Merge pull request #739 from dev-sec/restruct_vars

restructure readme to move known problems up top
2024-01-15 14:51:08 +01:00 · 2024-01-12 09:30:48 +01:00 · 2023-12-22 09:56:52 +00:00 · 2023-12-22 10:54:13 +01:00 · 2023-12-12 00:11:54 +00:00 · 2023-12-12 00:09:03 +00:00
197 changed files with 8561 additions and 2427 deletions
@@ -0,0 +1,50 @@
 output_template: |
  <!-- BEGIN_ANSIBLE_DOCS -->
  ## Supported Operating Systems
  {%- for platform in metadata.galaxy_info.platforms %}
  - {{ platform.name }}
    {%- if "versions" in platform %}
    - {{ platform.versions | default([]) | join(', ') }}
    {%- endif %}
  {%- endfor %}
  ## Role Variables
  {% for entrypoint in argument_specs.keys() %}
  {%- set path, options=entrypoint_options[entrypoint][0] -%}
  {%- for name, details in options.items() |sort() %}
  - `{{ name }}`
    - Default: `{{ details.display_default }}`
    - Description: {{ details.display_description }}
    - Type: {{ details.display_type }}
    - Required: {{ details.display_required }}
    {%- if details.choices %}
    - Choices:
      {%- for choice in details.choices %}
      - {{ choice }}
      {%- endfor %}
    {%- endif %}
  {%- endfor %}
  {%- endfor %}
  ## Dependencies
  {%- if ("dependencies" in metadata) and (metadata.dependencies | length > 0) %}
  {%- for dependency in metadata.dependencies %}
  - {{ dependency }}
  {%- endfor %}
  {%- else %}
  None.
  {%- endif %}
  ## Example Playbook
  ```
  - hosts: all
    roles:
      - name: {{ role }}
  ```
  <!-- END_ANSIBLE_DOCS -->
@@ -0,0 +1,21 @@
 ---
 # .ansible-lint
 # exclude_paths included in this file are parsed relative to this file's location
 # and not relative to the CWD of execution. CLI arguments passed to the --exclude
 # option will be parsed relative to the CWD of execution.
 exclude_paths:
  - .cache/ # implicit unless exclude_paths is defined in config
  # add all waivers individually, since exclude_files does not support globs
  - molecule/os_hardening/waivers.yaml
  - molecule/ssh_hardening_bsd/waivers_freebsd12.yaml
  - molecule/ssh_hardening_bsd/waivers_freebsd13.yaml
  - molecule/ssh_hardening_bsd/waivers_freebsd14.yaml
  - molecule/ssh_hardening_bsd/waivers_openbsd7.yaml
 mock_roles:
  - geerlingguy.git
  - nginxinc.nginx
 skip_list:
  - var-naming[no-role-prefix]
  - meta-runtime[unsupported-version]
@@ -1,49 +0,0 @@
 ---
 name: Bug report
 about: Create a report to help us improve
 ---
 **Describe the bug**
 A clear and concise description of what the bug is.
 **Expected behavior**
 A clear and concise description of what you expected to happen.
 **Actual behavior**
 <!--- Paste verbatim command output between quotes -->
 ```paste below
 ```
 **Example Playbook**
 <!--- Paste an example playbook that can be used to reproduce the problem between quotes -->
 ```paste below
 ```
 **OS / Environment**
 <!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
 **Ansible Version**
 <!--- Paste verbatim output from "ansible --version" between quotes -->
 ```paste below
 ```
 **Role Version**
 <!--- Paste version of the role between quotes -->
 ```paste below
 ```
 **Additional context**
 Add any other context about the problem here.
@@ -0,0 +1,97 @@
 ---
 # reference: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests
 name: "Bug report"
 description: "Create a report to help us improve."
 labels: [
  "bug"
 ]
 body:
  - type: markdown
    attributes:
      value: |
        Reporting Bugs ld follow some simple rules:
        - **Check**, if you can find similar bugs
        - **Describe** what is happening and what should happen
        - **Explain** how to reproduce the problem
        - **Add** more details and attachments
        - **Follow up**, if somebody is having questions or needs more details
  - type: textarea
    id: description
    attributes:
      label: "Description"
      description: Describe the bug
      placeholder: A clear and concise description of what the bug is.
    validations:
      required: true
  - type: textarea
    id: reprod
    attributes:
      label: "Reproduction steps"
      render: Shell
      description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, no need for backticks.
      value: |
        ...
    validations:
      required: true
  - type: textarea
    id: currentbehavior
    attributes:
      label: "Current Behavior"
      description: Please describe the results you received
      value: |
        ...
    validations:
      required: true
  - type: textarea
    id: expectedbehavior
    attributes:
      label: "Expected Behavior"
      description: Please describe the results you expect
      value: |
        ...
    validations:
      required: true
  - type: textarea
    id: os
    attributes:
      label: "OS / Environment"
      value: |
        Provide all relevant information below, e.g. target OS versions, network device firmware, etc.
    validations:
      required: true
  - type: textarea
    id: ansible
    attributes:
      label: "Ansible Version"
      render: Shell
      value: |
        Paste verbatim output from "ansible --version" between quotes. This will be automatically formatted into code, so no need for backticks.
    validations:
      required: true
  - type: textarea
    id: collection
    attributes:
      label: "Collection Version"
      render: Shell
      value: |
        Paste version of the collection. This will be automatically formatted into code, so no need for backticks.
    validations:
      required: true
  - type: textarea
    id: additional
    attributes:
      label: "Additional information"
      description: Please add information like the used software versions, outputs of logs, OS information, screenshots, etc. to enhance the report
      value: |
        ...
    validations:
      required: false
@@ -1,16 +0,0 @@
 ---
 name: Feature request
 about: Suggest an idea for this project
 ---
 **Is your feature request related to a problem? Please describe.**
 A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
 **Describe the solution you'd like**
 A clear and concise description of what you want to happen.
 **Describe alternatives you've considered**
 A clear and concise description of any alternative solutions or features you've considered.
 **Additional context**
 Add any other context or screenshots about the feature request here.
@@ -0,0 +1,55 @@
 ---
 # reference: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests
 name: "Feature request"
 description: "Suggest an idea for this project."
 labels: [
  "enhancement"
 ]
 body:
  - type: markdown
    attributes:
      value: |
        Requesting a new feature or enhancement is following some simple rules:
        - **Check**, if the feature is already requested
        - **Describe** what your feature will bring to the community
        - **Explain** the criteria to fulfill the request
        - **Add** more details like mock ups, attachments, lists, screenshots
        - **Follow Up** in the discussion to the feature
  - type: textarea
    id: description
    attributes:
      label: "Description"
      description: Is your feature request related to a problem? Please describe.
      placeholder: A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
    validations:
      required: true
  - type: textarea
    id: solution
    attributes:
      label: "Solution"
      description: Describe the solution you'd like
      placeholder: A clear and concise description of what you want to happen.
    validations:
      required: false
  - type: textarea
    id: alternatives
    attributes:
      label: "Alternatives"
      description: Describe alternatives you've considered
      placeholder: A clear and concise description of any alternative solutions or features you've considered.
    validations:
      required: false
  - type: textarea
    id: additional
    attributes:
      label: "Additional information"
      description: Add any other context or screenshots about the feature request here.
      value: |
        ...
    validations:
      required: false
@@ -1,11 +0,0 @@
 # To get started with Dependabot version updates, you'll need to specify which
 # package ecosystems to update and where the package manifests are located.
 # Please see the documentation for all configuration options:
 # https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
 version: 2
 updates:
  - package-ecosystem: "pip" # See documentation for possible values
    directory: "/" # Location of package manifests
    schedule:
      interval: "daily"
@@ -1,20 +1,30 @@
 ---
 mysql_hardening:
-  - 'roles/mysql_hardening/**'
+  - changed-files:
-  - 'molecule/mysql_hardening/**'
+      - any-glob-to-any-file:
-  - '.github/workflows/mysql_hardening.yml'
+          - roles/mysql_hardening/**
          - molecule/mysql_hardening/**
          - .github/workflows/mysql_hardening.yml
 os_hardening:
-  - 'roles/os_hardening/**'
+  - changed-files:
-  - 'molecule/os_hardening/**'
+      - any-glob-to-any-file:
-  - '.github/workflows/os_hardening.yml'
+          - roles/os_hardening/**
          - molecule/os_hardening/**
          - .github/workflows/os_hardening.yml
 ssh_hardening:
-  - 'roles/ssh_hardening/**'
+  - changed-files:
-  - 'molecule/ssh_hardening/**'
+      - any-glob-to-any-file:
-  - '.github/workflows/ssh_hardening.yml'
+          - roles/ssh_hardening/**
          - molecule/ssh_hardening/**
          - molecule/ssh_hardening_custom_tests/**
          - .github/workflows/ssh_hardening.yml
          - .github/workflows/ssh_hardening_custom_tests.yml
 nginx_hardening:
-  - 'roles/nginx_hardening/**'
+  - changed-files:
-  - 'molecule/nginx_hardening/**'
+      - any-glob-to-any-file:
-  - '.github/workflows/nginx_hardening.yml'
+          - roles/nginx_hardening/**
          - molecule/nginx_hardening/**
          - .github/workflows/nginx_hardening.yml
@@ -0,0 +1,32 @@
 ---
 name: Ansible Lint  # feel free to pick your own name
 on:  # yamllint disable-line rule:truthy
  # Run CI against all pushes (direct commits, also merged PRs), Pull Requests
  push:
    branches: [master]
    paths:
      - 'roles/**'
      - 'molecule/**'
      - 'requirements.txt'
      - '.github/workflows/ansible-lint.yml'
      - '.config/ansible-lint.yml'
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [master]
    paths:
      - 'roles/**'
      - 'molecule/**'
      - 'requirements.txt'
      - '.github/workflows/ansible-lint.yml'
      - '.config/ansible-lint.yml'
 jobs:
  ansible-lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Lint Ansible Playbook
        uses: ansible/ansible-lint@v6
@@ -0,0 +1,14 @@
 ---
 name: Codespell - Spellcheck
 on:  # yamllint disable-line rule:truthy
  push:
    branches: [master]
  pull_request:
    branches: [master]
 jobs:
  codespell:
    uses: "dev-sec/.github/.github/workflows/codespell.yml@main"
    with:
      ignore_words_list: "chage"
@@ -1,12 +1,14 @@
 ---
 name: "Enforce PR labels"
-on:
+on:  # yamllint disable-line rule:truthy
  pull_request_target:
    types: [labeled, unlabeled, opened, edited, synchronize]
 jobs:
  enforce-label:
    if: github.repository == 'dev-sec/ansible-collection-hardening'
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/labeler@main
+      - uses: actions/labeler@v5.0.0
        with:
          repo-token: "${{ secrets.GITHUB_TOKEN }}"
@@ -1,16 +1,17 @@
 ---
 name: Publish collection to Ansible Galaxy
-on:
+on:  # yamllint disable-line rule:truthy
  release:
    types:
-      - published
+      - released
 jobs:
  deploy:
    if: github.repository == 'dev-sec/ansible-collection-hardening'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
      # deploy the collection first, because if it fails, we don't want
      # to update the galaxy.yml
@@ -21,7 +22,7 @@ jobs:
          galaxy_version: ${{ github.event.release.tag_name }}
      # checkout master instead of the release-tag so we can push the galaxy.yml
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
        with:
          ref: master
@@ -33,7 +34,7 @@ jobs:
          version: "${{ github.event.release.tag_name }}"
      - name: push galaxy.yml
-        uses: github-actions-x/commit@v2.7
+        uses: github-actions-x/commit@v2.9
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          push-branch: 'master'
@@ -1,20 +1,35 @@
 ---
 name: "devsec.mysql_hardening"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - 'roles/mysql_hardening/**'
      - 'molecule/mysql_hardening/**'
      - '.github/workflows/mysql_hardening.yml'
      - 'requirements.txt'
  pull_request:
    branches: [master]
    paths:
      - 'roles/mysql_hardening/**'
      - 'molecule/mysql_hardening/**'
      - '.github/workflows/mysql_hardening.yml'
      - 'requirements.txt'
  schedule:
    - cron: '0 6 * * 0'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -23,26 +38,31 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
-          - centos8
+          - centosstream8
          - centosstream9
          - rocky8
          - rocky9
          - ubuntu1804
          - ubuntu2004
-          - debian9
+          - ubuntu2204
          - debian10
          - debian11
          - debian12
          # - amazon  # geerlingguy.mysql does not support fedora
-          # - arch  # needs to be fixed
+          # - arch  # geerlingguy.mysql does not support arch
-          # - opensuse_tumbleweed  # needs to be fixed
+          - opensuse_tumbleweed
          # - fedora  # geerlingguy.mysql does not support fedora
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
-      - name: Set up Python 3.7
+      - name: Set up Python
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v5
        with:
-          python-version: 3.7
+          python-version: 3.12
      - name: Install dependencies
        run: |
@@ -51,11 +71,6 @@ jobs:
          pip install -r requirements.txt
        working-directory: ansible_collections/devsec/hardening
      - name: Create default collection path symlink
        run: |
          mkdir -p /home/runner/.ansible
          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
      # that was a hard one to fix. robert did it thankfully
      # https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212
      - name: disable apparmor on debian systems
@@ -66,6 +81,17 @@ jobs:
            sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld
        if: ${{ startsWith(matrix.molecule_distro, 'Debian') }}
      # Molecule has problems detecting the proper location for installing roles
      # https://github.com/ansible/molecule/issues/3806
      # we do not set a custom role path, but the automatically determined install path used is not compatible with the location molecule expects the role
      # see CI logs of this action "INFO     Set ANSIBLE_ROLES_PATH" should not be present, since we do not set a custom path
      # we have to find a proper way to configure this
      - name: Temporary fix for roles
        run: |
          mkdir -p /home/runner/.ansible
          ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles \
            /home/runner/.ansible/roles
      - name: Test with molecule
        run: |
          molecule --version
@@ -3,18 +3,32 @@ name: "devsec.nginx_hardening"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - 'roles/nginx_hardening/**'
      - 'molecule/nginx_hardening/**'
      - '.github/workflows/nginx_hardening.yml'
      - 'requirements.txt'
  pull_request:
    branches: [master]
    paths:
      - 'roles/nginx_hardening/**'
      - 'molecule/nginx_hardening/**'
      - '.github/workflows/nginx_hardening.yml'
      - 'requirements.txt'
  schedule:
    - cron: '0 6 * * 1'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -23,26 +37,31 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
-          - centos8
+          - centosstream8
          - centosstream9
          - rocky8
          - rocky9
          - ubuntu1804
          - ubuntu2004
-          - debian9
+          - ubuntu2204
          - debian10
-          - amazon
+          - debian11
          - debian12
          - amazon2023
          # - arch  # needs to be fixed
          # - opensuse_tumbleweed  # needs to be fixed
          # - fedora  # no support from geerlingguy role
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
-      - name: Set up Python 3.7
+      - name: Set up Python
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v5
        with:
-          python-version: 3.7
+          python-version: 3.12
      - name: Install dependencies
        run: |
@@ -51,10 +70,16 @@ jobs:
          pip install -r requirements.txt
        working-directory: ansible_collections/devsec/hardening
-      - name: Create default collection path symlink
+      # Molecule has problems detecting the proper location for installing roles
      # https://github.com/ansible/molecule/issues/3806
      # we do not set a custom role path, but the automatically determined install path used is not compatible with the location molecule expects the role
      # see CI logs of this action "INFO     Set ANSIBLE_ROLES_PATH" should not be present, since we do not set a custom path
      # we have to find a proper way to configure this
      - name: Temporary fix for roles
        run: |
          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
+          ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles \
            /home/runner/.ansible/roles
      - name: Test with molecule
        run: |
@@ -3,18 +3,32 @@ name: "devsec.os_hardening"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening/**'
      - '.github/workflows/os_hardening.yml'
      - 'requirements.txt'
  pull_request:
    branches: [master]
    paths:
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening/**'
      - '.github/workflows/os_hardening.yml'
      - 'requirements.txt'
  schedule:
    - cron: '0 6 * * 3'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -23,25 +37,32 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
-          - centos8
+          - centosstream8
          - centosstream9
          - rocky8
          - rocky9
          - fedora38
          - fedora39
          - ubuntu1804
          - ubuntu2004
-          - debian9
+          - ubuntu2204
          - debian10
-          - amazon
+          - debian11
          - debian12
          - amazon2023
          - opensuse_tumbleweed
-          # - arch  # needs to be fixed
+          - arch
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
-      - name: Set up Python 3.7
+      - name: Set up Python
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v5
        with:
-          python-version: 3.7
+          python-version: 3.12
      - name: Install dependencies
        run: |
@@ -50,11 +71,6 @@ jobs:
          pip install -r requirements.txt
        working-directory: ansible_collections/devsec/hardening
      - name: Create default collection path symlink
        run: |
          mkdir -p /home/runner/.ansible
          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
      - name: Test with molecule
        run: |
          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
@@ -0,0 +1,67 @@
 ---
 name: "devsec.os_hardening VM"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening_vm/**'
      - '.github/workflows/os_hardening_vm.yml'
      - 'requirements.txt'
  pull_request:
    branches: [master]
    paths:
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening_vm/**'
      - '.github/workflows/os_hardening_vm.yml'
      - 'requirements.txt'
  schedule:
    - cron: '0 6 * * 2'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
    runs-on: self-hosted
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
    strategy:
      fail-fast: false
      matrix:
        molecule_distro:
          - generic/centos7
          - generic/centos8s
          - generic/centos9s
          - generic/rocky8
          - generic/rocky9
          - fedora/38-cloud-base
          - fedora/39-cloud-base
          - generic/ubuntu1804
          - generic/ubuntu2004
          - generic/ubuntu2204
          - generic/debian10
          - generic/debian11
          - generic/debian12
          - generic/opensuse15
          - generic/arch
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
      - name: Test with molecule
        run: |
          molecule --version
          molecule test -s os_hardening_vm
        env:
          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
        working-directory: ansible_collections/devsec/hardening
@@ -2,23 +2,25 @@
 # https://github.com/creyD/prettier_action
 name: Prettier markdown files
-on:
+on:  # yamllint disable-line rule:truthy
  push:
    branches: [master]
    paths:
      - '**.md'
 jobs:
  prettier-md:
    if: github.repository == 'dev-sec/ansible-collection-hardening'
    runs-on: ubuntu-latest
    timeout-minutes: 1
    steps:
      - name: Git checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
        with:
          ref: ${{ github.head_ref }}
      - name: Prettify code
-        uses: creyD/prettier_action@v3.1
+        uses: creyD/prettier_action@v4.3
        with:
          prettier_options: --write {**/*,*}.md
@@ -9,12 +9,14 @@ on:  # yamllint disable-line rule:truthy
 jobs:
  generate_changelog:
    runs-on: ubuntu-latest
    name: create release draft
    if: github.repository == 'dev-sec/ansible-collection-hardening'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: master
      - name: 'Get Previous tag'
        id: previoustag
@@ -37,9 +39,10 @@ jobs:
          # since they break the changelog generation with the error:
          # "No common ancestor between ... and $version"
          exclude_tags_regex: '[0-6]\.\d\.\d'
          issue_line_labels: mysql_hardening,os_hardening,ssh_hardening,nginx_hardening
      - name: push changelog
-        uses: github-actions-x/commit@v2.6
+        uses: github-actions-x/commit@v2.9
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          push-branch: 'master'
@@ -49,12 +52,6 @@ jobs:
          name: dev-sec CI
          email: [email protected]
      # do a second checkout to prevent race situation
      # changelog gets updated but action works on old commit id
      - uses: actions/[email protected]
        with:
          ref: master
      - name: Generate changelog for the release
        run: |
          sed '/## \[${{ steps.previoustag.outputs.tag }}\]/Q' CHANGELOG.md > CHANGELOGRELEASE.md
@@ -65,6 +62,11 @@ jobs:
        with:
          path: ./CHANGELOGRELEASE.md
      - name: Delete old drafts
        uses: hugo19941994/[email protected]
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Create Release draft
        id: create_release
        uses: actions/create-release@v1
@@ -0,0 +1,52 @@
 ---
 name: create roles readme
 on:  # yamllint disable-line rule:truthy
  push:
    branches: [master]
    paths:
      - 'roles/**/meta/argument_specs.yml'
  pull_request:
    branches: [master]
    paths:
      - 'roles/**/meta/argument_specs.yml'
 jobs:
  readme:
    name: create roles readme
    runs-on: ubuntu-latest
    strategy:
      matrix:
        roles:
          - mysql_hardening
          - nginx_hardening
          - os_hardening
          - ssh_hardening
    steps:
      - name: Check out code
        uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: 3.12
      - name: Install aar_doc
        run: pip3 install aar_doc
      - name: Run aar_doc
        run: aar_doc roles/${{ matrix.roles }} markdown
      - name: Output diff
        run: git diff roles/${{ matrix.roles }}/README.md
      - name: Push README
        if: github.event_name != 'pull_request'
        uses: github-actions-x/[email protected]
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          commit-message: 'update ${{ matrix.roles }} readme'
          files: roles/${{ matrix.roles }}/README.md
          rebase: true
          name: dev-sec CI
          email: [email protected]
@@ -3,18 +3,32 @@ name: "devsec.ssh_hardening"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening/**'
      - '.github/workflows/ssh_hardening.yml'
      - 'requirements.txt'
  pull_request:
    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening/**'
      - '.github/workflows/ssh_hardening.yml'
      - 'requirements.txt'
  schedule:
    - cron: '0 6 * * 5'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -23,26 +37,32 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
-          - centos8
+          - centosstream8
-          - fedora
+          - centosstream9
          - rocky8
          - rocky9
          - fedora38
          - fedora39
          - ubuntu1804
          - ubuntu2004
-          - debian9
+          - ubuntu2204
          - debian10
-          - amazon
+          - debian11
-          # - arch  # needs to be fixed
+          - debian12
-          # - opensuse_tumbleweed  # baseline is not compatible with suse
+          - amazon2023
          - arch
          # - opensuse_tumbleweed  # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
-      - name: Set up Python 3.7
+      - name: Set up Python
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v5
        with:
-          python-version: 3.7
+          python-version: 3.12
      - name: Install dependencies
        run: |
@@ -51,11 +71,6 @@ jobs:
          pip install -r requirements.txt
        working-directory: ansible_collections/devsec/hardening
      - name: Create default collection path symlink
        run: |
          mkdir -p /home/runner/.ansible
          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
      - name: Test with molecule
        run: |
          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
@@ -0,0 +1,56 @@
 ---
 name: "devsec.ssh_hardening BSD"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening_bsd/**'
      - '.github/workflows/ssh_hardening_bsd.yml'
      - 'requirements.txt'
  pull_request:
    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening_bsd/**'
      - '.github/workflows/ssh_hardening_bsd.yml'
      - 'requirements.txt'
  schedule:
    - cron: '0 6 * * 5'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
    runs-on: self-hosted
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
    strategy:
      fail-fast: false
      matrix:
        molecule_distro:
          - openbsd7
          - freebsd12
          - freebsd13
          - freebsd14
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
      - name: Test with molecule
        run: |
          molecule --version
          molecule test -s ssh_hardening_bsd
        env:
          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
        working-directory: ansible_collections/devsec/hardening
@@ -0,0 +1,83 @@
 ---
 name: "devsec.ssh_hardening with custom tests"
 on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening_custom_tests/**'
      - '.github/workflows/ssh_hardening_custom_tests.yml'
      - 'requirements.txt'
  pull_request:
    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening_custom_tests/**'
      - '.github/workflows/ssh_hardening_custom_tests.yml'
      - 'requirements.txt'
  schedule:
    - cron: '0 6 * * 4'
 concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true
 jobs:
  build:
    runs-on: ubuntu-latest
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
    strategy:
      fail-fast: false
      matrix:
        molecule_distro:
          - centos7
          - centosstream8
          - centosstream9
          - rocky8
          - rocky9
          - fedora38
          - fedora39
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
          - debian10
          - debian11
          - debian12
          - amazon2023
          - arch
          # - opensuse_tumbleweed  # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: 3.12
      - name: Install dependencies
        run: |
          sudo apt install git
          python -m pip install --no-cache-dir --upgrade pip
          pip install -r requirements.txt
        working-directory: ansible_collections/devsec/hardening
      - name: Test with molecule
        run: |
          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
            export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
          fi
          molecule --version
          molecule converge -s ssh_hardening_custom_tests
        env:
          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
        working-directory: ansible_collections/devsec/hardening
@@ -1,3 +1,4 @@
 .kitchen
 hosts
 Gemfile.lock
 .venv
@@ -1,33 +0,0 @@
 ---
 # Based on ansible-lint config
 extends: default
 rules:
  braces:
    max-spaces-inside: 1
    level: error
  brackets:
    max-spaces-inside: 1
    level: error
  colons:
    max-spaces-after: -1
    level: error
  commas:
    max-spaces-after: -1
    level: error
 #  comments: disable
 #  comments-indentation: disable
 #  document-start: disable
  empty-lines:
    max: 3
    level: error
  hyphens:
    level: error
 #  indentation: disable
  key-duplicates: enable
  line-length: disable
 #  new-line-at-end-of-file: disable
  new-lines:
    type: unix
 #  trailing-spaces: disable
 #  truthy: disable
@@ -15,7 +15,7 @@ In order to contribute code please:
 1. Fork the project on GitHub
 2. Clone the project
 3. Add changes (and tests)
-4. Commit and push
+4. Commit, sign off and push your changes
 5. Create a merge-request
 To have your code merged, see the expectations listed below.
@@ -28,6 +28,24 @@ Some great guidelines can be found [here](https://wiki.openstack.org/wiki/GitCom
 ## Expectations
 ## Sign off Your Work
 The Developer Certificate of Origin (DCO) is a lightweight way for contributors to certify that they wrote or otherwise have the right to submit the code they are contributing to the project.
 [Here is the full text of the DCO](http://developercertificate.org/).
 Contributors must sign-off that they adhere to these requirements by adding a `Signed-off-by` line to commit messages.
 ```text
 This is my commit message
 Signed-off-by: Random J Developer <random@developer.example.org>
 ```
 Git even has a -s command line option to append this automatically to your commit message:
 ```text
 git commit -s -m 'This is my commit message'
 ```
 ### Don't reinvent the wheel
 This hardening project doesn't intend to reinvent the configuration stack for services. Aim to use official configuration projects first and provide hardening as a layer on top. The goal is remove the need for a user to configure all aspects of services and maintain security configuration. This way, the user can still configure a service using the interface provided by the official project.
@@ -0,0 +1,201 @@
                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/
   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
   1. Definitions.
      "License" shall mean the terms and conditions for use, reproduction,
      and distribution as defined by Sections 1 through 9 of this document.
      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.
      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.
      "You" (or "Your") shall mean an individual or Legal Entity
      exercising permissions granted by this License.
      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.
      "Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.
      "Work" shall mean the work of authorship, whether in Source or
      Object form, made available under the License, as indicated by a
      copyright notice that is included in or attached to the work
      (an example is provided in the Appendix below).
      "Derivative Works" shall mean any work, whether in Source or Object
      form, that is based on (or derived from) the Work and for which the
      editorial revisions, annotations, elaborations, or other modifications
      represent, as a whole, an original work of authorship. For the purposes
      of this License, Derivative Works shall not include works that remain
      separable from, or merely link (or bind by name) to the interfaces of,
      the Work and Derivative Works thereof.
      "Contribution" shall mean any work of authorship, including
      the original version of the Work and any modifications or additions
      to that Work or Derivative Works thereof, that is intentionally
      submitted to Licensor for inclusion in the Work by the copyright owner
      or by an individual or Legal Entity authorized to submit on behalf of
      the copyright owner. For the purposes of this definition, "submitted"
      means any form of electronic, verbal, or written communication sent
      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise
      designated in writing by the copyright owner as "Not a Contribution."
      "Contributor" shall mean Licensor and any individual or Legal Entity
      on behalf of whom a Contribution has been received by Licensor and
      subsequently incorporated within the Work.
   2. Grant of Copyright License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      copyright license to reproduce, prepare Derivative Works of,
      publicly display, publicly perform, sublicense, and distribute the
      Work and such Derivative Works in Source or Object form.
   3. Grant of Patent License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct
      or contributory patent infringement, then any patent licenses
      granted to You under this License for that Work shall terminate
      as of the date such litigation is filed.
   4. Redistribution. You may reproduce and distribute copies of the
      Work or Derivative Works thereof in any medium, with or without
      modifications, and in Source or Object form, provided that You
      meet the following conditions:
      (a) You must give any other recipients of the Work or
          Derivative Works a copy of this License; and
      (b) You must cause any modified files to carry prominent notices
          stating that You changed the files; and
      (c) You must retain, in the Source form of any Derivative Works
          that You distribute, all copyright, patent, trademark, and
          attribution notices from the Source form of the Work,
          excluding those notices that do not pertain to any part of
          the Derivative Works; and
      (d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed
          as part of the Derivative Works; within the Source form or
          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. You may add Your own attribution
          notices within Derivative Works that You distribute, alongside
          or as an addendum to the NOTICE text from the Work, provided
          that such additional attribution notices cannot be construed
          as modifying the License.
      You may add Your own copyright statement to Your modifications and
      may provide additional or different license terms and conditions
      for use, reproduction, or distribution of Your modifications, or
      for any such Derivative Works as a whole, provided Your use,
      reproduction, and distribution of the Work otherwise complies with
      the conditions stated in this License.
   5. Submission of Contributions. Unless You explicitly state otherwise,
      any Contribution intentionally submitted for inclusion in the Work
      by You to the Licensor shall be under the terms and conditions of
      this License, without any additional terms or conditions.
      Notwithstanding the above, nothing herein shall supersede or modify
      the terms of any separate license agreement you may have executed
      with Licensor regarding such Contributions.
   6. Trademarks. This License does not grant permission to use the trade
      names, trademarks, service marks, or product names of the Licensor,
      except as required for reasonable and customary use in describing the
      origin of the Work and reproducing the content of the NOTICE file.
   7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. You are solely responsible for determining the
      appropriateness of using or redistributing the Work and assume any
      risks associated with Your exercise of permissions under this License.
   8. Limitation of Liability. In no event and under no legal theory,
      whether in tort (including negligence), contract, or otherwise,
      unless required by applicable law (such as deliberate and grossly
      negligent acts) or agreed to in writing, shall any Contributor be
      liable to You for damages, including any direct, indirect, special,
      incidental, or consequential damages of any character arising as a
      result of this License or out of the use or inability to use the
      Work (including but not limited to damages for loss of goodwill,
      work stoppage, computer failure or malfunction, or any and all
      other commercial damages or losses), even if such Contributor
      has been advised of the possibility of such damages.
   9. Accepting Warranty or Additional Liability. While redistributing
      the Work or Derivative Works thereof, You may choose to offer,
      and charge a fee for, acceptance of support, warranty, indemnity,
      or other liability obligations and/or rights consistent with this
      License. However, in accepting such obligations, You may act only
      on Your own behalf and on Your sole responsibility, not on behalf
      of any other Contributor, and only if You agree to indemnify,
      defend, and hold each Contributor harmless for any liability
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.
   END OF TERMS AND CONDITIONS
   APPENDIX: How to apply the Apache License to your work.
      To apply the Apache License to your work, attach the following
      boilerplate notice, with the fields enclosed by brackets "[]"
      replaced with your own identifying information. (Don't include
      the brackets!)  The text should be enclosed in the appropriate
      comment syntax for the file format. We also recommend that a
      file or class name and description of purpose be included on the
      same "printed page" as the copyright notice for easier
      identification within third-party archives.
   Copyright [yyyy] [name of copyright owner]
   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at
       http://www.apache.org/licenses/LICENSE-2.0
   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
@@ -26,7 +26,7 @@
 - fix fedora build [\#296](https://github.com/dev-sec/ansible-os-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
 - do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-os-hardening/pull/289) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([schurzi](https://github.com/schurzi))
- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))
+- move hidepid vars into defaults so they're overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))
 ## [6.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/6.1.0) (2020-07-21)
@@ -90,7 +90,7 @@
 - Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-os-hardening/pull/259) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jaredledvina](https://github.com/jaredledvina))
 - Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-os-hardening/pull/254) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([kravietz](https://github.com/kravietz))
 - Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-os-hardening/pull/251) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
+- Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
 - Make max_log_file_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-os-hardening/pull/246) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jandd](https://github.com/jandd))
 - Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-os-hardening/pull/240) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([ghost](https://github.com/ghost))
 - Fedora - Use new auto ansible_python_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-os-hardening/pull/239) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jaredledvina](https://github.com/jaredledvina))
@@ -165,7 +165,7 @@
 **Fixed bugs:**
- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- auditd causing v5.0 to fail on unprivileged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
 - Setting os_security_users_allow has no effect [\#175](https://github.com/dev-sec/ansible-os-hardening/issues/175) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
 - add /usr/bin/su to suid_guid whitelist [\#199](https://github.com/dev-sec/ansible-os-hardening/pull/199) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([ccolic](https://github.com/ccolic))
 - ensure that permissions to su-binary are not restricted to root user and group only, if os_security_users_allow contains the value change_user [\#197](https://github.com/dev-sec/ansible-os-hardening/pull/197) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([szEvEz](https://github.com/szEvEz))
@@ -346,7 +346,7 @@
 - Docker [\#90](https://github.com/dev-sec/ansible-os-hardening/pull/90) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
 - debian 8 support [\#88](https://github.com/dev-sec/ansible-os-hardening/pull/88) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-os-hardening/pull/85) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
- replace ignore_errors to failed_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
+- replace ignore_errors to failed_when to suppress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
 - fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-os-hardening/pull/79) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
 **Fixed bugs:**
@@ -459,7 +459,7 @@
 - Repair debian install script [\#8](https://github.com/dev-sec/ansible-os-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
 - Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-os-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
 - Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-os-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accommodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
 - treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-os-hardening/pull/3) ([arlimus](https://github.com/arlimus))
 - Add Securetty-support [\#2](https://github.com/dev-sec/ansible-os-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
 - Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-os-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))
@@ -1,21 +1,25 @@
 # Ansible Collection - devsec.hardening
-![devsec.os_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening/badge.svg)
+[![devsec.os_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml)
-![devsec.ssh_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.ssh_hardening/badge.svg)
+[![devsec.os_hardening VM](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml)
-![devsec.nginx_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.nginx_hardening/badge.svg)
+[![devsec.ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml)
-![devsec.mysql_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.mysql_hardening/badge.svg)
+[![devsec.ssh_hardening BSD](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml)
 [![devsec.ssh_hardening with custom tests](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml)
 [![devsec.nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml)
 [![devsec.mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
 ## Description
 This collection provides battle tested hardening for:
 - Linux operating systems:
-  - CentOS 7/8
+  - CentOS 7/8/9
-  - Debian 9/10
+  - Rocky Linux 8/9
-  - Ubuntu 16.04/18.04/20.04
+  - Debian 10/11/12
  - Ubuntu 18.04/20.04/22.04
  - Amazon Linux (some roles supported)
  - Arch Linux (some roles supported)
-  - Fedora (some roles supported)
+  - Fedora 37/38 (some roles supported)
  - Suse Tumbleweed (some roles supported)
 - MySQL
  - MariaDB >= 5.5.65, >= 10.1.45, >= 10.3.17
@@ -25,14 +29,24 @@ This collection provides battle tested hardening for:
 The hardening is intended to be compliant with the Inspec DevSec Baselines:
- https://github.com/dev-sec/linux-baseline
+- <https://github.com/dev-sec/linux-baseline>
- https://github.com/dev-sec/mysql-baseline
+- <https://github.com/dev-sec/mysql-baseline>
- https://github.com/dev-sec/nginx-baseline
+- <https://github.com/dev-sec/nginx-baseline>
- https://github.com/dev-sec/ssh-baseline
+- <https://github.com/dev-sec/ssh-baseline>
-## Looking for the old ansible-os-hardening role?
+## Looking for the old roles?
-This role is now part of the hardening-collection. You can find the old role in the branch `legacy`.
+The roles are now part of the hardening-collection.
 We have kept the old releases of the `os-hardening` role in this repository, so you can find the them by exploring older tags.
 The last release of the standalone role was [6.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/6.2.0).
 The other roles are in separate archives repositories:
 - [apache_hardening](https://github.com/dev-sec/ansible-apache-hardening)
 - [mysql_hardening](https://github.com/dev-sec/ansible-mysql-hardening)
 - [nginx_hardening](https://github.com/dev-sec/ansible-nginx-hardening)
 - [ssh_hardening](https://github.com/dev-sec/ansible-ssh-hardening)
 - [windows_hardening](https://github.com/dev-sec/ansible-windows-hardening)
 ## Minimum required Ansible-version
@@ -74,8 +88,8 @@ See the [changelog](https://github.com/dev-sec/ansible-os-hardening/tree/master/
 Todos:
- Work on [apache_hardening](roles/apache_hardening/) and [windows_hardening](roles/windows_hardening/).
+- Work on [apache_hardening](roles/apache_hardening/) and [windows_hardening](roles/windows_hardening/)
- Add support for more operating systems,
+- Add support for more operating systems
 ## More information
@@ -93,6 +107,6 @@ General information:
 Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
-http://www.apache.org/licenses/LICENSE-2.0
+<http://www.apache.org/licenses/LICENSE-2.0>
 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
@@ -1,12 +1,12 @@
 namespace: devsec
 name: hardening
-version: 7.4.0
+version: 9.0.0
 readme: README.md
 authors:
  - dev-sec <[email protected]>
 description: 'This collection provides battle tested hardening for Linux, SSH, nginx, MySQL'
 license:
-  - GPL-2.0-or-later
+  - Apache-2.0
 license_file: ''
 tags:
  - devsec
@@ -17,11 +17,22 @@ tags:
  - nginx
  - mysql
  - openssh
  - apache_hardening
  - mysql_hardening
  - nginx_hardening
  - os_hardening
  - ssh_hardening
  - database
  - linux
  - security
 dependencies:
  ansible.posix: '>=1.0.0'
  community.crypto: '>=1.0.0'
-repository: 'https://github.com/dev-sec/ansible-os-hardening'
+  community.general: '>=1.0.0'
  community.mysql: '>=1.3.0'
 repository: 'https://github.com/dev-sec/ansible-collection-hardening/'
 homepage: 'https://dev-sec.io/'
-issues: 'https://github.com/dev-sec/ansible-os-hardening/issues'
+issues: 'https://github.com/dev-sec/ansible-collection-hardening/issues'
 build_ignore:
  - codecov.yml
  - .github
@@ -34,3 +45,4 @@ build_ignore:
  - .tox
  - tox.ini
  - .yamllint
  - renovate.json
@@ -1,2 +1,2 @@
 ---
-requires_ansible: '>=2.9.10'
+requires_ansible: ">=2.9.10"
@@ -1,5 +1,5 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
+- name: Wrapper playbook for kitchen testing "ansible-mysql-hardening"
  hosts: all
  become: true
  environment:
@@ -8,22 +8,30 @@
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
-      set_fact:
+      ansible.builtin.set_fact:
-        mysql_python_package_debian: "python3-pymysql"
+        mysql_python_package_debian: python3-pymysql
      when:
        - mysql_python_package_debian is not defined
        - ansible_distribution == "Ubuntu"
        - ansible_distribution_major_version|int > 19
    - name: Determine required MySQL Python libraries.
-      set_fact:
+      ansible.builtin.set_fact:
-        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
+        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
      when:
        - mysql_python_package_debian is not defined
        - ansible_distribution != "Ubuntu"
        - ansible_distribution_major_version|int < 20
-    - include_role:
+
-        name: mysql_hardening
+    - name: Use Python 3 on Suse
      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
        - ansible_os_family == 'Suse'
    - name: Include mysql_hardening role
      ansible.builtin.include_role:
        name: devsec.hardening.mysql_hardening
  vars:
    overwrite_global_mycnf: false
    mysql_root_password: iloverandompasswordsbutthiswilldo
@@ -6,32 +6,23 @@ dependency:
    requirements-file: molecule/mysql_hardening/requirements.yml
 driver:
  name: docker
 lint: |
  yamllint roles/mysql_hardening/ molecule/mysql_hardening/ .github/workflows/mysql_hardening.yml
  ansible-lint roles/mysql_hardening/
 platforms:
  - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
    cgroupns_mode: host
    pre_build_image: true
    environment:
      container: docker
    security_opts:
      - apparmor=unconfined
    env:
      http_proxy: "${http_proxy}"
      https_proxy: "${https_proxy}"
      no_proxy: "${no_proxy}"
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
  name: ansible
@@ -57,12 +48,12 @@ scenario:
    - destroy
  test_sequence:
    - dependency
    - lint
    - destroy
    - syntax
    - create
    - prepare
    - check
    - converge
-    # - idempotence  # not idempotent
+    - idempotence
    - verify
    - destroy
@@ -1,58 +1,81 @@
 ---
-
+- name: Wrapper playbook for kitchen testing "ansible-mysql-hardening"
 - name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Run the equivalent of "apt-get update && apt-get upgrade"
      apt:
        name: "*"
        state: latest
        update_cache: true
      when: ansible_os_family == 'Debian'
    - name: install required tools on SuSE
      zypper:
        name: "python-xml"
        state: present
      when: ansible_facts.os_family == 'Suse'
    - name: create missing directory
      file:
        path: "/etc/mysql/conf.d"
        state: directory
    - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
      set_fact:
        mysql_python_package_debian: "python3-pymysql"
      when:
        - mysql_python_package_debian is not defined
        - ansible_distribution == "Ubuntu"
        - ansible_distribution_major_version|int > 19
    - name: Determine required MySQL Python libraries.
      set_fact:
        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
      when:
        - mysql_python_package_debian is not defined
        - ansible_distribution != "Ubuntu"
        - ansible_distribution_major_version|int < 20
    - include_role:
        name: dev-sec.mysql
    - name: create a user with an empty password
      community.mysql.mysql_query:
        query:
          - "CREATE USER foo@bar;"
        login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  vars:
    overwrite_global_mycnf: false
    mysql_root_password: iloverandompasswordsbutthiswilldo
    mysql_user_password: iloverandompasswordsbutthiswilldo
    mysql_config_file: /etc/mysql/mariadb.cnf
    mysql_root_password_update: true
  tasks:
    - name: Use Python 3 on Debian 11
      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
        - ansible_distribution == 'Debian'
        - ansible_distribution_major_version|int >= 11
    - name: Use Python 3 on Suse
      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
        - ansible_os_family == 'Suse'
    - name: Use Python 2 on Debian 10
      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python
      when:
        - ansible_distribution == 'Debian'
        - ansible_distribution_major_version|int == 10
    - name: Run the equivalent of "apt-get update && apt-get upgrade"
      ansible.builtin.apt:
        upgrade: safe
        update_cache: true
      when: ansible_os_family == 'Debian'
    - name: Install required python packages on Suse
      ansible.builtin.command: zypper -n install python-xml python3-rpm python3-PyMySQL
      changed_when: false
      when: ansible_os_family == 'Suse'
    - name: Create missing directory
      ansible.builtin.file:
        path: /etc/mysql
        state: directory
        mode: "0755"
    - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
      ansible.builtin.set_fact:
        mysql_python_package_debian: python3-pymysql
      when:
        - mysql_python_package_debian is not defined
        - ansible_distribution == "Ubuntu"
        - ansible_distribution_major_version|int > 19
    - name: Determine required MySQL Python libraries.
      ansible.builtin.set_fact:
        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
      when:
        - mysql_python_package_debian is not defined
        - ansible_distribution != "Ubuntu"
        - ansible_distribution_major_version|int < 20
    - name: Install required MySQL Python libraries on RHEL
      ansible.builtin.yum:
        name: "{% if 'python3' in ansible_python_interpreter | default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
      when:
        - ansible_os_family == "RedHat"
        - ansible_distribution_major_version == "7"
    - name: Install mysql with a generic Ansible role
      ansible.builtin.include_role:
        name: dev-sec.mysql
    - name: Include MySQL user prepare tasks
      ansible.builtin.include_tasks: prepare_tasks/mysql_users.yml
@@ -0,0 +1,32 @@
 ---
 - name: Create users for test
  community.mysql.mysql_query:
    query:
      - CREATE USER 'user'@'delete';
      - CREATE USER 'user'@'127.0.0.1';
      - CREATE USER 'user'@'::1';
      - CREATE USER 'user'@'%';
      - CREATE USER 'user'@'192.168.0.%';
      - CREATE USER 'user'@'192.168.0.1';
      - CREATE USER    '%'@'192.168.0.1';
      - CREATE USER 'user'@'192.168.0.2' IDENTIFIED BY 'keep';
      - CREATE USER 'user'@'keep' IDENTIFIED BY 'keep';
      - CREATE USER 'user'@'192.168.%' IDENTIFIED BY 'keep';
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
 - name: Detect role support on MySQL
  community.mysql.mysql_query:
    query: >
      SELECT 1 FROM information_schema.COLUMNS
                WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
                AND COLUMN_NAME = 'is_role';
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_role_support
 - name: Create roles for test
  community.mysql.mysql_query:
    query:
      - CREATE ROLE 'role_keep';
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when:
    - mysql_role_support.rowcount[0] > 0
@@ -1,7 +1,5 @@
 ---
 roles:
  - name: geerlingguy.git
    version: 3.0.0
  - name: dev-sec.mysql
    version: master
@@ -6,54 +6,50 @@
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  roles:
    - geerlingguy.git
  tasks:
-    - name: install fake SuSE-release for cinc compatibility
+    - name: Use Python 3 on Suse
-      copy:
+      ansible.builtin.set_fact:
-        content: |
+        ansible_python_interpreter: /usr/bin/python3
-          openSUSE Faked Enterprise 2020 (x86_64)
+      when:
-          VERSION = 2020
+        - ansible_os_family == 'Suse'
          CODENAME = Faked Feature
        dest: /etc/SuSE-release
        owner: root
        group: root
        mode: '0444'
      when: ansible_facts.os_family == 'Suse'
-    - name: install git for SuSE since geerlinguy.git does not support it
+    - name: Install procps for debian systems
-      zypper:
+      ansible.builtin.apt:
        name: git
        state: present
      when: ansible_facts.os_family == 'Suse'
    - name: install procps for debian systems
      apt:
        name: procps
        state: present
        update_cache: true
      when: ansible_distribution == 'Debian'
-    - name: download cinc-auditor
+    - name: Include tests for the service
-      get_url:
+      ansible.builtin.include_tasks: verify_tasks/service.yml
        url: https://omnitruck.cinc.sh/install.sh
        dest: /tmp/install.sh
        mode: '0775'
-    - name: install cinc-auditor
+    - name: Include tests for MySQL user
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
+      ansible.builtin.include_tasks: verify_tasks/mysql_users.yml
 - name: Verify
  hosts: localhost
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit supermarket://dev-sec/mysql-baseline"
+      ansible.builtin.command: >
        docker run
        --volume /run/docker.sock:/run/docker.sock
        docker.io/cincproject/auditor exec
        -t docker://instance
        --no-show-progress --no-color
        --no-distinct-exit https://github.com/dev-sec/mysql-baseline/archive/refs/heads/master.zip
      register: test_results
      changed_when: false
      ignore_errors: true
    - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
        msg: "{{ test_results.stdout_lines }}"
    - name: Fail when tests fail
-      fail:
+      ansible.builtin.fail:
-        msg: "Inspec failed to validate"
+        msg: Inspec failed to validate
      when: test_results.rc != 0
@@ -0,0 +1,41 @@
 ---
 - name: Get all users from MySQL server
  community.mysql.mysql_query:
    query: >
      SELECT CONCAT(USER, '@', HOST) AS users FROM mysql.user;
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_users
 - name: Create list of users from mysql query
  ansible.builtin.set_fact:
    mysql_users_list: "{{ mysql_users.query_result.0  | json_query('[*].users') | list }}"
 - name: Assert that only accounts with password remain
  ansible.builtin.assert:
    that:
      - '"user@delete" not in mysql_users_list'
      - '"[email protected]" not in mysql_users_list'
      - '"user@::1" not in mysql_users_list'
      - '"user@%" not in mysql_users_list'
      - '"[email protected].%" not in mysql_users_list'
      - '"[email protected]" not in mysql_users_list'
      - '"%@192.168.0.1" not in mysql_users_list'
      - '"[email protected]" in mysql_users_list'
      - '"user@keep" in mysql_users_list'
      - '"[email protected].%" in mysql_users_list'
 - name: Detect role support on MySQL
  community.mysql.mysql_query:
    query: >
      SELECT 1 FROM information_schema.COLUMNS
                WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
                AND COLUMN_NAME = 'is_role';
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_role_support
 - name: Assert that roles remain
  ansible.builtin.assert:
    that:
      - '"role_keep@" in mysql_users_list'
  when:
    - mysql_role_support.rowcount[0] > 0
@@ -0,0 +1,16 @@
 ---
 - name: Load variables from role to use the "mysql_daemon" variable
  ansible.builtin.include_role:
    name: devsec.hardening.mysql_hardening
    apply:
      tags:
        - never
 - name: Populate service facts
  ansible.builtin.service_facts:
 - name: Check if MySQL is running and enabled
  ansible.builtin.assert:
    that:
      - ansible_facts.services[mysql_daemon + '.service'].state == 'running'
      - ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'
@@ -1,5 +1,5 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
  become: true
  hosts: all
  environment:
@@ -7,8 +7,9 @@
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  vars:
-    - nginx_ppa_use: true
+    nginx_ppa_use: true
-    - nginx_ppa_version: stable
+    nginx_ppa_version: stable
  tasks:
-    - include_role:
+    - name: Include nginx_hardening role
-        name: nginx_hardening
+      ansible.builtin.include_role:
        name: devsec.hardening.nginx_hardening
@@ -5,33 +5,23 @@ dependency:
    role-file: molecule/nginx_hardening/requirements.yml
 driver:
  name: docker
 lint: |
  yamllint roles/nginx_hardening/ molecule/nginx_hardening/ .github/workflows/nginx_hardening.yml
  ansible-lint roles/nginx_hardening/
 platforms:
  - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
-    tmpfs:
+    cgroupns_mode: host
-      - /tmp
+    pre_build_image: true
      - /run
    capabilities:
      - SYS_ADMIN
    tty: true
    env:
      http_proxy: "${http_proxy}"
      https_proxy: "${https_proxy}"
      no_proxy: "${no_proxy}"
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
  name: ansible
@@ -57,11 +47,11 @@ scenario:
    - destroy
  test_sequence:
    - dependency
    - lint
    - destroy
    - syntax
    - create
    - prepare
    - check
    - converge
    - idempotence
    - verify
@@ -1,9 +1,9 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
  hosts: localhost
  vars:
-    - nginx_main_template_enable: true
+    nginx_main_template_enable: true
-    - nginx_main_template:
+    nginx_main_template:
      template_file: nginx.conf.j2
      conf_file_name: nginx.conf
      conf_file_location: /etc/nginx/
@@ -1,5 +1,5 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
  hosts: localhost
  roles:
    - nginxinc.nginx
@@ -1,5 +1,5 @@
 ---
- name: prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: Prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
  become: true
  hosts: all
  environment:
@@ -7,22 +7,23 @@
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
-    - name: install required tools on SuSE
+    - name: Install required tools on SuSE
-      zypper:
+      community.general.zypper:
-        name: "python-xml"
+        name: python-xml
        state: present
      when: ansible_facts.os_family == 'Suse'
-    - name: install required packages
+    - name: Install required packages
-      package:
+      ansible.builtin.package:
-        name: "python3-apt"
+        name: python3-apt
        update_cache: true
-      ignore_errors: true
+      ignore_errors: true # noqa ignore-errors
    - name: Set correct distribution Version for Amazon Linux
-      set_fact:
+      ansible.builtin.set_fact:
        ansible_distribution_major_version: 7
      when: ansible_distribution == 'Amazon'
-    - include_role:
+    - name: Install nginx with a generic Ansible role
      ansible.builtin.include_role:
        name: geerlingguy.nginx
@@ -1,4 +1,3 @@
 ---
 roles:
-  - geerlingguy.git
+  - name: geerlingguy.nginx
  - geerlingguy.nginx
@@ -6,57 +6,38 @@
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  roles:
    - geerlingguy.git
  tasks:
-    - name: install fake SuSE-release for cinc compatibility
+    - name: Install procps for debian systems
-      copy:
+      ansible.builtin.apt:
        content: |
          openSUSE Faked Enterprise 2020 (x86_64)
          VERSION = 2020
          CODENAME = Faked Feature
        dest: /etc/SuSE-release
        owner: root
        group: root
        mode: '0444'
      when: ansible_facts.os_family == 'Suse'
    - name: install git for SuSE since geerlinguy.git does not support it
      zypper:
        name: git
        state: present
      when: ansible_facts.os_family == 'Suse'
    - name: Run the equivalent of "apt-get update" as a separate step
      apt:
        update_cache: true
      when: ansible_facts.os_family == 'Debian'
    - name: install required tools on debian
      apt:
        name: procps
-      when: ansible_facts.os_family == 'Debian'
+        state: present
-
+        update_cache: true
-    - name: download cinc-auditor
+      when: ansible_distribution == 'Debian'
      get_url:
        url: https://omnitruck.cinc.sh/install.sh
        dest: /tmp/install.sh
        mode: '0775'
    - name: install cinc-auditor
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
 - name: Verify
  hosts: localhost
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit supermarket://dev-sec/nginx-baseline"
+      ansible.builtin.command: >
        docker run
        --volume /run/docker.sock:/run/docker.sock
        docker.io/cincproject/auditor exec
        -t docker://instance
        --no-show-progress --no-color
        --no-distinct-exit https://github.com/dev-sec/nginx-baseline/archive/refs/heads/master.zip
      register: test_results
      changed_when: false
      ignore_errors: true
    - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
        msg: "{{ test_results.stdout_lines }}"
    - name: Fail when tests fail
-      fail:
+      ansible.builtin.fail:
-        msg: "Inspec failed to validate"
+        msg: Inspec failed to validate
      when: test_results.rc != 0
@@ -1,31 +1,37 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  collections:
    - devsec.hardening
  tasks:
-    - name: workaround for https://github.com/ansible/ansible/issues/66304
+    - name: Workaround for https://github.com/ansible/ansible/issues/66304
-      set_fact:
+      ansible.builtin.set_fact:
-        ansible_virtualization_type: "docker"
+        ansible_virtualization_type: docker
-    - include_role:
+    - name: Include os_hardening role
-        name: os_hardening
+      ansible.builtin.include_role:
        name: devsec.hardening.os_hardening
  vars:
    os_security_users_allow: change_user
-    os_security_kernel_enable_core_dump: true
+    os_security_kernel_enable_core_dump: false
    os_auditd_num_logs: 10
    os_security_suid_sgid_remove_from_unknown: true
    os_auth_pam_passwdqc_enable: false
    os_auth_lockout_time: 15
    os_desktop_enable: true
-    os_env_extra_user_paths: ['/home']
+    os_env_extra_user_paths: [/home]
    os_auth_allow_homeless: true
-    os_security_suid_sgid_blacklist: ['/bin/umount']
+    os_security_suid_sgid_blacklist: [/bin/umount]
-    os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
+    os_security_suid_sgid_whitelist: [/usr/bin/rlogin]
    os_filesystem_whitelist: []
    os_yum_repo_file_whitelist: [foo.repo]
    os_users_without_password_ageing: [pw_no_ageing]
    os_auth_pw_warn_age: 7
    os_netrc_enabled: false
    os_ignore_users: [shell_sys_acc]
    os_ignore_home_folder_users: [user_with_777_home]
    sysctl_config:
      net.ipv4.ip_forward: 0
      net.ipv6.conf.all.forwarding: 0
@@ -37,7 +43,6 @@
      net.ipv4.icmp_ignore_bogus_error_responses: 1
      net.ipv4.icmp_ratelimit: 100
      net.ipv4.icmp_ratemask: 88089
      net.ipv6.conf.all.disable_ipv6: 1
      net.ipv4.conf.all.arp_ignore: 1
      net.ipv4.conf.all.arp_announce: 2
      net.ipv4.conf.all.shared_media: 1
@@ -67,8 +72,6 @@
 # - name: wrapper playbook for kitchen testing "ansible-os-hardening"
 #  hosts: all
 #  become: true
 #  collections:
 #    - devsec.hardening
 #  vars:
 #    os_auditd_enabled: false
 #  tasks:
@@ -78,9 +81,9 @@
 #      when: ansible_facts.distribution == 'Fedora'
 #
 #    - name: Run the equivalent of "apt-get update" as a separate step
-#      apt:
+#      ansible.builtin.apt:
 #        update_cache: yes
 #      when: ansible_facts.os_family == 'Debian'
 #
 #    - include_role:
-#        name: os_hardening
+#        name: devsec.hardening.os_hardening
@@ -1,37 +1,23 @@
 ---
 dependency:
  name: galaxy
  options:
    role-file: molecule/os_hardening/requirements.yml
 driver:
  name: docker
 lint: |
  yamllint roles/os_hardening/ molecule/os_hardening/ .github/workflows/os_hardening.yml
  ansible-lint roles/os_hardening/
 platforms:
  - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
-    tmpfs:
+    cgroupns_mode: host
-      - /tmp
+    pre_build_image: true
      - /run
    capabilities:
      - SYS_ADMIN
    tty: true
    env:
      http_proxy: "${http_proxy}"
      https_proxy: "${https_proxy}"
      no_proxy: "${no_proxy}"
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
  name: ansible
@@ -57,11 +43,11 @@ scenario:
    - destroy
  test_sequence:
    - dependency
    - lint
    - destroy
    - syntax
    - create
    - prepare
    - check
    - converge
    - idempotence
    - verify
@@ -1,49 +1,47 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
  hosts: all
  become: true
  collections:
    - devsec.hardening
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
-    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
+    - name: Set ansible_python_interpreter to "/usr/bin/python3" on fedora
-      set_fact:
+      ansible.builtin.set_fact:
-        ansible_python_interpreter: "/usr/bin/python3"
+        ansible_python_interpreter: /usr/bin/python3
      when: ansible_facts.distribution == 'Fedora'
    - name: Run the equivalent of "apt-get update && apt-get upgrade"
-      apt:
+      ansible.builtin.apt:
-        name: "*"
+        upgrade: safe
        state: latest
        update_cache: true
      when: ansible_os_family == 'Debian'
-    - name: install required tools on SuSE
+    - name: Install required tools on SuSE
      # cannot use zypper module, since it depends on python-xml
-      shell: "zypper -n install python-xml"
+      ansible.builtin.command: zypper -n install python-xml awk
      changed_when: false
      when: ansible_facts.os_family == 'Suse'
-    - name: install required tools on fedora
+    - name: Install required tools on fedora
-      dnf:
+      ansible.builtin.dnf:
        name:
          - python
          - findutils
          - procps-ng
      when: ansible_facts.distribution == 'Fedora'
-    - name: install packages
+    - name: Install required tools on Arch
-      pacman:
+      community.general.pacman:
        name:
-          - "awk"
+          - awk
        state: present
        update_cache: true
-      ignore_errors: true
+      when: ansible_facts.os_family == 'Archlinux'
-    - name: install required tools on RHEL
+    - name: Install required tools on RHEL # noqa ignore-errors
-      yum:
+      ansible.builtin.yum:
        name:
          - openssh-clients
          - openssh
@@ -51,6 +49,19 @@
        update_cache: true
      ignore_errors: true
-    - name: create recursing symlink to test minimize access
+    - name: Create recursing symlink to test minimize access
-      shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
+      ansible.builtin.shell: rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz
      changed_when: false
    - name: Include YUM prepare tasks
      ansible.builtin.include_tasks: prepare_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'
    - name: Include preparation tasks
      ansible.builtin.include_tasks:
        file: "{{ item }}"
      loop:
        - prepare_tasks/netrc.yml
        - prepare_tasks/pw_ageing.yml
        - prepare_tasks/sys_account_shell.yml
        - prepare_tasks/ignore_home_folders.yml
@@ -0,0 +1,9 @@
 ---
 - name: Create user whose home-folder should not be touched
  ansible.builtin.user:
    name: user_with_777_home
 - name: Change mode of home-folder for user to 777
  ansible.builtin.file:
    path: /home/user_with_777_home
    mode: "0777"
@@ -0,0 +1,9 @@
 ---
 - name: create '.netrc' in /root
  ansible.builtin.copy:
    dest: /root/.netrc
    mode: "0600"
    content: |
      machine localhost
      login root
      password ipsum
@@ -0,0 +1,10 @@
 ---
 - name: Create user those password ageing should not be changed
  user:
    name: pw_no_ageing
    password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
 - name: Create user those password ageing should be changed
  user:
    name: pw_ageing
    password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
@@ -0,0 +1,5 @@
 ---
 - name: Create system user with shell that should keep it
  user:
    name: shell_sys_acc
    shell: /bin/bash
@@ -0,0 +1,16 @@
 ---
 - name: Create 'foo' repository
  ansible.builtin.yum_repository:
    name: foo
    description: mandatory description
    baseurl: file:///mandatory-url
    enabled: false
    gpgcheck: false
 - name: Create 'bar' repository
  ansible.builtin.yum_repository:
    name: bar
    description: mandatory description
    baseurl: file:///mandatory-url
    enabled: false
    gpgcheck: false
@@ -1,3 +0,0 @@
 ---
 roles:
  - geerlingguy.git
@@ -6,75 +6,79 @@
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  roles:
    - geerlingguy.git
  tasks:
-    - name: install fake SuSE-release for cinc compatibility
+    - name: Set ansible_python_interpreter to "/usr/bin/python3"
-      copy:
+      ansible.builtin.set_fact:
-        content: |
+        ansible_python_interpreter: /usr/bin/python3
-          openSUSE Faked Enterprise 2020 (x86_64)
+      when: ansible_facts.distribution == 'Fedora'
          VERSION = 2020
          CODENAME = Faked Feature
        dest: /etc/SuSE-release
        owner: root
        group: root
        mode: '0444'
      when: ansible_facts.os_family == 'Suse'
-    - name: install git for SuSE since geerlinguy.git does not support it
+    - name: Include verification tasks
-      zypper:
+      ansible.builtin.include_tasks:
-        name: git
+        file: "{{ item }}"
-        state: present
+      loop:
-      when: ansible_facts.os_family == 'Suse'
+        - verify_tasks/sys_account_shell.yml
        - verify_tasks/pw_ageing.yml
        - verify_tasks/netrc.yml
        - verify_tasks/ignore_home_folders.yml
-    - name: Run the equivalent of "apt-get update" as a separate step
+    # temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
-      apt:
+    #    - name: Include PAM tests
-        update_cache: true
+    #      ansible.builtin.include_tasks: verify_tasks/pam.yml
-      when: ansible_facts.os_family == 'Debian'
+    #      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
-    - name: install required tools on debian
+    - name: Include YUM tests
-      apt:
+      ansible.builtin.include_tasks: verify_tasks/yum.yml
-        name: procps
+      when: ansible_facts.os_family == 'RedHat'
      when: ansible_facts.os_family == 'Debian'
    - name: include PAM tests
      include: verify_pam.yml
      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
    - name: download cinc-auditor
      get_url:
        url: https://omnitruck.cinc.sh/install.sh
        dest: /tmp/install.sh
        mode: '0775'
    - name: install cinc-auditor
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
 - name: Verify
  hosts: localhost
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit supermarket://dev-sec/linux-baseline"
+      ansible.builtin.command: >
        docker run
        --volume /run/docker.sock:/run/docker.sock
        --volume {{ playbook_dir }}/waivers.yaml:/waivers.yaml
        docker.io/cincproject/auditor exec
        -t docker://instance
        --no-show-progress --no-color
        --waiver-file /waivers.yaml
        --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip
      register: test_results
      changed_when: false
      ignore_errors: true
    - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
        msg: "{{ test_results.stdout_lines }}"
    - name: Fail when tests fail
-      fail:
+      ansible.builtin.fail:
-        msg: "Inspec failed to validate"
+        msg: Inspec failed to validate
      when: test_results.rc != 0
 - name: Verify
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    # test if variable can be overridden
-    - name: workaround for https://github.com/ansible/ansible/issues/66304
+    - name: Workaround for https://github.com/ansible/ansible/issues/66304
-      set_fact:
+      ansible.builtin.set_fact:
-        ansible_virtualization_type: "docker"
+        ansible_virtualization_type: docker
        os_env_umask: "027 #override"
-    - include_role:
+    - name: Include os_hardening role
-        name: os_hardening
+      ansible.builtin.include_role:
        name: devsec.hardening.os_hardening
-    - name: verify os_env_umask
+    - name: Verify os_env_umask
-      shell:
+      ansible.builtin.command:
        cmd: "grep '027 #override' /etc/login.defs"
      changed_when: false
@@ -0,0 +1,10 @@
 ---
 - name: Get properties of user user_with_777_home's home-folder
  ansible.builtin.stat:
    path: /home/user_with_777_home
  register: stats
 - name: Check that the home-folder has mode 777
  ansible.builtin.assert:
    that:
      - stats.stat.mode == "0777"
@@ -0,0 +1,19 @@
 ---
 - name: Test that .netrc in root homedir exists
  ansible.builtin.file:
    path: /root/.netrc
    state: file
  register: result_test_netrc
 - name: Output result if .netrc for user root exists
  ansible.builtin.assert:
    that:
      - result_test_netrc.state == 'file'
    fail_msg: .netrc in /root/ not present
    success_msg: .netrc exists in /root/
 - name: Delete '.netrc' in /root
  ansible.builtin.file:
    path: /root/.netrc
    state: absent
  when: result_test_netrc.state == 'file'
@@ -0,0 +1,66 @@
 ---
 - name: install pip
  package:
    name:
      - python3-pip
      - python3-setuptools
    state: present
 - name: install pam-tester
  ansible.builtin.pip:
    name: pam-tester
    state: present
    executable: /usr/bin/pip3
 - name: set password for test
  ansible.builtin.set_fact:
    test_pw: myTest!pw
 - name: set locale for test
  ansible.builtin.set_fact:
    locale: en_US.UTF-8
  when:
    - ansible_facts.os_family == 'RedHat'
    - ansible_facts.distribution_major_version < '8'
 - name: create testuser
  user:
    name: testuser
    password: "{{ test_pw | password_hash('sha512') }}"
 - name: check successful login with correct password
  ansible.builtin.shell:
    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"
 - name: check unsuccessful login with incorrect password
  ansible.builtin.shell:
    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"
  with_sequence: count=6
 - name: check unsuccessful login, with correct password (lockout)
  ansible.builtin.shell:
    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"
 - name: wait for account to unlock
  pause:
    seconds: 20
 - name: check successful login
  ansible.builtin.shell:
    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"
@@ -0,0 +1,32 @@
 ---
 - name: Get Password Expiry date for use pw_no_ageing
  ansible.builtin.shell: chage -l pw_no_ageing | grep "Password expires" | cut -d ":" -f 2
  changed_when: false
  register: expiry_date
 - name: Check that the expiry date of pw_no_ageing is "never"
  ansible.builtin.assert:
    that:
      - expiry_date.stdout | trim == 'never'
 - name: Get Password Expiry date for pw_ageing
  ansible.builtin.shell: chage -l pw_ageing | grep "Password expires" | cut -d ":" -f 2
  changed_when: false
  register: expiry_date
 - name: Check that the expiry date of pw_ageing is 60 days
  ansible.builtin.assert:
    # this uses the date from the expire_date variable and subtracts the current date.
    # it should be bigger that the password_expire_min of the user "pw_no_ageing"
    that:
      - ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_date_time.date | to_datetime('%Y-%m-%d')).days == 60
 - name: Get Password Expiry warning days for pw_ageing
  ansible.builtin.shell: chage -l pw_ageing | grep "warning before password expires" | cut -d ":" -f 2
  changed_when: false
  register: expiry_warndays
 - name: Check that number of days of warning before password expires is 7 days
  ansible.builtin.assert:
    that:
      - expiry_warndays.stdout | trim == '7'
@@ -0,0 +1,9 @@
 ---
 - name: Read local linux user database
  getent:
    database: passwd
 - name: Check that shell_sys_acc's shell is still bash
  ansible.builtin.assert:
    that:
      - getent_passwd['shell_sys_acc'][5] == "/bin/bash"
@@ -0,0 +1,8 @@
 ---
 - name: Verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
  changed_when: false
 - name: Verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
  changed_when: false
@@ -0,0 +1,9 @@
 os-14:
  run: false
  justification: "ansible does not gather all fact-mounts (e.g. mounts with tmpfs) so we cannot change these. see https://github.com/ansible/ansible/pull/79787"
 os-15:
  run: false
  justification: "ansible does not gather all fact-mounts (e.g. mounts with tmpfs) so we cannot change these. see https://github.com/ansible/ansible/pull/79787"
 os-16:
  run: false
  justification: "ansible does not gather all fact-mounts (e.g. mounts with tmpfs) so we cannot change these. see https://github.com/ansible/ansible/pull/79787"
@@ -0,0 +1,22 @@
 *******
 Docker driver installation guide
 *******
 Requirements
 ============
 * Docker Engine
 Install
 =======
 Please refer to the `Virtual environment`_ documentation for installation best
 practices. If not using a virtual environment, please consider passing the
 widely recommended `'--user' flag`_ when invoking ``pip``.
 .. _Virtual environment: https://virtualenv.pypa.io/en/latest/
 .. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
 .. code-block:: bash
    $ python3 -m pip install 'molecule[docker]'
@@ -0,0 +1,32 @@
 ---
 - name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Override for arch
      ansible.builtin.set_fact:
        os_mnt_boot_enabled: false
        os_mnt_tmp_enabled: true
        os_mnt_tmp_src: tmpfs
        os_mnt_tmp_filesystem: tmpfs
      when: ansible_facts.os_family == 'Archlinux'
    - name: Overrides for Fedora image
      ansible.builtin.set_fact:
        os_mnt_tmp_enabled: true
        os_mnt_tmp_src: tmpfs
        os_mnt_tmp_filesystem: tmpfs
      when: ansible_facts.distribution == 'Fedora'
    - name: Include os_hardening role
      ansible.builtin.include_role:
        name: devsec.hardening.os_hardening
  vars:
    os_auth_pam_passwdqc_enable: false
    os_auth_lockout_time: 15
    os_yum_repo_file_whitelist: [foo.repo]
    os_mnt_boot_enabled: true
    os_mnt_home_enabled: true
    os_mnt_boot_src: /dev/vda1
@@ -0,0 +1,63 @@
 ---
 dependency:
  name: galaxy
  options:
    role-file: molecule/os_hardening_vm/requirements.yml
 driver:
  name: vagrant
  provider:
    name: libvirt
 platforms:
  # we need to name every instance differently to start multiple VMs on the same host (parallelization)
  # since we also need to use different OS users to run the tests because of how molecule operates,
  # the VM names must be predictable by OS user (to clean up canceled runs)
  - name: ${USER}
    box: ${MOLECULE_DISTRO}
    memory: 1024
    cpus: 2
 provisioner:
  name: ansible
  options:
    diff: true
  env:
    ANSIBLE_PIPELINING: "True"
  config_options:
    defaults:
      interpreter_python: auto_silent
      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
  name: ansible
  env:
    ANSIBLE_PIPELINING: "True"
 scenario:
  create_sequence:
    - dependency
    - create
    - prepare
  check_sequence:
    - dependency
    - destroy
    - create
    - prepare
    - converge
    - check
    - destroy
  converge_sequence:
    - dependency
    - create
    - prepare
    - converge
  destroy_sequence:
    - destroy
  test_sequence:
    - dependency
    - destroy
    - syntax
    - create
    - prepare
    - check
    - converge
    - idempotence
    - verify
    - destroy
@@ -0,0 +1,80 @@
 ---
 - name: Prepare Archliux host
  hosts: all
  become: true
  gather_facts: false
  tasks:
    - name: Install python, since it's not installed by default
      ansible.builtin.raw: pacman --noconfirm -Sy python
      changed_when: false
      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
 - name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Set ansible_python_interpreter to "/usr/bin/python3" on fedora
      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when: ansible_facts.distribution == 'Fedora'
    - name: Block update of Grub, because of error
      ansible.builtin.dpkg_selections:
        name: grub-pc
        selection: hold
      when: ansible_os_family == 'Debian'
    - name: Run the equivalent of "apt-get update && apt-get upgrade"
      ansible.builtin.apt:
        upgrade: safe
        update_cache: true
      when: ansible_os_family == 'Debian'
    - name: Install required tools on SuSE
      # cannot use zypper module, since it depends on python-xml
      ansible.builtin.command: zypper -n install python-xml
      changed_when: false
      when: ansible_facts.os_family == 'Suse'
    - name: Install required tools on fedora
      ansible.builtin.dnf:
        name:
          - python
          - findutils
          - procps-ng
      when: ansible_facts.distribution == 'Fedora'
    - name: Install required tools on Arch
      community.general.pacman:
        name:
          - awk
        state: present
        update_cache: true
      when: ansible_facts.os_family == 'Archlinux'
    - name: Install required tools on RHEL # noqa ignore-errors
      ansible.builtin.yum:
        name:
          - openssh-clients
          - openssh
        state: present
        update_cache: true
      ignore_errors: true
    - name: Create recursing symlink to test minimize access
      ansible.builtin.shell: rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz
      changed_when: false
    - name: Unmount EFI partition to get rid of vfat filesystem (qemu has no firmware image that inspec can detect)
      ansible.posix.mount:
        path: /boot/efi
        state: unmounted
      when: ansible_facts.distribution == 'Fedora'
    - name: Include YUM prepare tasks
      ansible.builtin.include_tasks: prepare_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'
@@ -0,0 +1,16 @@
 ---
 - name: Create 'foo' repository
  ansible.builtin.yum_repository:
    name: foo
    description: mandatory description
    baseurl: file:///mandatory-url
    enabled: false
    gpgcheck: false
 - name: Create 'bar' repository
  ansible.builtin.yum_repository:
    name: bar
    description: mandatory description
    baseurl: file:///mandatory-url
    enabled: false
    gpgcheck: false
@@ -0,0 +1,3 @@
 ---
 roles:
  - name: geerlingguy.git
@@ -0,0 +1,60 @@
 ---
 - name: Verify
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    # temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
    #    - name: Include PAM tests
    #      ansible.builtin.include_tasks: verify_tasks/pam.yml
    #      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
    - name: Include YUM tests
      ansible.builtin.include_tasks: verify_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'
 - name: Verify
  hosts: localhost
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Get ssh-config
      ansible.builtin.command:
        cmd: vagrant ssh-config
        chdir: "{{ molecule_ephemeral_directory }}"
      register: ssh_config
      changed_when: false
    - name: Create ssh-config file
      ansible.builtin.copy:
        content: "{{ ssh_config.stdout_lines | join ('\n') }}"
        dest: "{{ molecule_ephemeral_directory }}/ssh-config"
        mode: "0400"
      changed_when: false
    - name: Execute cinc-auditor tests
      ansible.builtin.command: >
        docker run
        --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
        docker.io/cincproject/auditor exec
        --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
        -t ssh://{{ lookup('env', 'USER') }}
        --sudo --no-show-progress --no-color
        --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip
      register: test_results
      changed_when: false
      ignore_errors: true
    - name: Display details about the cinc-auditor results
      ansible.builtin.debug:
        msg: "{{ test_results.stdout_lines }}"
    - name: Fail when tests fail
      ansible.builtin.fail:
        msg: Inspec failed to validate
      when: test_results.rc != 0
@@ -1,17 +1,23 @@
 ---
- name: download pam-tester
+- name: install pip
-  get_url:
+  package:
-    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
+    name:
-    dest: /bin/pam-tester
+      - python3-pip
-    mode: 0555
+      - python3-setuptools
    state: present
 - name: install pam-tester
  ansible.builtin.pip:
    name: pam-tester
    state: present
 - name: set password for test
-  set_fact:
+  ansible.builtin.set_fact:
-    test_pw: "myTest!pw"
+    test_pw: myTest!pw
 - name: set locale for test
-  set_fact:
+  ansible.builtin.set_fact:
-    locale: "en_US.UTF-8"
+    locale: en_US.UTF-8
  when:
    - ansible_facts.os_family == 'RedHat'
    - ansible_facts.distribution_major_version < '8'
@@ -21,26 +27,26 @@
    name: testuser
    password: "{{ test_pw | password_hash('sha512') }}"
- name: check successfull login with correct password
+- name: check successful login with correct password
-  shell:
+  ansible.builtin.shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+    cmd: pam-tester --user testuser --password {{ test_pw }}
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"
- name: check unsuccessfull login with incorrect password
+- name: check unsuccessful login with incorrect password
-  shell:
+  ansible.builtin.shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+    cmd: pam-tester --user testuser --password {{ test_pw }}fail --expectfail
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"
  with_sequence: count=6
- name: check unsuccessfull login, with correct password (lockout)
+- name: check unsuccessful login, with correct password (lockout)
-  shell:
+  ansible.builtin.shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
+    cmd: pam-tester --user testuser --password {{ test_pw }} --expectfail
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -50,9 +56,9 @@
  pause:
    seconds: 20
- name: check successfull login
+- name: check successful login
-  shell:
+  ansible.builtin.shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+    cmd: pam-tester --user testuser --password {{ test_pw }}
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -0,0 +1,8 @@
 ---
 - name: Verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
  changed_when: false
 - name: Verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
  changed_when: false
@@ -1,13 +1,13 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  collections:
    - devsec.hardening
  tasks:
-    - include_role:
+    - name: Include ssh_hardening role
-        name: ssh_hardening
+      ansible.builtin.include_role:
        name: devsec.hardening.ssh_hardening
  vars:
    sftp_enabled: false
@@ -1,37 +1,29 @@
 ---
 dependency:
  name: galaxy
  options:
    role-file: molecule/ssh_hardening/requirements.yml
 driver:
  name: docker
 lint: |
  yamllint roles/ssh_hardening/ molecule/ssh_hardening/ .github/workflows/ssh_hardening.yml
  ansible-lint roles/ssh_hardening/
 platforms:
  - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
-    tmpfs:
+    cgroupns_mode: host
-      - /tmp
+    pre_build_image: true
      - /run
    capabilities:
      - SYS_ADMIN
    tty: true
    env:
      http_proxy: "${http_proxy}"
      https_proxy: "${https_proxy}"
      no_proxy: "${no_proxy}"
      container: docker
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
  inventory:
    host_vars:
      # https://molecule.readthedocs.io/en/latest/examples.html#docker-with-non-privileged-user
      # setting for the platform instance named 'instance'
      instance:
        ansible_user: ansible
 verifier:
  name: ansible
@@ -57,11 +49,11 @@ scenario:
    - destroy
  test_sequence:
    - dependency
    - lint
    - destroy
    - syntax
    - create
    - prepare
    - check
    - converge
    - idempotence
    - verify
@@ -1,5 +1,5 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
  hosts: all
  become: true
  environment:
@@ -7,13 +7,13 @@
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
-    - name: use python3
+    - name: Use python3
-      set_fact:
+      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when: ansible_facts.distribution == 'Fedora'
-    - name: install packages
+    - name: Install packages # noqa ignore-errors
-      yum:
+      ansible.builtin.yum:
        name:
          - openssh-clients
          - openssh-server
@@ -22,8 +22,8 @@
        update_cache: true
      ignore_errors: true
-    - name: install packages
+    - name: Install packages # noqa ignore-errors
-      dnf:
+      ansible.builtin.dnf:
        name:
          - openssh-clients
          - openssh-server
@@ -32,8 +32,8 @@
        update_cache: true
      ignore_errors: true
-    - name: install packages
+    - name: Install packages # noqa ignore-errors
-      apt:
+      ansible.builtin.apt:
        name:
          - openssh-client
          - openssh-server
@@ -41,36 +41,38 @@
        update_cache: true
      ignore_errors: true
-    - name: install required tools on SuSE
+    - name: Install required tools on SuSE
      # cannot use zypper module, since it depends on python-xml
-      shell: "zypper -n install python-xml"
+      ansible.builtin.command: zypper -n install python-xml
      changed_when: false
      when: ansible_facts.os_family == 'Suse'
-    - name: install packages
+    - name: Install packages
-      zypper:
+      community.general.zypper:
        name:
-          - "openssh"
+          - openssh
      when: ansible_facts.os_family == 'Suse'
-    - name: install packages
+    - name: Install required tools on Arch
-      pacman:
+      community.general.pacman:
        name:
-          - "openssh"
+          - openssh
-          - "awk"
+          - awk
        state: present
        update_cache: true
-      ignore_errors: true
+      when: ansible_facts.os_family == 'Archlinux'
-    - name: created needed directory
+    - name: Created needed directory
-      file:
+      ansible.builtin.file:
-        path: "/var/run/sshd"
+        path: /var/run/sshd
        state: directory
        mode: "0755"
-    - name: create ssh host keys
+    - name: Create ssh host keys # noqa ignore-errors
-      command: "ssh-keygen -A"
+      ansible.builtin.command: ssh-keygen -A
-      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
-            ansible_facts.distribution == "Fedora" or
+        or ansible_facts.distribution == "Fedora"
-            ansible_facts.distribution == "Amazon" or
+        or ansible_facts.distribution == "Amazon"
-            ansible_facts.os_family == "Suse"
+        or ansible_facts.os_family == "Suse"
      changed_when: false
      ignore_errors: true
@@ -1,3 +0,0 @@
 ---
 roles:
  - geerlingguy.git
@@ -1,57 +1,28 @@
 ---
 - name: Verify
-  hosts: all
+  hosts: localhost
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  roles:
    - geerlingguy.git
  tasks:
    - name: install fake SuSE-release for cinc compatibility
      copy:
        content: |
          openSUSE Faked Enterprise 2020 (x86_64)
          VERSION = 2020
          CODENAME = Faked Feature
        dest: /etc/SuSE-release
        owner: root
        group: root
        mode: '0444'
      when: ansible_facts.os_family == 'Suse'
    - name: install git for SuSE since geerlinguy.git does not support it
      zypper:
        name: git
        state: present
      when: ansible_facts.os_family == 'Suse'
    - name: install crypto compat modules on fedora
      dnf:
        name: libxcrypt-compat
      when: ansible_facts.distribution == 'Fedora'
    - name: download cinc-auditor
      get_url:
        url: https://omnitruck.cinc.sh/install.sh
        dest: /tmp/install.sh
        mode: '0775'
    - name: install cinc-auditor
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit supermarket://dev-sec/nginx-baseline"
+      ansible.builtin.command: >
        docker run
        --volume /run/docker.sock:/run/docker.sock
        docker.io/cincproject/auditor exec
        -t docker://instance
        --no-show-progress --no-color
        --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip
      register: test_results
      changed_when: false
      ignore_errors: true
    - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
        msg: "{{ test_results.stdout_lines }}"
    - name: Fail when tests fail
-      fail:
+      ansible.builtin.fail:
-        msg: "Inspec failed to validate"
+        msg: Inspec failed to validate
      when: test_results.rc != 0
@@ -0,0 +1,22 @@
 *******
 Docker driver installation guide
 *******
 Requirements
 ============
 * Docker Engine
 Install
 =======
 Please refer to the `Virtual environment`_ documentation for installation best
 practices. If not using a virtual environment, please consider passing the
 widely recommended `'--user' flag`_ when invoking ``pip``.
 .. _Virtual environment: https://virtualenv.pypa.io/en/latest/
 .. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
 .. code-block:: bash
    $ python3 -m pip install 'molecule[docker]'
@@ -0,0 +1,13 @@
 ---
 - name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
  hosts: all
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Include ssh_hardening role
      ansible.builtin.include_role:
        name: devsec.hardening.ssh_hardening
  vars:
    sftp_enabled: false
@@ -0,0 +1,58 @@
 ---
 driver:
  name: vagrant
  provider:
    name: libvirt
 platforms:
  # we need to name every instance differently to start multiple VMs on the same host (parallelization)
  # since we also need to use different OS users to run the tests because of how molecule operates,
  # the VM names must be predictable by OS user (to clean up canceled runs)
  - name: ${USER}
    box: generic/${MOLECULE_DISTRO}
    memory: 1024
    cpus: 2
 provisioner:
  name: ansible
  options:
    diff: true
  env:
    ANSIBLE_PIPELINING: "True"
  config_options:
    defaults:
      interpreter_python: auto_silent
      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
  name: ansible
  env:
    ANSIBLE_PIPELINING: "True"
 scenario:
  create_sequence:
    - dependency
    - create
    - prepare
  check_sequence:
    - dependency
    - destroy
    - create
    - prepare
    - converge
    - check
    - destroy
  converge_sequence:
    - dependency
    - create
    - prepare
    - converge
  destroy_sequence:
    - destroy
  test_sequence:
    - dependency
    - destroy
    - syntax
    - create
    - prepare
    - converge
    - idempotence
    - verify
    - destroy
@@ -0,0 +1,34 @@
 ---
 - name: Prepare OpenBSD host
  hosts: all
  become: true
  gather_facts: false
  tasks:
    - name: Install python
      # BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
      ansible.builtin.raw: pkg_add python%3.10
      changed_when: false
      when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
 - name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Created needed directory
      ansible.builtin.file:
        path: /var/run/sshd
        state: directory
        mode: "0755"
    - name: Create ssh host keys # noqa ignore-errors
      ansible.builtin.command: ssh-keygen -A
      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
        or ansible_facts.distribution == "Fedora"
        or ansible_facts.distribution == "Amazon"
        or ansible_facts.os_family == "Suse"
      changed_when: false
      ignore_errors: true
@@ -0,0 +1,57 @@
 ---
 - name: OpenBSD workaround - inspec detects OpenSBD as unix and not linux compatible
  hosts: all
  become: true
  tasks:
    - name: Use the type command instead of which to detect existing commands
      ansible.builtin.file:
        src: /usr/bin/which
        dest: /usr/bin/type
        state: hard
        mode: "0770"
      when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
 - name: Verify
  hosts: localhost
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Get ssh-config
      ansible.builtin.command:
        cmd: vagrant ssh-config
        chdir: "{{ molecule_ephemeral_directory }}"
      register: ssh_config
      changed_when: false
    - name: Create ssh-config file
      ansible.builtin.copy:
        content: "{{ ssh_config.stdout_lines | join ('\n') }}"
        dest: "{{ molecule_ephemeral_directory }}/ssh-config"
        mode: "0400"
      changed_when: false
    - name: Execute cinc-auditor tests
      ansible.builtin.command: >
        docker run
        --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
        --volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') }}.yaml:/waivers.yaml
        docker.io/cincproject/auditor exec
        --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
        -t ssh://{{ lookup('env', 'USER') }}
        --sudo --no-show-progress --no-color
        --waiver-file /waivers.yaml
        --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip
      register: test_results
      changed_when: false
      ignore_errors: true
    - name: Display details about the cinc-auditor results
      ansible.builtin.debug:
        msg: "{{ test_results.stdout_lines }}"
    - name: Fail when tests fail
      ansible.builtin.fail:
        msg: Inspec failed to validate
      when: test_results.rc != 0
@@ -0,0 +1,3 @@
 sshd-45:
  run: false
  justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"
@@ -0,0 +1,3 @@
 sshd-45:
  run: false
  justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"
@@ -0,0 +1,3 @@
 sshd-45:
  run: false
  justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"
@@ -0,0 +1,21 @@
 ssh-17:
  run: false
  justification: "GSSAPIAuthentication is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
 ssh-18:
  run: false
  justification: "GSSAPIDelegateCredentials is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
 sshd-30:
  run: false
  justification: "KerberosAuthentication is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
 sshd-31:
  run: false
  justification: "KerberosOrLocalPasswd is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
 sshd-32:
  run: false
  justification: "KerberosTicketCleanup is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
 sshd-33:
  run: false
  justification: "GSSAPIAuthentication is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
 sshd-34:
  run: false
  justification: "GSSAPICleanupCredentials is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
@@ -0,0 +1,22 @@
 *******
 Docker driver installation guide
 *******
 Requirements
 ============
 * Docker Engine
 Install
 =======
 Please refer to the `Virtual environment`_ documentation for installation best
 practices. If not using a virtual environment, please consider passing the
 widely recommended `'--user' flag`_ when invoking ``pip``.
 .. _Virtual environment: https://virtualenv.pypa.io/en/latest/
 .. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
 .. code-block:: bash
    $ python3 -m pip install 'molecule[docker]'
@@ -0,0 +1,97 @@
 ---
 - name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Include ssh_hardening role
      ansible.builtin.include_role:
        name: devsec.hardening.ssh_hardening
  vars:
    ssh_trusted_user_ca_keys_file: /etc/ssh/ca.pub
    ssh_trusted_user_ca_keys:
      - "# ssh-rsa ..."
    ssh_authorized_principals_file: /etc/ssh/auth_principals/%u
    ssh_authorized_principals:
      - path: /etc/ssh/auth_principals/root
        principals:
          - root
    network_ipv6_enable: true
    ssh_allow_tcp_forwarding: "yes"
    ssh_gateway_ports: true
    ssh_allow_agent_forwarding: true
    ssh_server_permit_environment_vars: "yes"
    ssh_server_accept_env_vars: PWD HTTP_PROXY
    ssh_client_alive_interval: 100
    ssh_client_alive_count: 10
    ssh_client_password_login: true
    ssh_challengeresponseauthentication: true
    ssh_compression: true
    ssh_allow_users: root kitchen vagrant
    ssh_allow_groups: root kitchen vagrant
    ssh_deny_users: foo bar
    ssh_deny_groups: foo bar
    ssh_authorized_keys_file: /etc/ssh/authorized_keys/%u
    ssh_max_auth_retries: 10
    ssh_permit_root_login: without-password
    ssh_permit_tunnel: "yes"
    ssh_print_motd: true
    ssh_print_last_log: true
    ssh_banner: true
    ssh_server_password_login: true
    sftp_chroot: true
    # ssh_server_enabled: false
    ssh_server_ports:
      - 22
      - 222
    ssh_server_match_address:
      - address: 192.168.1.0/24
        rules:
          - AllowTcpForwarding yes
          - AllowAgentForwarding no
    ssh_server_match_group:
      - group: root
        rules:
          - AllowTcpForwarding yes
          - AllowAgentForwarding no
    ssh_server_match_user:
      - user: root
        rules:
          - AllowTcpForwarding yes
          - AllowAgentForwarding no
    ssh_server_match_local_port:
      - port: 222
        rules:
          - AllowTcpForwarding yes
          - AllowAgentForwarding no
    ssh_remote_hosts:
      - names: [example.com, example2.com]
        options: [Port 2222, ForwardAgent yes]
      - names: [example3.com]
        options: [StrictHostKeyChecking no]
    ssh_use_dns: true
    ssh_use_pam: true
    ssh_max_startups: 10:30:60
    ssh_host_key_algorithms:
      - ssh-ed25519
      - rsa-sha2-512
      - rsa-sha2-256
      - ssh-rsa
    ssh_macs:
      - hmac-sha2-512
      - hmac-sha2-256
    ssh_ciphers:
      - aes256-ctr
      - aes192-ctr
      - aes128-ctr
      - aes256-cbc
    ssh_kex:
      - diffie-hellman-group-exchange-sha256
      - diffie-hellman-group-exchange-sha1
    ssh_custom_options:
      - Include /etc/ssh/ssh_config.d/*
    sshd_custom_options:
      - AcceptEnv LANG
@@ -0,0 +1,54 @@
 ---
 driver:
  name: docker
 platforms:
  - name: instance
    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    privileged: true
    cgroupns_mode: host
    pre_build_image: true
 provisioner:
  name: ansible
  options:
    diff: true
  config_options:
    defaults:
      interpreter_python: auto_silent
      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
  name: ansible
 scenario:
  create_sequence:
    - dependency
    - create
    - prepare
  check_sequence:
    - dependency
    - destroy
    - create
    - prepare
    - converge
    - check
    - destroy
  converge_sequence:
    - dependency
    - create
    - prepare
    - converge
  destroy_sequence:
    - destroy
  test_sequence:
    - dependency
    - destroy
    - syntax
    - create
    - prepare
    - check
    - converge
    - idempotence
    - verify
    - destroy
@@ -0,0 +1,78 @@
 ---
 - name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Use python3
      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when: ansible_facts.distribution == 'Fedora'
    - name: Install packages # noqa ignore-errors
      ansible.builtin.yum:
        name:
          - openssh-clients
          - openssh-server
          - libselinux-python
        state: present
        update_cache: true
      ignore_errors: true
    - name: Install packages # noqa ignore-errors
      ansible.builtin.dnf:
        name:
          - openssh-clients
          - openssh-server
          - procps-ng
        state: present
        update_cache: true
      ignore_errors: true
    - name: Install packages # noqa ignore-errors
      ansible.builtin.apt:
        name:
          - openssh-client
          - openssh-server
        state: present
        update_cache: true
      ignore_errors: true
    - name: Install required tools on SuSE
      # cannot use zypper module, since it depends on python-xml
      ansible.builtin.command: zypper -n install python-xml
      changed_when: false
      when: ansible_facts.os_family == 'Suse'
    - name: Install packages
      community.general.zypper:
        name:
          - openssh
      when: ansible_facts.os_family == 'Suse'
    - name: Install required tools on Arch
      community.general.pacman:
        name:
          - openssh
          - awk
        state: present
        update_cache: true
      when: ansible_facts.os_family == 'Archlinux'
    - name: Created needed directory
      ansible.builtin.file:
        path: /var/run/sshd
        state: directory
        mode: "0755"
    - name: Create ssh host keys # noqa ignore-errors
      ansible.builtin.command: ssh-keygen -A
      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
        or ansible_facts.distribution == "Fedora"
        or ansible_facts.distribution == "Amazon"
        or ansible_facts.os_family == "Suse"
      changed_when: false
      ignore_errors: true
@@ -0,0 +1,15 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:base",
    ":gitSignOff"
  ],
  "dependencyDashboard": true,
  "dependencyDashboardAutoclose": true,
  "packageRules": [
    {
      "matchUpdateTypes": ["patch", "minor"],
      "automerge": true
    }
  ]
 }
@@ -1,6 +1,7 @@
-molecule[docker]
+molecule
 molecule-plugins[docker]
 yamllint
-ansible
+ansible-core==2.16.2
 ansible-lint
 docker
 flake8
@@ -91,7 +91,7 @@
 **Implemented enhancements:**
- add follow=yes to my.cnf protect task, incase its a symlink. fixes \#20 [\#21](https://github.com/dev-sec/ansible-mysql-hardening/pull/21) ([rndmh3ro](https://github.com/rndmh3ro))
+- add follow=yes to my.cnf protect task, in case its a symlink. fixes \#20 [\#21](https://github.com/dev-sec/ansible-mysql-hardening/pull/21) ([rndmh3ro](https://github.com/rndmh3ro))
 - add changelog generator [\#7](https://github.com/dev-sec/ansible-mysql-hardening/pull/7) ([chris-rock](https://github.com/chris-rock))
 **Closed issues:**
@@ -1,6 +1,6 @@
 # devsec.mysql_hardening
-![devsec.mysql_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.mysql_hardening/badge.svg)
+[![devsec.mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
 ## Description
@@ -12,71 +12,130 @@ It configures:
 - Removes anonymous users, users without a password or authentication_string and test databases
 - various hardening options inside MySQL
 Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.
 Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
 ## Requirements
- Ansible 2.9.0
+- An existing installation of MySQL or MariaDB.
- An existing MySQL installation
+- python-jmespath on the ansible host
-### Example playbook
+<!-- BEGIN_ANSIBLE_DOCS -->
-```yml
+## Supported Operating Systems
- hosts: localhost
+- EL
-  collections:
+  - 7, 8, 9
-    - devsec.hardening
+- Ubuntu
-  roles:
+  - bionic, focal, jammy
-    - mysql_hardening
+- Debian
-```
+  - bullseye, buster
-
+- Amazon
-This role expects an existing installation of MySQL or MariaDB. Please ensure that the following variables are set accordingly:
+- opensuse
 - `mysql_hardening_enabled: yes` role is enabled by default and can be disabled without removing it from a playbook. You can use conditional variable, for example: `mysql_hardening_enabled: "{{ true if mysql_enabled else false }}"`
 - `mysql_hardening_user: 'mysql'` The user that mysql runs as.
 - `mysql_datadir: '/var/lib/mysql'` The MySQL data directory
 - `mysql_hardening_mysql_hardening_conf_file: '/etc/mysql/conf.d/hardening.cnf'` The path to the configuration file where the hardening will be performed
 ## Role Variables
 - `mysql_daemon_enabled`
  - Default: `true`
  - Description: Whether to enable the MySQL-service so it starts on boot
  - Type: bool
  - Required: no
 - `mysql_hardening_chroot`
-  - Default: ""
+  - Default: ``
  - Description: [chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)
- `mysql_hardening_options.safe-user-create`
+  - Type: str
-  - Default: 1
+  - Required: no
  - Description: [safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)
 - `mysql_hardening_options.secure-auth`
  - Default: 1
  - Description: [secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)
 - `mysql_hardening_options.skip-symbolic-links`
  - Default: 1
  - Description: [skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)
 - `mysql_hardening_skip_grant_tables:`
  - Default: false
  - Description: [skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)
 - `mysql_hardening_skip_show_database`
  - Default: 1
  - Description: [skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)
 - `mysql_hardening_options.local-infile`
  - Default: 0
  - Description: [local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)
 - `mysql_hardening_options.allow-suspicious-udfs`
  - Default: 0
  - Description: [allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)
 - `mysql_hardening_chroot.automatic-sp-privileges`
-  - Default: 0
+  - Default: `0`
  - Description: [automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)
  - Type: int
  - Required: no
 - `mysql_hardening_enabled`
  - Default: `true`
  - Description: Whether to run the hardening
  - Type: bool
  - Required: no
 - `mysql_hardening_options.allow-suspicious-udfs`
  - Default: `0`
  - Description: [allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)
  - Type: int
  - Required: no
 - `mysql_hardening_options.local-infile`
  - Default: `0`
  - Description: [local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)
  - Type: int
  - Required: no
 - `mysql_hardening_options.safe-user-create`
  - Default: `1`
  - Description: [safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)
  - Type: int
  - Required: no
 - `mysql_hardening_options.secure-auth`
  - Default: `1`
  - Description: [secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)
  - Type: int
  - Required: no
 - `mysql_hardening_options.secure-file-priv`
-  - Default: /tmp
+  - Default: `/tmp`
  - Description: [secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)
- `mysql_allow_remote_root`
+  - Type: str
-  - Default: false
+  - Required: no
-  - Description: delete remote root users
+- `mysql_hardening_options.skip-symbolic-links`
- `mysql_remove_anonymous_users`
+  - Default: `1`
-  - Default: true
+  - Description: [skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)
-  - Description: remove users without authentication
+  - Type: int
- `mysql_remove_test_database`
+  - Required: no
  - Default: true
  - Description: remove test database
 - `mysql_hardening_restart_mysql`
-  - Default: true
+  - Default: `true`
  - Description: Restart mysql after running this role
  - Type: bool
  - Required: no
 - `mysql_hardening_skip_grant_tables:`
  - Default: `false`
  - Description: [skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)
  - Type: bool
  - Required: no
 - `mysql_hardening_skip_show_database`
  - Default: `1`
  - Description: [skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)
  - Type: int
  - Required: no
 - `mysql_remove_anonymous_users`
  - Default: `true`
  - Description: Set to `false` to keep users without authentication
  - Type: bool
  - Required: no
 - `mysql_remove_remote_root`
  - Default: `true`
  - Description: If `true`, root can only connect from localhost. Set to `false` to not remove remote root users.
  - Type: bool
  - Required: no
 - `mysql_remove_test_database`
  - Default: `true`
  - Description: Set to `false` to keep the test database
  - Type: bool
  - Required: no
 - `mysql_root_password`
  - Default: `-----====>SetR00tPa$$wordH3r3!!!<====-----`
  - Description: The default password. Please change or overwrite it
  - Type: str
  - Required: no
 - `mysql_user_home`
  - Default: `{{ ansible_env.HOME }}`
  - Description: The path where the `.my.cnf` will be stored
  - Type: str
  - Required: no
-Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
+## Dependencies
 None.
 ## Example Playbook
 ```
 - hosts: all
  roles:
    - name: devsec.hardening.mysql_hardening
 ```
 <!-- END_ANSIBLE_DOCS -->
@@ -6,13 +6,10 @@ mysql_daemon_enabled: true
 mysql_hardening_restart_mysql: true
 # general configuration
 mysql_datadir: '/var/lib/mysql'
 mysql_hardening_mysql_hardening_conf_file: '{{mysql_hardening_mysql_confd_dir}}/hardening.cnf'
 # You have to change this to your own strong enough mysql root password
-mysql_root_password: '-----====>SetR00tPa$$wordH3r3!!!<====-----'
+mysql_root_password: "-----====>SetR00tPa$$wordH3r3!!!<====-----"
 # There .my.cnf with mysql root credentials will be installed
-mysql_user_home: "{{ ansible_env.HOME}}"
+mysql_user_home: "{{ ansible_env.HOME }}"
 # ensure the following parameters are set properly
 mysql_remove_remote_root: true
@@ -49,6 +46,6 @@ mysql_hardening_options:
  automatic-sp-privileges: 0
  # @see https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option-mysqld-secure-file-priv
-  secure-file-priv: '/tmp'
+  secure-file-priv: /tmp
  # @see https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_user
-  user: '{{mysql_hardening_user}}'
+  user: "{{ mysql_hardening_user }}"
@@ -1,7 +1,6 @@
 ---
 - name: Restart mysql
-  service:
+  ansible.builtin.service:
-    name: '{{ mysql_daemon }}'
+    name: "{{ mysql_daemon }}"
    state: restarted
  when: mysql_hardening_restart_mysql | bool
@@ -0,0 +1,79 @@
 ---
 argument_specs:
  main:
    short_description: The main entry point for the mysql hardening role.
    version_added: 8.8.0
    options:
      mysql_hardening_chroot:
        default: ''
        type: str
        description: '[chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)'
      mysql_hardening_options.safe-user-create:
        default: 1
        type: int
        description: '[safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)'
      mysql_hardening_options.secure-auth:
        default: 1
        type: int
        description: '[secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)'
      mysql_hardening_options.skip-symbolic-links:
        default: 1
        type: int
        description: '[skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)'
      'mysql_hardening_skip_grant_tables:':
        default: false
        type: bool
        description: '[skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)'
      mysql_hardening_skip_show_database:
        default: 1
        type: int
        description: '[skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)'
      mysql_hardening_options.local-infile:
        default: 0
        type: int
        description: '[local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)'
      mysql_hardening_options.allow-suspicious-udfs:
        default: 0
        type: int
        description: '[allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)'
      mysql_hardening_chroot.automatic-sp-privileges:
        default: 0
        type: int
        description: '[automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)'
      mysql_hardening_options.secure-file-priv:
        default: /tmp
        type: str
        description: '[secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)'
      mysql_remove_anonymous_users:
        default: true
        type: bool
        description: Set to `false` to keep users without authentication
      mysql_remove_test_database:
        default: true
        type: bool
        description: Set to `false` to keep the test database
      mysql_hardening_restart_mysql:
        default: true
        type: bool
        description: Restart mysql after running this role
      mysql_hardening_enabled:
        default: true
        type: bool
        description: Whether to run the hardening
      mysql_daemon_enabled:
        default: true
        type: bool
        description: Whether to enable the MySQL-service so it starts on boot
      mysql_root_password:
        default: '-----====>SetR00tPa$$wordH3r3!!!<====-----'
        type: str
        description: The default password. Please change or overwrite it
      mysql_user_home:
        default: '{{ ansible_env.HOME }}'
        type: str
        description: The path where the `.my.cnf` will be stored
      mysql_remove_remote_root:
        default: true
        type: bool
        description: If `true`, root can only connect from localhost. Set to `false`
          to not remove remote root users.
@@ -1,24 +1,27 @@
 ---
 galaxy_info:
-  author: "Sebastian Gumprich"
+  author: Sebastian Gumprich
-  description: 'This Ansible playbook provides security configuration for mysql.'
+  description: This Ansible playbook provides security configuration for mysql.
  company: Hardening Framework Team
  license: Apache License 2.0
-  min_ansible_version: '1.9'
+  min_ansible_version: 2.9.10
  platforms:
    - name: EL
      versions:
-        - 6
+        - "7"
-        - 7
+        - "8"
        - "9"
    - name: Ubuntu
      versions:
        - xenial
        - bionic
        - focal
        - jammy
    - name: Debian
      versions:
-        - jessie
+        - bullseye
        - buster
    - name: Amazon
-    - name: Fedora
+    - name: opensuse
  galaxy_tags:
    - system
    - security
@@ -1,56 +1,68 @@
 ---
 - name: Protect my.cnf
-  file:
+  ansible.builtin.file:
-    path: '{{ mysql_hardening_mysql_conf_file }}'
+    path: "{{ mysql_hardening_mysql_conf_file }}"
-    mode: '0640'
+    mode: "0640"
-    owner: '{{ mysql_cnf_owner }}'
+    owner: "{{ mysql_cnf_owner }}"
-    group: '{{ mysql_cnf_group }}'
+    group: "{{ mysql_cnf_group }}"
    follow: true
    state: file
 - name: Ensure permissions on mysql-datadir are correct
-  file:
+  ansible.builtin.file:
-    path: '{{ mysql_datadir }}'
+    path: "{{ item }}"
    state: directory
-    owner: '{{ mysql_hardening_user }}'
+    owner: "{{ mysql_hardening_user }}"
-    group: '{{ mysql_hardening_user }}'
+    group: "{{ mysql_hardening_user }}"
-    mode: '0750'
+    mode: "0750"
  when: item is defined and item != ""
  loop:
    - "{{ mysql_settings.settings.datadir }}"
    - '{{ mysql_datadir | default("") }}'
 - name: Ensure permissions on mysql-logfile are correct
-  file:
+  ansible.builtin.file:
-    path: '{{ mysql_hardening_log_file }}'
+    path: "{{ item }}"
    state: file
-    owner: '{{ mysql_hardening_user }}'
+    owner: "{{ mysql_hardening_user }}"
-    group: '{{ mysql_hardening_group }}'
+    group: "{{ mysql_hardening_group }}"
-    mode: '0640'
+    mode: "0640"
  when:
    - item is defined
    - item != ""
    - item != "stderr"
    - item != "stdout"
  loop:
    - "{{ mysql_settings.settings.log_error }}"
    - '{{ mysql_hardening_log_file | default("") }}'
 - name: Check mysql configuration-directory exists and has right permissions
-  file:
+  ansible.builtin.file:
-    path: '{{ mysql_hardening_mysql_confd_dir }}'
+    path: "{{ mysql_hardening_mysql_confd_dir }}"
    state: directory
-    owner: '{{ mysql_hardening_user }}'
+    owner: "{{ mysql_hardening_user }}"
-    group: '{{ mysql_hardening_group }}'
+    group: "{{ mysql_hardening_group }}"
-    mode: '0750'
+    mode: "0750"
 - name: Check include-dir directive is present in my.cnf
-  lineinfile:
+  ansible.builtin.lineinfile:
-    dest: '{{ mysql_hardening_mysql_conf_file }}'
+    dest: "{{ mysql_hardening_mysql_conf_file }}"
-    line: '!includedir {{ mysql_hardening_mysql_confd_dir }}'
+    line: "!includedir {{ mysql_hardening_mysql_confd_dir }}"
-    insertafter: 'EOF'
+    insertafter: EOF
    state: present
    backup: true
  notify: Restart mysql
 - name: Apply hardening configuration
-  template:
+  ansible.builtin.template:
-    src: 'hardening.cnf.j2'
+    src: hardening.cnf.j2
-    dest: '{{ mysql_hardening_mysql_hardening_conf_file }}'
+    dest: "{{ mysql_hardening_mysql_confd_dir + '/hardening.cnf' }}"
-    owner: '{{ mysql_cnf_owner }}'
+    owner: "{{ mysql_cnf_owner }}"
-    group: '{{ mysql_cnf_group }}'
+    group: "{{ mysql_cnf_group }}"
-    mode: '0640'
+    mode: "0640"
  notify: Restart mysql
 - name: Enable mysql
-  service:
+  ansible.builtin.service:
-    name: '{{ mysql_daemon }}'
+    name: "{{ mysql_daemon }}"
-    enabled: '{{ mysql_daemon_enabled }}'
+    enabled: "{{ mysql_daemon_enabled }}"
@@ -1,33 +1,42 @@
 ---
 - name: Fetch OS dependent variables
-  include_vars:
+  ansible.builtin.include_vars:
-    file: '{{ item }}'
+    file: "{{ item }}"
-    name: 'os_vars'
+    name: os_vars
  with_first_found:
    - files:
-        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - "{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml"
-        - '{{ ansible_facts.distribution }}.yml'
+        - "{{ ansible_facts.distribution }}.yml"
-        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - "{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml"
-        - '{{ ansible_facts.os_family }}.yml'
+        - "{{ ansible_facts.os_family }}.yml"
      skip: true
  tags: always
 # we only override variables with our default if they have not been specified already.
 # by default the lookup functions finds all varnames containing the string, therefore
-# we add ^ and $ to denote start and end of string, so this returns only exact maches.
+# we add ^ and $ to denote start and end of string, so this returns only exact matches.
- name: Set OS dependent variables, if not already defined by user
+- name: Set OS dependent variables, if not already defined by user # noqa var-naming
-  set_fact:
+  ansible.builtin.set_fact:
-    '{{ item.key }}': '{{ item.value }}'
+    "{{ item.key }}": "{{ item.value }}"
-  when: "not lookup('varnames', '^' + item.key + '$')"
+  when: not lookup('varnames', '^' + item.key + '$')
-  with_dict: '{{ os_vars }}'
+  with_dict: "{{ os_vars }}"
  tags: always
 - name: Check that the variable mysql_distribution is set correctly
  ansible.builtin.assert:
    that: mysql_distribution == 'mysql' or mysql_distribution == 'mariadb'
    fail_msg: mysql_distribution must be set to either mysql or mariadb!
  when: mysql_distribution is defined
 - name: Gather package facts to check for mysql/mariadb version
  ansible.builtin.package_facts:
    manager: auto
  when: not mysql_distribution is defined
 - name: Check if MySQL or MariaDB is used
-  set_fact:
+  ansible.builtin.set_fact:
    mysql_distribution: "{{ ansible_facts.packages['mysql-server'] is defined | ternary('mysql', 'mariadb') }}"
  when: not mysql_distribution is defined
 - name: Check which MySQL/MariaDB version is used
  community.mysql.mysql_info:
@@ -35,21 +44,29 @@
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_version
 - name: Check MySQL/MariaDB settings
  community.mysql.mysql_info:
    filter: settings
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_settings
 # see https://stackoverflow.com/a/59451077/2953919 for the
 # dict2items and vice versa magic
 - name: Drop the secure-auth parameter on MySQL >=8.0.3 (not mariadb)
-  set_fact:
+  ansible.builtin.set_fact:
-    mysql_hardening_options: "{{ mysql_hardening_options| dict2items | rejectattr('key', 'search', 'secure-auth') | list | items2dict }}"
+    mysql_hardening_options: "{{ mysql_hardening_options | dict2items | rejectattr('key', 'search', 'secure-auth') | list | items2dict }}"
  when:
    - mysql_version.version.full is version('8.0.3', '>=')
    - mysql_distribution == "mysql"
- include: configure.yml
+- name: Include tasks for configuration
  ansible.builtin.import_tasks: configure.yml
  when: mysql_hardening_enabled | bool
  tags:
    - mysql_hardening
- include: mysql_secure_installation.yml
+- name: Include tasks to secure mysql installation
  ansible.builtin.import_tasks: mysql_secure_installation.yml
  when: mysql_hardening_enabled | bool
  tags:
    - mysql_hardening
`@@ -1,2 +1,2 @@`
	`---`	`---`
	`requires_ansible: '>=2.9.10'`	`requires_ansible: ">=2.9.10"`