Merge pull request #530 from dev-sec/delete_drafts

delete obsolete release drafts
delete old release drafts
2022-02-28 10:20:01 +01:00 · 2022-02-25 20:10:36 +01:00 · 2022-02-21 13:03:04 +00:00 · 2022-02-21 14:01:19 +01:00 · 2022-02-21 13:00:41 +00:00 · 2022-02-21 13:58:39 +01:00
86 changed files with 1200 additions and 123 deletions
@@ -12,7 +12,9 @@ os_hardening:
 ssh_hardening:
  - 'roles/ssh_hardening/**'
  - 'molecule/ssh_hardening/**'
+  - 'molecule/ssh_hardening_custom_tests/**'
  - '.github/workflows/ssh_hardening.yml'
+  - '.github/workflows/ssh_hardening_custom_tests.yml'

 nginx_hardening:
  - 'roles/nginx_hardening/**'
@@ -0,0 +1,58 @@
+name: Ansible Lint  # feel free to pick your own name
+
+on: [push, pull_request]
+
+jobs:
+  ansible-lint:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    # Important: This sets up your GITHUB_WORKSPACE environment variable
+    - uses: actions/checkout@v2
+
+    - name: Lint Ansible Playbook
+      # replace "master" with any valid ref
+      uses: ansible/ansible-lint-action@master
+      with:
+        # [required]
+        # Paths to ansible files (i.e., playbooks, tasks, handlers etc..)
+        # or valid Ansible directories according to the Ansible role
+        # directory structure.
+        # If you want to lint multiple ansible files, use the following syntax
+        # targets: |
+        #   playbook_1.yml
+        #   playbook_2.yml
+        targets: "roles/"
+        # [optional]
+        # Arguments to override a package and its version to be set explicitly.
+        # Must follow the example syntax.
+        # override-deps: |
+        #   ansible==2.9
+        #   ansible-lint==4.2.0
+        override-deps: |
+           rich>=9.5.1,<11.0.0
+        # [optional]
+        # Arguments to be passed to the ansible-lint
+
+        # Options:
+        #   -q                    quieter, although not silent output
+        #   -p                    parseable output in the format of pep8
+        #   --parseable-severity  parseable output including severity of rule
+        #   -r RULESDIR           specify one or more rules directories using one or
+        #                         more -r arguments. Any -r flags override the default
+        #                         rules in ansiblelint/rules, unless -R is also used.
+        #   -R                    Use default rules in ansiblelint/rules in addition to
+        #                         any extra
+        #                         rules directories specified with -r. There is no need
+        #                         to specify this if no -r flags are used
+        #   -t TAGS               only check rules whose id/tags match these values
+        #   -x SKIP_LIST          only check rules whose id/tags do not match these
+        #                         values
+        #   --nocolor             disable colored output
+        #   --exclude=EXCLUDE_PATHS
+        #                         path to directories or files to skip. This option is
+        #                         repeatable.
+        #   -c C                  Specify configuration file to use. Defaults to ".ansible-lint"
+        args: ""
+
@@ -23,7 +23,6 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
-          - centos8
          - rocky8
          - ubuntu1804
          - ubuntu2004
@@ -23,7 +23,6 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
-          - centos8
          - rocky8
          - ubuntu1804
          - ubuntu2004
@@ -23,7 +23,6 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
-          - centos8
          - rocky8
          - ubuntu1804
          - ubuntu2004
@@ -66,6 +66,11 @@ jobs:
        with:
          path: ./CHANGELOGRELEASE.md

+      - name: Delete old drafts
+        uses: hugo19941994/[email protected]
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
      - name: Create Release draft
        id: create_release
        uses: actions/create-release@v1
@@ -23,7 +23,6 @@ jobs:
      matrix:
        molecule_distro:
          - centos7
-          - centos8
          - rocky8
          - fedora
          - ubuntu1804
@@ -0,0 +1,68 @@
+---
+name: "devsec.ssh_hardening with custom tests"
+on:  # yamllint disable-line rule:truthy
+  workflow_dispatch:
+  push:
+    paths:
+      - 'roles/ssh_hardening/**'
+      - 'molecule/ssh_hardening_custom_tests/**'
+      - '.github/workflows/ssh_hardening_custom_tests.yml'
+  pull_request:
+    paths:
+      - 'roles/ssh_hardening/**'
+      - 'molecule/ssh_hardening_custom_tests/**'
+      - '.github/workflows/ssh_hardening_custom_tests.yml'
+jobs:
+  build:
+    runs-on: ubuntu-18.04
+    env:
+      PY_COLORS: 1
+      ANSIBLE_FORCE_COLOR: 1
+    strategy:
+      fail-fast: false
+      matrix:
+        molecule_distro:
+          - centos7
+          - rocky8
+          - fedora
+          - ubuntu1804
+          - ubuntu2004
+          - debian9
+          - debian10
+          - amazon
+          # - arch  # needs to be fixed
+          # - opensuse_tumbleweed  # baseline is not compatible with suse
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v2
+        with:
+          path: ansible_collections/devsec/hardening
+          submodules: true
+
+      - name: Set up Python 3.7
+        uses: actions/setup-python@v1
+        with:
+          python-version: 3.7
+
+      - name: Install dependencies
+        run: |
+          sudo apt install git
+          python -m pip install --no-cache-dir --upgrade pip
+          pip install -r requirements.txt
+        working-directory: ansible_collections/devsec/hardening
+
+      - name: Create default collection path symlink
+        run: |
+          mkdir -p /home/runner/.ansible
+          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
+
+      - name: Test with molecule
+        run: |
+          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
+            export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
+          fi
+          molecule --version
+          molecule converge -s ssh_hardening_custom_tests
+        env:
+          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
+        working-directory: ansible_collections/devsec/hardening
@@ -1,6 +1,175 @@
 # Changelog

-## [7.8.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.8.0) (2021-06-30)
+## [7.14.2](https://github.com/dev-sec/ansible-collection-hardening/tree/7.14.2) (2022-02-21)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.1...7.14.2)
+
+**Fixed bugs:**
+
+- debian 9's nginx doesn't support tls1.3 [\#526](https://github.com/dev-sec/ansible-collection-hardening/pull/526) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Change permissions of the tmout.sh file [\#520](https://github.com/dev-sec/ansible-collection-hardening/pull/520) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([abejotaR](https://github.com/abejotaR))
+
+**Closed issues:**
+
+- No such file directory error triggered by the  kernel.unpriviliged\_userns\_clone configuration. [\#514](https://github.com/dev-sec/ansible-collection-hardening/issues/514)
+
+**Merged pull requests:**
+
+- add waivers to skip controls [\#529](https://github.com/dev-sec/ansible-collection-hardening/pull/529) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- remove centos8 tests [\#525](https://github.com/dev-sec/ansible-collection-hardening/pull/525) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.14.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.14.1) (2022-02-18)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.0...7.14.1)
+
+**Fixed bugs:**
+
+- move sysctls to debian specific vars [\#524](https://github.com/dev-sec/ansible-collection-hardening/pull/524) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Closed issues:**
+
+- Error when using the ssh\_hardening role [\#519](https://github.com/dev-sec/ansible-collection-hardening/issues/519)
+
+## [7.14.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.14.0) (2021-12-16)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.13.2...7.14.0)
+
+**Implemented enhancements:**
+
+- Add option to set timeout in seconds to logout users [\#516](https://github.com/dev-sec/ansible-collection-hardening/pull/516) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lbayerlein](https://github.com/lbayerlein))
+- add feature to disable coredump to limit task [\#511](https://github.com/dev-sec/ansible-collection-hardening/pull/511) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lbayerlein](https://github.com/lbayerlein))
+- change hidepid mount task state to mounted [\#510](https://github.com/dev-sec/ansible-collection-hardening/pull/510) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([alegrey91](https://github.com/alegrey91))
+- prettify nginx options [\#509](https://github.com/dev-sec/ansible-collection-hardening/pull/509) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Update nginx\_add\_header README to match default [\#506](https://github.com/dev-sec/ansible-collection-hardening/pull/506) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([duffn](https://github.com/duffn))
+- Updated dh\_params to 4096 [\#501](https://github.com/dev-sec/ansible-collection-hardening/pull/501) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([ksaadDE](https://github.com/ksaadDE))
+
+**Fixed bugs:**
+
+- Duplication of sysctl default parameter fs.protected\_hardlinks and fs.protected\_symlinks [\#502](https://github.com/dev-sec/ansible-collection-hardening/issues/502)
+- Fix duplicate sysctl config in fs [\#505](https://github.com/dev-sec/ansible-collection-hardening/pull/505) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([tekicat](https://github.com/tekicat))
+
+**Merged pull requests:**
+
+- Feature coredump [\#513](https://github.com/dev-sec/ansible-collection-hardening/pull/513) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.13.2](https://github.com/dev-sec/ansible-collection-hardening/tree/7.13.2) (2021-11-23)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.13.1...7.13.2)
+
+## [7.13.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.13.1) (2021-11-23)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.13.0...7.13.1)
+
+**Closed issues:**
+
+- Unable to use 7.13.0 Release [\#503](https://github.com/dev-sec/ansible-collection-hardening/issues/503)
+
+## [7.13.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.13.0) (2021-11-15)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.12.0...7.13.0)
+
+**Implemented enhancements:**
+
+- os\_hardening: Provide a whitelist for yum repositories with non-signed RPMs [\#485](https://github.com/dev-sec/ansible-collection-hardening/issues/485)
+- Disable ctrl-alt-del key combination [\#496](https://github.com/dev-sec/ansible-collection-hardening/pull/496) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([lbayerlein](https://github.com/lbayerlein))
+- implement sysctl-34 - link protection settings [\#494](https://github.com/dev-sec/ansible-collection-hardening/pull/494) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Add whitelist option for yum repository files [\#487](https://github.com/dev-sec/ansible-collection-hardening/pull/487) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([darxriggs](https://github.com/darxriggs))
+- Add TLSv1.3 to nginx default configuration [\#470](https://github.com/dev-sec/ansible-collection-hardening/pull/470) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([ksaadDE](https://github.com/ksaadDE))
+
+**Closed issues:**
+
+- Please create the collection in ansible-galaxy [\#407](https://github.com/dev-sec/ansible-collection-hardening/issues/407)
+
+**Merged pull requests:**
+
+- Improve testing: install packages on Arch Linux [\#499](https://github.com/dev-sec/ansible-collection-hardening/pull/499) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([darxriggs](https://github.com/darxriggs))
+- add old role names to tags in Galaxy [\#495](https://github.com/dev-sec/ansible-collection-hardening/pull/495) ([schurzi](https://github.com/schurzi))
+- update minimum ansible version for roles [\#493](https://github.com/dev-sec/ansible-collection-hardening/pull/493) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- revive old tests with custom ssh settings [\#491](https://github.com/dev-sec/ansible-collection-hardening/pull/491) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.12.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.12.0) (2021-10-21)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.11.0...7.12.0)
+
+**Implemented enhancements:**
+
+- feat\(os\_hardening\): extend file permission tasks to cover more files [\#489](https://github.com/dev-sec/ansible-collection-hardening/pull/489) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([cmhe](https://github.com/cmhe))
+
+**Fixed bugs:**
+
+- mysql remove deprecated 'secure\_auth' parameter in mysql [\#346](https://github.com/dev-sec/ansible-collection-hardening/issues/346)
+- change baseline urls to full zip-url [\#490](https://github.com/dev-sec/ansible-collection-hardening/pull/490) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- fix filter error in ansible.builtin.file mode parameter [\#486](https://github.com/dev-sec/ansible-collection-hardening/pull/486) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([ssttehrani](https://github.com/ssttehrani))
+
+**Closed issues:**
+
+- Extend os\_hardening minimize\_access task to cover additional passwd/group/shadow/gshadow paths [\#488](https://github.com/dev-sec/ansible-collection-hardening/issues/488)
+- postgresql\_hardening role [\#484](https://github.com/dev-sec/ansible-collection-hardening/issues/484)
+- os\_hardening fails on "Create a combined sysctl-dict if overwrites are defined" task [\#482](https://github.com/dev-sec/ansible-collection-hardening/issues/482)
+- Improve changelog generation [\#381](https://github.com/dev-sec/ansible-collection-hardening/issues/381)
+
+## [7.11.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.11.0) (2021-08-30)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.10.0...7.11.0)
+
+**Implemented enhancements:**
+
+- Use `log_error` file and `datadir` from mysql\_info settings instead of variables `mysql_datadir` and `mysql_hardening_log_file` [\#478](https://github.com/dev-sec/ansible-collection-hardening/pull/478) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([123quhiwiwk](https://github.com/123quhiwiwk))
+- Execute check of MySQL error logfile permissions on Debian 11 only when log\_error is defined [\#477](https://github.com/dev-sec/ansible-collection-hardening/pull/477) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([123quhiwiwk](https://github.com/123quhiwiwk))
+- \[mysql\_hardening\] Setup defaults for MySQL on FreeBSD [\#474](https://github.com/dev-sec/ansible-collection-hardening/pull/474) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([sdwilsh](https://github.com/sdwilsh))
+
+**Closed issues:**
+
+- MariaDB hardening fails, because log\_error file is missing \[Debian 11\] [\#476](https://github.com/dev-sec/ansible-collection-hardening/issues/476)
+
+**Merged pull requests:**
+
+- ssh\_allow\_tcp\_forwarding is not a boolean [\#480](https://github.com/dev-sec/ansible-collection-hardening/pull/480) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([ReinerNippes](https://github.com/ReinerNippes))
+- chore\(ssh\_hardening\): set min\_ansible\_version to \>=2.9.10 [\#479](https://github.com/dev-sec/ansible-collection-hardening/pull/479) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([bufferoverflow](https://github.com/bufferoverflow))
+
+## [7.10.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.10.0) (2021-08-15)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.9.0...7.10.0)
+
+**Implemented enhancements:**
+
+- use Ansible lint in separate task [\#475](https://github.com/dev-sec/ansible-collection-hardening/pull/475) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- \[mysql\_hardening\] Allow setting the mysql\_distribution [\#473](https://github.com/dev-sec/ansible-collection-hardening/pull/473) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([sdwilsh](https://github.com/sdwilsh))
+
+**Fixed bugs:**
+
+- mysql\_hardening cannot work with mysql on freebsd [\#472](https://github.com/dev-sec/ansible-collection-hardening/issues/472)
+
+**Closed issues:**
+
+- run ansible-lint only once in Github Actions [\#398](https://github.com/dev-sec/ansible-collection-hardening/issues/398)
+
+**Merged pull requests:**
+
+- SSH Hardening: backtick typo [\#471](https://github.com/dev-sec/ansible-collection-hardening/pull/471) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Slamdunk](https://github.com/Slamdunk))
+- fix license in galaxy [\#469](https://github.com/dev-sec/ansible-collection-hardening/pull/469) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.9.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.9.0) (2021-07-22)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.8.0...7.9.0)
+
+**Implemented enhancements:**
+
+- Allow configuration of password remember in pam [\#467](https://github.com/dev-sec/ansible-collection-hardening/pull/467) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([m41kc0d3](https://github.com/m41kc0d3))
+- Add CVE-2021-33909 mitigations [\#466](https://github.com/dev-sec/ansible-collection-hardening/pull/466) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([kravietz](https://github.com/kravietz))
+- Add SUB\_UID\_MIN/MAX/COUNT, SUB\_GID\_MIN/MAX/COUNT [\#463](https://github.com/dev-sec/ansible-collection-hardening/pull/463) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([elgalu](https://github.com/elgalu))
+- Add os\_auth\_uid\_max, os\_auth\_gid\_max [\#461](https://github.com/dev-sec/ansible-collection-hardening/pull/461) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([elgalu](https://github.com/elgalu))
+
+**Closed issues:**
+
+- MySQL hardening fails because of missing attribute [\#464](https://github.com/dev-sec/ansible-collection-hardening/issues/464)
+- add "when" statements for every import\_tasks in hardening.yml [\#453](https://github.com/dev-sec/ansible-collection-hardening/issues/453)
+
+**Merged pull requests:**
+
+- update metadata to include community.mysql deps [\#465](https://github.com/dev-sec/ansible-collection-hardening/pull/465) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [7.8.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.8.0) (2021-07-01)

 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.7.0...7.8.0)

@@ -22,7 +191,8 @@
 **Merged pull requests:**

 - Cleanup old OS-support and simplify vars [\#458](https://github.com/dev-sec/ansible-collection-hardening/pull/458) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
- add rocky linux 8 tests and make sure that all relevant tasks are execd [\#457](https://github.com/dev-sec/ansible-collection-hardening/pull/457) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add rocky linux 8 tests and make sure that all relevant tasks are execd [\#457](https://github.com/dev-sec/ansible-collection-hardening/pull/457) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add "when" statements in hardening.yml\(\#453\) [\#455](https://github.com/dev-sec/ansible-collection-hardening/pull/455) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([jqiuyin](https://github.com/jqiuyin))
 - enable ipv6 globally [\#450](https://github.com/dev-sec/ansible-collection-hardening/pull/450) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))

 ## [7.7.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.7.0) (2021-05-24)
@@ -92,12 +262,12 @@

 **Merged pull requests:**

-  remove secure-auth param if mysql \>= 8.0.3 [\#438](https://github.com/dev-sec/ansible-collection-hardening/pull/438) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+-  remove secure-auth param if mysql \>= 8.0.3 [\#438](https://github.com/dev-sec/ansible-collection-hardening/pull/438) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Improved comments. [\#436](https://github.com/dev-sec/ansible-collection-hardening/pull/436) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
 - os\_auth\_pam\_pwquality\_options: Changed type to authtok\_type [\#432](https://github.com/dev-sec/ansible-collection-hardening/pull/432) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
- add restart-auditd handler after configuration change [\#427](https://github.com/dev-sec/ansible-collection-hardening/pull/427) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
- add new tasks to delete mysql users without passwords [\#423](https://github.com/dev-sec/ansible-collection-hardening/pull/423) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
- Uppercased first letter of task names. [\#422](https://github.com/dev-sec/ansible-collection-hardening/pull/422) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([joubbi](https://github.com/joubbi))
+- add restart-auditd handler after configuration change [\#427](https://github.com/dev-sec/ansible-collection-hardening/pull/427) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add new tasks to delete mysql users without passwords [\#423](https://github.com/dev-sec/ansible-collection-hardening/pull/423) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Uppercased first letter of task names. [\#422](https://github.com/dev-sec/ansible-collection-hardening/pull/422) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([joubbi](https://github.com/joubbi))

 ## [7.4.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.4.0) (2021-03-23)

@@ -115,7 +285,7 @@

 - Use pam\_pwhistory.so instead of pam\_unix.so for remembering old passwords [\#431](https://github.com/dev-sec/ansible-collection-hardening/pull/431) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
 - Remove comments from PAM config file, but keep it in the template [\#430](https://github.com/dev-sec/ansible-collection-hardening/pull/430) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
- add support for using a proxy to test with molecule [\#429](https://github.com/dev-sec/ansible-collection-hardening/pull/429) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add support for using a proxy to test with molecule [\#429](https://github.com/dev-sec/ansible-collection-hardening/pull/429) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Improve Documentation for sysctl defaults [\#418](https://github.com/dev-sec/ansible-collection-hardening/pull/418) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))

 ## [7.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.3.0) (2021-03-16)
@@ -147,9 +317,9 @@
 **Merged pull requests:**

 - Improve Release Action [\#421](https://github.com/dev-sec/ansible-collection-hardening/pull/421) ([schurzi](https://github.com/schurzi))
- remove FQCN from roles in examples [\#420](https://github.com/dev-sec/ansible-collection-hardening/pull/420) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- remove FQCN from roles in examples [\#420](https://github.com/dev-sec/ansible-collection-hardening/pull/420) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
 - Ensure permissions on /etc/crontab are configured [\#405](https://github.com/dev-sec/ansible-collection-hardening/pull/405) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([joubbi](https://github.com/joubbi))
- remove FQCN from roles in examples [\#404](https://github.com/dev-sec/ansible-collection-hardening/pull/404) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- remove FQCN from roles in examples [\#404](https://github.com/dev-sec/ansible-collection-hardening/pull/404) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
 - do not install mysql python package on target host [\#401](https://github.com/dev-sec/ansible-collection-hardening/pull/401) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - make wrong password fail task [\#400](https://github.com/dev-sec/ansible-collection-hardening/pull/400) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))

@@ -176,7 +346,7 @@

 **Merged pull requests:**

- update ansible-lint to version 5 [\#397](https://github.com/dev-sec/ansible-collection-hardening/pull/397) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- update ansible-lint to version 5 [\#397](https://github.com/dev-sec/ansible-collection-hardening/pull/397) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
 - fix minimum required ansible version in docs [\#390](https://github.com/dev-sec/ansible-collection-hardening/pull/390) ([schurzi](https://github.com/schurzi))

 ## [7.1.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.1.1) (2021-02-05)
@@ -233,7 +403,7 @@
 - make release workflow manually runnable [\#384](https://github.com/dev-sec/ansible-collection-hardening/pull/384) ([schurzi](https://github.com/schurzi))
 - run labeler workflow with higher privileges [\#383](https://github.com/dev-sec/ansible-collection-hardening/pull/383) ([schurzi](https://github.com/schurzi))
 - remove issue labels from changelog [\#382](https://github.com/dev-sec/ansible-collection-hardening/pull/382) ([schurzi](https://github.com/schurzi))
- Added comment on top of templates about which role manages the file [\#378](https://github.com/dev-sec/ansible-collection-hardening/pull/378) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([joubbi](https://github.com/joubbi))
+- Added comment on top of templates about which role manages the file [\#378](https://github.com/dev-sec/ansible-collection-hardening/pull/378) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([joubbi](https://github.com/joubbi))
 - Regenerate RSA key with size 4096 bits [\#376](https://github.com/dev-sec/ansible-collection-hardening/pull/376) ([ssttehrani](https://github.com/ssttehrani))
 - fix second changelog generation task, too [\#349](https://github.com/dev-sec/ansible-collection-hardening/pull/349) ([rndmh3ro](https://github.com/rndmh3ro))
 - fix changelog generation [\#341](https://github.com/dev-sec/ansible-collection-hardening/pull/341) ([rndmh3ro](https://github.com/rndmh3ro))
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
@@ -1,12 +1,12 @@
 namespace: devsec
 name: hardening
-version: 7.7.0
+version: 7.14.1
 readme: README.md
 authors:
  - dev-sec <[email protected]>
 description: 'This collection provides battle tested hardening for Linux, SSH, nginx, MySQL'
 license:
-  - GPL-2.0-or-later
+  - Apache-2.0
 license_file: ''
 tags:
  - devsec
@@ -17,13 +17,19 @@ tags:
  - nginx
  - mysql
  - openssh
+  - apache_hardening
+  - mysql_hardening
+  - nginx_hardening
+  - os_hardening
+  - ssh_hardening
 dependencies:
  ansible.posix: '>=1.0.0'
  community.crypto: '>=1.0.0'
  community.general: '>=1.0.0'
-repository: 'https://github.com/dev-sec/ansible-os-hardening'
+  community.mysql: '>=1.3.0'
+repository: 'https://github.com/dev-sec/ansible-collection-hardening/'
 homepage: 'https://dev-sec.io/'
-issues: 'https://github.com/dev-sec/ansible-os-hardening/issues'
+issues: 'https://github.com/dev-sec/ansible-collection-hardening/issues'
 build_ignore:
  - codecov.yml
  - .github
@@ -6,9 +6,6 @@ dependency:
    requirements-file: molecule/mysql_hardening/requirements.yml
 driver:
  name: docker
-lint: |
-  yamllint roles/mysql_hardening/ molecule/mysql_hardening/ .github/workflows/mysql_hardening.yml
-  ansible-lint roles/mysql_hardening/
 platforms:
  - name: instance
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
@@ -57,7 +54,6 @@ scenario:
    - destroy
  test_sequence:
    - dependency
-    - lint
    - destroy
    - syntax
    - create
@@ -44,7 +44,7 @@
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"

    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit supermarket://dev-sec/mysql-baseline"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/mysql-baseline/archive/refs/heads/master.zip"
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -5,9 +5,6 @@ dependency:
    role-file: molecule/nginx_hardening/requirements.yml
 driver:
  name: docker
-lint: |
-  yamllint roles/nginx_hardening/ molecule/nginx_hardening/ .github/workflows/nginx_hardening.yml
-  ansible-lint roles/nginx_hardening/
 platforms:
  - name: instance
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
@@ -57,7 +54,6 @@ scenario:
    - destroy
  test_sequence:
    - dependency
-    - lint
    - destroy
    - syntax
    - create
@@ -47,7 +47,7 @@
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"

    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit supermarket://dev-sec/nginx-baseline"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/nginx-baseline/archive/refs/heads/master.zip"
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -16,7 +16,7 @@
        name: os_hardening
  vars:
    os_security_users_allow: change_user
-    os_security_kernel_enable_core_dump: true
+    os_security_kernel_enable_core_dump: false
    os_security_suid_sgid_remove_from_unknown: true
    os_auth_pam_passwdqc_enable: false
    os_auth_lockout_time: 15
@@ -26,6 +26,8 @@
    os_security_suid_sgid_blacklist: ['/bin/umount']
    os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
    os_filesystem_whitelist: []
+    os_ctrlaltdel_disabled: true
+    os_yum_repo_file_whitelist: ['foo.repo']
    sysctl_config:
      net.ipv4.ip_forward: 0
      net.ipv6.conf.all.forwarding: 0
@@ -5,9 +5,6 @@ dependency:
    role-file: molecule/os_hardening/requirements.yml
 driver:
  name: docker
-lint: |
-  yamllint roles/os_hardening/ molecule/os_hardening/ .github/workflows/os_hardening.yml
-  ansible-lint roles/os_hardening/
 platforms:
  - name: instance
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
@@ -57,7 +54,6 @@ scenario:
    - destroy
  test_sequence:
    - dependency
-    - lint
    - destroy
    - syntax
    - create
@@ -34,13 +34,13 @@
          - procps-ng
      when: ansible_facts.distribution == 'Fedora'

-    - name: install packages
+    - name: install required tools on Arch
      pacman:
        name:
-          - "awk"
+          - awk
        state: present
        update_cache: true
-      ignore_errors: true
+      when: ansible_facts.os_family == 'Archlinux'

    - name: install required tools on RHEL
      yum:
@@ -54,3 +54,7 @@
    - name: create recursing symlink to test minimize access
      shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
      changed_when: false
+
+    - name: include YUM prepare tasks
+      include: prepare_yum.yml
+      when: ansible_facts.os_family == 'RedHat'
@@ -0,0 +1,16 @@
+---
+- name: create 'foo' repository
+  yum_repository:
+    name: foo
+    description: mandatory description
+    baseurl: file:///mandatory-url
+    enabled: false
+    gpgcheck: false
+
+- name: create 'bar' repository
+  yum_repository:
+    name: bar
+    description: mandatory description
+    baseurl: file:///mandatory-url
+    enabled: false
+    gpgcheck: false
@@ -41,6 +41,10 @@
      include: verify_pam.yml
      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'

+    - name: include YUM tests
+      include: verify_yum.yml
+      when: ansible_facts.os_family == 'RedHat'
+
    - name: download cinc-auditor
      get_url:
        url: https://omnitruck.cinc.sh/install.sh
@@ -51,7 +55,7 @@
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"

    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit supermarket://dev-sec/linux-baseline"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit  --waiver-file waivers.yaml https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -0,0 +1,8 @@
+---
+- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
+  command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
+  changed_when: false
+
+- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
+  command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
+  changed_when: false
@@ -0,0 +1,3 @@
+os-14:
+  run: false
+  justification: "not yet implemented"
@@ -5,9 +5,6 @@ dependency:
    role-file: molecule/ssh_hardening/requirements.yml
 driver:
  name: docker
-lint: |
-  yamllint roles/ssh_hardening/ molecule/ssh_hardening/ .github/workflows/ssh_hardening.yml
-  ansible-lint roles/ssh_hardening/
 platforms:
  - name: instance
    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
@@ -57,7 +54,6 @@ scenario:
    - destroy
  test_sequence:
    - dependency
-    - lint
    - destroy
    - syntax
    - create
@@ -52,14 +52,14 @@
          - "openssh"
      when: ansible_facts.os_family == 'Suse'

-    - name: install packages
+    - name: install required tools on Arch
      pacman:
        name:
-          - "openssh"
-          - "awk"
+          - openssh
+          - awk
        state: present
        update_cache: true
-      ignore_errors: true
+      when: ansible_facts.os_family == 'Archlinux'

    - name: created needed directory
      file:
@@ -42,7 +42,7 @@
      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"

    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit supermarket://dev-sec/nginx-baseline"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip"
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -0,0 +1,22 @@
+*******
+Docker driver installation guide
+*******
+
+Requirements
+============
+
+* Docker Engine
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ python3 -m pip install 'molecule[docker]'
@@ -0,0 +1,104 @@
+---
+- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
+  hosts: all
+  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  collections:
+    - devsec.hardening
+  tasks:
+    - include_role:
+        name: ssh_hardening
+  vars:
+    ssh_trusted_user_ca_keys_file: '/etc/ssh/ca.pub'
+    ssh_trusted_user_ca_keys:
+      - '# ssh-rsa ...'
+    ssh_authorized_principals_file: '/etc/ssh/auth_principals/%u'
+    ssh_authorized_principals:
+      - path: "/etc/ssh/auth_principals/root"
+        principals:
+          - "root"
+        owner: "{{ ssh_owner }}"
+        group: "{{ ssh_group }}"
+        directoryowner: "{{ ssh_owner }}"
+        directorygroup: "{{ ssh_group }}"
+        directorymode: "0700"
+    network_ipv6_enable: true
+    ssh_allow_tcp_forwarding: 'yes'
+    ssh_gateway_ports: true
+    ssh_allow_agent_forwarding: true
+    ssh_server_permit_environment_vars: 'yes'
+    ssh_server_accept_env_vars: 'PWD HTTP_PROXY'
+    ssh_client_alive_interval: 100
+    ssh_client_alive_count: 10
+    ssh_client_password_login: true
+    ssh_challengeresponseauthentication: true
+    ssh_compression: true
+    ssh_allow_users: 'root kitchen vagrant'
+    ssh_allow_groups: 'root kitchen vagrant'
+    ssh_deny_users: 'foo bar'
+    ssh_deny_groups: 'foo bar'
+    ssh_authorized_keys_file: '/etc/ssh/authorized_keys/%u'
+    ssh_max_auth_retries: 10
+    ssh_permit_root_login: "without-password"
+    ssh_permit_tunnel: true
+    ssh_print_motd: true
+    ssh_print_last_log: true
+    ssh_banner: true
+    ssh_server_password_login: true
+    sftp_enabled: true
+    sftp_chroot: true
+    # ssh_server_enabled: false
+    ssh_server_ports:
+      - 22
+      - 222
+    ssh_server_match_address:
+      - address: '192.168.1.0/24'
+        rules:
+          - 'AllowTcpForwarding yes'
+          - 'AllowAgentForwarding no'
+    ssh_server_match_group:
+      - group: 'root'
+        rules:
+          - 'AllowTcpForwarding yes'
+          - 'AllowAgentForwarding no'
+    ssh_server_match_user:
+      - user: 'root'
+        rules:
+          - 'AllowTcpForwarding yes'
+          - 'AllowAgentForwarding no'
+    ssh_server_match_local_port:
+      - port: 222
+        rules:
+          - 'AllowTcpForwarding yes'
+          - 'AllowAgentForwarding no'
+    ssh_remote_hosts:
+      - names: ['example.com', 'example2.com']
+        options: ['Port 2222', 'ForwardAgent yes']
+      - names: ['example3.com']
+        options: ['StrictHostKeyChecking no']
+    ssh_use_dns: true
+    ssh_use_pam: true
+    ssh_max_startups: '10:30:60'
+    ssh_host_key_algorithms:
+      - ssh-ed25519
+      - rsa-sha2-512
+      - rsa-sha2-256
+      - ssh-rsa
+    ssh_macs:
+      - hmac-sha2-512
+      - hmac-sha2-256
+    ssh_ciphers:
+      - aes256-ctr
+      - aes192-ctr
+      - aes128-ctr
+      - aes256-cbc
+    ssh_kex:
+      - diffie-hellman-group-exchange-sha256
+      - diffie-hellman-group-exchange-sha1
+    ssh_custom_options:
+      - "Include /etc/ssh/ssh_config.d/*"
+    sshd_custom_options:
+      - "AcceptEnv LANG"
@@ -0,0 +1,64 @@
+---
+dependency:
+  name: galaxy
+  options:
+    role-file: molecule/ssh_hardening/requirements.yml
+driver:
+  name: docker
+platforms:
+  - name: instance
+    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    privileged: true
+    tmpfs:
+      - /tmp
+      - /run
+    capabilities:
+      - SYS_ADMIN
+    tty: true
+    env:
+      http_proxy: "${http_proxy}"
+      https_proxy: "${https_proxy}"
+      no_proxy: "${no_proxy}"
+      container: docker
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      interpreter_python: auto_silent
+      callback_whitelist: profile_tasks, timer, yaml
+verifier:
+  name: ansible
+
+scenario:
+  create_sequence:
+    - dependency
+    - create
+    - prepare
+  check_sequence:
+    - dependency
+    - destroy
+    - create
+    - prepare
+    - converge
+    - check
+    - destroy
+  converge_sequence:
+    - dependency
+    - create
+    - prepare
+    - converge
+  destroy_sequence:
+    - destroy
+  test_sequence:
+    - dependency
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - verify
+    - destroy
@@ -0,0 +1,76 @@
+---
+- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+  hosts: all
+  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: use python3
+      set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+      when: ansible_facts.distribution == 'Fedora'
+
+    - name: install packages
+      yum:
+        name:
+          - openssh-clients
+          - openssh-server
+          - libselinux-python
+        state: present
+        update_cache: true
+      ignore_errors: true
+
+    - name: install packages
+      dnf:
+        name:
+          - openssh-clients
+          - openssh-server
+          - procps-ng
+        state: present
+        update_cache: true
+      ignore_errors: true
+
+    - name: install packages
+      apt:
+        name:
+          - openssh-client
+          - openssh-server
+        state: present
+        update_cache: true
+      ignore_errors: true
+
+    - name: install required tools on SuSE
+      # cannot use zypper module, since it depends on python-xml
+      shell: "zypper -n install python-xml"
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: install packages
+      zypper:
+        name:
+          - "openssh"
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: install required tools on Arch
+      pacman:
+        name:
+          - openssh
+          - awk
+        state: present
+        update_cache: true
+      when: ansible_facts.os_family == 'Archlinux'
+
+    - name: created needed directory
+      file:
+        path: "/var/run/sshd"
+        state: directory
+
+    - name: create ssh host keys
+      command: "ssh-keygen -A"
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
+            ansible_facts.distribution == "Fedora" or
+            ansible_facts.distribution == "Amazon" or
+            ansible_facts.os_family == "Suse"
+      changed_when: false
+      ignore_errors: true
@@ -0,0 +1,3 @@
+---
+roles:
+  - geerlingguy.git
@@ -27,12 +27,14 @@ It configures:
    - mysql_hardening
 ```

-This role expects an existing installation of MySQL or MariaDB. Please ensure that the following variables are set accordingly:
+This role expects an existing installation of MySQL or MariaDB. Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.  
+Please ensure that the following variables are set accordingly:

 - `mysql_hardening_enabled: yes` role is enabled by default and can be disabled without removing it from a playbook. You can use conditional variable, for example: `mysql_hardening_enabled: "{{ true if mysql_enabled else false }}"`
 - `mysql_hardening_user: 'mysql'` The user that mysql runs as.
- `mysql_datadir: '/var/lib/mysql'` The MySQL data directory
 - `mysql_hardening_mysql_hardening_conf_file: '/etc/mysql/conf.d/hardening.cnf'` The path to the configuration file where the hardening will be performed
+- _deprecated: `mysql_datadir: '/var/lib/mysql'` The MySQL data directory_
+  - `mysql_datadir` is no longer necessary, as MySQL data directory is automatically taken from `mysql_info`. But it can still be defined and will also be checked for correct permissions.

 ## Role Variables

@@ -7,7 +7,6 @@ mysql_daemon_enabled: true
 mysql_hardening_restart_mysql: true

 # general configuration
-mysql_datadir: '/var/lib/mysql'
 mysql_hardening_mysql_hardening_conf_file: '{{mysql_hardening_mysql_confd_dir}}/hardening.cnf'
 # You have to change this to your own strong enough mysql root password
 mysql_root_password: '-----====>SetR00tPa$$wordH3r3!!!<====-----'
@@ -4,7 +4,7 @@ galaxy_info:
  description: 'This Ansible playbook provides security configuration for mysql.'
  company: Hardening Framework Team
  license: Apache License 2.0
-  min_ansible_version: '1.9'
+  min_ansible_version: '2.9.10'
  platforms:
    - name: EL
      versions:
@@ -10,19 +10,27 @@

 - name: Ensure permissions on mysql-datadir are correct
  file:
-    path: '{{ mysql_datadir }}'
+    path: '{{ item }}'
    state: directory
    owner: '{{ mysql_hardening_user }}'
    group: '{{ mysql_hardening_user }}'
    mode: '0750'
+  when: item is defined and item != ""
+  loop:
+    - '{{ mysql_settings.settings.datadir }}'
+    - '{{ mysql_datadir|default("") }}'

 - name: Ensure permissions on mysql-logfile are correct
  file:
-    path: '{{ mysql_hardening_log_file }}'
+    path: '{{ item }}'
    state: file
    owner: '{{ mysql_hardening_user }}'
    group: '{{ mysql_hardening_group }}'
    mode: '0640'
+  when: item is defined and item != ""
+  loop:
+    - '{{ mysql_settings.settings.log_error }}'
+    - '{{ mysql_hardening_log_file|default("") }}'

 - name: Check mysql configuration-directory exists and has right permissions
  file:
@@ -15,20 +15,28 @@
 # we only override variables with our default if they have not been specified already.
 # by default the lookup functions finds all varnames containing the string, therefore
 # we add ^ and $ to denote start and end of string, so this returns only exact maches.
- name: Set OS dependent variables, if not already defined by user
+- name: Set OS dependent variables, if not already defined by user  # noqa var-naming
  set_fact:
    '{{ item.key }}': '{{ item.value }}'
  when: "not lookup('varnames', '^' + item.key + '$')"
  with_dict: '{{ os_vars }}'
  tags: always

+- name: Check that the variable mysql_distribution is set correctly
+  ansible.builtin.assert:
+    that: mysql_distribution == 'mysql' or mysql_distribution == 'mariadb'
+    fail_msg: 'mysql_distribution must be set to either mysql or mariadb!'
+  when: mysql_distribution is defined
+
 - name: Gather package facts to check for mysql/mariadb version
  ansible.builtin.package_facts:
    manager: auto
+  when: not mysql_distribution is defined

 - name: Check if MySQL or MariaDB is used
  set_fact:
    mysql_distribution: "{{ ansible_facts.packages['mysql-server'] is defined | ternary('mysql', 'mariadb') }}"
+  when: not mysql_distribution is defined

 - name: Check which MySQL/MariaDB version is used
  community.mysql.mysql_info:
@@ -36,6 +44,12 @@
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_version

+- name: Check MySQL/MariaDB settings
+  community.mysql.mysql_info:
+    filter: settings
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_settings
+
 # see https://stackoverflow.com/a/59451077/2953919 for the
 # dict2items and vice versa magic
 - name: Drop the secure-auth parameter on MySQL >=8.0.3 (not mariadb)
@@ -4,8 +4,6 @@ mysql_daemon: mysql
 mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'

-mysql_hardening_log_file: '/var/log/mysql/error.log'
-
 mysql_hardening_group: 'adm'

 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
@@ -2,5 +2,3 @@
 mysql_daemon: mysqld
 mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
-
-mysql_hardening_mysql_log_file: '/var/log/mysqld.log'
@@ -0,0 +1,10 @@
+---
+mysql_daemon: mysql-server
+
+mysql_hardening_mysql_conf_file: '/usr/local/etc/mysql/my.cnf'
+mysql_hardening_mysql_confd_dir: '/usr/local/etc/mysql/conf.d'
+
+mysql_hardening_group: 'mysql'
+
+mysql_cnf_owner: 'root'  # owner of /usr/local/etc/mysql/*.cnf files
+mysql_cnf_group: 'mysql'  # owner of /usr/local/etc/mysql/*.cnf files
@@ -4,6 +4,4 @@ mysql_daemon: mysqld
 mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'

-mysql_hardening_log_file: '/var/log/mysqld.log'
-
 mysql_hardening_group: 'adm'
@@ -3,8 +3,6 @@ mysql_daemon: mariadb
 mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'

-mysql_hardening_log_file: '/var/log/mariadb/mariadb.log'
-
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files

@@ -2,7 +2,6 @@
 mysql_daemon: mariadb
 mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
-mysql_hardening_log_file: '/var/log/mariadb/mariadb.log'

 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
@@ -2,7 +2,6 @@
 mysql_daemon: mariadb
 mysql_hardening_mysql_conf_file: '/etc/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
-mysql_hardening_log_file: '/var/log/mariadb/mariadb.log'

 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
@@ -4,8 +4,6 @@ mysql_daemon: mysql
 mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'

-mysql_hardening_log_file: '/var/log/mysql/error.log'
-
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files

@@ -4,8 +4,6 @@ mysql_daemon: mysql
 mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'

-mysql_hardening_log_file: '/var/log/mysql/error.log'
-
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files

@@ -4,8 +4,6 @@ mysql_daemon: mysql
 mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'

-mysql_hardening_log_file: '/var/log/mysql/error.log'
-
 mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files

@@ -61,8 +61,8 @@ It works with the following nginx-roles, including, but not limited to:
  - Default: `default 5`
  - Description: Sets the shared memory zone and the maximum allowed number of connections for a given key value.
 - [nginx_add_header][]
-  - Default: `[ "X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"" ]`
-  - Description:Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307.
+  - Default: `[ "X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"", Content-Security-Policy \"script-src 'self'; object-src 'self'\" ]`
+  - Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307.
 - [nginx_ssl_protocols][]
  - Default: `TLSv1.2`
  - Description: Specifies the SSL protocol which should be used.
@@ -11,19 +11,18 @@ nginx_client_header_timeout: "10"
 nginx_send_timeout: "10"
 nginx_limit_conn_zone: "$binary_remote_addr zone=default:10m"
 nginx_limit_conn: "default 5"
-nginx_add_header: [
-# vvoid clickjacking
-"X-Frame-Options SAMEORIGIN",
-# disable content-type sniffing
-"X-Content-Type-Options nosniff",
-# XSS filter
-"X-XSS-Protection \"1; mode=block\"",
-"Strict-Transport-Security max-age=15768000",
-"Content-Security-Policy \"script-src 'self'; object-src 'self'\"" ]
+nginx_add_header:
+  # avoid clickjacking
+  - X-Frame-Options SAMEORIGIN
+  # disable content-type sniffing
+  - X-Content-Type-Options nosniff
+  # XSS filter
+  - X-XSS-Protection "1; mode=block"
+  - Strict-Transport-Security max-age=15768000
+  - Content-Security-Policy "script-src 'self'; object-src 'self'"

 nginx_set_cookie_flag: "* HttpOnly secure"
 nginx_ssl_prefer_server_ciphers: "on"
-nginx_ssl_protocols: "TLSv1.2"
 nginx_ssl_ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
 nginx_ssl_session_tickets: "off"
-nginx_dh_size: "2048"
+nginx_dh_size: "4096"
@@ -4,7 +4,7 @@ galaxy_info:
  description: 'This Ansible role provides secure nginx configurations. http://dev-sec.io/'
  company: Hardening Framework Team
  license: Apache License 2.0
-  min_ansible_version: '2.5'
+  min_ansible_version: '2.9.10'
  platforms:
    - name: EL
      versions:
@@ -1,4 +1,27 @@
 ---
+- name: Fetch OS dependent variables
+  include_vars:
+    file: '{{ item }}'
+    name: 'os_vars'
+  with_first_found:
+    - files:
+        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - '{{ ansible_facts.distribution }}.yml'
+        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - '{{ ansible_facts.os_family }}.yml'
+      skip: true
+  tags: always
+
+# we only override variables with our default, if they have not been specified already
+# by default the lookup functions finds all varnames containing the string, therefore
+# we add ^ and $ to denote start and end of string, so this returns only exact matches
+- name: Set OS dependent variables, if not already defined by user  # noqa var-naming
+  set_fact:
+    '{{ item.key }}': '{{ item.value }}'
+  when: "not lookup('varnames', '^' + item.key + '$')"
+  with_dict: '{{ os_vars }}'
+  tags: always
+
 - name: Create additional configuration
  template:
    src: "hardening.conf.j2"
@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2"
@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
@@ -0,0 +1,2 @@
+---
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
@@ -1 +0,0 @@
---
@@ -106,6 +106,9 @@ We know that this is the case on Raspberry Pi.
 - `os_auth_pw_min_age`
  - Default: `7`
  - Description: minimum password age (before allowing any other password change).
+- `os_auth_pw_remember`
+  - Default: `5`
+  - Description: how many used passwords are record.
 - `os_auth_retries`
  - Default: `5`
  - Description: the maximum number of authentication attempts, before the account is locked for some time.
@@ -148,6 +151,36 @@ We know that this is the case on Raspberry Pi.
 - `os_security_suid_sgid_remove_from_unknown`
  - Default: `false`
  - Description: true if you want to remove SUID/SGID bits from any file, that is not explicitly configured in a `blacklist`. This will make every Ansible-run search through the mounted filesystems looking for SUID/SGID bits that are not configured in the default and user blacklist. If it finds an SUID/SGID bit, it will be removed, unless this file is in your `whitelist`.
+- `os_auth_uid_min`
+  - Default: `1000`
+  - Description: minimum number for automatic uid selection in useradd.
+- `os_auth_uid_max`
+  - Default: `60000`
+  - Description: maximum number for automatic uid selection in useradd.
+- `os_auth_gid_min`
+  - Default: `1000`
+  - Description: minimum number for automatic gid selection in groupadd.
+- `os_auth_gid_max`
+  - Default: `60000`
+  - Description: maximum number for automatic gid selection in groupadd.
+- `os_auth_sub_uid_count`
+  - Default: `65536`
+  - Description: If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate user IDs) allocate SUB_UID_COUNT unused user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user. See also `os_auth_sub_uid_min` and `os_auth_sub_uid_max`.
+- `os_auth_sub_uid_min`.
+  - Default: `100000`
+  - Description: minimum number for automatic subordinate uid selection in useradd and newusers.
+- `os_auth_sub_uid_max`
+  - Default: `600100000`
+  - Description: maximum number for automatic subordinate uid selection in useradd and newusers.
+- `os_auth_sub_gid_count`
+  - Default: `65536`
+  - Description: If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate group IDs) allocate SUB_GID_COUNT unused group IDs from the range SUB_GID_MIN to SUB_GID_MAX for each new user. See also `os_auth_sub_gid_min` and `os_auth_sub_gid_max`.
+- `os_auth_sub_gid_min`
+  - Default: `100000`
+  - Description: minimum number for automatic subordinate gid selection in useradd and newusers.
+- `os_auth_sub_gid_max`
+  - Default: `600100000`
+  - Description: maximum number for automatic subordinate gid selection in useradd and newusers.
 - `os_security_packages_clean`
  - Default: `true`
  - Description: removes packages with known issues. See section packages.
@@ -196,6 +229,9 @@ We know that this is the case on Raspberry Pi.
 - `os_cron_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring cron.
+- `os_ctrlaltdel_disabled`
+  - Default: `false`
+  - Description: Set to true to disable ctrl-alt-delete key combination.
 - `os_limits_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring limits.
@@ -214,6 +250,9 @@ We know that this is the case on Raspberry Pi.
 - `os_profile_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring profile.
+- `os_security_auto_logout`
+  - Default: `0`
+  - Description: Set timeout in seconds for logout users automatically after time. Setting this to `0` disables the timeout.
 - `os_securetty_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring securetty.
@@ -229,6 +268,9 @@ We know that this is the case on Raspberry Pi.
 - `os_yum_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring yum.
+- `os_yum_repo_file_whitelist`
+  - Default: `[]`
+  - Description: List of yum repository files under /etc/yum.repos.d/ which should not be altered.
 - `os_apt_enabled`
  - Default: `true`
  - Description: Set to false to disable installing and configuring apt.
@@ -3,6 +3,7 @@ os_desktop_enable: false
 os_env_extra_user_paths: []
 os_auth_pw_max_age: 60
 os_auth_pw_min_age: 7  # Discourage password cycling
+os_auth_pw_remember: 5  # Specify how many used passwords are record
 os_auth_retries: 5
 os_auth_lockout_time: 600  # Seconds (600 = 10min)
 os_auth_timeout: 60
@@ -69,6 +70,12 @@ sysctl_config:
  fs.protected_hardlinks: 1
  fs.protected_symlinks: 1

+  # For more info on the following settings see: https://www.kernel.org/doc/html/latest/admin-guide/sysctl/fs.html
+  # Restrict FIFO special device creation behavior
+  fs.protected_fifos: 1
+  # Restrict regular files creation behavior
+  fs.protected_regular: 2
+
  # Prevent core dumps with SUID. These are usually only
  # needed by developers and may contain sensitive information. | sysctl-31
  fs.suid_dumpable: 0
@@ -325,6 +332,9 @@ proc_mnt_options: 'rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}'
 # Set to false to disable installing and configuring cron.
 os_cron_enabled: true

+# Set to true to disable ctrl-alt-del key combination.
+os_ctrlaltdel_disabled: false
+
 # Set to false to disable installing and configuring limits.
 os_limits_enabled: true

@@ -346,6 +356,9 @@ os_profile_enabled: true
 # Set to false to disable installing and configuring securetty.
 os_securetty_enabled: true

+# Set timeout in seconds for logout users automatically after time. Setting this to `0` disables the timeout.
+os_security_auto_logout: 0
+
 # Set to false to disable installing and configuring sysctl.
 os_sysctl_enabled: true

@@ -358,6 +371,9 @@ os_rhosts_enabled: true
 # Set to false to disable installing and configuring yum.
 os_yum_enabled: true

+# List of yum repository files under /etc/yum.repos.d/ which should not be altered.
+os_yum_repo_file_whitelist: []
+
 # Set to false to disable installing and configuring apt.
 os_apt_enabled: true

@@ -7,3 +7,7 @@
    cmd: 'service auditd restart'  # rhel: see: https://access.redhat.com/solutions/2664811
    warn: false  # sadly 'service' module fails in that case also by using 'use: service'
  when: molecule_yml is not defined  # restarting auditd in a container does not work
+
+- name: Reload systemd
+  systemd:
+    daemon_reload: yes
@@ -4,7 +4,7 @@ galaxy_info:
  description: 'This Ansible role provides numerous security-related ssh configurations, providing all-round base protection.'
  company: Hardening Framework Team
  license: Apache License 2.0
-  min_ansible_version: '2.5'
+  min_ansible_version: '2.9.10'
  platforms:
    - name: EL
      versions:
@@ -0,0 +1,7 @@
+---
+- name: Disable CTRL-ALT-DEL
+  systemd:
+    name: ctrl-alt-del.target
+    masked: yes
+    daemon_reload: yes
+  when: ansible_service_mgr == "systemd"
@@ -15,7 +15,7 @@
 # we only override variables with our default, if they have not been specified already
 # by default the lookup functions finds all varnames containing the string, therefore
 # we add ^ and $ to denote start and end of string, so this returns only exact matches
- name: Set OS dependent variables, if not already defined by user
+- name: Set OS dependent variables, if not already defined by user  # noqa var-naming
  set_fact:
    '{{ item.key }}': '{{ item.value }}'
  when: "not lookup('varnames', '^' + item.key + '$')"
@@ -30,6 +30,10 @@
  tags: cron
  when: os_cron_enabled | bool

+- import_tasks: ctrlaltdel.yml
+  tags: ctrlaltdel
+  when: os_ctrlaltdel_disabled | bool
+
 - import_tasks: limits.yml
  tags: limits
  when: os_limits_enabled | bool
@@ -1,5 +1,6 @@
 ---
- block:
+- name: disable coredumps
+  block:
  - name: Create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
    file:
      path: '/etc/security/limits.d'
@@ -27,10 +28,38 @@
      modification_time: preserve
      access_time: preserve

+  - name: create coredump.conf.d-directory if it does not exist
+    file:
+      path: '/etc/systemd/coredump.conf.d'
+      owner: root
+      group: root
+      mode: 0755
+      state: directory
+    when: ansible_service_mgr == "systemd"
+
+  - name: create custom.conf for disabling coredumps
+    template:
+      src: 'etc/systemd/coredump.conf.d/coredumps.conf.j2'
+      dest: '/etc/systemd/coredump.conf.d/custom.conf'
+      owner: root
+      group: root
+      mode: 0644
+    when: ansible_service_mgr == "systemd"
+    notify: Reload systemd
+
  when: not os_security_kernel_enable_core_dump | bool

- name: Remove 10.hardcore.conf config file
-  file:
-    path: /etc/security/limits.d/10.hardcore.conf
-    state: absent
+- name: enable coredumps
+  block:
+  - name: Remove coredump.conf.d directory with files
+    file:
+      path: /etc/systemd/coredump.conf.d
+      state: absent
+    when: ansible_service_mgr == "systemd"
+    notify: Reload systemd
+
+  - name: Remove 10.hardcore.conf config file
+    file:
+      path: /etc/security/limits.d/10.hardcore.conf
+      state: absent
  when: os_security_kernel_enable_core_dump | bool
@@ -27,19 +27,43 @@
    - "{{ minimize_access_directories.results }}"
    - stdout_lines

+- name: Find shadow files
+  stat:
+    path: "{{ item }}"
+  loop:
+    - '/etc/shadow'
+    - '/etc/gshadow'
+    - '/etc/shadow-'
+    - '/etc/gshadow-'
+  register: minimize_access_shadow_files
+
 - name: Change shadow ownership to root and mode to 0600 | os-02
  file:
-    dest: '/etc/shadow'
+    dest: "{{ item.item }}"
    owner: '{{ os_shadow_perms.owner }}'
    group: '{{ os_shadow_perms.group }}'
    mode: '{{ os_shadow_perms.mode }}'
+  when: item.stat.exists
+  loop: "{{ minimize_access_shadow_files.results }}"
+
+- name: Find passwd files
+  stat:
+    path: "{{ item }}"
+  loop:
+    - '/etc/passwd'
+    - '/etc/group'
+    - '/etc/passwd-'
+    - '/etc/group-'
+  register: minimize_access_passwd_files

 - name: Change passwd ownership to root and mode to 0644 | os-03
  file:
-    dest: '/etc/passwd'
+    dest: "{{ item.item }}"
    owner: '{{ os_passwd_perms.owner }}'
    group: '{{ os_passwd_perms.group }}'
    mode: '{{ os_passwd_perms.mode }}'
+  when: item.stat.exists
+  loop: "{{ minimize_access_passwd_files.results }}"

 - name: Change su-binary to only be accessible to user and group root
  file:
@@ -55,4 +79,4 @@
    src: proc
    fstype: proc
    opts: '{{ proc_mnt_options }}'
-    state: present
+    state: mounted
@@ -13,3 +13,11 @@
    path: /etc/profile.d/pinerolo_profile.sh
    state: absent
  when: os_security_kernel_enable_core_dump | bool
+
+- name: Add autologout to profile env
+  template:
+    src: 'etc/profile.d/tmout.sh.j2'
+    dest: '/etc/profile.d/tmout.sh'
+    owner: 'root'
+    group: 'root'
+    mode: '0644'
@@ -43,6 +43,17 @@

 - name: Change sysctls
  block:
+    - name: Create a combined sysctl-dict if os-dependent sysctls are defined
+      set_fact:
+        sysctl_config: '{{ sysctl_config | combine(sysctl_custom_config) }}'
+      when: sysctl_custom_config | default()
+
+    # sysctl_rhel_config is kept for backwards-compatibility. use sysctl_custom_config instead
+    - name: Create a combined sysctl-dict if os-dependent sysctls are defined
+      set_fact:
+        sysctl_config: '{{ sysctl_config | combine(sysctl_rhel_config) }}'
+      when: sysctl_rhel_config | default()
+
    - name: Create a combined sysctl-dict if overwrites are defined
      set_fact:
        sysctl_config: '{{ sysctl_config | combine(sysctl_overwrite) }}'
@@ -57,17 +68,6 @@
        reload: true
        ignoreerrors: true
      with_dict: '{{ sysctl_config }}'
-
-    - name: Change various sysctl-settings on Amazon Linux, look at the sysctl-vars file for documentation
-      sysctl:
-        name: '{{ item.key }}'
-        value: '{{ item.value }}'
-        state: present
-        reload: true
-        ignoreerrors: true
-      with_dict: '{{ sysctl_rhel_config }}'
-      when: ansible_facts.distribution == 'Amazon'
-
  when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']

 - name: Apply ufw defaults
@@ -9,7 +9,7 @@
    - 'CentOS-Vault'
  when: os_security_packages_clean | bool

- name: Get yum-repository-files
+- name: Get yum repository files
  find:
    paths: '/etc/yum.repos.d'
    patterns: '*.repo'
@@ -18,14 +18,14 @@
 # for the 'default([])' see here:
 # https://github.com/dev-sec/ansible-os-hardening/issues/99 and
 # https://stackoverflow.com/questions/37067827/ansible-deprecation-warning-for-undefined-variable-despite-when-clause
- name: Activate gpg-check for yum-repository-files
+- name: Activate gpg-check for yum repository files
  replace:
-    path: '{{ item.path }}'
+    path: '{{ item }}'
    regexp: '^\s*gpgcheck.*'
    replace: 'gpgcheck=1'
    mode: '0644'
  with_items:
-    - '{{ yum_repos.files | default([]) }}'
+    - "{{ yum_repos.files | default([]) | map(attribute='path') | difference(os_yum_repo_file_whitelist | map('regex_replace', '^', '/etc/yum.repos.d/') | list) }}"

 # failed_when is needed because by default replace module will fail if the file doesn't exists.
 # status.rc is only defined if an error accrued and only error code (rc) 257 will be ignored.
@@ -114,18 +114,28 @@ PASS_WARN_AGE     7

 # Min/max values for automatic uid selection in useradd
 UID_MIN           {{ os_auth_uid_min }}
-UID_MAX           60000
+UID_MAX           {{ os_auth_uid_max }}
 # System accounts
 SYS_UID_MIN       {{ os_auth_sys_uid_min }}
 SYS_UID_MAX       {{ os_auth_sys_uid_max }}

 # Min/max values for automatic gid selection in groupadd
 GID_MIN           {{ os_auth_gid_min }}
-GID_MAX           60000
+GID_MAX           {{ os_auth_gid_max }}
 # System accounts
 SYS_GID_MIN       {{ os_auth_sys_gid_min }}
 SYS_GID_MAX       {{ os_auth_sys_gid_max }}

+# If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate user IDs)
+# allocate SUB_UID_COUNT unused user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user.
+# The default values for SUB_UID_MIN, SUB_UID_MAX, SUB_UID_COUNT are respectively 100000, 600100000 and 65536.
+SUB_UID_MIN       {{ os_auth_sub_uid_min }}
+SUB_UID_MAX       {{ os_auth_sub_uid_max }}
+SUB_UID_COUNT     {{ os_auth_sub_uid_count }}
+SUB_GID_MIN       {{ os_auth_sub_gid_min }}
+SUB_GID_MAX       {{ os_auth_sub_gid_max }}
+SUB_GID_COUNT     {{ os_auth_sub_gid_count }}
+
 # Max number of login retries if password is bad. This will most likely be overriden by PAM, since the default pam_unix module has it's own built in of 3 retries. However, this is a safe fallback in case you are using an authentication module that does not enforce PAM_MAXTRIES.
 LOGIN_RETRIES     {{ os_auth_retries }}

@@ -36,7 +36,7 @@ account     required      pam_permit.so
 password    requisite     pam_pwquality.so {{ os_auth_pam_pwquality_options }}
 {% endif %}
 {# NSA 2.3.3.6 Limit Password Reuse #}
-password    requisite     pam_pwhistory.so remember=5 use_authtok
+password    requisite     pam_pwhistory.so remember={{ os_auth_pw_remember }} use_authtok
 {# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512 #}
 password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok rounds={{ os_sha_crypt_min_rounds }}
 {% if (os_auth_pam_sssd_enable | bool) %}
@@ -0,0 +1,3 @@
+# Logout Timeout
+export TMOUT={{ os_security_auto_logout }}
+readonly TMOUT
@@ -0,0 +1,2 @@
+[Coredump]
+Storage=none
@@ -19,11 +19,19 @@ os_passwd_perms:
 os_env_umask: '077'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 201
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 os_auth_pam_sssd_enable: false

@@ -37,8 +45,4 @@ auditd_package: 'audit'
 # system accounts that do not get their login disabled and pasword changed
 os_always_ignore_users: ['root', 'sync', 'shutdown', 'halt', 'ec2-user']

-sysctl_rhel_config:
-  # ExecShield protection against buffer overflows
-  kernel.exec-shield: 1
-
 hidepid_option: '2'  # allowed values: 0, 1, 2
@@ -15,13 +15,27 @@ os_passwd_perms:
 os_env_umask: '027'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 500
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 500
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 modprobe_package: 'kmod'
 auditd_package: 'audit'

 hidepid_option: '2'  # allowed values: 0, 1, 2
+
+sysctl_custom_config:
+  # Mitigation of vulnerability CVE-2021-33909
+  kernel.unprivileged_userns_clone: 0
+  # Mitigation of vulnerability CVE-2021-33910
+  kernel.unprivileged_bpf_disabled: 1
@@ -19,11 +19,19 @@ os_passwd_perms:
 os_env_umask: '027'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 100
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 100
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 # defaults for useradd
 os_useradd_mail_dir: /var/mail
@@ -35,3 +43,9 @@ tally2_path: '/usr/share/pam-configs/tally2'
 passwdqc_path: '/usr/share/pam-configs/passwdqc'

 hidepid_option: '2'  # allowed values: 0, 1, 2
+
+sysctl_custom_config:
+  # Mitigation of vulnerability CVE-2021-33909
+  kernel.unprivileged_userns_clone: 0
+  # Mitigation of vulnerability CVE-2021-33910
+  kernel.unprivileged_bpf_disabled: 1
@@ -19,11 +19,19 @@ os_passwd_perms:
 os_env_umask: '027'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 201
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 os_auth_pam_sssd_enable: true

@@ -19,11 +19,19 @@ os_passwd_perms:
 os_env_umask: '077'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 201
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 os_auth_pam_sssd_enable: false

@@ -19,11 +19,19 @@ os_passwd_perms:
 os_env_umask: '077'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 201
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 os_auth_pam_sssd_enable: false

@@ -19,11 +19,19 @@ os_passwd_perms:
 os_env_umask: '077'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 201
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 os_auth_pam_sssd_enable: true

@@ -19,11 +19,19 @@ os_passwd_perms:
 os_env_umask: '077'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 201
 os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 os_auth_pam_sssd_enable: true

@@ -19,11 +19,19 @@ os_passwd_perms:
 os_env_umask: '027'

 os_auth_uid_min: 1000
+os_auth_uid_max: 60000
 os_auth_gid_min: 1000
+os_auth_gid_max: 60000
 os_auth_sys_uid_min: 100
 os_auth_sys_uid_max: 499
 os_auth_sys_gid_min: 100
 os_auth_sys_gid_max: 499
+os_auth_sub_uid_min: 100000
+os_auth_sub_uid_max: 600100000
+os_auth_sub_uid_count: 65536
+os_auth_sub_gid_min: 100000
+os_auth_sub_gid_max: 600100000
+os_auth_sub_gid_count: 65536

 # defaults for useradd
 os_useradd_create_home: false
@@ -61,7 +61,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
  - Description: Disable root-login. Set to `'without-password'` or `'yes'` to enable root-login - The quotes are required!
 - `ssh_allow_tcp_forwarding`
  - Default: `no`
-  - Description: `'no'` to disable TCP Forwarding. Set to `'yes'` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all', `'local'`or`'remote'`. <br> _Note_: values passed to this variable must be strings, thus values `'yes'`and`'no'` should be passed with quotes.
+  - Description: `'no'` to disable TCP Forwarding. Set to `'yes'` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all'`, `'local'`or`'remote'`. <br> _Note_: values passed to this variable must be strings, thus values `'yes'`and`'no'` should be passed with quotes.
 - `ssh_gateway_ports`
  - Default: `false`
  - Description: `false` to disable binding forwarded ports to non-loopback addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified` to allow the client to specify which address to bind to.
@@ -75,7 +75,7 @@ ssh_remote_hosts: []
 # Set this to "without-password" or "yes" to allow root to login
 ssh_permit_root_login: 'no'         # sshd

-# false to disable TCP Forwarding. Set to true to allow TCP Forwarding.
+# false to disable TCP Forwarding. Set to 'yes', 'no', 'local', 'all' or 'remote' to allow TCP Forwarding.
 ssh_allow_tcp_forwarding: 'no'      # sshd

 # false to disable binding forwarded ports to non-loopback addresses. Set to true to force binding on wildcard address.
@@ -4,7 +4,7 @@ galaxy_info:
  description: 'This Ansible role provides numerous security-related ssh configurations, providing all-round base protection.'
  company: Hardening Framework Team
  license: Apache License 2.0
-  min_ansible_version: '2.5'
+  min_ansible_version: '2.9.10'
  platforms:
    - name: EL
      versions:
@@ -11,7 +11,7 @@
 - name: Create ssh authorized principals directories
  file:
    path: '{{ item.path | dirname }}'
-    mode: '{{ item.directorymode | default(0700) }}'
+    mode: '{{ item.directorymode | default("700") }}'
    owner: '{{ item.directoryowner | default(ssh_owner) }}'
    group: '{{ item.directorygroup | default(ssh_group) }}'
    state: directory
@@ -21,7 +21,7 @@
  template:
    src: 'authorized_principals.j2'
    dest: '{{ item.path }}'
-    mode: '{{ item.filemode | default(0600) }}'
+    mode: '{{ item.filemode | default("600") }}'
    owner: '{{ item.owner| default(ssh_owner) }}'
    group: '{{ item.group | default(ssh_group) }}'
  loop: '{{ ssh_authorized_principals }}'
@@ -15,7 +15,7 @@
 # we only override variables with our default, if they have not been specified already
 # by default the lookup functions finds all varnames containing the string, therefore
 # we add ^ and $ to denote start and end of string, so this returns only exact matches
- name: Set OS dependent variables, if not already defined by user
+- name: Set OS dependent variables, if not already defined by user  # noqa var-naming
  set_fact:
    '{{ item.key }}': '{{ item.value }}'
  when: "not lookup('varnames', '^' + item.key + '$')"
Author	SHA1	Message	Date
schurzi	dc22dc33a2	Merge pull request #530 from dev-sec/delete_drafts delete obsolete release drafts	2022-02-28 10:20:01 +01:00
Martin Schurz	9d00c8ba29	delete old release drafts Signed-off-by: Martin Schurz <[email protected]>	2022-02-25 20:10:36 +01:00
dev-sec CI	bf276ba14d	update changelog	2022-02-21 13:03:04 +00:00
abejotaRandAbraham Rebori	8edd650135	change permissions of the tmout.sh file (#520 ) Co-authored-by: Abraham Rebori <[email protected]>	2022-02-21 14:01:19 +01:00
dev-sec CI	fce131a75d	update changelog	2022-02-21 13:00:41 +00:00
Sebastian Gumprich	af14af5954	add waivers to skip controls (#529 ) Signed-off-by: rndmh3ro <[email protected]>	2022-02-21 13:58:39 +01:00
dev-sec CI	b6677fccd9	update changelog	2022-02-21 11:14:34 +00:00
schurzi	9be3a0520b	Merge pull request #526 from dev-sec/nginx_debian_9_tls debian 9's nginx doesn't support tls1.3	2022-02-21 11:49:34 +01:00
dev-sec CI	1f8c8d1c43	update changelog	2022-02-21 10:46:52 +00:00
schurzi	49b93dc89c	Merge pull request #525 from dev-sec/remove_centos_8 remove centos8 tests	2022-02-21 11:39:09 +01:00
rndmh3ro	468e4674b8	debian 9's nginx doesnt support tls1.3 while this could be better solved by checking what nginx version is used, debian9 is eol'd in 4 months. if there will be again a need to check for nginx versions, we'll add it then Signed-off-by: rndmh3ro <[email protected]>	2022-02-21 10:02:54 +01:00
dev-sec CI	2a4d409339	update galaxy.yml with new version	2022-02-21 08:28:20 +00:00
rndmh3ro	b74e88723d	remove centos8 tests Signed-off-by: rndmh3ro <[email protected]>	2022-02-21 08:05:40 +01:00
dev-sec CI	e0e76fa675	update changelog	2022-02-18 14:46:02 +00:00
Sebastian Gumprich	2ba40b0891	move sysctls to debian specific vars (#524 ) * fix ansible-lint issue https://github.com/ansible-community/ansible-lint/issues/1795 Signed-off-by: rndmh3ro <[email protected]> * move 2 sysctls to debian specific Signed-off-by: rndmh3ro <[email protected]> * fix ansible-lint issue https://github.com/ansible-community/ansible-lint/issues/1795 Signed-off-by: rndmh3ro <[email protected]> * add arch linux sysctls * simplify sysctl settings Signed-off-by: rndmh3ro <[email protected]> * ove overwrite to the bottom to let it acutally overwrite something Signed-off-by: rndmh3ro <[email protected]> * fix typo Signed-off-by: rndmh3ro <[email protected]>	2022-02-18 15:30:32 +01:00
dev-sec CI	798f4b9a99	update galaxy.yml with new version	2021-12-16 11:03:39 +00:00
dev-sec CI	507873f388	update changelog	2021-12-16 10:56:21 +00:00
dev-sec CI	8bdf9bbb21	update changelog	2021-12-16 10:41:14 +00:00
lbayerleinandLudwig Bayerlein	1a97c6cf87	new feautre tmout in a new pr (#516 ) Signed-off-by: Ludwig Bayerlein <[email protected]> Co-authored-by: Ludwig Bayerlein <[email protected]>	2021-12-16 11:39:24 +01:00
dev-sec CI	73d319cc79	update changelog	2021-12-10 21:12:13 +00:00
Sebastian Gumprich	8f22ce788c	Feature coredump (#513 ) * restructure limits-tasks * disable coredumps in tests * use notify-task for systemd-reload Signed-off-by: rndmh3ro <[email protected]> * add notify to another task Signed-off-by: rndmh3ro <[email protected]> * rm obsolete task and rename handler Signed-off-by: rndmh3ro <[email protected]>	2021-12-10 22:10:14 +01:00
dev-sec CI	945d00fd91	update changelog	2021-12-08 13:27:41 +00:00
lbayerleinandLudwig Bayerlein	bb8e3e375e	add feature to disable coredump to limit task (#511 ) Signed-off-by: Ludwig Bayerlein <[email protected]> Co-authored-by: Ludwig Bayerlein <[email protected]>	2021-12-08 14:25:49 +01:00
dev-sec CI	db78f612f5	update changelog	2021-11-30 09:24:20 +00:00
schurzi	82be5db515	Merge pull request #510 from alegrey91/master change hidepid mount task state to mounted	2021-11-30 10:22:24 +01:00
alegrey91	8805d9c14a	fix: change hidepid mount task state to mounted	2021-11-29 22:37:21 +01:00
dev-sec CI	ed17a6370a	update changelog	2021-11-29 09:27:29 +00:00
schurzi	ad43f908df	prettify nginx options (#509 ) Signed-off-by: Martin Schurz <[email protected]>	2021-11-29 10:25:43 +01:00
dev-sec CI	530069ae88	update changelog	2021-11-28 10:40:22 +00:00
schurzi	cb3574ed56	Merge pull request #501 from ksaadDE/patch-3 Updated dh_params to 4096	2021-11-28 11:38:39 +01:00
dev-sec CI	e95729b431	update changelog	2021-11-26 10:34:51 +00:00
duffn	1d25d4185c	Update nginx_add_header README to match default (#506 ) Signed-off-by: Nicholas Duffy <[email protected]>	2021-11-26 11:31:47 +01:00
tekicat	88893a5d4a	Fix duplicate sysctl config (#505 ) Signed-off-by: tekicat <[email protected]> Signed-off-by: gk <[email protected]> Signed-off-by: Tekicat <[email protected]>	2021-11-26 11:30:50 +01:00
dev-sec CI	b67a28bd09	update galaxy.yml with new version	2021-11-23 10:49:03 +00:00
rndmh3ro	88ea2966db	fix tags in galaxy.yml - no dashes allowed Signed-off-by: rndmh3ro <[email protected]>	2021-11-23 08:20:06 +01:00
dev-sec CI	dfa065dcff	update changelog	2021-11-23 07:08:47 +00:00
rndmh3ro	cb0e00f433	fix tags in galaxy.yml - no dashes allowed Signed-off-by: rndmh3ro <[email protected]>	2021-11-23 08:06:45 +01:00
dev-sec CI	3bd20265d4	update changelog	2021-11-23 06:46:04 +00:00
Karim	f84ff572ac	Updated dh_params to 4096 Updated dh_params to 4096	2021-11-15 19:02:59 +00:00
dev-sec CI	8a385b8114	update changelog	2021-11-15 18:43:49 +00:00
schurzi	b0393a12ce	Merge pull request #470 from ksaadDE/patch-2 Add TLSv1.3 to nginx default configuration	2021-11-15 19:41:49 +01:00
Karim	96d6b47912	Update main.yml TLSv1.3 should be supported (+security) and soon as possible should be TLSv1.2 EOL.	2021-11-15 19:23:47 +01:00
dev-sec CI	0c840372d8	update changelog	2021-11-07 21:30:06 +00:00
schurzi	ff939a2b4c	Merge pull request #499 from darxriggs/improvement-arch-linux Improve testing: install packages on Arch Linux	2021-11-07 22:21:58 +01:00
René Scheibe	0609cf729a	Improve installing packages on Arch Linux This prevents annoying task errors (even though they are ignored) when testing on non-Arch distributions. Running the "prepare" command, this was always visible: > fatal: [instance]: FAILED! => {"changed": false, "msg": "Failed to find required executable \"pacman\" in paths: /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin"} Signed-off-by: René Scheibe <[email protected]>	2021-11-07 13:53:03 +01:00
dev-sec CI	c9c6819892	update changelog	2021-11-07 10:58:40 +00:00
René Scheibe	bbe4ce16a1	Add whitelist option for yum repository files (#487 ) Files in this whitelist should not be altered. Currently this is only relevant for enforcing the gpg check. Signed-off-by: René Scheibe <[email protected]>	2021-11-07 11:56:59 +01:00
dev-sec CI	4eb847c90e	update changelog	2021-10-28 08:33:53 +00:00
lbayerlein Ludwig Bayerlein Sebastian Gumprich	1bf31a197b	disable ctrl-alt-del key combination (#496 ) * new function to disable ctrl-alt-del to avooid reboot virtual machines f.e. Signed-off-by: Ludwig Bayerlein <[email protected]> * fix variable documentation for ctrlaltdel Signed-off-by: Ludwig Bayerlein <[email protected]> * added ctrlaltdel variable for molecule Signed-off-by: Ludwig Bayerlein <[email protected]> * optimize ctrlaltdel function with a 'when' query. thanks to rndmh3ro Signed-off-by: Ludwig Bayerlein <[email protected]> * fix typo in new file Co-authored-by: Ludwig Bayerlein <[email protected]> Co-authored-by: Sebastian Gumprich <[email protected]>	2021-10-28 10:31:58 +02:00
dev-sec CI	1605f304ec	update changelog	2021-10-25 09:14:17 +00:00
schurzi	12c1f3dd78	Merge pull request #491 from dev-sec/recreate_tests revive old tests with custom ssh settings	2021-10-25 11:12:10 +02:00
rndmh3ro	7f17f9b8b2	remove unused verify file Signed-off-by: rndmh3ro <[email protected]>	2021-10-25 11:04:47 +02:00
Sebastian Gumprich	f09b2b6338	fix molecule call	2021-10-25 10:26:56 +02:00
dev-sec CI	2e5e1de407	update changelog	2021-10-24 10:41:11 +00:00
schurzi	c1974282b1	add old role names to tags in Galaxy (#495 ) We deprecated our roles in Ansible Galaxy the deprecation link contains a search keyword with the role name and our new collection should be found, if someone clicks this link. Signed-off-by: Martin Schurz <[email protected]>	2021-10-24 12:39:16 +02:00
dev-sec CI	09958ccb91	update changelog	2021-10-24 09:30:03 +00:00
schurzi	08b0fd14f4	Merge pull request #494 from dev-sec/sysctl-34 implement sysctl-34 - link protection settings	2021-10-24 11:21:14 +02:00
schurzi	ff37289879	Merge pull request #493 from dev-sec/rndmh3ro-patch-1 update minimum ansible version for roles	2021-10-24 11:09:37 +02:00
Sebastian Gumprichandschurzi	9f372c285c	Update roles/os_hardening/defaults/main.yml Co-authored-by: schurzi <[email protected]>	2021-10-24 10:59:49 +02:00
dev-sec CI	aaf6d307b8	update galaxy.yml with new version	2021-10-22 10:51:29 +00:00
dev-sec CI	3cd532fe41	update changelog	2021-10-21 07:53:07 +00:00
Claudius Heine	384c097f8a	feat(os_hardening): extend file permission tasks to cover more files (#489 ) The tasks `Change shadow ownership to root and mode to 0600` and `Change passwd ownership to root and mode to 0644` only handle `/etc/shadow` and `/etc/passwd` respectively. But there multiple adjacent files that should be handled with these rules as well: - `/etc/gshadow` - `/etc/shadow-` - `/etc/gshadow-` - `/etc/group` - `/etc/shadow-` - `/etc/group-` This change adds those files to the rules, so that permissions are handled in the same way. Closes: #488 Signed-off-by: Claudius Heine <[email protected]>	2021-10-21 09:51:20 +02:00
rndmh3ro	346b064682	implement sysctl-34 - link protection settings Signed-off-by: rndmh3ro <[email protected]>	2021-10-20 20:59:49 +02:00
Sebastian Gumprich	be0d501bc8	update minimum ansible version for roles fixes #407 Signed-off-by: rndmh3ro <[email protected]>	2021-10-20 20:42:05 +02:00
rndmh3ro	12aaa7d955	add new files to labeler config Signed-off-by: rndmh3ro <[email protected]>	2021-10-20 15:32:45 +02:00
rndmh3ro	f32b2c2c5e	fix match address test	2021-10-20 15:18:01 +02:00
rndmh3ro	3877a9bab1	fix comment Signed-off-by: rndmh3ro <[email protected]>	2021-10-18 22:00:01 +02:00
rndmh3ro	cb7f447d9f	fix comment Signed-off-by: rndmh3ro <[email protected]>	2021-10-18 21:55:01 +02:00
rndmh3ro	55c83ac92d	use second molecule scenario for custom ssh tests Signed-off-by: rndmh3ro <[email protected]>	2021-10-18 21:49:24 +02:00
rndmh3ro	bbc827e4a1	use second molecule scenario for custom ssh tests Signed-off-by: rndmh3ro <[email protected]>	2021-10-18 21:33:45 +02:00
dev-sec CI	999e5fa210	update changelog	2021-10-18 19:14:34 +00:00
schurzi	215c8042ad	Merge pull request #490 from dev-sec/change_baseline_urlsa change baseline urls to full zip-url	2021-10-18 21:04:05 +02:00
rndmh3ro	940819ab84	revive old tests with custom ssh settings Signed-off-by: rndmh3ro <[email protected]>	2021-10-18 21:01:02 +02:00
dev-sec CI	21ca7c533a	update changelog	2021-10-18 18:57:06 +00:00
Sina Tak TehraniandSebastian Gumprich	5debcc0c6f	fix filter error in ansible.builtin.file mode parameter (#486 ) * fix filter error in ansible.builtin.file mode parameter * Change cinc supermarket * fix link to baseline * fix typo Co-authored-by: Sebastian Gumprich <[email protected]>	2021-10-18 20:55:24 +02:00
rndmh3ro	92bd94a0cf	change baseline urls to full zip-url the other urls that use git don't work anymore Signed-off-by: rndmh3ro <[email protected]>	2021-10-18 20:28:19 +02:00
dev-sec CI	aea4499805	update galaxy.yml with new version	2021-10-15 13:46:33 +00:00
dev-sec CI	29945527b8	update changelog	2021-08-30 13:47:56 +00:00
ReinerNippes	e819f89ccb	ssh_allow_tcp_forwarding is not a boolean (#480 ) Changed the comment to "Set to 'yes', 'no', 'local', 'all' or 'remote' to allow TCP Forwarding"	2021-08-30 15:46:03 +02:00
dev-sec CI	fcb7efc156	update changelog	2021-08-28 13:23:49 +00:00
Roger Meier	8fdb4e55b8	chore(ssh_hardening): set min_ansible_version to >=2.9.10 (#479 )	2021-08-28 15:21:59 +02:00
rndmh3ro	8ff3d73bbf	Prettified Code!	2021-08-25 10:58:16 +00:00
123quhiwiwk	062dd3f092	Use log_error/datadir from database settings instead of default variable (#478 ) Signed-off-by: 123quhiwiwk <[email protected]>	2021-08-25 12:57:46 +02:00
dev-sec CI	37cff01759	update changelog	2021-08-24 07:43:35 +00:00
123quhiwiwk	4671a32062	Execute check of error logfile permissions only when log_error is defined (#477 ) Signed-off-by: 123quhiwiwk <[email protected]>	2021-08-24 09:41:55 +02:00
dev-sec CI	78bab3f710	update changelog	2021-08-20 11:02:03 +00:00
Shawn Wilsher	3b33e0a7aa	[mysql_hardening] Setup defaults for MySQL on FreeBSD (#474 ) Signed-off-by: Shawn Wilsher <[email protected]>	2021-08-20 13:00:12 +02:00
dev-sec CI	2ed9d8e9da	update galaxy.yml with new version	2021-08-17 11:29:25 +00:00
dev-sec CI	df134e6385	update changelog	2021-08-15 20:55:27 +00:00
schurzi	d7eb00f4b7	Merge pull request #475 from dev-sec/ansible_lint use Ansible lint in separate task	2021-08-15 22:53:41 +02:00
rndmh3ro	7b37e9890e	rename ansible-lint task Signed-off-by: rndmh3ro <[email protected]>	2021-08-15 20:16:56 +02:00
rndmh3ro	cf17f80374	skip linting on special task Signed-off-by: rndmh3ro <[email protected]>	2021-08-15 20:16:56 +02:00
rndmh3ro	6fa7f7a0c8	add new linting action to replace molecules linting molecule lints multiple times per action Signed-off-by: rndmh3ro <[email protected]>	2021-08-15 20:16:56 +02:00
rndmh3ro	6c80de270b	remove molecule linting, because it has own action now Signed-off-by: rndmh3ro <[email protected]>	2021-08-15 20:16:56 +02:00
dev-sec CI	e20dd076d1	update changelog	2021-08-15 18:04:40 +00:00
Shawn WilsherandSebastian Gumprich	9ab06a5e06	[mysql_hardening] Allow setting the mysql_distribution (#473 ) * [mysql_hardening] Allow setting the mysql_distribution On some operating systems, the package for MySQL is not `mysql-server`, and so the default check for this will not yield the correct result. This change adds an escape hatch by letting the user set `mysql_distribution`. Additionally, it verifies that it is set to a legal value if the user has set it. Closes #472 Signed-off-by: Shawn Wilsher <[email protected]> * Update roles/mysql_hardening/tasks/main.yml Co-authored-by: Sebastian Gumprich <[email protected]>	2021-08-15 20:03:07 +02:00
dev-sec CI	bfd3f96355	update changelog	2021-08-06 11:42:51 +00:00
Filippo Tessarotto	3a73f6c46a	SSH Hardening: backtick typo (#471 )	2021-08-06 13:41:05 +02:00
dev-sec CI	4162929d2e	update changelog	2021-08-06 11:10:37 +00:00
Sebastian Gumprich	545fd8798f	Create LICENSE	2021-08-06 13:08:55 +02:00
dev-sec CI	3bd5eccec0	update changelog	2021-07-23 10:06:49 +00:00
schurzi	430e6c366f	Merge pull request #469 from dev-sec/rndmh3ro-patch-1 fix license in galaxy	2021-07-23 12:04:59 +02:00
schurzi	b24ee631cb	fix double space	2021-07-23 12:04:45 +02:00
Sebastian Gumprich	681047ba52	fix readme in galaxy	2021-07-23 11:06:22 +02:00
dev-sec CI	96685ff0ac	update galaxy.yml with new version	2021-07-22 14:41:26 +00:00
dev-sec CI	93ed95fe90	update changelog	2021-07-22 14:34:58 +00:00
Paweł Krawczyk	66bd1f0aec	Add CVE-2021-33909 mitigations (#466 ) * Add CVE-2021-33909 mitigations kernel.unprivileged_bpf_disabled: 1 kernel.unprivileged_userns_clone: 0 The first one is also used by Tails. Signed-off-by: Paweł Krawczyk <[email protected]> * Clean up whitespaces Signed-off-by: Paweł Krawczyk <[email protected]>	2021-07-22 16:32:41 +02:00
dev-sec CI	327b1a84c8	update changelog	2021-07-22 08:20:09 +00:00
Maik Stübner	714a34fa55	Allow configuration of password remember in pam (#467 ) * Add Configuration of password remember and set default to 60 see Telekom 2021.07-01 SoC 3.01 Req 25 and SoC 3.65 Req46 Signed-off-by: Maik Stuebner <[email protected]> * set default for password remember back to 5 Signed-off-by: Maik Stuebner <[email protected]> * readme default for password remember back to 5 Signed-off-by: Maik Stuebner <[email protected]>	2021-07-22 10:18:01 +02:00
dev-sec CI	488441a7dc	update changelog	2021-07-16 07:43:08 +00:00
Leo Gallucci	585f1dc227	Add SUB_UID_MIN/MAX/COUNT, SUB_GID_MIN/MAX/COUNT (#463 ) * add SUB_UID_MIN/MAX/COUNT, SUB_GID_MIN/MAX/COUNT Similar reason as #461 > If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate user IDs) > allocate SUB_UID_COUNT unused user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user. > The default values for SUB_UID_MIN, SUB_UID_MAX, SUB_UID_COUNT are respectively 100000, 600100000 and 65536. Signed-off-by: Leo Gallucci <[email protected]> * document SUB_UID_MIN/MAX/COUNT, etc Signed-off-by: Leo Gallucci <[email protected]>	2021-07-16 09:41:37 +02:00
dev-sec CI	2c5cf45573	update changelog	2021-07-13 14:09:08 +00:00
schurzi	5618655ce5	Merge pull request #465 from dev-sec/rndmh3ro-patch-1 update metadata to include community.mysql deps	2021-07-13 16:07:27 +02:00
Sebastian Gumprich	da50f20860	update metadata to include community.mysql deps	2021-07-13 14:08:27 +02:00
dev-sec CI	c87ac4425c	update changelog	2021-07-12 13:33:37 +00:00
Leo Gallucci	f92d193d3d	add os_auth_uid_max, os_auth_gid_max (#461 ) Signed-off-by: Leo Gallucci <[email protected]>	2021-07-12 15:32:02 +02:00
dev-sec CI	a075af2f31	update galaxy.yml with new version	2021-07-08 11:35:18 +00:00
dev-sec CI	50f362602f	update changelog	2021-07-01 09:26:58 +00:00