+- Enable pam\_pwquality in rhel-family \> 7 [\#73](https://github.com/dev-sec/ansible-collection-hardening/issues/73)
+- Hardening fails on Centos 7.1 at task 'minimize access' [\#71](https://github.com/dev-sec/ansible-collection-hardening/issues/71)
+- "irc" user always changed after reboot [\#53](https://github.com/dev-sec/ansible-collection-hardening/issues/53)
 - use touch for 10.hardcore.conf to avoid problems with dry-run [\#314](https://github.com/dev-sec/ansible-collection-hardening/pull/314) ([schurzi](https://github.com/schurzi))
 - use touch with no date changes [\#310](https://github.com/dev-sec/ansible-collection-hardening/pull/310) ([rndmh3ro](https://github.com/rndmh3ro))
 - do not touch sysctl file to avoid idempotency problems [\#309](https://github.com/dev-sec/ansible-collection-hardening/pull/309) ([rndmh3ro](https://github.com/rndmh3ro))
 - replace module parameter fixed [\#297](https://github.com/dev-sec/ansible-collection-hardening/pull/297) ([danielkubat](https://github.com/danielkubat))
+- Addressing issue \#255 [\#258](https://github.com/dev-sec/ansible-collection-hardening/pull/258) ([ljkimmel](https://github.com/ljkimmel))
+- Fix \#247, cleanup conditions [\#248](https://github.com/dev-sec/ansible-collection-hardening/pull/248) ([fernandezcuesta](https://github.com/fernandezcuesta))
+- Fix error on applying the sysctl vars on containers [\#243](https://github.com/dev-sec/ansible-collection-hardening/pull/243) ([ghost](https://github.com/ghost))
+- Update location of NSA RHEL 5 Guide [\#235](https://github.com/dev-sec/ansible-collection-hardening/pull/235) ([jaredledvina](https://github.com/jaredledvina))
+- Fix typo [\#212](https://github.com/dev-sec/ansible-collection-hardening/pull/212) ([ruslo](https://github.com/ruslo))
+- Update modprobe to 0644 [\#211](https://github.com/dev-sec/ansible-collection-hardening/pull/211) ([joshuatalb](https://github.com/joshuatalb))
+- Test Kitchen Vagrant Fixes [\#210](https://github.com/dev-sec/ansible-collection-hardening/pull/210) ([joshuatalb](https://github.com/joshuatalb))
+- \[readme\] Update documentation link [\#207](https://github.com/dev-sec/ansible-collection-hardening/pull/207) ([pmav99](https://github.com/pmav99))
+- fix ansible lint remarks [\#204](https://github.com/dev-sec/ansible-collection-hardening/pull/204) ([rndmh3ro](https://github.com/rndmh3ro))
+- add colon to user env paths - fix \#202 [\#203](https://github.com/dev-sec/ansible-collection-hardening/pull/203) ([rndmh3ro](https://github.com/rndmh3ro))
+- add /usr/bin/su to suid\_guid whitelist [\#199](https://github.com/dev-sec/ansible-collection-hardening/pull/199) ([ccolic](https://github.com/ccolic))
+- ensure that permissions to su-binary are not restricted to root user and group only, if os\_security\_users\_allow contains the value change\_user [\#197](https://github.com/dev-sec/ansible-collection-hardening/pull/197) ([szEvEz](https://github.com/szEvEz))
+- do not install passwdqc on amazon linux [\#189](https://github.com/dev-sec/ansible-collection-hardening/pull/189) ([rndmh3ro](https://github.com/rndmh3ro))
+- add back run opts for debian 8 in travis [\#184](https://github.com/dev-sec/ansible-collection-hardening/pull/184) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix core dump config file creation when core dumps are disabled [\#182](https://github.com/dev-sec/ansible-collection-hardening/pull/182) ([Normo](https://github.com/Normo))
+- change minimize access method [\#181](https://github.com/dev-sec/ansible-collection-hardening/pull/181) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix errors produced by ansible-lint [\#159](https://github.com/dev-sec/ansible-collection-hardening/pull/159) ([zbrojny120](https://github.com/zbrojny120))
+- replace single ticks with double ticks. fix \#151 [\#152](https://github.com/dev-sec/ansible-collection-hardening/pull/152) ([rndmh3ro](https://github.com/rndmh3ro))
+- fixed tag [\#149](https://github.com/dev-sec/ansible-collection-hardening/pull/149) ([martinbydefault](https://github.com/martinbydefault))
+- Remove rsync from package blacklist [\#142](https://github.com/dev-sec/ansible-collection-hardening/pull/142) ([duk3luk3](https://github.com/duk3luk3))
+- Updates "tags" parameters on includes in main.yml [\#66](https://github.com/dev-sec/ansible-collection-hardening/pull/66) ([conorsch](https://github.com/conorsch))
+- Suid set def var, fix \#64 [\#63](https://github.com/dev-sec/ansible-collection-hardening/pull/63) ([rndmh3ro](https://github.com/rndmh3ro))

 **Closed issues:**

 - Any planned support for RHEL/CentOS 8? [\#298](https://github.com/dev-sec/ansible-collection-hardening/issues/298)
+- Consider using find module instead of shell [\#293](https://github.com/dev-sec/ansible-collection-hardening/issues/293)
+- Optimize logical OR in when clause [\#292](https://github.com/dev-sec/ansible-collection-hardening/issues/292)
+- vfat added to dev-sec.conf, but efi is used [\#288](https://github.com/dev-sec/ansible-collection-hardening/issues/288)
+- The state of the galaxy release [\#269](https://github.com/dev-sec/ansible-collection-hardening/issues/269)
+- OpenSUSE Support [\#249](https://github.com/dev-sec/ansible-collection-hardening/issues/249)
+- ansible hardening fails on ubuntu 16.04 with msg": "ERROR! 'sysctl\_rhel\_config' is undefined [\#147](https://github.com/dev-sec/ansible-collection-hardening/issues/147)
+- Enhancement: Test with TestInfra and Molecule [\#128](https://github.com/dev-sec/ansible-collection-hardening/issues/128)
+- Enhancement: Pin python dependencies for development and testing [\#127](https://github.com/dev-sec/ansible-collection-hardening/issues/127)
+- Update readme to include baselines [\#122](https://github.com/dev-sec/ansible-collection-hardening/issues/122)
+- Error running on RHEL 7 due to syntax issues [\#112](https://github.com/dev-sec/ansible-collection-hardening/issues/112)
+- disable password age [\#109](https://github.com/dev-sec/ansible-collection-hardening/issues/109)
+- Permissions on /etc/shadow can lock out GUI users [\#86](https://github.com/dev-sec/ansible-collection-hardening/issues/86)
+- network related sysctl rewritten by ufw in ubuntu  [\#82](https://github.com/dev-sec/ansible-collection-hardening/issues/82)
+- ansible \>= 2.0 complains: Using bare variables is deprecated [\#78](https://github.com/dev-sec/ansible-collection-hardening/issues/78)
+- Hardening fails on Centos 7.1 at task 'remove suid/sgid bit from all binaries except in system and user whitelist' [\#72](https://github.com/dev-sec/ansible-collection-hardening/issues/72)
+- ansible 2.0 | "remove suid/sgid" task fails [\#64](https://github.com/dev-sec/ansible-collection-hardening/issues/64)
+- Custom sysctl [\#50](https://github.com/dev-sec/ansible-collection-hardening/issues/50)
+- Fix directory structure. [\#48](https://github.com/dev-sec/ansible-collection-hardening/issues/48)
+- pam auth update error [\#47](https://github.com/dev-sec/ansible-collection-hardening/issues/47)
+- ansible-os-hardening/tasks/minimize\_access.yml [\#38](https://github.com/dev-sec/ansible-collection-hardening/issues/38)
+- Role configuration. vars/main.yml? [\#34](https://github.com/dev-sec/ansible-collection-hardening/issues/34)
+- Sysctl reloading [\#18](https://github.com/dev-sec/ansible-collection-hardening/issues/18)
+- Add conditions for disabling of ip forwarding [\#15](https://github.com/dev-sec/ansible-collection-hardening/issues/15)
+- Disable System Accounts [\#6](https://github.com/dev-sec/ansible-collection-hardening/issues/6)

 **Merged pull requests:**

@@ -179,6 +522,60 @@
 - do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-collection-hardening/pull/289) ([schurzi](https://github.com/schurzi))
 - move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-collection-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
 - install procps in debian so sysctl.conf exists [\#282](https://github.com/dev-sec/ansible-collection-hardening/pull/282) ([rndmh3ro](https://github.com/rndmh3ro))
+- move defaults to os-specific vars [\#157](https://github.com/dev-sec/ansible-collection-hardening/pull/157) ([rndmh3ro](https://github.com/rndmh3ro))
+- Converts set to JSON-serializable list [\#126](https://github.com/dev-sec/ansible-collection-hardening/pull/126) ([pestaa](https://github.com/pestaa))
+- add more sysctl settings, allow overwriting [\#120](https://github.com/dev-sec/ansible-collection-hardening/pull/120) ([rndmh3ro](https://github.com/rndmh3ro))
+- remove execshield sysctl-parameter on rhel7 [\#119](https://github.com/dev-sec/ansible-collection-hardening/pull/119) ([rndmh3ro](https://github.com/rndmh3ro))
+- change shadow owner in debian systems [\#117](https://github.com/dev-sec/ansible-collection-hardening/pull/117) ([rndmh3ro](https://github.com/rndmh3ro))
+- Rhel7 [\#113](https://github.com/dev-sec/ansible-collection-hardening/pull/113) ([tyrken](https://github.com/tyrken))
+- use new Docker images [\#110](https://github.com/dev-sec/ansible-collection-hardening/pull/110) ([rndmh3ro](https://github.com/rndmh3ro))
+- Don’t refer to this role as "playbook" in the role description [\#104](https://github.com/dev-sec/ansible-collection-hardening/pull/104) ([ypid](https://github.com/ypid))
+- update template [\#101](https://github.com/dev-sec/ansible-collection-hardening/pull/101) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix deprecation warning for undefined error. \#99 [\#100](https://github.com/dev-sec/ansible-collection-hardening/pull/100) ([rndmh3ro](https://github.com/rndmh3ro))
+- add rhel7 pam\_pwquality. fix \#73 [\#94](https://github.com/dev-sec/ansible-collection-hardening/pull/94) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix a formatting issue in readme. [\#92](https://github.com/dev-sec/ansible-collection-hardening/pull/92) ([vivekagr](https://github.com/vivekagr))
+- Permits overriding permissions on /etc/shadow [\#89](https://github.com/dev-sec/ansible-collection-hardening/pull/89) ([conorsch](https://github.com/conorsch))
+- Release 3.0.0 [\#75](https://github.com/dev-sec/ansible-collection-hardening/pull/75) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add explicit role-path to kitchen.yml [\#52](https://github.com/dev-sec/ansible-collection-hardening/pull/52) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix pam passwdqc template [\#51](https://github.com/dev-sec/ansible-collection-hardening/pull/51) ([rndmh3ro](https://github.com/rndmh3ro))
+- New dir layout [\#49](https://github.com/dev-sec/ansible-collection-hardening/pull/49) ([rndmh3ro](https://github.com/rndmh3ro))
+- remove duplicate "update pam" task [\#46](https://github.com/dev-sec/ansible-collection-hardening/pull/46) ([fitz123](https://github.com/fitz123))
+- Fix stuck in case pam files was updated before by force update [\#45](https://github.com/dev-sec/ansible-collection-hardening/pull/45) ([fitz123](https://github.com/fitz123))
+- Fix nologin shell path [\#44](https://github.com/dev-sec/ansible-collection-hardening/pull/44) ([fitz123](https://github.com/fitz123))
+- improved travis-tests to cover more cases [\#42](https://github.com/dev-sec/ansible-collection-hardening/pull/42) ([rndmh3ro](https://github.com/rndmh3ro))
+- Update kitchen-ansible, remove separate debian install [\#40](https://github.com/dev-sec/ansible-collection-hardening/pull/40) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add mode to su-binary task. Fix \#38 [\#39](https://github.com/dev-sec/ansible-collection-hardening/pull/39) ([rndmh3ro](https://github.com/rndmh3ro))
+- update common kitchen.yml platforms \(ansible\), kitchen\_debian.yml platforms \(ansible\) [\#37](https://github.com/dev-sec/ansible-collection-hardening/pull/37) ([chris-rock](https://github.com/chris-rock))
+- Change oneliner if-statements to be more readable [\#36](https://github.com/dev-sec/ansible-collection-hardening/pull/36) ([rndmh3ro](https://github.com/rndmh3ro))
+- Separate system-vars from editable vars. Fix \#34 [\#35](https://github.com/dev-sec/ansible-collection-hardening/pull/35) ([rndmh3ro](https://github.com/rndmh3ro))
+- Create limits.d-directory if it does not exist. [\#33](https://github.com/dev-sec/ansible-collection-hardening/pull/33) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add correct CONTRIB-file [\#32](https://github.com/dev-sec/ansible-collection-hardening/pull/32) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add Ansible Galaxy badge [\#31](https://github.com/dev-sec/ansible-collection-hardening/pull/31) ([rndmh3ro](https://github.com/rndmh3ro))
+-  Update readme, todo, changelog, vars [\#30](https://github.com/dev-sec/ansible-collection-hardening/pull/30) ([rndmh3ro](https://github.com/rndmh3ro))
+- List-cleanup and follow symlinks added [\#29](https://github.com/dev-sec/ansible-collection-hardening/pull/29) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add module configuration [\#28](https://github.com/dev-sec/ansible-collection-hardening/pull/28) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix two sysctl-settings [\#27](https://github.com/dev-sec/ansible-collection-hardening/pull/27) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add meta-files for Ansible Galaxy [\#26](https://github.com/dev-sec/ansible-collection-hardening/pull/26) ([rndmh3ro](https://github.com/rndmh3ro))
+- Disable System Accounts. Fix \#6 [\#25](https://github.com/dev-sec/ansible-collection-hardening/pull/25) ([rndmh3ro](https://github.com/rndmh3ro))
+- Use changed\_when to avoid changed tasks [\#24](https://github.com/dev-sec/ansible-collection-hardening/pull/24) ([rndmh3ro](https://github.com/rndmh3ro))
+- Delete authconfig-task on rhel-systems [\#23](https://github.com/dev-sec/ansible-collection-hardening/pull/23) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add missing rhosts-include task [\#21](https://github.com/dev-sec/ansible-collection-hardening/pull/21) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change sysctl-task. Fix \#18 [\#20](https://github.com/dev-sec/ansible-collection-hardening/pull/20) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add travis-support [\#17](https://github.com/dev-sec/ansible-collection-hardening/pull/17) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add conditions for various tasks. Fix \#15 [\#16](https://github.com/dev-sec/ansible-collection-hardening/pull/16) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix configuration of playbook path [\#14](https://github.com/dev-sec/ansible-collection-hardening/pull/14) ([chris-rock](https://github.com/chris-rock))
+- Make tasks clearer [\#13](https://github.com/dev-sec/ansible-collection-hardening/pull/13) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add remove suid/sgid function [\#12](https://github.com/dev-sec/ansible-collection-hardening/pull/12) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add task to remove unused repos and pkgs [\#11](https://github.com/dev-sec/ansible-collection-hardening/pull/11) ([rndmh3ro](https://github.com/rndmh3ro))
+- Edit README to fit to os-hardening [\#10](https://github.com/dev-sec/ansible-collection-hardening/pull/10) ([rndmh3ro](https://github.com/rndmh3ro))
+- ignore RAs on Ipv6 [\#9](https://github.com/dev-sec/ansible-collection-hardening/pull/9) ([rndmh3ro](https://github.com/rndmh3ro))
+- Repair debian install script [\#8](https://github.com/dev-sec/ansible-collection-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
+- Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-collection-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
+- Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-collection-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-collection-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-collection-hardening/pull/3) ([arlimus](https://github.com/arlimus))
+- Add Securetty-support [\#2](https://github.com/dev-sec/ansible-collection-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
+- Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-collection-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))



@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
@@ -11,6 +11,7 @@ This collection provides battle tested hardening for:

 - Linux operating systems:
  - CentOS 7/8
+  - Rocky Linux 8
  - Debian 9/10
  - Ubuntu 16.04/18.04/20.04
  - Amazon Linux (some roles supported)
@@ -1,12 +1,12 @@
 namespace: devsec
 name: hardening
-version: 7.3.0
+version: 7.11.0
 readme: README.md
 authors:
  - dev-sec <[email protected]>
 description: 'This collection provides battle tested hardening for Linux, SSH, nginx, MySQL'
 license:
-  - GPL-2.0-or-later
+  - Apache-2.0
 license_file: ''
 tags:
  - devsec
@@ -18,10 +18,13 @@ tags:
  - mysql
  - openssh
 dependencies:
+  ansible.posix: '>=1.0.0'
  community.crypto: '>=1.0.0'
-repository: 'https://github.com/dev-sec/ansible-os-hardening'
+  community.general: '>=1.0.0'
+  community.mysql: '>=1.3.0'
+repository: 'https://github.com/dev-sec/ansible-collection-hardening/'
 homepage: 'https://dev-sec.io/'
-issues: 'https://github.com/dev-sec/ansible-os-hardening/issues'
+issues: 'https://github.com/dev-sec/ansible-collection-hardening/issues'
 build_ignore:
  - codecov.yml
  - .github
@@ -22,9 +22,6 @@
        - mysql_python_package_debian is not defined
        - ansible_distribution != "Ubuntu"
        - ansible_distribution_major_version|int < 20
-    - include_role:
-        name: dev-sec.mysql
-
    - include_role:
        name: mysql_hardening
  vars:
@@ -3,11 +3,9 @@ dependency:
  name: galaxy
  options:
    role-file: molecule/mysql_hardening/requirements.yml
+    requirements-file: molecule/mysql_hardening/requirements.yml
 driver:
  name: docker
-lint: |
-  yamllint roles/mysql_hardening/ molecule/mysql_hardening/ .github/workflows/mysql_hardening.yml
-  ansible-lint roles/mysql_hardening/
 platforms:
  - name: instance
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
@@ -56,7 +54,6 @@ scenario:
    - destroy
  test_sequence:
    - dependency
-    - lint
    - destroy
    - syntax
    - create
@@ -25,3 +25,34 @@
      file:
        path: "/etc/mysql/conf.d"
        state: directory
+
+    - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
+      set_fact:
+        mysql_python_package_debian: "python3-pymysql"
+      when:
+        - mysql_python_package_debian is not defined
+        - ansible_distribution == "Ubuntu"
+        - ansible_distribution_major_version|int > 19
+
+    - name: Determine required MySQL Python libraries.
+      set_fact:
+        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
+      when:
+        - mysql_python_package_debian is not defined
+        - ansible_distribution != "Ubuntu"
+        - ansible_distribution_major_version|int < 20
+
+    - include_role:
+        name: dev-sec.mysql
+
+    - name: create a user with an empty password
+      community.mysql.mysql_query:
+        query:
+          - "CREATE USER foo@bar;"
+        login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  vars:
+    overwrite_global_mycnf: false
+    mysql_root_password: iloverandompasswordsbutthiswilldo
+    mysql_user_password: iloverandompasswordsbutthiswilldo
+    mysql_config_file: /etc/mysql/mariadb.cnf
+    mysql_root_password_update: true
@@ -44,7 +44,7 @@
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"

    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/mysql-baseline.git"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/mysql-baseline/archive/refs/heads/master.zip"
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -5,9 +5,6 @@ dependency:
    role-file: molecule/nginx_hardening/requirements.yml
 driver:
  name: docker
-lint: |
-  yamllint roles/nginx_hardening/ molecule/nginx_hardening/ .github/workflows/nginx_hardening.yml
-  ansible-lint roles/nginx_hardening/
 platforms:
  - name: instance
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
@@ -57,7 +54,6 @@ scenario:
    - destroy
  test_sequence:
    - dependency
-    - lint
    - destroy
    - syntax
    - create
@@ -47,7 +47,7 @@
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"

    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/nginx-baseline.git"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/nginx-baseline/archive/refs/heads/master.zip"
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -37,7 +37,6 @@
      net.ipv4.icmp_ignore_bogus_error_responses: 1
      net.ipv4.icmp_ratelimit: 100
      net.ipv4.icmp_ratemask: 88089
-      net.ipv6.conf.all.disable_ipv6: 1
      net.ipv4.conf.all.arp_ignore: 1
      net.ipv4.conf.all.arp_announce: 2
      net.ipv4.conf.all.shared_media: 1
@@ -5,9 +5,6 @@ dependency:
    role-file: molecule/os_hardening/requirements.yml
 driver:
  name: docker
-lint: |
-  yamllint roles/os_hardening/ molecule/os_hardening/ .github/workflows/os_hardening.yml
-  ansible-lint roles/os_hardening/
 platforms:
  - name: instance
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
@@ -57,7 +54,6 @@ scenario:
    - destroy
  test_sequence:
    - dependency
-    - lint
    - destroy
    - syntax
    - create
@@ -51,7 +51,7 @@
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"

    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline.git"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -5,9 +5,6 @@ dependency:
    role-file: molecule/ssh_hardening/requirements.yml
 driver:
  name: docker
-lint: |
-  yamllint roles/ssh_hardening/ molecule/ssh_hardening/ .github/workflows/ssh_hardening.yml
-  ansible-lint roles/ssh_hardening/
 platforms:
  - name: instance
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
@@ -57,7 +54,6 @@ scenario:
    - destroy
  test_sequence:
    - dependency
-    - lint
    - destroy
    - syntax
    - create
@@ -42,7 +42,7 @@
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"

    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline.git"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip"
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -4,3 +4,4 @@ ansible
 ansible-lint
 docker
 flake8
+jmespath
@@ -9,7 +9,7 @@ This role provides security configurations for MySQL and its derivates. It is in
 It configures:

 - Permissions for the various configuration files and folders
- Removes anonymous users, root-users without a password and test databases
+- Removes anonymous users, users without a password or authentication_string and test databases
 - various hardening options inside MySQL

 ## Requirements
@@ -27,12 +27,14 @@ It configures:
    - mysql_hardening
 ```

-This role expects an existing installation of MySQL or MariaDB. Please ensure that the following variables are set accordingly:
+This role expects an existing installation of MySQL or MariaDB. Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.  
+Please ensure that the following variables are set accordingly:

 - `mysql_hardening_enabled: yes` role is enabled by default and can be disabled without removing it from a playbook. You can use conditional variable, for example: `mysql_hardening_enabled: "{{ true if mysql_enabled else false }}"`
 - `mysql_hardening_user: 'mysql'` The user that mysql runs as.
- `mysql_datadir: '/var/lib/mysql'` The MySQL data directory
 - `mysql_hardening_mysql_hardening_conf_file: '/etc/mysql/conf.d/hardening.cnf'` The path to the configuration file where the hardening will be performed
+- _deprecated: `mysql_datadir: '/var/lib/mysql'` The MySQL data directory_
+  - `mysql_datadir` is no longer necessary, as MySQL data directory is automatically taken from `mysql_info`. But it can still be defined and will also be checked for correct permissions.

 ## Role Variables

@@ -7,7 +7,6 @@ mysql_daemon_enabled: true
 mysql_hardening_restart_mysql: true

 # general configuration
-mysql_datadir: '/var/lib/mysql'
 mysql_hardening_mysql_hardening_conf_file: '{{mysql_hardening_mysql_confd_dir}}/hardening.cnf'
 # You have to change this to your own strong enough mysql root password
 mysql_root_password: '-----====>SetR00tPa$$wordH3r3!!!<====-----'
@@ -1,6 +1,6 @@
 ---

- name: restart mysql
+- name: Restart mysql
  service:
    name: '{{ mysql_daemon }}'
    state: restarted
@@ -1,5 +1,5 @@
 ---
- name: protect my.cnf
+- name: Protect my.cnf
  file:
    path: '{{ mysql_hardening_mysql_conf_file }}'
    mode: '0640'
@@ -8,23 +8,31 @@
    follow: true
    state: file

- name: ensure permissions on mysql-datadir are correct
+- name: Ensure permissions on mysql-datadir are correct
  file:
-    path: '{{ mysql_datadir }}'
+    path: '{{ item }}'
    state: directory
    owner: '{{ mysql_hardening_user }}'
    group: '{{ mysql_hardening_user }}'
    mode: '0750'
+  when: item is defined and item != ""
+  loop:
+    - '{{ mysql_settings.settings.datadir }}'
+    - '{{ mysql_datadir|default("") }}'

- name: ensure permissions on mysql-logfile are correct
+- name: Ensure permissions on mysql-logfile are correct
  file:
-    path: '{{ mysql_hardening_log_file }}'
+    path: '{{ item }}'
    state: file
    owner: '{{ mysql_hardening_user }}'
    group: '{{ mysql_hardening_group }}'
    mode: '0640'
+  when: item is defined and item != ""
+  loop:
+    - '{{ mysql_settings.settings.log_error }}'
+    - '{{ mysql_hardening_log_file|default("") }}'

- name: check mysql configuration-directory exists and has right permissions
+- name: Check mysql configuration-directory exists and has right permissions
  file:
    path: '{{ mysql_hardening_mysql_confd_dir }}'
    state: directory
@@ -32,25 +40,25 @@
    group: '{{ mysql_hardening_group }}'
    mode: '0750'

- name: check include-dir directive is present in my.cnf
+- name: Check include-dir directive is present in my.cnf
  lineinfile:
    dest: '{{ mysql_hardening_mysql_conf_file }}'
    line: '!includedir {{ mysql_hardening_mysql_confd_dir }}'
    insertafter: 'EOF'
    state: present
    backup: true
-  notify: restart mysql
+  notify: Restart mysql

- name: apply hardening configuration
+- name: Apply hardening configuration
  template:
    src: 'hardening.cnf.j2'
    dest: '{{ mysql_hardening_mysql_hardening_conf_file }}'
    owner: '{{ mysql_cnf_owner }}'
    group: '{{ mysql_cnf_group }}'
    mode: '0640'
-  notify: restart mysql
+  notify: Restart mysql

- name: enable mysql
+- name: Enable mysql
  service:
    name: '{{ mysql_daemon }}'
    enabled: '{{ mysql_daemon_enabled }}'
@@ -15,11 +15,49 @@
 # we only override variables with our default if they have not been specified already.
 # by default the lookup functions finds all varnames containing the string, therefore
 # we add ^ and $ to denote start and end of string, so this returns only exact maches.
- name: Set OS dependent variables, if not already defined by user
+- name: Set OS dependent variables, if not already defined by user  # noqa var-naming
  set_fact:
    '{{ item.key }}': '{{ item.value }}'
  when: "not lookup('varnames', '^' + item.key + '$')"
  with_dict: '{{ os_vars }}'
+  tags: always
+
+- name: Check that the variable mysql_distribution is set correctly
+  ansible.builtin.assert:
+    that: mysql_distribution == 'mysql' or mysql_distribution == 'mariadb'
+    fail_msg: 'mysql_distribution must be set to either mysql or mariadb!'
+  when: mysql_distribution is defined
+
+- name: Gather package facts to check for mysql/mariadb version
+  ansible.builtin.package_facts:
+    manager: auto
+  when: not mysql_distribution is defined
+
+- name: Check if MySQL or MariaDB is used
+  set_fact:
+    mysql_distribution: "{{ ansible_facts.packages['mysql-server'] is defined | ternary('mysql', 'mariadb') }}"
+  when: not mysql_distribution is defined
+
+- name: Check which MySQL/MariaDB version is used
+  community.mysql.mysql_info:
+    filter: version
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_version
+
+- name: Check MySQL/MariaDB settings
+  community.mysql.mysql_info:
+    filter: settings
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_settings
+
+# see https://stackoverflow.com/a/59451077/2953919 for the
+# dict2items and vice versa magic
+- name: Drop the secure-auth parameter on MySQL >=8.0.3 (not mariadb)
+  set_fact:
+    mysql_hardening_options: "{{ mysql_hardening_options| dict2items | rejectattr('key', 'search', 'secure-auth') | list | items2dict }}"
+  when:
+    - mysql_version.version.full is version('8.0.3', '>=')
+    - mysql_distribution == "mysql"

 - include: configure.yml
  when: mysql_hardening_enabled | bool
@@ -1,42 +1,104 @@
 ---
- name: fail the role if the mysql root password was not set
+- name: Fail the role if the mysql root password was not set
  fail:
    msg: 'ERROR - you have to change default mysql_root_password'
  when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'

- name: root password is present
-  mysql_user:
+- name: ensure that the root password is present
+  community.mysql.mysql_user:
    name: 'root'
    host_all: true
    password: '{{ mysql_root_password | mandatory }}'
    state: present
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"

- name: install .my.cnf with credentials
+- name: Install .my.cnf with credentials
  template:
    src: 'my.cnf.j2'
    dest: '{{ mysql_user_home }}/.my.cnf'
    mode: '0400'
  tags: my_cnf

- name: test database is absent
-  mysql_db:
+- name: ensure that the test database is absent
+  community.mysql.mysql_db:
    name: test
    state: absent
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_test_database

- name: anonymous users are absent
-  mysql_user:
+- name: ensure that anonymous users are absent
+  community.mysql.mysql_user:
    name: ''
    state: absent
    host_all: true
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_anonymous_users

- name: remove remote root
+- name: ensure that root can only login from localhost
  community.mysql.mysql_query:
    query:
-      - DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1')
+      - DELETE
+        FROM mysql.user
+        WHERE USER='root'
+          AND HOST NOT IN ('localhost',
+                          '127.0.0.1',
+                          '::1')
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_remote_root
+
+- name: get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
+  community.mysql.mysql_query:
+    query:
+      - SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
+        FROM mysql.user
+        WHERE (length(authentication_string)=0
+              OR authentication_string="")
+          AND USER NOT IN ('mysql.sys',
+                          'mysqlxsys',
+                          'mariadb.sys');
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_users_wo_passwords_or_auth_string
+  when:
+    - (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '>=')) or
+      (mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '>='))
+
+- name: get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
+  community.mysql.mysql_query:
+    query:
+      - SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
+        FROM mysql.user
+        WHERE (length(password)=0
+              OR password="")
+          AND (length(authentication_string)=0
+              OR authentication_string="")
+          AND USER NOT IN ('mysql.sys',
+                          'mysqlxsys',
+                          'mariadb.sys');
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_users_wo_passwords
+  when:
+    - (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '<')) or
+      (mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '<'))
+
+- name: create a fact for users without password or authentication_string
+  set_fact:
+    users_wo_auth: "{{ mysql_users_wo_passwords_or_auth_string.query_result.0.0 | community.general.json_query('users') }}"
+  when:
+    - mysql_users_wo_passwords_or_auth_string.query_result is defined
+    - mysql_users_wo_passwords_or_auth_string.query_result != ""  # noqa empty-string-compare
+
+- name: create a fact for users without password
+  set_fact:
+    users_wo_auth: "{{ mysql_users_wo_passwords.query_result.0.0 | community.general.json_query('users') }}"
+  when:
+    - mysql_users_wo_passwords.query_result is defined
+    - mysql_users_wo_passwords.query_result != ""  # noqa empty-string-compare
+
+- name: ensure that there are no users without password or authentication_string
+  community.mysql.mysql_query:
+    query:
+      - "DROP USER {{ users_wo_auth }}"
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  when:
+    - users_wo_auth is defined
+    - users_wo_auth != ""  # noqa empty-string-compare
@@ -4,8 +4,6 @@ mysql_daemon: mysql
 mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'

-mysql_hardening_log_file: '/var/log/mysql/error.log'
-
 mysql_hardening_group: 'adm'

 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
@@ -2,5 +2,3 @@
 mysql_daemon: mysqld
 mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
-
-mysql_hardening_mysql_log_file: '/var/log/mysqld.log'
@@ -0,0 +1,10 @@
+---
+mysql_daemon: mysql-server
+
+mysql_hardening_mysql_conf_file: '/usr/local/etc/mysql/my.cnf'
+mysql_hardening_mysql_confd_dir: '/usr/local/etc/mysql/conf.d'
+
+mysql_hardening_group: 'mysql'
+
+mysql_cnf_owner: 'root'  # owner of /usr/local/etc/mysql/*.cnf files
+mysql_cnf_group: 'mysql'  # owner of /usr/local/etc/mysql/*.cnf files
@@ -4,6 +4,4 @@ mysql_daemon: mysqld
 mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'

-mysql_hardening_log_file: '/var/log/mysqld.log'
-
 mysql_hardening_group: 'adm'
@@ -3,8 +3,6 @@ mysql_daemon: mariadb
 mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'

-mysql_hardening_log_file: '/var/log/mariadb/mariadb.log'
-
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files

@@ -2,7 +2,6 @@
 mysql_daemon: mariadb
 mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
-mysql_hardening_log_file: '/var/log/mariadb/mariadb.log'

 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
@@ -0,0 +1,9 @@
+---
+mysql_daemon: mariadb
+mysql_hardening_mysql_conf_file: '/etc/my.cnf'
+mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
+
+mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
+mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
+
+mysql_hardening_group: 'mysql'
@@ -4,8 +4,6 @@ mysql_daemon: mysql
 mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'

-mysql_hardening_log_file: '/var/log/mysql/error.log'
-
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files

@@ -4,8 +4,6 @@ mysql_daemon: mysql
 mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'

-mysql_hardening_log_file: '/var/log/mysql/error.log'
-
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files

@@ -4,8 +4,6 @@ mysql_daemon: mysql
 mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'

-mysql_hardening_log_file: '/var/log/mysql/error.log'
-
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files

@@ -1,5 +1,5 @@
 ---
- name: restart nginx
+- name: Restart nginx
  service:
    name: "nginx"
    state: restarted
@@ -1,14 +1,14 @@
 ---
- name: create additional configuration
+- name: Create additional configuration
  template:
    src: "hardening.conf.j2"
    dest: "/etc/nginx/conf.d/90.hardening.conf"
    mode: '0600'
    owner: "root"
    group: "root"
-  notify: restart nginx
+  notify: Restart nginx

- name: change configuration in main nginx.conf
+- name: Change configuration in main nginx.conf
  lineinfile:
    dest: "/etc/nginx/nginx.conf"
    regexp: '^\s*server_tokens'
@@ -17,9 +17,9 @@
    mode: '0640'
    owner: "root"
    group: "root"
-  notify: restart nginx
+  notify: Restart nginx

- name: change ssl_protocols in main nginx.conf
+- name: Change ssl_protocols in main nginx.conf
  lineinfile:
    dest: "/etc/nginx/nginx.conf"
    regexp: '^\s*ssl_protocols'
@@ -28,9 +28,9 @@
    mode: '0640'
    owner: "root"
    group: "root"
-  notify: restart nginx
+  notify: Restart nginx

- name: change ssl_prefer_server_ciphers in main nginx.conf
+- name: Change ssl_prefer_server_ciphers in main nginx.conf
  lineinfile:
    dest: "/etc/nginx/nginx.conf"
    regexp: '^\s*ssl_prefer_server_ciphers'
@@ -39,9 +39,9 @@
    mode: '0640'
    owner: "root"
    group: "root"
-  notify: restart nginx
+  notify: Restart nginx

- name: change client_max_body_size in main nginx.conf
+- name: Change client_max_body_size in main nginx.conf
  lineinfile:
    dest: "/etc/nginx/nginx.conf"
    regexp: '^\s*client_max_body_size'
@@ -50,9 +50,9 @@
    mode: '0640'
    owner: "root"
    group: "root"
-  notify: restart nginx
+  notify: Restart nginx

- name: change client_body_buffer_size in main nginx.conf
+- name: Change client_body_buffer_size in main nginx.conf
  lineinfile:
    dest: "/etc/nginx/nginx.conf"
    regexp: '^\s*client_body_buffer_size'
@@ -61,9 +61,9 @@
    mode: '0640'
    owner: "root"
    group: "root"
-  notify: restart nginx
+  notify: Restart nginx

- name: change keepalive_timeout in main nginx.conf
+- name: Change keepalive_timeout in main nginx.conf
  lineinfile:
    dest: "/etc/nginx/nginx.conf"
    regexp: '^\s*keepalive_timeout'
@@ -72,23 +72,23 @@
    mode: '0640'
    owner: "root"
    group: "root"
-  notify: restart nginx
+  notify: Restart nginx

- name: remove default.conf
+- name: Remove default.conf
  file:
    path: "{{ item }}"
    state: absent
  when: nginx_remove_default_site
-  notify: restart nginx
+  notify: Restart nginx
  loop:
    - "/etc/nginx/conf.d/default.conf"
    - "/etc/nginx/sites-enabled/default"

- name: generate dh group
+- name: Generate dh group
  openssl_dhparam:
    path: "/etc/nginx/dh{{ nginx_dh_size }}.pem"
    size: "{{ nginx_dh_size }}"
    mode: '0640'
    owner: "root"
    group: "root"
-  notify: restart nginx
+  notify: Restart nginx
@@ -106,6 +106,9 @@ We know that this is the case on Raspberry Pi.
 - `os_auth_pw_min_age`
  - Default: `7`
  - Description: minimum password age (before allowing any other password change).
+- `os_auth_pw_remember`
+  - Default: `5`
+  - Description: how many used passwords are record.
 - `os_auth_retries`
  - Default: `5`
  - Description: the maximum number of authentication attempts, before the account is locked for some time.
@@ -148,6 +151,36 @@ We know that this is the case on Raspberry Pi.
 - `os_security_suid_sgid_remove_from_unknown`
  - Default: `false`
  - Description: true if you want to remove SUID/SGID bits from any file, that is not explicitly configured in a `blacklist`. This will make every Ansible-run search through the mounted filesystems looking for SUID/SGID bits that are not configured in the default and user blacklist. If it finds an SUID/SGID bit, it will be removed, unless this file is in your `whitelist`.
+- `os_auth_uid_min`
+  - Default: `1000`
+  - Description: minimum number for automatic uid selection in useradd.
+- `os_auth_uid_max`
+  - Default: `60000`
+  - Description: maximum number for automatic uid selection in useradd.
+- `os_auth_gid_min`
+  - Default: `1000`
+  - Description: minimum number for automatic gid selection in groupadd.
+- `os_auth_gid_max`
+  - Default: `60000`
+  - Description: maximum number for automatic gid selection in groupadd.
+- `os_auth_sub_uid_count`
+  - Default: `65536`
+  - Description: If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate user IDs) allocate SUB_UID_COUNT unused user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user. See also `os_auth_sub_uid_min` and `os_auth_sub_uid_max`.
+- `os_auth_sub_uid_min`.
+  - Default: `100000`
+  - Description: minimum number for automatic subordinate uid selection in useradd and newusers.
+- `os_auth_sub_uid_max`
+  - Default: `600100000`
+  - Description: maximum number for automatic subordinate uid selection in useradd and newusers.
+- `os_auth_sub_gid_count`
+  - Default: `65536`
+  - Description: If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate group IDs) allocate SUB_GID_COUNT unused group IDs from the range SUB_GID_MIN to SUB_GID_MAX for each new user. See also `os_auth_sub_gid_min` and `os_auth_sub_gid_max`.
+- `os_auth_sub_gid_min`
+  - Default: `100000`
+  - Description: minimum number for automatic subordinate gid selection in useradd and newusers.
+- `os_auth_sub_gid_max`
+  - Default: `600100000`
+  - Description: maximum number for automatic subordinate gid selection in useradd and newusers.
 - `os_security_packages_clean`
  - Default: `true`
  - Description: removes packages with known issues. See section packages.
@@ -172,6 +205,9 @@ We know that this is the case on Raspberry Pi.
 - `ufw_default_forward_policy`
  - Default: `DROP`
  - Description: set default forward policy of ufw to `DROP`.
+- `ufw_enable_ipv6`
+  - Default: `true`
+  - Description: Set to `true` to apply rules to support IPv6 (no means only IPv6 on loopback accepted).
 - `os_auditd_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring auditd.
@@ -190,6 +226,54 @@ We know that this is the case on Raspberry Pi.
 - `os_ignore_home_folder_users`
  - Default: `lost+found`
  - Description: specify user home folders in `/home` that shouldn't be chmodded to 700
+- `os_cron_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring cron.
+- `os_limits_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring limits.
+- `os_login_defs_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring login_defs.
+- `os_minimize_access_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring minimize_access.
+- `os_pam_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring pam.
+- `os_modprobe_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring modprobe.
+- `os_profile_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring profile.
+- `os_securetty_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring securetty.
+- `os_sysctl_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring sysctl.
+- `os_user_accounts_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring user_accounts.
+- `os_rhosts_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring rhosts.
+- `os_yum_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring yum.
+- `os_apt_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring apt.
+- `os_selinux_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring selinux.
+- `os_sha_crypt_min_rounds`
+  - Default: `640000`
+  - Description: Define the number of minimum SHA rounds. With a lot of rounds brute forcing the password is more difficult. But note also that it more CPU resources will be needed to authenticate users. The values must be inside the 1000-999999999 range.
+- `os_sha_crypt_max_rounds`
+  - Default: `640000`
+  - Description: Define the number of maximum SHA rounds. With a lot of rounds brute forcing the password is more difficult. But note also that it more CPU resources will be needed to authenticate users. The values must be inside the 1000-999999999 range.

 ## Packages

@@ -2,14 +2,15 @@
 os_desktop_enable: false
 os_env_extra_user_paths: []
 os_auth_pw_max_age: 60
-os_auth_pw_min_age: 7  # discourage password cycling
+os_auth_pw_min_age: 7  # Discourage password cycling
+os_auth_pw_remember: 5  # Specify how many used passwords are record
 os_auth_retries: 5
-os_auth_lockout_time: 600  # 10min
+os_auth_lockout_time: 600  # Seconds (600 = 10min)
 os_auth_timeout: 60
 os_auth_allow_homeless: false
 os_auth_pam_passwdqc_enable: true
-os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8'  # used in RHEL6
-os_auth_pam_pwquality_options: 'try_first_pass retry=3 type='  # used in RHEL7
+os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8'  # Used in RHEL6
+os_auth_pam_pwquality_options: 'try_first_pass retry=3 authtok_type='  # Used in RHEL7 and RHEL8
 os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]

 os_chfn_restrict: ''
@@ -17,22 +18,22 @@ os_chfn_restrict: ''
 # Set to false to disable chmod /home folders to 700
 os_chmod_home_folders: true

-# may contain: change_user
+# May contain: change_user
 os_security_users_allow: []
-# specify user home folders in /home that shouldn't be chmodded to 700
+# Specify user home folders in /home that shouldn't be chmodded to 700
 os_ignore_home_folder_users: ['lost+found']
-# specify system accounts those login should not be disabled and password not changed
+# Specify system accounts whose login should not be disabled and password not changed
 os_ignore_users: ['vagrant', 'kitchen']
 os_security_kernel_enable_module_loading: true
 os_security_kernel_enable_core_dump: false
 os_security_suid_sgid_enforce: true
-# user-defined blacklist and whitelist
+# User-defined blacklist and whitelist
 os_security_suid_sgid_blacklist: []
 os_security_suid_sgid_whitelist: []
-# if this is true, remove any suid/sgid bits from files that were not in the whitelist
+# If this is true, remove any suid/sgid bits from files that are not in the whitelist
 os_security_suid_sgid_remove_from_unknown: false

-# remove packages with known issues
+# Remove packages with known security issues
 os_security_packages_clean: true
 os_security_packages_list: ['xinetd', 'inetd', 'ypserv', 'telnet-server', 'rsh-server', 'prelink']

@@ -45,9 +46,9 @@ os_security_init_single: false
 ufw_manage_defaults: true

 # Empty variable disables IPT_SYSCTL in /etc/default/ufw
-# by default in Ubuntu it set to: /etc/ufw/sysctl.conf
-# CAUTION
-# if you enable it - it'll overwrite /etc/sysctl.conf file, managed by hardening framework
+# By default in Ubuntu it is set to: /etc/ufw/sysctl.conf
+# CAUTION!
+# If you enable it - it overwrites /etc/sysctl.conf file, managed by hardening framework
 ufw_ipt_sysctl: ''

 # Default ufw variables
@@ -58,6 +59,10 @@ ufw_default_application_policy: 'SKIP'
 ufw_manage_builtins: 'no'
 ufw_ipt_modules: 'nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns'

+# Set to true to apply rules to support IPv6 (no means only IPv6 on loopback
+# accepted).
+ufw_enable_ipv6: true
+
 sysctl_config:
  # These settings eliminate an entire class of security vulnerabilities:
  # time-of-check-time-of-use cross-privilege attacks using guessable
@@ -202,6 +207,8 @@ sysctl_config:
  # so disable it if not needed. | sysctl-13
  net.ipv4.conf.all.accept_source_route: 0
  net.ipv4.conf.default.accept_source_route: 0
+  net.ipv6.conf.all.accept_source_route: 0
+  net.ipv6.conf.default.accept_source_route: 0

  # For non-routers: don't send redirects.
  # An attacker could use a compromised host to send invalid ICMP redirects to other
@@ -211,7 +218,7 @@ sysctl_config:
  net.ipv4.conf.all.send_redirects: 0
  net.ipv4.conf.default.send_redirects: 0

-  # log martian packets
+  # Log martian packets
  # This feature logs packets with un-routable source addresses to the kernel log.
  # Enabling this feature and logging these packets allows an administrator to investigate
  # the possibility that an attacker is sending spoofed packets to their system.
@@ -234,10 +241,7 @@ sysctl_config:
  net.ipv6.conf.default.accept_redirects: 0
  net.ipv6.conf.all.accept_redirects: 0

-  # Disable IPv6 | sysctl-18
-  net.ipv6.conf.all.disable_ipv6: 1
-
-  # ignore RAs on Ipv6. | sysctl-25
+  # Ignore RAs on Ipv6. | sysctl-25
  net.ipv6.conf.all.accept_ra: 0
  net.ipv6.conf.default.accept_ra: 0

@@ -278,11 +282,19 @@ sysctl_config:
  vm.mmap_rnd_bits: 32
  vm.mmap_rnd_compat_bits: 16

+  # Disable unprivileged users from loading eBPF programs into the kernel.
+  # One of mitigations against CVE-2021-33909. | Tail-2
+  kernel.unprivileged_bpf_disabled: 1
+
+  # Reduce attack surface by disabling unprivileged user namespaces.
+  # Mitigates CVE-2021-33909 and other exploits.
+  kernel.unprivileged_userns_clone: 0
+
 # Do not delete the following line or otherwise the playbook will fail
 # at task 'create a combined sysctl-dict if overwrites are defined'
 sysctl_overwrite:

-# disable unused filesystems
+# Disable unused filesystems
 os_unused_filesystems:
  - "cramfs"
  - "freevxfs"
@@ -299,7 +311,7 @@ os_unused_filesystems:
  - "sctp"  # CIS 3.5.2
  - "tipc"  # CIS 3.5.4

-# whitelist for used filesystems
+# Whitelist for used filesystems
 os_filesystem_whitelist: []

 # Set to false to turn the role into a no-op. Useful when using
@@ -311,9 +323,58 @@ os_auditd_enabled: true
 os_auditd_max_log_file: 6
 os_auditd_max_log_file_action: keep_logs

-# Set the SELinux state, can be either disabled, permissive, or enforcing.
+# Set the SELinux state, which can be either disabled, permissive, or enforcing.
 os_selinux_state: enforcing
 # Set the SELinux polixy.
 os_selinux_policy: targeted

+# Mount options for proc in /etc/fstab.
 proc_mnt_options: 'rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}'
+
+# Set to false to disable installing and configuring cron.
+os_cron_enabled: true
+
+# Set to false to disable installing and configuring limits.
+os_limits_enabled: true
+
+# Set to false to disable installing and configuring login_defs.
+os_login_defs_enabled: true
+
+# Set to false to disable installing and configuring minimize_access.
+os_minimize_access_enabled: true
+
+# Set to false to disable installing and configuring pam.
+os_pam_enabled: true
+
+# Set to false to disable installing and configuring modprobe.
+os_modprobe_enabled: true
+
+# Set to false to disable installing and configuring profile.
+os_profile_enabled: true
+
+# Set to false to disable installing and configuring securetty.
+os_securetty_enabled: true
+
+# Set to false to disable installing and configuring sysctl.
+os_sysctl_enabled: true
+
+# Set to false to disable installing and configuring user_accounts.
+os_user_accounts_enabled: true
+
+# Set to false to disable installing and configuring rhosts.
+os_rhosts_enabled: true
+
+# Set to false to disable installing and configuring yum.
+os_yum_enabled: true
+
+# Set to false to disable installing and configuring apt.
+os_apt_enabled: true
+
+# Set to false to disable installing and configuring selinux.
+os_selinux_enabled: true
+
+# Define the number of SHA rounds.
+# With a lot of rounds brute forcing the password is more difficult. But note also that it more CPU resources will be needed to authenticate users.
+# The values must be inside the 1000-999999999 range.
+os_sha_crypt_min_rounds: "640000"
+os_sha_crypt_max_rounds: "640000"
@@ -1,3 +1,9 @@
 ---
- name: update-initramfs
+- name: Update-initramfs
  command: 'update-initramfs -u'
+
+- name: restart-auditd
+  command:
+    cmd: 'service auditd restart'  # rhel: see: https://access.redhat.com/solutions/2664811
+    warn: false  # sadly 'service' module fails in that case also by using 'use: service'
+  when: molecule_yml is not defined  # restarting auditd in a container does not work
@@ -1,5 +1,5 @@
 ---
- name: remove deprecated or insecure packages | package-01 - package-09
+- name: Remove deprecated or insecure packages | package-01 - package-09
  apt:
    name: '{{ os_security_packages_list }}'
    state: 'absent'
@@ -1,13 +1,16 @@
 ---
- name: install auditd package | package-08
+- name: Install auditd package | package-08
  package:
    name: '{{ auditd_package }}'
    state: 'present'
+  tags: auditd

- name: configure auditd | package-08
+- name: Configure auditd | package-08
  template:
    src: 'etc/audit/auditd.conf.j2'
    dest: '/etc/audit/auditd.conf'
    owner: 'root'
    group: 'root'
    mode: '0640'
+  notify: 'restart-auditd'
+  tags: auditd
@@ -14,12 +14,13 @@

 # we only override variables with our default, if they have not been specified already
 # by default the lookup functions finds all varnames containing the string, therefore
-# we add ^ and $ to denote start and end of string, so this returns only exact maches
- name: Set OS dependent variables, if not already defined by user
+# we add ^ and $ to denote start and end of string, so this returns only exact matches
+- name: Set OS dependent variables, if not already defined by user  # noqa var-naming
  set_fact:
    '{{ item.key }}': '{{ item.value }}'
  when: "not lookup('varnames', '^' + item.key + '$')"
  with_dict: '{{ os_vars }}'
+  tags: always

 - import_tasks: auditd.yml
  tags: auditd
@@ -27,27 +28,35 @@

 - import_tasks: cron.yml
  tags: cron
+  when: os_cron_enabled | bool

 - import_tasks: limits.yml
  tags: limits
+  when: os_limits_enabled | bool

 - import_tasks: login_defs.yml
  tags: login_defs
+  when: os_login_defs_enabled | bool

 - import_tasks: minimize_access.yml
  tags: minimize_access
+  when: os_minimize_access_enabled | bool

 - import_tasks: pam.yml
  tags: pam
+  when: os_pam_enabled | bool

 - import_tasks: modprobe.yml
  tags: modprobe
+  when: os_modprobe_enabled | bool

 - import_tasks: profile.yml
  tags: profile
+  when: os_profile_enabled | bool

 - import_tasks: securetty.yml
  tags: securetty
+  when: os_securetty_enabled | bool

 - import_tasks: suid_sgid.yml
  when: os_security_suid_sgid_enforce  | bool
@@ -55,21 +64,30 @@

 - import_tasks: sysctl.yml
  tags: sysctl
+  when: os_sysctl_enabled | bool

 - import_tasks: user_accounts.yml
  tags: user_accounts
+  when: os_user_accounts_enabled | bool

 - import_tasks: rhosts.yml
  tags: rhosts
+  when: os_rhosts_enabled | bool

 - import_tasks: yum.yml
-  when: ansible_facts.os_family == 'RedHat'
  tags: yum
+  when:
+    - ansible_facts.os_family == 'RedHat'
+    - os_yum_enabled | bool

 - import_tasks: apt.yml
-  when: ansible_facts.distribution in ['Debian', 'Ubuntu']
  tags: apt
+  when:
+    - ansible_facts.os_family == 'Debian'
+    - os_apt_enabled | bool

 - import_tasks: selinux.yml
  tags: selinux
-  when: ansible_facts.selinux.status == 'enabled'
+  when:
+    - ansible_facts.selinux.status == 'enabled'
+    - os_selinux_enabled | bool
@@ -1,6 +1,6 @@
 ---
 - block:
-  - name: create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
+  - name: Create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
    file:
      path: '/etc/security/limits.d'
      owner: 'root'
@@ -8,7 +8,7 @@
      mode: '0755'
      state: 'directory'

-  - name: create additional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
+  - name: Create additional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
    pam_limits:
      dest: '/etc/security/limits.d/10.hardcore.conf'
      domain: '*'
@@ -17,7 +17,7 @@
      value: '0'
      comment: Prevent core dumps for all users. These are usually not needed and may contain sensitive information

-  - name: set 10.hardcore.conf perms to 0400 and root ownership
+  - name: Set 10.hardcore.conf perms to 0400 and root ownership
    file:
      path: /etc/security/limits.d/10.hardcore.conf
      owner: 'root'
@@ -29,7 +29,7 @@

  when: not os_security_kernel_enable_core_dump | bool

- name: remove 10.hardcore.conf config file
+- name: Remove 10.hardcore.conf config file
  file:
    path: /etc/security/limits.d/10.hardcore.conf
    state: absent
@@ -1,5 +1,5 @@
 ---
- name: create login.defs | os-05, os-05b
+- name: Create login.defs | os-05, os-05b
  template:
    src: 'etc/login.defs.j2'
    dest: '/etc/login.defs'
@@ -1,3 +1,3 @@
 ---
- import_tasks: hardening.yml
+- include_tasks: hardening.yml
  when: os_hardening_enabled | bool
@@ -4,7 +4,7 @@
 # still getting found and the permissions minimized in the next task.
 # This is also the reason why there's ignore_errors: true on the task.
 # also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
- name: find files with write-permissions for group
+- name: Find files with write-permissions for group
  shell: "find -L {{ item }} -perm /go+w -type f"  # noqa command-instead-of-shell
  with_flattened:
    - '/usr/local/sbin'
@@ -18,7 +18,7 @@
  ignore_errors: true
  changed_when: false

- name: minimize access on found files
+- name: Minimize access on found files
  file:
    path: '{{ item.1 }}'
    mode: 'go-w'
@@ -27,21 +27,45 @@
    - "{{ minimize_access_directories.results }}"
    - stdout_lines

- name: change shadow ownership to root and mode to 0600 | os-02
+- name: Find shadow files
+  stat:
+    path: "{{ item }}"
+  loop:
+    - '/etc/shadow'
+    - '/etc/gshadow'
+    - '/etc/shadow-'
+    - '/etc/gshadow-'
+  register: minimize_access_shadow_files
+
+- name: Change shadow ownership to root and mode to 0600 | os-02
  file:
-    dest: '/etc/shadow'
+    dest: "{{ item.item }}"
    owner: '{{ os_shadow_perms.owner }}'
    group: '{{ os_shadow_perms.group }}'
    mode: '{{ os_shadow_perms.mode }}'
+  when: item.stat.exists
+  loop: "{{ minimize_access_shadow_files.results }}"

- name: change passwd ownership to root and mode to 0644 | os-03
+- name: Find passwd files
+  stat:
+    path: "{{ item }}"
+  loop:
+    - '/etc/passwd'
+    - '/etc/group'
+    - '/etc/passwd-'
+    - '/etc/group-'
+  register: minimize_access_passwd_files
+
+- name: Change passwd ownership to root and mode to 0644 | os-03
  file:
-    dest: '/etc/passwd'
+    dest: "{{ item.item }}"
    owner: '{{ os_passwd_perms.owner }}'
    group: '{{ os_passwd_perms.group }}'
    mode: '{{ os_passwd_perms.mode }}'
+  when: item.stat.exists
+  loop: "{{ minimize_access_passwd_files.results }}"

- name: change su-binary to only be accessible to user and group root
+- name: Change su-binary to only be accessible to user and group root
  file:
    dest: '/bin/su'
    owner: 'root'
@@ -49,7 +73,7 @@
    mode: '0750'
  when: '"change_user" not in os_security_users_allow'

- name: set option hidepid for proc filesystem
+- name: Set option hidepid for proc filesystem
  mount:
    path: /proc
    src: proc
@@ -1,28 +1,26 @@
 ---
- name: install modprobe to disable filesystems | os-10
+- name: Install modprobe to disable filesystems | os-10
  package:
    name: '{{ modprobe_package }}'
    state: 'present'

- name: check if efi is installed
+- name: Check if efi is installed
  stat:
    path: "/sys/firmware/efi"
  register: efi_installed

- name: remove vfat from fs-list if efi is used
+- name: Remove vfat from fs-list if efi is used
  set_fact:
    os_unused_filesystems: "{{ os_unused_filesystems | difference('vfat') }}"
  when:
    - efi_installed.stat.isdir is defined
    - efi_installed.stat.isdir

- name: remove used filesystems from fs-list
+- name: Remove used filesystems from fs-list
  set_fact:
    os_unused_filesystems: "{{ os_unused_filesystems | difference(ansible_mounts | map(attribute='fstype') | list) }}"
-  # we cannot do this on el6 and below, because these systems don't support the map function
-  when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')

- name: disable unused filesystems | os-10
+- name: Disable unused filesystems | os-10
  template:
    src: 'etc/modprobe.d/modprobe.j2'
    dest: '/etc/modprobe.d/dev-sec.conf'
@@ -10,7 +10,7 @@
 # that isn't connected to an LDAP server anymore.
 # normally caching credentials shouldn't be necessary for most machines.
 # removing it provides some more security while not removing usability.
- name: remove pam ccreds to disable password caching
+- name: Remove pam ccreds to disable password caching
  package:
    name: '{{ os_packages_pam_ccreds }}'
    state: 'absent'
@@ -19,7 +19,7 @@

 - import_tasks: pam_debian.yml
  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
+    - ansible_facts.os_family == 'Debian'

 - import_tasks: pam_rhel.yml
  when:
@@ -1,5 +1,5 @@
 ---
- name: install the package for strong password checking
+- name: Install the package for strong password checking
  apt:
    name: 'libpam-passwdqc'
    state: 'present'
@@ -7,7 +7,7 @@
  when:
    - os_auth_pam_passwdqc_enable

- name: configure passwdqc
+- name: Configure passwdqc
  template:
    src: 'usr/share/pam-configs/pam_passwdqc.j2'
    dest: '{{ passwdqc_path }}'
@@ -17,16 +17,16 @@
  when:
    - os_auth_pam_passwdqc_enable

- name: install tally2
+- name: Install tally2
  apt:
    name: 'libpam-modules'
    state: 'present'
  when:
    - os_auth_retries > 0

- name: manage tally on Debian stable
+- name: Manage tally on Debian stable
  block:
-    - name: configure tally2
+    - name: Configure tally2
      template:
        src: 'usr/share/pam-configs/pam_tally2.j2'
        dest: '{{ tally2_path }}'
@@ -36,7 +36,7 @@
      when:
        - os_auth_retries > 0

-    - name: delete tally2 when retries is 0
+    - name: Delete tally2 when retries is 0
      file:
        path: '{{ tally2_path }}'
        state: 'absent'
@@ -46,9 +46,9 @@
    - "'libpam-modules' in ansible_facts.packages"
    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '<')"

- name: manage tally/faillock on Debian unstable
+- name: Manage tally/faillock on Debian unstable
  block:
-    - name: delete tally2
+    - name: Delete tally2
      file:
        path: '{{ tally2_path }}'
        state: 'absent'
@@ -61,7 +61,7 @@
        owner: 'root'
        group: 'root'

-    - name: configure faillock
+    - name: Configure faillock
      template:
        src: 'etc/security/faillock.conf.j2'
        dest: '/etc/security/faillock.conf'
@@ -69,7 +69,7 @@
        owner: 'root'
        group: 'root'

-    - name: configure faillock pam
+    - name: Configure faillock pam
      template:
        src: 'usr/share/pam-configs/pam_faillock.j2'
        dest: '/usr/share/pam-configs/faillock'
@@ -79,7 +79,7 @@
      when:
        - os_auth_retries > 0

-    - name: configure faillock pam authfail
+    - name: Configure faillock pam authfail
      template:
        src: 'usr/share/pam-configs/pam_faillock_authfail.j2'
        dest: '/usr/share/pam-configs/faillock_authfail'
@@ -89,14 +89,14 @@
      when:
        - os_auth_retries > 0

-    - name: delete faillock when retries is 0
+    - name: Delete faillock when retries is 0
      file:
        path: '/usr/share/pam-configs/faillock'
        state: 'absent'
      when:
        - os_auth_retries == 0

-    - name: delete faillock authfail when retries is 0
+    - name: Delete faillock authfail when retries is 0
      file:
        path: '/usr/share/pam-configs/faillock_authfail'
        state: 'absent'
@@ -106,13 +106,13 @@
    - "'libpam-modules' in ansible_facts.packages"
    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '>=')"

- name: update pam on Debian systems
+- name: Update pam on Debian systems
  command: 'pam-auth-update --package'
  environment:
    DEBIAN_FRONTEND: noninteractive
  changed_when: false

- name: remove passwdqc
+- name: Remove passwdqc
  apt:
    name: 'libpam-passwdqc'
    state: 'absent'
@@ -1,12 +1,12 @@
 ---
- name: install sssd-clients
+- name: Install sssd-clients
  yum:
    name: sssd-client
    state: 'present'
  when:
    - os_auth_pam_sssd_enable | bool

- name: configure passwdqc and faillock via central system-auth config
+- name: Configure passwdqc and faillock via central system-auth config
  template:
    src: 'etc/pam.d/rhel_auth.j2'
    dest: '/etc/pam.d/system-auth-local'
@@ -14,7 +14,7 @@
    owner: 'root'
    group: 'root'

- name: enable our config for system-auth
+- name: Enable our config for system-auth
  file:
    src: /etc/pam.d/system-auth-local
    dest: /etc/pam.d/system-auth
@@ -24,7 +24,7 @@
    state: link
    force: true

- name: configure passwdqc and faillock via central password-auth config
+- name: Configure passwdqc and faillock via central password-auth config
  template:
    src: 'etc/pam.d/rhel_auth.j2'
    dest: '/etc/pam.d/password-auth-local'
@@ -32,7 +32,7 @@
    owner: 'root'
    group: 'root'

- name: enable our config for password-auth
+- name: Enable our config for password-auth
  file:
    src: /etc/pam.d/password-auth-local
    dest: /etc/pam.d/password-auth
@@ -1,5 +1,5 @@
 ---
- name: add pinerolo_profile.sh to profile.d
+- name: Add pinerolo_profile.sh to profile.d
  template:
    src: 'etc/profile.d/profile.conf.j2'
    dest: '/etc/profile.d/pinerolo_profile.sh'
@@ -8,7 +8,7 @@
    mode: '0750'
  when: not os_security_kernel_enable_core_dump | bool

- name: remove pinerolo_profile.sh from profile.d
+- name: Remove pinerolo_profile.sh from profile.d
  file:
    path: /etc/profile.d/pinerolo_profile.sh
    state: absent
@@ -5,18 +5,18 @@
  check_mode: false
  register: users_accounts

- name: delete rhosts-files from system | os-09
+- name: Delete rhosts-files from system | os-09
  file:
    dest: '~{{ item }}/.rhosts'
    state: 'absent'
  with_flattened: '{{ users_accounts.stdout_lines | default([]) }}'

- name: delete hosts.equiv from system | os-01
+- name: Delete hosts.equiv from system | os-01
  file:
    dest: '/etc/hosts.equiv'
    state: 'absent'

- name: delete .netrc-files from system | os-09
+- name: Delete .netrc-files from system | os-09
  file:
    dest: '~{{ item }}/.netrc'
    state: 'absent'
@@ -1,5 +1,5 @@
 ---
- name: create securetty
+- name: Create securetty
  template:
    src: 'etc/securetty.j2'
    dest: '/etc/securetty'
@@ -1,5 +1,5 @@
 ---
- name: configure selinux | selinux-01
+- name: Configure selinux | selinux-01
  selinux:
    policy: "{{ os_selinux_policy }}"
    state: "{{ os_selinux_state }}"
@@ -1,5 +1,5 @@
 ---
- name: remove suid/sgid bit from binaries in blacklist | os-06
+- name: Remove suid/sgid bit from binaries in blacklist | os-06
  file:
    path: '{{ item }}'
    mode: 'a-s'
@@ -10,18 +10,18 @@
    - '{{ os_security_suid_sgid_system_blacklist }}'
    - '{{ os_security_suid_sgid_blacklist }}'

- name: find binaries with suid/sgid set | os-06
+- name: Find binaries with suid/sgid set | os-06
  shell: find / -xdev \( -perm -4000 -o -perm -2000 \) -type f ! -path '/proc/*' -print 2>/dev/null
  register: sbit_binaries
  when: os_security_suid_sgid_remove_from_unknown | bool
  changed_when: false

- name: gather files from which to remove suids/sgids and remove system white-listed files | os-06
+- name: Gather files from which to remove suids/sgids and remove system white-listed files | os-06
  set_fact:
    suid: '{{ sbit_binaries.stdout_lines | difference(os_security_suid_sgid_system_whitelist) }}'
  when: os_security_suid_sgid_remove_from_unknown | bool

- name: remove suid/sgid bit from all binaries except in system and user whitelist | os-06
+- name: Remove suid/sgid bit from all binaries except in system and user whitelist | os-06
  file:
    path: '{{ item }}'
    mode: 'a-s'
@@ -1,5 +1,5 @@
 ---
- name: protect sysctl.conf
+- name: Protect sysctl.conf
  file:
    path: '/etc/sysctl.conf'
    owner: 'root'
@@ -9,16 +9,16 @@
    modification_time: preserve
    access_time: preserve

- name: set Daemon umask, do config for rhel-family | NSA 2.2.4.1
+- name: Set Daemon umask, do config for rhel-family | NSA 2.2.4.1
  template:
    src: 'etc/sysconfig/rhel_sysconfig_init.j2'
    dest: '/etc/sysconfig/init'
    owner: 'root'
    group: 'root'
    mode: '0544'
-  when: ansible_facts.distribution in ['Amazon', 'CentOS', 'Fedora', 'RedHat']
+  when: ansible_facts.os_family == 'RedHat'

- name: install initramfs-tools
+- name: Install initramfs-tools
  apt:
    name: 'initramfs-tools'
    state: 'present'
@@ -27,7 +27,7 @@
    - ansible_facts.os_family == 'Debian'
    - os_security_kernel_enable_module_loading

- name: rebuild initramfs with starting pack of modules, if module loading at runtime is disabled
+- name: Rebuild initramfs with starting pack of modules, if module loading at runtime is disabled
  template:
    src: 'etc/initramfs-tools/modules.j2'
    dest: '/etc/initramfs-tools/modules'
@@ -35,15 +35,15 @@
    group: 'root'
    mode: '0440'
  notify:
-    - update-initramfs
+    - Update-initramfs
  when:
    - ansible_facts.os_family == 'Debian'
    - os_security_kernel_enable_module_loading
  register: initramfs

- name: change sysctls
+- name: Change sysctls
  block:
-    - name: create a combined sysctl-dict if overwrites are defined
+    - name: Create a combined sysctl-dict if overwrites are defined
      set_fact:
        sysctl_config: '{{ sysctl_config | combine(sysctl_overwrite) }}'
      when: sysctl_overwrite | default()
@@ -58,7 +58,7 @@
        ignoreerrors: true
      with_dict: '{{ sysctl_config }}'

-    - name: Change various sysctl-settings on rhel6-hosts or older, look at the sysctl-vars file for documentation
+    - name: Change various sysctl-settings on Amazon Linux, look at the sysctl-vars file for documentation
      sysctl:
        name: '{{ item.key }}'
        value: '{{ item.value }}'
@@ -66,8 +66,7 @@
        reload: true
        ignoreerrors: true
      with_dict: '{{ sysctl_rhel_config }}'
-      when: ((ansible_facts.distribution in ['CentOS', 'Fedora', 'RedHat']) and
-            ansible_distribution_version|int is version('7', '<')) or ansible_facts.distribution == 'Amazon'
+      when: ansible_facts.distribution == 'Amazon'

  when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']

@@ -78,5 +77,5 @@
    mode: '0644'
  when:
    - ufw_manage_defaults
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
+    - ansible_facts.os_family == 'Debian'
  tags: ufw
@@ -1,5 +1,5 @@
 ---
- name: get UID_MIN from login.defs
+- name: Get UID_MIN from login.defs
  shell: awk '/^\s*UID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs
  args:
    removes: /etc/login.defs
@@ -7,24 +7,24 @@
  check_mode: false
  changed_when: false

- name: calculate UID_MAX from UID_MIN by substracting 1
+- name: Calculate UID_MAX from UID_MIN by substracting 1
  set_fact:
    uid_max: '{{ uid_min.stdout | int - 1 }}'
  when: uid_min.stdout|int > 0

- name: set UID_MAX on Debian-systems if no login.defs exist
+- name: Set UID_MAX on Debian-systems if no login.defs exist
  set_fact:
    uid_max: '999'
  when:
    - ansible_facts.os_family == 'Debian'
    - uid_max is not defined

- name: set UID_MAX on other systems if no login.defs exist
+- name: Set UID_MAX on other systems if no login.defs exist
  set_fact:
    uid_max: '499'
  when: uid_max is not defined

- name: get all system accounts
+- name: Get all system accounts
  command: awk -F'':'' '{ if ( $3 <= {{ uid_max|quote }} ) print $1}' /etc/passwd
  args:
    removes: /etc/passwd
@@ -32,12 +32,12 @@
  check_mode: false
  register: sys_accs

- name: remove always ignored system accounts from list
+- name: Remove always ignored system accounts from list
  set_fact:
    sys_accs_cond: '{{ sys_accs.stdout_lines | difference(os_always_ignore_users) }}'
  check_mode: false

- name: change system accounts not on the user provided ignore-list
+- name: Change system accounts not on the user provided ignore-list
  user:
    name: '{{ item }}'
    shell: '{{ os_nologin_shell_path }}'
@@ -1,5 +1,5 @@
 ---
- name: remove unused repositories
+- name: Remove unused repositories
  file:
    name: '/etc/yum.repos.d/{{ item }}.repo'
    state: 'absent'
@@ -9,7 +9,7 @@
    - 'CentOS-Vault'
  when: os_security_packages_clean | bool

- name: get yum-repository-files
+- name: Get yum-repository-files
  find:
    paths: '/etc/yum.repos.d'
    patterns: '*.repo'
@@ -18,7 +18,7 @@
 # for the 'default([])' see here:
 # https://github.com/dev-sec/ansible-os-hardening/issues/99 and
 # https://stackoverflow.com/questions/37067827/ansible-deprecation-warning-for-undefined-variable-despite-when-clause
- name: activate gpg-check for yum-repository-files
+- name: Activate gpg-check for yum-repository-files
  replace:
    path: '{{ item.path }}'
    regexp: '^\s*gpgcheck.*'
@@ -30,7 +30,7 @@
 # failed_when is needed because by default replace module will fail if the file doesn't exists.
 # status.rc is only defined if an error accrued and only error code (rc) 257 will be ignored.
 # All other errors will still be raised.
- name: activate gpg-check for config files
+- name: Activate gpg-check for config files
  replace:
    path: '{{ item }}'
    regexp: '^\s*gpgcheck\W.*'
@@ -43,7 +43,7 @@
    - '/etc/dnf/dnf.conf'
    - '/etc/yum/pluginconf.d/rhnplugin.conf'

- name: remove deprecated or insecure packages | package-01 - package-09
+- name: Remove deprecated or insecure packages | package-01 - package-09
  yum:
    name: '{{ os_security_packages_list }}'
    state: 'absent'
@@ -7,7 +7,7 @@
 # Set to yes to apply rules to support IPv6 (no means only IPv6 on loopback
 # accepted). You will need to 'disable' and then 'enable' the firewall for
 # the changes to take affect.
-IPV6={{ 'no' if sysctl_config['net.ipv6.conf.all.disable_ipv6'] is defined and sysctl_config['net.ipv6.conf.all.disable_ipv6'] == 1 else 'yes' }}
+IPV6={{ 'yes' if ufw_enable_ipv6 else 'no' }}

 # Set the default input policy to ACCEPT, DROP, or REJECT. Please note that if
 # you change this you will most likely want to adjust your rules.
@@ -114,18 +114,28 @@ PASS_WARN_AGE     7

 # Min/max values for automatic uid selection in useradd
 UID_MIN           {{ os_auth_uid_min }}
-UID_MAX           60000
+UID_MAX           {{ os_auth_uid_max }}
 # System accounts
 SYS_UID_MIN       {{ os_auth_sys_uid_min }}
 SYS_UID_MAX       {{ os_auth_sys_uid_max }}

 # Min/max values for automatic gid selection in groupadd
 GID_MIN           {{ os_auth_gid_min }}
-GID_MAX           60000
+GID_MAX           {{ os_auth_gid_max }}
 # System accounts
 SYS_GID_MIN       {{ os_auth_sys_gid_min }}
 SYS_GID_MAX       {{ os_auth_sys_gid_max }}

+# If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate user IDs)
+# allocate SUB_UID_COUNT unused user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user.
+# The default values for SUB_UID_MIN, SUB_UID_MAX, SUB_UID_COUNT are respectively 100000, 600100000 and 65536.
+SUB_UID_MIN       {{ os_auth_sub_uid_min }}
+SUB_UID_MAX       {{ os_auth_sub_uid_max }}
+SUB_UID_COUNT     {{ os_auth_sub_uid_count }}
+SUB_GID_MIN       {{ os_auth_sub_gid_min }}
+SUB_GID_MAX       {{ os_auth_sub_gid_max }}
+SUB_GID_COUNT     {{ os_auth_sub_gid_count }}
+
 # Max number of login retries if password is bad. This will most likely be overriden by PAM, since the default pam_unix module has it's own built in of 3 retries. However, this is a safe fallback in case you are using an authentication module that does not enforce PAM_MAXTRIES.
 LOGIN_RETRIES     {{ os_auth_retries }}

@@ -170,11 +180,11 @@ MD5_CRYPT_ENAB    no
 ENCRYPT_METHOD    SHA512

 # Only used if `ENCRYPT_METHOD` is set to `SHA256` or `SHA512`: Define the number of SHA rounds.
-# With a lot of rounds, it is more difficult to brute forcing the password. But note also that it more CPU resources will be needed to authenticate users.
+# With a lot of rounds brute forcing the password is more difficult. But note also that it more CPU resources will be needed to authenticate users.
 # If not specified, the libc will choose the default number of rounds (5000). The values must be inside the 1000-999999999 range. If only one of the MIN or MAX values is set, then this value will be used.
 # If MIN > MAX, the highest value will be used.
-#SHA_CRYPT_MIN_ROUNDS    5000
-#SHA_CRYPT_MAX_ROUNDS    5000
+SHA_CRYPT_MIN_ROUNDS    {{ os_sha_crypt_min_rounds }}
+SHA_CRYPT_MAX_ROUNDS    {{ os_sha_crypt_max_rounds }}


 # Obsoleted by PAM
@@ -36,9 +36,9 @@ account     required      pam_permit.so
 password    requisite     pam_pwquality.so {{ os_auth_pam_pwquality_options }}
 {% endif %}
 {# NSA 2.3.3.6 Limit Password Reuse #}
-password    requisite     pam_pwhistory.so remember=5 use_authtok
+password    requisite     pam_pwhistory.so remember={{ os_auth_pw_remember }} use_authtok
 {# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512 #}
-password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
+password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok rounds={{ os_sha_crypt_min_rounds }}
 {% if (os_auth_pam_sssd_enable | bool) %}
 password    sufficient    pam_sss.so use_authtok
 {% endif %}
@@ -19,11 +19,19 @@ os_passwd_perms:
 os_env_umask: '077'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 201
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 os_auth_pam_sssd_enable: false

@@ -15,11 +15,19 @@ os_passwd_perms:
 os_env_umask: '027'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 500
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 500
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 modprobe_package: 'kmod'
 auditd_package: 'audit'
@@ -19,11 +19,19 @@ os_passwd_perms:
 os_env_umask: '027'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 100
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 100
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 # defaults for useradd
 os_useradd_mail_dir: /var/mail
@@ -19,11 +19,19 @@ os_passwd_perms:
 os_env_umask: '027'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 201
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 os_auth_pam_sssd_enable: true

@@ -19,11 +19,19 @@ os_passwd_perms:
 os_env_umask: '077'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 201
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 os_auth_pam_sssd_enable: false

@@ -19,11 +19,19 @@ os_passwd_perms:
 os_env_umask: '077'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 201
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 os_auth_pam_sssd_enable: false

@@ -19,11 +19,19 @@ os_passwd_perms:
 os_env_umask: '077'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 201
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 os_auth_pam_sssd_enable: true

@@ -0,0 +1,45 @@
+---
+
+os_packages_pam_ccreds: 'pam_ccreds'
+os_nologin_shell_path: '/sbin/nologin'
+
+# Different distros use different standards for /etc/shadow perms, e.g.
+# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
+# You must provide key/value pairs for owner, group, and mode if overriding.
+os_shadow_perms:
+  owner: root
+  group: root
+  mode: '0000'
+
+os_passwd_perms:
+  owner: root
+  group: root
+  mode: '0644'
+
+os_env_umask: '077'
+
+os_auth_uid_min: 1000
+os_auth_uid_max: 60000
+os_auth_gid_min: 1000
+os_auth_gid_max: 60000
+os_auth_sys_uid_min: 201
+os_auth_sys_uid_max: 999
+os_auth_sys_gid_min: 201
+os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536
+
+os_auth_pam_sssd_enable: true
+
+# defaults for useradd
+os_useradd_mail_dir: /var/spool/mail
+os_useradd_create_home: true
+
+modprobe_package: 'module-init-tools'
+auditd_package: 'audit'
+
+hidepid_option: '2'  # allowed values: 0, 1, 2
@@ -19,11 +19,19 @@ os_passwd_perms:
 os_env_umask: '027'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 100
 os_auth_sys_uid_max: 499
 os_auth_sys_gid_min: 100
 os_auth_sys_gid_max: 499
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 # defaults for useradd
 os_useradd_create_home: false
@@ -15,8 +15,8 @@ Warning: This role disables root-login on the target server! Please make sure yo
 ## Role Variables

 - `network_ipv6_enable`
-  - Default: `false`
-  - Description: true if IPv6 is needed. `ssh_listen_to` must also be set to listen to IPv6 addresses (for example `[::]`).
+  - Default: `true`
+  - Description: false if IPv6 is not needed. `ssh_listen_to` must also be set to listen to IPv6 addresses (for example `[::]`).
 - `ssh_client_config_file`
  - Default: `'/etc/ssh/ssh_config'`
  - Description: path of the ssh client configuration file, e.g. `/etc/ssh/ssh_config.d/custom.conf`.
@@ -40,7 +40,10 @@ Warning: This role disables root-login on the target server! Please make sure yo
  - Description: Specifies the number of bits in the private host RSA key to create.
 - `ssh_host_key_algorithms`
  - Default: `[]`
-  - Description: Host key algorithms that the server offers. If empty the [default list](https://man.openbsd.org/sshd_config#HostKeyAlgorithms) will be used, otherwise overrides the setting with specified list of algorithms.
+  - Description: Host key algorithms that the server offers. If empty the default list will be used. Otherwise overrides the setting with specified list of algorithms. Check `man sshd_config`, `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make sure you check the correct version!
+- `ssh_client_host_key_algorithms`
+  - Default: `[]`
+  - Description: Specifies the host key algorithms that the client wants to use in order of preference. If empty the default list will be used. Otherwise overrides the setting with specified list of algorithms. Check `man ssh_config`, `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make sure you check the correct version!.
 - `ssh_client_alive_interval`
  - Default: `600`
  - Description: specifies an interval for sending keepalive messages.
@@ -58,7 +61,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
  - Description: Disable root-login. Set to `'without-password'` or `'yes'` to enable root-login - The quotes are required!
 - `ssh_allow_tcp_forwarding`
  - Default: `no`
-  - Description: `'no'` to disable TCP Forwarding. Set to `'yes'` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all'` or `'local'`. <br> _Note_: values passed to this variable must be strings, thus values `'yes'` and `'no'` should be passed with quotes.
+  - Description: `'no'` to disable TCP Forwarding. Set to `'yes'` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all'`, `'local'`or`'remote'`. <br> _Note_: values passed to this variable must be strings, thus values `'yes'`and`'no'` should be passed with quotes.
 - `ssh_gateway_ports`
  - Default: `false`
  - Description: `false` to disable binding forwarded ports to non-loopback addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified` to allow the client to specify which address to bind to.
@@ -1,6 +1,6 @@
 ---
 # true if IPv6 is needed
-network_ipv6_enable: false          # sshd + ssh
+network_ipv6_enable: true          # sshd + ssh

 # Paths of the config files
 ssh_client_config_file: /etc/ssh/ssh_config   # ssh
@@ -45,6 +45,9 @@ ssh_host_certificates: []           # sshd
 # Specifies the host key algorithms that the server offers
 ssh_host_key_algorithms: []         # sshd

+# Specifies the host key algorithms order the client will try
+ssh_client_host_key_algorithms: []  # ssh
+
 # specifies the time allowed for successful authentication to the SSH server
 ssh_login_grace_time: 30s

@@ -72,7 +75,7 @@ ssh_remote_hosts: []
 # Set this to "without-password" or "yes" to allow root to login
 ssh_permit_root_login: 'no'         # sshd

-# false to disable TCP Forwarding. Set to true to allow TCP Forwarding.
+# false to disable TCP Forwarding. Set to 'yes', 'no', 'local', 'all' or 'remote' to allow TCP Forwarding.
 ssh_allow_tcp_forwarding: 'no'      # sshd

 # false to disable binding forwarded ports to non-loopback addresses. Set to true to force binding on wildcard address.
@@ -188,7 +191,6 @@ ssh_server_accept_env_vars: ''
 # maximum number of concurrent unauthenticated connections to the SSH daemon
 ssh_max_startups: '10:30:60'       # sshd

-ssh_ps53: 'yes'
 ssh_ps59: 'sandbox'

 ssh_macs: []
@@ -1,5 +1,5 @@
 ---
- name: restart sshd
+- name: Restart sshd
  service:
    name: '{{ sshd_service_name }}'
    state: restarted
@@ -4,7 +4,7 @@ galaxy_info:
  description: 'This Ansible role provides numerous security-related ssh configurations, providing all-round base protection.'
  company: Hardening Framework Team
  license: Apache License 2.0
-  min_ansible_version: '2.5'
+  min_ansible_version: '>=2.9.10'
  platforms:
    - name: EL
      versions:
@@ -1,27 +1,27 @@
 ---
- name: set ssh CA pub keys
+- name: Set ssh CA pub keys
  template:
    src: 'trusted_user_ca_keys.j2'
    dest: '{{ ssh_trusted_user_ca_keys_file }}'
    mode: '0644'
    owner: '{{ ssh_owner }}'
    group: '{{ ssh_group }}'
-  notify: restart sshd
+  notify: Restart sshd

- name: create ssh authorized principals directories
+- name: Create ssh authorized principals directories
  file:
    path: '{{ item.path | dirname }}'
-    mode: '{{ item.directorymode | default(0700) }}'
+    mode: '{{ item.directorymode | default("700") }}'
    owner: '{{ item.directoryowner | default(ssh_owner) }}'
    group: '{{ item.directorygroup | default(ssh_group) }}'
    state: directory
  loop: '{{ ssh_authorized_principals }}'

- name: set ssh authorized principals
+- name: Set ssh authorized principals
  template:
    src: 'authorized_principals.j2'
    dest: '{{ item.path }}'
-    mode: '{{ item.filemode | default(0600) }}'
+    mode: '{{ item.filemode | default("600") }}'
    owner: '{{ item.owner| default(ssh_owner) }}'
    group: '{{ item.group | default(ssh_group) }}'
  loop: '{{ ssh_authorized_principals }}'
@@ -1,10 +1,10 @@
 ---
- name: set ciphers according to openssh-version if openssh >= 5.3
+- name: Set ciphers according to openssh-version if openssh >= 5.3
  set_fact:
    ssh_ciphers: '{{ ssh_ciphers_53_default }}'
  when: sshd_version is version('5.3', '>=')

- name: set ciphers according to openssh-version if openssh >= 6.6
+- name: Set ciphers according to openssh-version if openssh >= 6.6
  set_fact:
    ssh_ciphers: '{{ ssh_ciphers_66_default }}'
  when: sshd_version is version('6.6', '>=')
@@ -1,5 +1,5 @@
 ---
- name: replace default 2048 bits RSA keypair
+- name: Replace default 2048 bits RSA keypair
  community.crypto.openssh_keypair:
    state: present
    type: rsa
@@ -10,28 +10,28 @@

 # In RHEL and Fedora, the 'ssh_keys' group is the group owner of the host private SSH keys.
 # Since the openssh_keypair module needs to read the key to provide idempotency, we need to set ownership and group based on specific OS vars.
- name: change host private key ownership, group and permissions
+- name: Change host private key ownership, group and permissions
  file:
    path: "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
    owner: "{{ ssh_host_keys_owner }}"
    group: "{{ ssh_host_keys_group }}"
    mode: "0640"
-  when: "ansible_facts.distribution in ['CentOS', 'OracleLinux', 'RedHat']"
+  when: "ansible_facts.os_family == 'RedHat'"

- name: set hostkeys according to openssh-version if openssh >= 5.3
+- name: Set hostkeys according to openssh-version if openssh >= 5.3
  set_fact:
    ssh_host_key_files:
      - "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
  when: sshd_version is version('5.3', '>=')

- name: set hostkeys according to openssh-version if openssh >= 6.0
+- name: Set hostkeys according to openssh-version if openssh >= 6.0
  set_fact:
    ssh_host_key_files:
      - "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
      - "{{ ssh_host_keys_dir }}/ssh_host_ecdsa_key"
  when: sshd_version is version('6.0', '>=')

- name: set hostkeys according to openssh-version if openssh >= 6.3
+- name: Set hostkeys according to openssh-version if openssh >= 6.3
  set_fact:
    ssh_host_key_files:
      - "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
@@ -1,15 +1,20 @@
 ---
- name: set kex according to openssh-version if openssh >= 5.9
+- name: Set kex according to openssh-version if openssh >= 5.9
  set_fact:
    ssh_kex: '{{ ssh_kex_59_default }}'
  when: sshd_version is version('5.9', '>=')

- name: set kex according to openssh-version if openssh >= 6.6
+- name: Set kex according to openssh-version if openssh >= 6.6
  set_fact:
    ssh_kex: '{{ ssh_kex_66_default }}'
  when: sshd_version is version('6.6', '>=')

- name: set kex according to openssh-version if openssh >= 8.0
+- name: Set kex according to openssh-version if openssh >= 8.0
  set_fact:
    ssh_kex: '{{ ssh_kex_80_default }}'
  when: sshd_version is version('8.0', '>=')
+
+- name: Set kex according to openssh-version if openssh >= 8.5
+  set_fact:
+    ssh_kex: '{{ ssh_kex_85_default }}'
+  when: sshd_version is version('8.5', '>=')
@@ -1,27 +1,20 @@
 ---
- name: set macs according to openssh-version if openssh >= 5.3
+- name: Set macs according to openssh-version if openssh >= 5.3
  set_fact:
    ssh_macs: '{{ ssh_macs_53_default }}'
  when: sshd_version is version('5.3', '>=')

- name: set macs for Enterprise Linux >= 6.5 (openssh 5.3 with backports)
-  set_fact:
-    ssh_macs: '{{ ssh_macs_53_el_6_5_default }}'
-  when:
-    - ansible_facts.distribution in ['CentOS', 'OracleLinux', 'RedHat']
-    - ansible_facts.distribution_version is version('6.5', '>=')
-
- name: set macs according to openssh-version if openssh >= 5.9
+- name: Set macs according to openssh-version if openssh >= 5.9
  set_fact:
    ssh_macs: '{{ ssh_macs_59_default }}'
  when: sshd_version is version('5.9', '>=')

- name: set macs according to openssh-version if openssh >= 6.6
+- name: Set macs according to openssh-version if openssh >= 6.6
  set_fact:
    ssh_macs: '{{ ssh_macs_66_default }}'
  when: sshd_version is version('6.6', '>=')

- name: set macs according to openssh-version if openssh >= 7.6
+- name: Set macs according to openssh-version if openssh >= 7.6
  set_fact:
    ssh_macs: '{{ ssh_macs_76_default }}'
  when: sshd_version is version('7.6', '>=')
@@ -14,52 +14,53 @@

 # we only override variables with our default, if they have not been specified already
 # by default the lookup functions finds all varnames containing the string, therefore
-# we add ^ and $ to denote start and end of string, so this returns only exact maches
- name: Set OS dependent variables, if not already defined by user
+# we add ^ and $ to denote start and end of string, so this returns only exact matches
+- name: Set OS dependent variables, if not already defined by user  # noqa var-naming
  set_fact:
    '{{ item.key }}': '{{ item.value }}'
  when: "not lookup('varnames', '^' + item.key + '$')"
  with_dict: '{{ os_vars }}'
+  tags: always

- name: get openssh-version
+- name: Get openssh-version
  command: ssh -V
  register: sshd_version_raw
  changed_when: false
  check_mode: false

- name: parse openssh-version
+- name: Parse openssh-version
  set_fact:
    sshd_version: "{{ sshd_version_raw.stderr | regex_replace('.*_([0-9]*.[0-9]).*', '\\1') }}"

- name: set default for ssh_host_key_files if not supplied
+- name: Set default for ssh_host_key_files if not supplied
  include_tasks: crypto_hostkeys.yml
  when:
    - ssh_server_hardening | bool
    - not ssh_host_key_files

- name: set default for ssh_macs if not supplied
+- name: Set default for ssh_macs if not supplied
  include_tasks: crypto_macs.yml
  when: not ssh_macs

- name: set default for ssh_ciphers if not supplied
+- name: Set default for ssh_ciphers if not supplied
  include_tasks: crypto_ciphers.yml
  when: not ssh_ciphers

- name: set default for ssh_kex if not supplied
+- name: Set default for ssh_kex if not supplied
  include_tasks: crypto_kex.yml
  when: not ssh_kex

- name: create revoked_keys and set permissions to root/600
+- name: Create revoked_keys and set permissions to root/600
  template:
    src: 'revoked_keys.j2'
    dest: '/etc/ssh/revoked_keys'
    mode: '0600'
    owner: '{{ ssh_owner }}'
    group: '{{ ssh_group }}'
-  notify: restart sshd
+  notify: Restart sshd
  when: ssh_server_hardening | bool

- name: create sshd_config and set permissions to root/600
+- name: Create sshd_config and set permissions to root/600
  template:
    src: 'opensshd.conf.j2'
    dest: "{{ ssh_server_config_file }}"
@@ -67,10 +68,10 @@
    owner: '{{ ssh_owner }}'
    group: '{{ ssh_group }}'
    validate: '{{ sshd_path }} -T -C user=root -C host=localhost -C addr=localhost -C lport=22 -f %s'
-  notify: restart sshd
+  notify: Restart sshd
  when: ssh_server_hardening | bool

- name: disable dynamic MOTD
+- name: Disable dynamic MOTD
  pamd:
    name: sshd
    type: session
@@ -83,7 +84,7 @@
    - ssh_pam_support | bool
    - not (ssh_print_pam_motd | bool)

- name: create ssh_config and set permissions to root/644
+- name: Create ssh_config and set permissions to root/644
  template:
    src: 'openssh.conf.j2'
    dest: "{{ ssh_client_config_file }}"
@@ -92,36 +93,36 @@
    group: '{{ ssh_group }}'
  when: ssh_client_hardening | bool

- name: check if {{ sshd_moduli_file }} contains weak DH parameters
+- name: Check if {{ sshd_moduli_file }} contains weak DH parameters
  shell: awk '$5 < {{ sshd_moduli_minimum }}' {{ sshd_moduli_file }}
  register: sshd_register_moduli
  changed_when: false
  check_mode: false
  when: ssh_server_hardening | bool

- name: remove all small primes
+- name: Remove all small primes
  shell: awk '$5 >= {{ sshd_moduli_minimum }}' {{ sshd_moduli_file }} > {{ sshd_moduli_file }}.new ;
         [ -r {{ sshd_moduli_file }}.new -a -s {{ sshd_moduli_file }}.new ] && mv {{ sshd_moduli_file }}.new {{ sshd_moduli_file }} || true
-  notify: restart sshd
+  notify: Restart sshd
  when:
    - ssh_server_hardening | bool
    - sshd_register_moduli.stdout

- name: include tasks to setup ca keys and principals
+- name: Include tasks to setup ca keys and principals
  include_tasks: ca_keys_and_principals.yml
  when: ssh_trusted_user_ca_keys_file | length > 0

- name: include selinux specific tasks
+- name: Include selinux specific tasks
  include_tasks: selinux.yml
  when: ansible_facts.selinux and ansible_facts.selinux.status == "enabled"

- name: gather package facts
+- name: Gather package facts
  package_facts:
  check_mode: false
  when:
    - sshd_disable_crypto_policy | bool

- name: disable SSH server CRYPTO_POLICY
+- name: Disable SSH server CRYPTO_POLICY
  copy:
    src: sshd
    dest: /etc/sysconfig/sshd
@@ -1,10 +1,10 @@
 ---
- name: install selinux dependencies when selinux is installed
+- name: Install selinux dependencies when selinux is installed
  package:
    name: '{{ ssh_selinux_packages }}'
    state: present

- name: authorize {{ ssh_server_ports }} ports for selinux
+- name: Authorize {{ ssh_server_ports }} ports for selinux
  seport:
    ports: '{{ item }}'
    proto: tcp
@@ -12,7 +12,7 @@
    state: present
  loop: '{{ ssh_server_ports }}'

- name: check if ssh_password module is already installed
+- name: Check if ssh_password module is already installed
  shell: 'set -o pipefail && semodule -l | grep ssh_password'
  args:
    executable: /bin/bash
@@ -28,7 +28,7 @@
    - not (ssh_use_pam | bool)
    - ('ssh_password' not in ssh_password_module.stdout)
  block:
-    - name: create selinux custom policy drop folder
+    - name: Create selinux custom policy drop folder
      file:
        path: '{{ ssh_custom_selinux_dir }}'
        state: 'directory'
@@ -36,7 +36,7 @@
        group: 'root'
        mode: '0750'

-    - name: distributing custom selinux policies
+    - name: Distributing custom selinux policies
      copy:
        src: 'ssh_password'
        dest: '{{ ssh_custom_selinux_dir }}'
@@ -44,20 +44,20 @@
        group: 'root'
        mode: '0600'

-    - name: check and compile policy
+    - name: Check and compile policy
      command: checkmodule -M -m -o {{ ssh_custom_selinux_dir }}/ssh_password.mod {{ ssh_custom_selinux_dir }}/ssh_password

-    - name: create selinux policy module package
+    - name: Create selinux policy module package
      command: semodule_package -o {{ ssh_custom_selinux_dir }}/ssh_password.pp  -m {{ ssh_custom_selinux_dir }}/ssh_password.mod

-    - name: install selinux policy
+    - name: Install selinux policy
      command: semodule -i {{ ssh_custom_selinux_dir }}/ssh_password.pp


 # The following tasks only get executed when selinux is installed, UsePam is
 # 'yes' and the ssh_password module is installed. See
 # http://danwalsh.livejournal.com/12333.html for more info
- name: remove selinux-policy when Pam is used, because Allowing sshd to read the shadow file directly is considered a potential security risk
+- name: Remove selinux-policy when Pam is used, because Allowing sshd to read the shadow file directly is considered a potential security risk
  command: semodule -r ssh_password
  when:
    - ssh_use_pam | bool
@@ -81,6 +81,9 @@ StrictHostKeyChecking ask
 {# This outputs 'KexAlgorithms <list-of-algos>' if ssh_kex is defined or '#KexAlgorithms' if ssh_kex is undefined #}
 {{ 'KexAlgorithms ' ~ ssh_kex|join(',') if ssh_kex else 'KexAlgorithms'|comment }}

+# Specifies the host key algorithms that the client wants to use in order of preference.
+{{ "HostKeyAlgorithms " ~ ssh_client_host_key_algorithms|join(',') if ssh_client_host_key_algorithms else "HostKeyAlgorithms"|comment }}
+
 {% if sshd_version is version('5.9', '<') %}
 # Alternative setting, if OpenSSH version is below v5.9
 #MACs hmac-ripemd160
@@ -103,11 +103,7 @@ LogLevel {{ sshd_log_level }}
 UseLogin no
 {% endif %}
 {% if sshd_version is version('7.5', '<') %}
-UsePrivilegeSeparation {{
-  (ansible_facts.distribution == 'Debian' and ansible_facts.distribution_major_version <= '6')
-  or (ansible_facts.os_family in ['Oracle Linux', 'RedHat'] and ansible_facts.distribution_major_version <= '6' and not ansible_facts.distribution == 'Amazon')
-  | ternary(ssh_ps53, ssh_ps59)
-}}
+UsePrivilegeSeparation {{ ssh_ps59 }}
 {% endif %}

 LoginGraceTime {{ ssh_login_grace_time }}
@@ -198,7 +194,7 @@ PermitTunnel {{ 'yes' if (ssh_permit_tunnel|bool) else 'no' }}
 # Disable forwarding tcp connections.
 # no real advantage without denied shell access
 {% if sshd_version is version('6.2', '>=') %}
-AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no', 'local', 'all')) else 'no' }}
+AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no', 'local', 'all', 'remote')) else 'no' }}
 {% else %}
 AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no')) else 'no' }}
 {% endif %}
@@ -0,0 +1,23 @@
+---
+sshd_path: /usr/sbin/sshd
+ssh_host_keys_dir: '/etc/ssh'
+sshd_service_name: sshd
+ssh_owner: root
+ssh_group: root
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'ssh_keys'
+ssh_selinux_packages:
+  - python3-policycoreutils
+  - checkpolicy
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: '/etc/ssh/moduli'
+
+# disable CRYPTO_POLICY to take settings from sshd configuration
+# see: https://access.redhat.com/solutions/4410591
+sshd_disable_crypto_policy: true
@@ -3,10 +3,6 @@ ssh_macs_53_default:
  - hmac-ripemd160
  - hmac-sha1

-ssh_macs_53_el_6_5_default:
-  - hmac-sha2-512
-  - hmac-sha2-256
-
 ssh_macs_59_default:
  - hmac-sha2-512
  - hmac-sha2-256
@@ -50,3 +46,8 @@ ssh_kex_80_default:
  - [email protected]
  - [email protected]
  - diffie-hellman-group-exchange-sha256
+
+ssh_kex_85_default:
+  - [email protected]
+  - [email protected]
+  - diffie-hellman-group-exchange-sha256
Author	SHA1	Message	Date
Claudius Heine	384c097f8a	feat(os_hardening): extend file permission tasks to cover more files (#489 ) The tasks `Change shadow ownership to root and mode to 0600` and `Change passwd ownership to root and mode to 0644` only handle `/etc/shadow` and `/etc/passwd` respectively. But there multiple adjacent files that should be handled with these rules as well: - `/etc/gshadow` - `/etc/shadow-` - `/etc/gshadow-` - `/etc/group` - `/etc/shadow-` - `/etc/group-` This change adds those files to the rules, so that permissions are handled in the same way. Closes: #488 Signed-off-by: Claudius Heine <[email protected]>	2021-10-21 09:51:20 +02:00
dev-sec CI	999e5fa210	update changelog	2021-10-18 19:14:34 +00:00
schurzi	215c8042ad	Merge pull request #490 from dev-sec/change_baseline_urlsa change baseline urls to full zip-url	2021-10-18 21:04:05 +02:00
dev-sec CI	21ca7c533a	update changelog	2021-10-18 18:57:06 +00:00
Sina Tak TehraniandSebastian Gumprich	5debcc0c6f	fix filter error in ansible.builtin.file mode parameter (#486 ) * fix filter error in ansible.builtin.file mode parameter * Change cinc supermarket * fix link to baseline * fix typo Co-authored-by: Sebastian Gumprich <[email protected]>	2021-10-18 20:55:24 +02:00
rndmh3ro	92bd94a0cf	change baseline urls to full zip-url the other urls that use git don't work anymore Signed-off-by: rndmh3ro <[email protected]>	2021-10-18 20:28:19 +02:00
dev-sec CI	aea4499805	update galaxy.yml with new version	2021-10-15 13:46:33 +00:00
dev-sec CI	29945527b8	update changelog	2021-08-30 13:47:56 +00:00
ReinerNippes	e819f89ccb	ssh_allow_tcp_forwarding is not a boolean (#480 ) Changed the comment to "Set to 'yes', 'no', 'local', 'all' or 'remote' to allow TCP Forwarding"	2021-08-30 15:46:03 +02:00
dev-sec CI	fcb7efc156	update changelog	2021-08-28 13:23:49 +00:00
Roger Meier	8fdb4e55b8	chore(ssh_hardening): set min_ansible_version to >=2.9.10 (#479 )	2021-08-28 15:21:59 +02:00
rndmh3ro	8ff3d73bbf	Prettified Code!	2021-08-25 10:58:16 +00:00
123quhiwiwk	062dd3f092	Use log_error/datadir from database settings instead of default variable (#478 ) Signed-off-by: 123quhiwiwk <[email protected]>	2021-08-25 12:57:46 +02:00
dev-sec CI	37cff01759	update changelog	2021-08-24 07:43:35 +00:00
123quhiwiwk	4671a32062	Execute check of error logfile permissions only when log_error is defined (#477 ) Signed-off-by: 123quhiwiwk <[email protected]>	2021-08-24 09:41:55 +02:00
dev-sec CI	78bab3f710	update changelog	2021-08-20 11:02:03 +00:00
Shawn Wilsher	3b33e0a7aa	[mysql_hardening] Setup defaults for MySQL on FreeBSD (#474 ) Signed-off-by: Shawn Wilsher <[email protected]>	2021-08-20 13:00:12 +02:00
dev-sec CI	2ed9d8e9da	update galaxy.yml with new version	2021-08-17 11:29:25 +00:00
dev-sec CI	df134e6385	update changelog	2021-08-15 20:55:27 +00:00
schurzi	d7eb00f4b7	Merge pull request #475 from dev-sec/ansible_lint use Ansible lint in separate task	2021-08-15 22:53:41 +02:00
rndmh3ro	7b37e9890e	rename ansible-lint task Signed-off-by: rndmh3ro <[email protected]>	2021-08-15 20:16:56 +02:00
rndmh3ro	cf17f80374	skip linting on special task Signed-off-by: rndmh3ro <[email protected]>	2021-08-15 20:16:56 +02:00
rndmh3ro	6fa7f7a0c8	add new linting action to replace molecules linting molecule lints multiple times per action Signed-off-by: rndmh3ro <[email protected]>	2021-08-15 20:16:56 +02:00
rndmh3ro	6c80de270b	remove molecule linting, because it has own action now Signed-off-by: rndmh3ro <[email protected]>	2021-08-15 20:16:56 +02:00
dev-sec CI	e20dd076d1	update changelog	2021-08-15 18:04:40 +00:00
Shawn WilsherandSebastian Gumprich	9ab06a5e06	[mysql_hardening] Allow setting the mysql_distribution (#473 ) * [mysql_hardening] Allow setting the mysql_distribution On some operating systems, the package for MySQL is not `mysql-server`, and so the default check for this will not yield the correct result. This change adds an escape hatch by letting the user set `mysql_distribution`. Additionally, it verifies that it is set to a legal value if the user has set it. Closes #472 Signed-off-by: Shawn Wilsher <[email protected]> * Update roles/mysql_hardening/tasks/main.yml Co-authored-by: Sebastian Gumprich <[email protected]>	2021-08-15 20:03:07 +02:00
dev-sec CI	bfd3f96355	update changelog	2021-08-06 11:42:51 +00:00
Filippo Tessarotto	3a73f6c46a	SSH Hardening: backtick typo (#471 )	2021-08-06 13:41:05 +02:00
dev-sec CI	4162929d2e	update changelog	2021-08-06 11:10:37 +00:00
Sebastian Gumprich	545fd8798f	Create LICENSE	2021-08-06 13:08:55 +02:00
dev-sec CI	3bd5eccec0	update changelog	2021-07-23 10:06:49 +00:00
schurzi	430e6c366f	Merge pull request #469 from dev-sec/rndmh3ro-patch-1 fix license in galaxy	2021-07-23 12:04:59 +02:00
schurzi	b24ee631cb	fix double space	2021-07-23 12:04:45 +02:00
Sebastian Gumprich	681047ba52	fix readme in galaxy	2021-07-23 11:06:22 +02:00
dev-sec CI	96685ff0ac	update galaxy.yml with new version	2021-07-22 14:41:26 +00:00
dev-sec CI	93ed95fe90	update changelog	2021-07-22 14:34:58 +00:00
Paweł Krawczyk	66bd1f0aec	Add CVE-2021-33909 mitigations (#466 ) * Add CVE-2021-33909 mitigations kernel.unprivileged_bpf_disabled: 1 kernel.unprivileged_userns_clone: 0 The first one is also used by Tails. Signed-off-by: Paweł Krawczyk <[email protected]> * Clean up whitespaces Signed-off-by: Paweł Krawczyk <[email protected]>	2021-07-22 16:32:41 +02:00
dev-sec CI	327b1a84c8	update changelog	2021-07-22 08:20:09 +00:00
Maik Stübner	714a34fa55	Allow configuration of password remember in pam (#467 ) * Add Configuration of password remember and set default to 60 see Telekom 2021.07-01 SoC 3.01 Req 25 and SoC 3.65 Req46 Signed-off-by: Maik Stuebner <[email protected]> * set default for password remember back to 5 Signed-off-by: Maik Stuebner <[email protected]> * readme default for password remember back to 5 Signed-off-by: Maik Stuebner <[email protected]>	2021-07-22 10:18:01 +02:00
dev-sec CI	488441a7dc	update changelog	2021-07-16 07:43:08 +00:00
Leo Gallucci	585f1dc227	Add SUB_UID_MIN/MAX/COUNT, SUB_GID_MIN/MAX/COUNT (#463 ) * add SUB_UID_MIN/MAX/COUNT, SUB_GID_MIN/MAX/COUNT Similar reason as #461 > If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate user IDs) > allocate SUB_UID_COUNT unused user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user. > The default values for SUB_UID_MIN, SUB_UID_MAX, SUB_UID_COUNT are respectively 100000, 600100000 and 65536. Signed-off-by: Leo Gallucci <[email protected]> * document SUB_UID_MIN/MAX/COUNT, etc Signed-off-by: Leo Gallucci <[email protected]>	2021-07-16 09:41:37 +02:00
dev-sec CI	2c5cf45573	update changelog	2021-07-13 14:09:08 +00:00
schurzi	5618655ce5	Merge pull request #465 from dev-sec/rndmh3ro-patch-1 update metadata to include community.mysql deps	2021-07-13 16:07:27 +02:00
Sebastian Gumprich	da50f20860	update metadata to include community.mysql deps	2021-07-13 14:08:27 +02:00
dev-sec CI	c87ac4425c	update changelog	2021-07-12 13:33:37 +00:00
Leo Gallucci	f92d193d3d	add os_auth_uid_max, os_auth_gid_max (#461 ) Signed-off-by: Leo Gallucci <[email protected]>	2021-07-12 15:32:02 +02:00
dev-sec CI	a075af2f31	update galaxy.yml with new version	2021-07-08 11:35:18 +00:00
dev-sec CI	50f362602f	update changelog	2021-07-01 09:26:58 +00:00
蚯蚓	27c6b93d04	add "when" statements in hardening.yml(#453 ) (#455 ) * add "when" statements in hardening.yml(#453) Signed-off-by: jqiuyin <[email protected]> * add "when" statements in hardening.yml(#453) Signed-off-by: jqiuyin <[email protected]> * add "when" statements in hardening.yml(#453) Signed-off-by: jqiuyin <[email protected]>	2021-07-01 11:25:14 +02:00
dev-sec CI	e733906aec	update changelog	2021-06-30 11:24:37 +00:00
Sebastian Gumprich	4ca4f09453	Cleanup old OS-support and simplify vars (#458 ) * use os_family instead of distribution for debian systems Signed-off-by: rndmh3ro <[email protected]> * remove tasks related to rhel6 or debian 6 Signed-off-by: rndmh3ro <[email protected]>	2021-06-30 13:09:46 +02:00
Sebastian Gumprich	72ec118a6d	add rocky linux 8 tests and make sure that all relevant tasks are execd (#457 ) * add rocky linux 8 tests and make sure that all relevant tasks are executed Signed-off-by: rndmh3ro <[email protected]> * fix missing quote Signed-off-by: rndmh3ro <[email protected]>	2021-06-30 13:09:12 +02:00
dev-sec CI	2a43ad9cc6	update changelog	2021-06-30 09:06:30 +00:00
Sebastian Gumprichandschurzi	9cefddd949	make sha rounds configurable and increase no of rounds (#452 ) * make sha rounds configurable and increase no of rounds Fixes #365 Signed-off-by: rndmh3ro <[email protected]> * Prettified Code! * make password rounds configurable in pam system-auth Signed-off-by: rndmh3ro <[email protected]> * change wording of sha rounds documentation Co-authored-by: schurzi <[email protected]> Co-authored-by: schurzi <[email protected]>	2021-06-30 10:41:59 +02:00
dev-sec CI	c769db4221	update changelog	2021-06-30 08:13:51 +00:00
Sherwin Daganato	350b5891d1	Add support for Rocky Linux 8 (#454 ) Signed-off-by: Sherwin Daganato <[email protected]>	2021-06-30 10:12:07 +02:00
dev-sec CI	d6cd67d908	update changelog	2021-06-29 11:10:34 +00:00
schurzi	29e10e5c3b	add tag always to os dependent vars task (#456 ) when our collection is used with tags, the os dependent variables are not resolved. This task should run every time, so the behaviour is correct. Signed-off-by: Martin Schurz <[email protected]>	2021-06-29 13:07:25 +02:00
dev-sec CI	d72db6037c	update changelog	2021-06-23 09:29:55 +00:00
Colin Adler	8cbeeff501	Use `include_tasks` for os_hardening/main.yml (#451 ) When `import_tasks` is used, the task `Fetch OS dependent variables` always runs, even when excluded by an upstream tag. When `Fetch OS dependent variables` runs while excluded via tags, it will always fail with the following. ``` fatal: [alpha]: FAILED! => {"msg": "No file was found when using first_found. Use errors='ignore' to allow this task to be skipped if no files are found"} ``` This brings os_hardening's main.yml in line with ssh_hardening's main.yml, which doesn't have this issue. Signed-off-by: Colin Adler <[email protected]>	2021-06-23 11:28:08 +02:00
dev-sec CI	cf6b6e6562	update changelog	2021-05-26 18:15:40 +00:00
Sebastian Gumprich	41cd8485cb	enable ipv6 globally (#450 ) Signed-off-by: Sebastian Gumprich <[email protected]>	2021-05-26 20:13:45 +02:00
dev-sec CI	be2523e5fb	update galaxy.yml with new version	2021-05-24 20:16:19 +00:00
dev-sec CI	c4ba0763ae	update changelog	2021-05-24 19:14:00 +00:00
schurzi	2597854735	Merge pull request #449 from lduesing/enable_ipv6 Removed sysctl that tries to disable IPv6	2021-05-24 21:12:14 +02:00
Lars Düsing	0beeb3ee03	Removed sysctl that tries to disable IPv6. #416 Signed-off-by: Lars Düsing <[email protected]>	2021-05-24 13:33:38 +02:00
dev-sec CI	735c905f71	update changelog	2021-05-05 21:02:55 +00:00
schurzi	eb28ebe298	Merge pull request #448 from dev-sec/limit_labels limit changelog labels to role names	2021-05-05 23:01:12 +02:00
Martin Schurz	8dbeae7b39	limit changelog labels to role names Signed-off-by: Martin Schurz <[email protected]>	2021-05-05 22:53:20 +02:00
dev-sec CI	0ce08455ef	update changelog	2021-05-05 19:08:21 +00:00
schurzi	66b0fa28e5	Merge pull request #446 from rndmh3ro/fixing add back labels to changelog	2021-05-05 21:06:41 +02:00
rndmh3ro	07a0943c5a	Prettified Code!	2021-04-30 12:50:12 +00:00
alimliandHaldun ALIMLI	4f42e0d396	ssh_allow_tcp_forwarding remote option added (#447 ) Signed-off-by: Haldun ALIMLI <[email protected]> Co-authored-by: Haldun ALIMLI <[email protected]>	2021-04-30 14:49:42 +02:00
Sebastian Gumprich	45711874e6	test release workflow with labels Signed-off-by: Sebastian Gumprich <[email protected]>	2021-04-29 07:46:06 +02:00
dev-sec CI	e9f23f0eac	update changelog	2021-04-28 08:37:30 +00:00
Iain R. LearmonthandSebastian Gumprich	93c489d3b2	Adds dependency on ansible.posix and community.general (#415 ) * galaxy.yml: Adds dependency on ansible.posix (Fixes: #414) This is required by the OS hardening role, which uses the mount module. * add community.general dependency Co-authored-by: Sebastian Gumprich <[email protected]>	2021-04-28 10:35:46 +02:00
dev-sec CI	180acf9540	update changelog	2021-04-28 07:53:52 +00:00
Martin NeubertandSebastian Gumprich	0324273dce	Check for MariaDB Version when selecting users without passwords (#444 ) * added version check for MariaDB in Query MariaDB Uses the authentication_string field since 10.4.0, added this in version check in query for users to delete Signed-off-by: Martin Neubert <[email protected]> * Update roles/mysql_hardening/tasks/mysql_secure_installation.yml Co-authored-by: Sebastian Gumprich <[email protected]> * Update roles/mysql_hardening/tasks/mysql_secure_installation.yml Co-authored-by: Sebastian Gumprich <[email protected]> Co-authored-by: Sebastian Gumprich <[email protected]>	2021-04-28 09:52:09 +02:00
dev-sec CI	22f1802d97	update galaxy.yml with new version	2021-04-27 19:27:03 +00:00
dev-sec CI	f9945c41de	update changelog	2021-04-27 19:18:34 +00:00
Martin Neubert	284943b699	USER and HOST should be quoted (#443 ) USER and HOST should be quoted to avoid errors in drop user statement Signed-off-by: Martin Neubert <[email protected]>	2021-04-27 21:16:50 +02:00
Paul Seidler	b12ee4d23b	ssh: Client HostKeyAlgorithms configuration variable (#442 ) * ssh: Client HostKeyAlgorithms configuration variable Introduce a new variable ssh_client_host_key_algorithms to be able to configure it for the client like for the server. This fixes #441 Signed-off-by: Paul Seidler <[email protected]> * sshd: Adapt the ssh_host_key_algorithms description Linking to the latest version may lead to a broken config so be a bit more dynamic Signed-off-by: Paul Seidler <[email protected]>	2021-04-23 15:54:30 +02:00
dev-sec CI	0f30ebf753	update changelog	2021-04-09 06:17:17 +00:00
Sina Tak Tehrani	4313d6fbfb	fixed a typo in comments (#439 ) Signed-off-by: Sina Tak Tehrani <[email protected]>	2021-04-09 08:15:11 +02:00
dev-sec CI	45f15aa08b	update galaxy.yml with new version	2021-04-01 20:15:31 +00:00
dev-sec CI	07c2931f1d	update changelog	2021-04-01 20:07:17 +00:00
schurzi	6e24797d2f	Merge pull request #423 from dev-sec/drop_users_wo_passwords add new tasks to delete mysql users without passwords	2021-04-01 22:04:59 +02:00
Sebastian Gumprich	8c89d78f44	move jmespath installation into github workflow Signed-off-by: Sebastian Gumprich <[email protected]>	2021-04-01 21:16:04 +02:00
Sebastian Gumprich	d6a99c995e	use fqcn for mysql tasks Signed-off-by: Sebastian Gumprich <[email protected]>	2021-04-01 21:16:04 +02:00
Sebastian Gumprich	5ed100b7ea	try to install jmespath on github host Signed-off-by: Sebastian Gumprich <[email protected]>	2021-04-01 21:16:04 +02:00
Sebastian Gumprich	c6febf3249	fix linting Signed-off-by: Sebastian Gumprich <[email protected]>	2021-04-01 21:16:04 +02:00
Sebastian Gumprich	7d68c6036c	use single ansible fact to delete user Signed-off-by: Sebastian Gumprich <[email protected]>	2021-04-01 21:16:04 +02:00
Sebastian Gumprich	d4a4faa16d	fix syntax of mysql queries Signed-off-by: Sebastian Gumprich <[email protected]>	2021-04-01 21:16:04 +02:00
Sebastian Gumprich	e1f0efb220	move mysql install to prepare step to create a password-less user Signed-off-by: Sebastian Gumprich <[email protected]>	2021-04-01 21:16:04 +02:00
Sebastian Gumprich	73cdd973d7	remove custom tests as we have inspec tests Signed-off-by: Sebastian Gumprich <[email protected]>	2021-04-01 21:16:04 +02:00
Sebastian Gumprich	5e7a0a60f1	fix linting Signed-off-by: Sebastian Gumprich <[email protected]>	2021-04-01 21:16:04 +02:00
Sebastian Gumprich	c3b954a2ab	add new tasks to delete users without passwords Signed-off-by: Sebastian Gumprich <[email protected]>	2021-04-01 21:16:04 +02:00
schurzi	add303f2be	Merge pull request #437 from BenjaminBoehm/bugfix/ssh-kex-sntrup-openssh8.5 Fix ssh kex [email protected] for openssh >= 8.5	2021-04-01 21:13:50 +02:00
dev-sec CI	03a0f26917	update changelog	2021-04-01 19:09:51 +00:00
schurzi	fdadb78080	Merge pull request #438 from dev-sec/remove_depracted_secure-auth remove secure-auth param if mysql >= 8.0.3	2021-04-01 21:07:04 +02:00
Sebastian Gumprich	2fb54bd224	remove secure-auth param if mysql => 8.0.3 Signed-off-by: Sebastian Gumprich <[email protected]> install collection in molecule Signed-off-by: Sebastian Gumprich <[email protected]> remove deprecated ubuntu 16.04 from tests Signed-off-by: Sebastian Gumprich <[email protected]>	2021-04-01 13:20:58 +02:00
Benjamin	29ee683069	Fix ssh kex [email protected] for openssh >= 8.5 fix #433 Signed-off-by: Benjamin <[email protected]> Signed-off-by: Benjamin Boehm <[email protected]>	2021-04-01 02:08:24 +02:00
dev-sec CI	d758fa5184	update changelog	2021-03-29 19:28:04 +00:00
schurzi	2882a15ee1	Merge pull request #427 from dev-sec/snoopotic-fix/add_auditd_restart_handler add restart-auditd handler after configuration change	2021-03-29 21:15:46 +02:00
Sebastian Gumprich	458dfa2b6a	use cinc exec supermarket instead of github Signed-off-by: Sebastian Gumprich <[email protected]>	2021-03-29 16:16:03 +02:00
Sebastian Gumprich	812c6c5974	skip auditd restart in molecule tests Signed-off-by: Sebastian Gumprich <[email protected]>	2021-03-29 10:00:15 +02:00
Sebastian Gumprich	ae68f73965	skip auditd restart in molecule tests Signed-off-by: Sebastian Gumprich <[email protected]>	2021-03-29 09:29:37 +02:00
dev-sec CI	d1d12ca6d7	update changelog	2021-03-25 12:55:51 +00:00
Farid Joubbi	7af432e1cf	Uppercased first letter of task names. (#422 ) Signed-off-by: Farid Joubbi <[email protected]>	2021-03-25 13:52:56 +01:00
dev-sec CI	2dac5e3289	update changelog	2021-03-24 13:34:39 +00:00
Farid Joubbi	c90bbd2c23	Improved comments. (#436 ) Signed-off-by: Farid Joubbi <[email protected]>	2021-03-24 14:31:58 +01:00
dev-sec CI	aec1f5dcb7	update changelog	2021-03-24 06:57:54 +00:00
Farid Joubbi	d1143a06b1	Not accepting source routing for IPv6. This was already done for IPv4. (#424 ) Signed-off-by: Farid Joubbi <[email protected]>	2021-03-24 07:55:29 +01:00
dev-sec CI	dfa89f7b47	update changelog	2021-03-23 21:04:30 +00:00
schurzi	0f424469be	Merge pull request #432 from joubbi/authtok_type os_auth_pam_pwquality_options: Changed type to authtok_type	2021-03-23 22:01:40 +01:00
Farid Joubbi	240d8acc0c	Changed os_auth_pam_pwquality_options type to authtok_type. Signed-off-by: Farid Joubbi <[email protected]>	2021-03-23 11:16:05 +01:00
dev-sec CI	5eae12005a	update galaxy.yml with new version	2021-03-23 09:09:20 +00:00
dev-sec CI	84d7bb5f5f	update changelog	2021-03-23 09:01:35 +00:00
Sebastian Gumprich	390f7ad6cc	fix linting Signed-off-by: Sebastian Gumprich <[email protected]>	2021-03-19 14:46:42 +01:00
Felix Herzog	eca93cc80b	add restart-auditd handler as after configuration change (e.g. of os_auditd_max_log_file_action) you need to restart. Sadly on rhel7 systems you cannot use systemd. And as debian derivates use service as alias and it works I kept it that simple. also adding 'auditd'-tag to make it easy only run that config change if needed. Signed-off-by: Felix Herzog <[email protected]>	2021-03-19 14:42:31 +01:00