Merge branch 'support_more_os' into test_crypto_lib

Signed-off-by: Sebastian Gumprich <[email protected]>

.github/workflows/ansible-lint.yml

@@ -1,7 +1,13 @@
 ---
 name: Ansible Lint  # feel free to pick your own name
 
-on: [push, pull_request]   # yamllint disable-line rule:truthy
+on:  # yamllint disable-line rule:truthy
+  # Run CI against all pushes (direct commits, also merged PRs), Pull Requests
+  push:
+    branches: [master]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master]
 
 jobs:
   ansible-lint:
@@ -15,43 +21,4 @@ jobs:
         # replace "master" with any valid ref
         uses: ansible/ansible-lint-action@main
         with:
-          # [required]
-          # Paths to ansible files (i.e., playbooks, tasks, handlers etc..)
-          # or valid Ansible directories according to the Ansible role
-          # directory structure.
-          # If you want to lint multiple ansible files, use the following syntax
-          # targets: |
-          #   playbook_1.yml
-          #   playbook_2.yml
-          targets: "roles/"
-          # [optional]
-          # Arguments to override a package and its version to be set explicitly.
-          # Must follow the example syntax.
-          # override-deps: |
-          #   ansible==2.9
-          #   ansible-lint==4.2.0
-          override-deps: |
-            rich>=9.5.1,<11.0.0
-          # [optional]
-          # Arguments to be passed to the ansible-lint
-
-          # Options:
-          #   -q                    quieter, although not silent output
-          #   -p                    parseable output in the format of pep8
-          #   --parseable-severity  parseable output including severity of rule
-          #   -r RULESDIR           specify one or more rules directories using one or
-          #                         more -r arguments. Any -r flags override the default
-          #                         rules in ansiblelint/rules, unless -R is also used.
-          #   -R                    Use default rules in ansiblelint/rules in addition to
-          #                         any extra
-          #                         rules directories specified with -r. There is no need
-          #                         to specify this if no -r flags are used
-          #   -t TAGS               only check rules whose id/tags match these values
-          #   -x SKIP_LIST          only check rules whose id/tags do not match these
-          #                         values
-          #   --nocolor             disable colored output
-          #   --exclude=EXCLUDE_PATHS
-          #                         path to directories or files to skip. This option is
-          #                         repeatable.
-          #   -c C                  Specify configuration file to use. Defaults to ".ansible-lint"
-          args: ""
+          path: "roles/"

.github/workflows/enforce-labels.yml

@@ -6,6 +6,7 @@ on:  # yamllint disable-line rule:truthy
     types: [labeled, unlabeled, opened, edited, synchronize]
 jobs:
   enforce-label:
+    if: github.repository == 'dev-sec/ansible-collection-hardening'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/labeler@main

.github/workflows/galaxy.yml

@@ -8,6 +8,7 @@ on:  # yamllint disable-line rule:truthy
 
 jobs:
   deploy:
+    if: github.repository == 'dev-sec/ansible-collection-hardening'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3

.github/workflows/mysql_hardening.yml

@@ -1,13 +1,16 @@
 ---
 name: "devsec.mysql_hardening"
+
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
+    branches: [master]
     paths:
       - 'roles/mysql_hardening/**'
       - 'molecule/mysql_hardening/**'
       - '.github/workflows/mysql_hardening.yml'
   pull_request:
+    branches: [master]
     paths:
       - 'roles/mysql_hardening/**'
       - 'molecule/mysql_hardening/**'
@@ -23,7 +26,10 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
+          - centosstream8
+          - centosstream9
           - rocky8
+          - rocky9
           - ubuntu1804
           - ubuntu2004
           - ubuntu2204

.github/workflows/nginx_hardening.yml

@@ -3,11 +3,13 @@ name: "devsec.nginx_hardening"
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
+    branches: [master]
     paths:
       - 'roles/nginx_hardening/**'
       - 'molecule/nginx_hardening/**'
       - '.github/workflows/nginx_hardening.yml'
   pull_request:
+    branches: [master]
     paths:
       - 'roles/nginx_hardening/**'
       - 'molecule/nginx_hardening/**'
@@ -23,7 +25,10 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
+          - centosstream8
+          - centosstream9
           - rocky8
+          - rocky9
           - ubuntu1804
           - ubuntu2004
           - ubuntu2204

.github/workflows/os_hardening.yml

@@ -3,11 +3,13 @@ name: "devsec.os_hardening"
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
+    branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening/**'
       - '.github/workflows/os_hardening.yml'
   pull_request:
+    branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening/**'
@@ -23,7 +25,10 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
+          - centosstream8
+          - centosstream9
           - rocky8
+          - rocky9
           - ubuntu1804
           - ubuntu2004
           - ubuntu2204

.github/workflows/os_hardening_vm.yml

@@ -3,11 +3,13 @@ name: "devsec.os_hardening VM"
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
+    branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening_vm/**'
       - '.github/workflows/os_hardening_vm.yml'
   pull_request:
+    branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening_vm/**'
@@ -23,7 +25,10 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
+          - centosstream8
+          - centosstream9
           - rocky8
+          - rocky9
           - ubuntu1804
           - ubuntu2004
           - ubuntu2204

.github/workflows/prettier-md.yml

@@ -4,11 +4,13 @@ name: Prettier markdown files
 
 on:  # yamllint disable-line rule:truthy
   push:
+    branches: [master]
     paths:
       - '**.md'
 
 jobs:
   prettier-md:
+    if: github.repository == 'dev-sec/ansible-collection-hardening'
     runs-on: ubuntu-latest
     timeout-minutes: 1
 

.github/workflows/release.yml

@@ -9,8 +9,9 @@ on:  # yamllint disable-line rule:truthy
 
 jobs:
   generate_changelog:
-    runs-on: ubuntu-latest
     name: create release draft
+    if: github.repository == 'dev-sec/ansible-collection-hardening'
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
         with:

.github/workflows/ssh_hardening.yml

@@ -3,11 +3,13 @@ name: "devsec.ssh_hardening"
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
+    branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening/**'
       - '.github/workflows/ssh_hardening.yml'
   pull_request:
+    branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening/**'
@@ -23,7 +25,10 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
+          - centosstream8
+          - centosstream9
           - rocky8
+          - rocky9
           - fedora
           - ubuntu1804
           - ubuntu2004

.github/workflows/ssh_hardening_custom_tests.yml

@@ -3,11 +3,13 @@ name: "devsec.ssh_hardening with custom tests"
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
+    branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening_custom_tests/**'
       - '.github/workflows/ssh_hardening_custom_tests.yml'
   pull_request:
+    branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening_custom_tests/**'
@@ -23,7 +25,10 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
+          - centosstream8
+          - centosstream9
           - rocky8
+          - rocky9
           - fedora
           - ubuntu1804
           - ubuntu2004

CHANGELOG.md

@@ -1,8 +1,54 @@
 # Changelog
 
-## [7.17.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.17.0) (2022-08-22)
+## [8.2.1](https://github.com/dev-sec/ansible-collection-hardening/tree/8.2.1) (2022-10-20)
 
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.16.0...7.17.0)
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.2.0...8.2.1)
+
+**Fixed bugs:**
+
+- do not manage trusted user ca keys if none exist [\#580](https://github.com/dev-sec/ansible-collection-hardening/pull/580) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([hollow](https://github.com/hollow))
+
+**Closed issues:**
+
+- Trying to run the os\_hardening on Debian 11, but fails on privilege escalation [\#587](https://github.com/dev-sec/ansible-collection-hardening/issues/587)
+- auditd increasing logfiles [\#586](https://github.com/dev-sec/ansible-collection-hardening/issues/586)
+- Path to nginx.conf should be configurable in a variable  [\#577](https://github.com/dev-sec/ansible-collection-hardening/issues/577)
+
+**Merged pull requests:**
+
+- run tests only on pushes to master or to PRs [\#581](https://github.com/dev-sec/ansible-collection-hardening/pull/581) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [8.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.2.0) (2022-09-08)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.1.0...8.2.0)
+
+**Implemented enhancements:**
+
+- Add nginx variables for config-path and owner/group [\#578](https://github.com/dev-sec/ansible-collection-hardening/pull/578) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([hagenbauer](https://github.com/hagenbauer))
+- add centos \>8 Support [\#573](https://github.com/dev-sec/ansible-collection-hardening/pull/573) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([sbaerlocher](https://github.com/sbaerlocher))
+- add always-tag to include so other tags can be used [\#569](https://github.com/dev-sec/ansible-collection-hardening/pull/569) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Closed issues:**
+
+- Bug using os\_hardening "tags" [\#567](https://github.com/dev-sec/ansible-collection-hardening/issues/567)
+
+## [8.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.1.0) (2022-08-26)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.0.0...8.1.0)
+
+**Closed issues:**
+
+- dev-sec CI bot should not update CHANGELOG.md in fork repository [\#566](https://github.com/dev-sec/ansible-collection-hardening/issues/566)
+
+**Merged pull requests:**
+
+- update supported OS in meta and fix linting [\#572](https://github.com/dev-sec/ansible-collection-hardening/pull/572) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- fix misleading comment [\#571](https://github.com/dev-sec/ansible-collection-hardening/pull/571) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([donestefan](https://github.com/donestefan))
+- only run release actions on upstream-repo [\#568](https://github.com/dev-sec/ansible-collection-hardening/pull/568) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [8.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.0.0) (2022-08-22)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.16.0...8.0.0)
 
 **Breaking changes:**
 

galaxy.yml

@@ -1,7 +1,6 @@
----
 namespace: devsec
 name: hardening
-version: 7.16.0
+version: 8.2.0
 readme: README.md
 authors:
   - dev-sec <[email protected]>

molecule/ssh_hardening/verify.yml

@@ -42,7 +42,7 @@
       shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
 
     - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip"
+      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/simplify_crypto.zip"
       register: test_results
       changed_when: false
       ignore_errors: true

roles/mysql_hardening/meta/main.yml

@@ -8,15 +8,17 @@ galaxy_info:
   platforms:
     - name: EL
       versions:
-        - 6
-        - 7
+        - "7"
+        - "8"
     - name: Ubuntu
       versions:
-        - xenial
         - bionic
+        - focal
+        - jammy
     - name: Debian
       versions:
-        - jessie
+        - bullseye
+        - buster
     - name: Amazon
     - name: Fedora
   galaxy_tags:

roles/mysql_hardening/vars/RedHat_8.yml

@@ -1,9 +0,0 @@
----
-mysql_daemon: mariadb
-mysql_hardening_mysql_conf_file: '/etc/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'mysql'

roles/mysql_hardening/vars/Rocky_8.yml

@@ -1,9 +0,0 @@
----
-mysql_daemon: mariadb
-mysql_hardening_mysql_conf_file: '/etc/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'mysql'

roles/mysql_hardening/vars/Ubuntu_18.yml

@@ -1,10 +0,0 @@
----
-mysql_daemon: mysql
-
-mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'adm'

roles/mysql_hardening/vars/Ubuntu_20.yml

@@ -1,10 +0,0 @@
----
-mysql_daemon: mysql
-
-mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'adm'

roles/mysql_hardening/vars/Ubuntu_22.yml

@@ -1,10 +0,0 @@
----
-mysql_daemon: mysql
-
-mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'adm'

roles/nginx_hardening/README.md

@@ -75,6 +75,18 @@ It works with the following nginx-roles, including, but not limited to:
 - [nginx_dh_size][]
   - Default: `2048`
   - Description: Specifies the length of DH parameters for EDH ciphers.
+- [nginx_configuration_dir][]
+  - default: "/etc/nginx"
+  - Description: The main location for all nginx configuration files
+- [nginx_configuration_hardening_dir][]
+  - default: "/etc/nginx"
+  - Description: The location for the nginx hardening configuration file (Could be different e.g. when used in jails)
+- [nginx_owner_user][]
+  - default: "root"
+  - Description: The owner user of the nginx configuration files
+- [nginx_owner_group][]
+  - default: "root"
+  - Description: The owner group of the nginx configuration files
 
 ## Example Playbook
 

roles/nginx_hardening/defaults/main.yml

@@ -11,6 +11,10 @@ nginx_client_header_timeout: "10"
 nginx_send_timeout: "10"
 nginx_limit_conn_zone: "$binary_remote_addr zone=default:10m"
 nginx_limit_conn: "default 5"
+nginx_configuration_dir: "/etc/nginx"
+nginx_configuration_hardening_dir: "/etc/nginx"
+nginx_owner_user: "root"
+nginx_owner_group: "root"
 nginx_add_header:
   # avoid clickjacking
   - X-Frame-Options SAMEORIGIN

roles/nginx_hardening/meta/main.yml

@@ -8,15 +8,15 @@ galaxy_info:
   platforms:
     - name: EL
       versions:
-        - 6
-        - 7
+        - "7"
+        - "8"
     - name: Ubuntu
       versions:
-        - xenial
         - bionic
+        - focal
+        - jammy
     - name: Debian
       versions:
-        - stretch
         - buster
         - bullseye
   galaxy_tags:

roles/nginx_hardening/tasks/main.yml

@@ -2,76 +2,76 @@
 - name: Create additional configuration
   template:
     src: "hardening.conf.j2"
-    dest: "/etc/nginx/conf.d/90.hardening.conf"
+    dest: "{{ nginx_configuration_dir }}/conf.d/90.hardening.conf"
     mode: '0600'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
   notify: Restart nginx
 
 - name: Change configuration in main nginx.conf
   lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
     regexp: '^\s*server_tokens'
     line: "    server_tokens {{ nginx_server_tokens }};"
     insertafter: "http {"
     mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
   notify: Restart nginx
 
 - name: Change ssl_protocols in main nginx.conf
   lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
     regexp: '^\s*ssl_protocols'
     line: "    ssl_protocols {{ nginx_ssl_protocols }};"
     insertafter: "http {"
     mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
   notify: Restart nginx
 
 - name: Change ssl_prefer_server_ciphers in main nginx.conf
   lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
     regexp: '^\s*ssl_prefer_server_ciphers'
     line: "    ssl_prefer_server_ciphers {{ nginx_ssl_prefer_server_ciphers }};"
     insertafter: "http {"
     mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
   notify: Restart nginx
 
 - name: Change client_max_body_size in main nginx.conf
   lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
     regexp: '^\s*client_max_body_size'
     line: "    client_max_body_size {{ nginx_client_max_body_size }};"
     insertafter: "http {"
     mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
   notify: Restart nginx
 
 - name: Change client_body_buffer_size in main nginx.conf
   lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
     regexp: '^\s*client_body_buffer_size'
     line: "    client_body_buffer_size {{ nginx_client_body_buffer_size }};"
     insertafter: "http {"
     mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
   notify: Restart nginx
 
 - name: Change keepalive_timeout in main nginx.conf
   lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
     regexp: '^\s*keepalive_timeout'
     line: "    keepalive_timeout {{ nginx_keepalive_timeout }};"
     insertafter: "http {"
     mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
   notify: Restart nginx
 
 - name: Remove default.conf
@@ -81,14 +81,14 @@
   when: nginx_remove_default_site
   notify: Restart nginx
   loop:
-    - "/etc/nginx/conf.d/default.conf"
-    - "/etc/nginx/sites-enabled/default"
+    - "{{ nginx_configuration_dir }}/conf.d/default.conf"
+    - "{{ nginx_configuration_dir }}/sites-enabled/default"
 
 - name: Generate dh group
   openssl_dhparam:
-    path: "/etc/nginx/dh{{ nginx_dh_size }}.pem"
+    path: "{{ nginx_configuration_dir }}/dh{{ nginx_dh_size }}.pem"
     size: "{{ nginx_dh_size }}"
     mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
   notify: Restart nginx

roles/nginx_hardening/templates/hardening.conf.j2

@@ -11,7 +11,7 @@ limit_conn_zone             {{ nginx_limit_conn_zone }};
 limit_conn                  {{ nginx_limit_conn }};
 ssl_ciphers                 '{{ nginx_ssl_ciphers }}';
 ssl_session_tickets         {{ nginx_ssl_session_tickets }};
-ssl_dhparam                 /etc/nginx/dh{{ nginx_dh_size }}.pem;
+ssl_dhparam                 {{ nginx_configuration_hardening_dir }}/dh{{ nginx_dh_size }}.pem;
 {% for header in nginx_add_header %}
 add_header                  {{ header }};
 {% endfor %}

roles/os_hardening/defaults/main.yml

@@ -9,7 +9,7 @@ os_auth_lockout_time: 600  # Seconds (600 = 10min)
 os_auth_timeout: 60
 os_auth_allow_homeless: false
 os_auth_pam_passwdqc_enable: true
-os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8'  # Used in RHEL6
+os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8'  # Used in Debian
 os_auth_pam_pwquality_options: 'try_first_pass retry=3 authtok_type='  # Used in RHEL7 and RHEL8
 os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]
 

roles/os_hardening/meta/main.yml

@@ -8,22 +8,22 @@ galaxy_info:
   platforms:
     - name: EL
       versions:
-        - 7
-        - 8
+        - "7"
+        - "8"
     - name: Ubuntu
       versions:
-        - xenial
         - bionic
+        - focal
+        - jammy
     - name: Debian
       versions:
-        - stretch
         - buster
         - bullseye
     - name: Amazon
     - name: Fedora
-    - name: Archlinux
+    - name: ArchLinux
     - name: SmartOS
-    - name: openSUSE
+    - name: opensuse
   galaxy_tags:
     - system
     - security

roles/os_hardening/tasks/main.yml

@@ -1,3 +1,5 @@
 ---
 - include_tasks: hardening.yml
   when: os_hardening_enabled | bool
+  tags:
+    - always

roles/os_hardening/tasks/minimize_access.yml

@@ -6,7 +6,7 @@
 # also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
 - name: Find files with write-permissions for group
   shell: "find -L {{ item }} -perm /go+w -type f"  # noqa command-instead-of-shell
-  with_flattened:
+  with_community.general.flattened:
     - '/usr/local/sbin'
     - '/usr/local/bin'
     - '/usr/sbin'

roles/os_hardening/tasks/rhosts.yml

@@ -15,4 +15,3 @@
   file:
     dest: '/etc/hosts.equiv'
     state: 'absent'
-

roles/os_hardening/tasks/suid_sgid.yml

@@ -6,7 +6,7 @@
     state: 'file'
     follow: 'yes'
   failed_when: false
-  with_flattened:
+  with_community.general.flattened:
     - '{{ os_security_suid_sgid_system_blacklist }}'
     - '{{ os_security_suid_sgid_blacklist }}'
 
@@ -27,6 +27,6 @@
     mode: 'a-s'
     state: 'file'
     follow: 'yes'
-  with_flattened:
+  with_community.general.flattened:
     - '{{ suid | default([]) | difference(os_security_suid_sgid_whitelist) }}'
   when: os_security_suid_sgid_remove_from_unknown | bool

roles/os_hardening/tasks/user_accounts.yml

@@ -43,7 +43,7 @@
     shell: '{{ os_nologin_shell_path }}'
     password: '*'
     createhome: false
-  with_flattened:
+  with_community.general.flattened:
     - '{{ sys_accs_cond | default([]) | difference(os_ignore_users) | list }}'
 
 - name: get all home directories in /home, but skip ignored users

roles/os_hardening/vars/RedHat.yml

@@ -33,7 +33,7 @@ os_auth_sub_gid_min: 100000
 os_auth_sub_gid_max: 600100000
 os_auth_sub_gid_count: 65536
 
-os_auth_pam_sssd_enable: false
+os_auth_pam_sssd_enable: true
 
 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail

roles/os_hardening/vars/RedHat_8.yml

@@ -1,45 +0,0 @@
----
-
-os_packages_pam_ccreds: 'pam_ccreds'
-os_nologin_shell_path: '/sbin/nologin'
-
-# Different distros use different standards for /etc/shadow perms, e.g.
-# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
-# You must provide key/value pairs for owner, group, and mode if overriding.
-os_shadow_perms:
-  owner: root
-  group: root
-  mode: '0000'
-
-os_passwd_perms:
-  owner: root
-  group: root
-  mode: '0644'
-
-os_env_umask: '077'
-
-os_auth_uid_min: 1000
-os_auth_uid_max: 60000
-os_auth_gid_min: 1000
-os_auth_gid_max: 60000
-os_auth_sys_uid_min: 201
-os_auth_sys_uid_max: 999
-os_auth_sys_gid_min: 201
-os_auth_sys_gid_max: 999
-os_auth_sub_uid_min: 100000
-os_auth_sub_uid_max: 600100000
-os_auth_sub_uid_count: 65536
-os_auth_sub_gid_min: 100000
-os_auth_sub_gid_max: 600100000
-os_auth_sub_gid_count: 65536
-
-os_auth_pam_sssd_enable: true
-
-# defaults for useradd
-os_useradd_mail_dir: /var/spool/mail
-os_useradd_create_home: true
-
-modprobe_package: 'module-init-tools'
-auditd_package: 'audit'
-
-hidepid_option: '2'  # allowed values: 0, 1, 2

roles/os_hardening/vars/Rocky_8.yml

@@ -1,45 +0,0 @@
----
-
-os_packages_pam_ccreds: 'pam_ccreds'
-os_nologin_shell_path: '/sbin/nologin'
-
-# Different distros use different standards for /etc/shadow perms, e.g.
-# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
-# You must provide key/value pairs for owner, group, and mode if overriding.
-os_shadow_perms:
-  owner: root
-  group: root
-  mode: '0000'
-
-os_passwd_perms:
-  owner: root
-  group: root
-  mode: '0644'
-
-os_env_umask: '077'
-
-os_auth_uid_min: 1000
-os_auth_uid_max: 60000
-os_auth_gid_min: 1000
-os_auth_gid_max: 60000
-os_auth_sys_uid_min: 201
-os_auth_sys_uid_max: 999
-os_auth_sys_gid_min: 201
-os_auth_sys_gid_max: 999
-os_auth_sub_uid_min: 100000
-os_auth_sub_uid_max: 600100000
-os_auth_sub_uid_count: 65536
-os_auth_sub_gid_min: 100000
-os_auth_sub_gid_max: 600100000
-os_auth_sub_gid_count: 65536
-
-os_auth_pam_sssd_enable: true
-
-# defaults for useradd
-os_useradd_mail_dir: /var/spool/mail
-os_useradd_create_home: true
-
-modprobe_package: 'module-init-tools'
-auditd_package: 'audit'
-
-hidepid_option: '2'  # allowed values: 0, 1, 2

roles/ssh_hardening/meta/main.yml

@@ -8,21 +8,22 @@ galaxy_info:
   platforms:
     - name: EL
       versions:
-        - 7
-        - 8
+        - "7"
+        - "8"
     - name: Ubuntu
       versions:
-        - xenial
         - bionic
+        - focal
+        - jammy
     - name: Debian
       versions:
-        - stretch
         - buster
+        - bullseye
     - name: Amazon
     - name: Fedora
-    - name: Archlinux
+    - name: ArchLinux
     - name: SmartOS
-    - name: openSUSE
+    - name: opensuse
   galaxy_tags:
     - system
     - security

roles/ssh_hardening/tasks/hardening.yml

@@ -110,7 +110,9 @@
 
 - name: Include tasks to setup ca keys and principals
   include_tasks: ca_keys_and_principals.yml
-  when: ssh_trusted_user_ca_keys_file | length > 0
+  when:
+    - ssh_trusted_user_ca_keys_file | length > 0
+    - ssh_trusted_user_ca_keys | length > 0
 
 - name: Include selinux specific tasks
   include_tasks: selinux.yml

roles/ssh_hardening/vars/RedHat.yml

@@ -7,7 +7,7 @@ ssh_group: root
 ssh_host_keys_owner: 'root'
 ssh_host_keys_group: 'ssh_keys'
 ssh_selinux_packages:
-  - policycoreutils-python
+  - policycoreutils-python-utils
   - checkpolicy
 
 # true if SSH support Kerberos

roles/ssh_hardening/vars/RedHat_7.yml

@@ -7,7 +7,7 @@ ssh_group: root
 ssh_host_keys_owner: 'root'
 ssh_host_keys_group: 'ssh_keys'
 ssh_selinux_packages:
-  - python3-policycoreutils
+  - policycoreutils-python
   - checkpolicy
 
 # true if SSH support Kerberos

roles/ssh_hardening/vars/RedHat_8.yml

@@ -1,23 +0,0 @@
----
-sshd_path: /usr/sbin/sshd
-ssh_host_keys_dir: '/etc/ssh'
-sshd_service_name: sshd
-ssh_owner: root
-ssh_group: root
-ssh_host_keys_owner: 'root'
-ssh_host_keys_group: 'ssh_keys'
-ssh_selinux_packages:
-  - python3-policycoreutils
-  - checkpolicy
-
-# true if SSH support Kerberos
-ssh_kerberos_support: true
-
-# true if SSH has PAM support
-ssh_pam_support: true
-
-sshd_moduli_file: '/etc/ssh/moduli'
-
-# disable CRYPTO_POLICY to take settings from sshd configuration
-# see: https://access.redhat.com/solutions/4410591
-sshd_disable_crypto_policy: true