make it possible to configure more then yes and no for PermitTunnel (#715)

This is a breaking change, since the default variable is now a string instead of a bool

Signed-off-by: Sebastian Gumprich <[email protected]>

.aar_doc.yml

@@ -0,0 +1,50 @@
+output_template: |
+  <!-- BEGIN_ANSIBLE_DOCS -->
+
+  ## Supported Operating Systems
+
+  {%- for platform in metadata.galaxy_info.platforms %}
+  - {{ platform.name }}
+    {%- if "versions" in platform %}
+    - {{ platform.versions | default([]) | join(', ') }}
+    {%- endif %}
+  {%- endfor %}
+
+  ## Role Variables
+  {% for entrypoint in argument_specs.keys() %}
+  {%- set path, options=entrypoint_options[entrypoint][0] -%}
+  {%- for name, details in options.items() |sort() %}
+  - `{{ name }}`
+    - Default: `{{ details.display_default }}`
+    - Description: {{ details.display_description }}
+    - Type: {{ details.display_type }}
+    - Required: {{ details.display_required }}
+    {%- if details.choices %}
+    - Choices:
+      {%- for choice in details.choices %}
+      - {{ choice }}
+      {%- endfor %}
+    {%- endif %}
+  {%- endfor %}
+  {%- endfor %}
+
+  ## Dependencies
+
+  {%- if ("dependencies" in metadata) and (metadata.dependencies | length > 0) %}
+  {%- for dependency in metadata.dependencies %}
+  - {{ dependency }}
+  {%- endfor %}
+  {%- else %}
+
+  None.
+  {%- endif %}
+
+  ## Example Playbook
+
+  ```
+  - hosts: all
+    roles:
+      - name: {{ role }}
+  ```
+
+  <!-- END_ANSIBLE_DOCS -->

.config/ansible-lint.yml

@@ -12,3 +12,6 @@ exclude_paths:
 mock_roles:
   - geerlingguy.git
   - nginxinc.nginx
+
+skip_list:
+  - var-naming[no-role-prefix]

.github/dependabot.yml

@@ -1,25 +0,0 @@
----
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
-version: 2
-updates:
-  - package-ecosystem: "pip"  # See documentation for possible values
-    directory: "/"  # Location of package manifests
-    schedule:
-      interval: "daily"
-    # by default Dependabot creates labels like "major" or "minor" for version updates of our deps.
-    # however this interferes with the github changelog generator which uses these labels to define
-    # a new version for the collection
-    labels: [ ]
-
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    # by default Dependabot creates labels like "major" or "minor" for version updates of our deps.
-    # however this interferes with the github changelog generator which uses these labels to define
-    # a new version for the collection
-    labels: [ ]

.github/workflows/ansible-lint.yml

@@ -19,7 +19,7 @@ jobs:
 
     steps:
       # Important: This sets up your GITHUB_WORKSPACE environment variable
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Lint Ansible Playbook
         # replace "master" with any valid ref

.github/workflows/codespell.yml

@@ -0,0 +1,14 @@
+---
+name: Codespell - Spellcheck
+
+on:  # yamllint disable-line rule:truthy
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  codespell:
+    uses: "dev-sec/.github/.github/workflows/codespell.yml@main"
+    with:
+      ignore_words_list: "chage"

.github/workflows/galaxy.yml

@@ -11,7 +11,7 @@ jobs:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       # deploy the collection first, because if it fails, we don't want
       # to update the galaxy.yml
@@ -22,7 +22,7 @@ jobs:
           galaxy_version: ${{ github.event.release.tag_name }}
 
       # checkout master instead of the release-tag so we can push the galaxy.yml
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: master
 

.github/workflows/mysql_hardening.yml

@@ -15,6 +15,8 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/mysql_hardening/**'
       - 'molecule/mysql_hardening/**'
       - '.github/workflows/mysql_hardening.yml'
+  schedule:
+    - cron: '0 6 * * 0'
 
 concurrency:
   group: >-
@@ -25,7 +27,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -43,21 +45,22 @@ jobs:
           - ubuntu2204
           - debian10
           - debian11
+          - debian12
           # - amazon  # geerlingguy.mysql does not support fedora
-          # - arch  # needs to be fixed
-          - opensuse_tumbleweed  # needs to be fixed
+          # - arch  # geerlingguy.mysql does not support arch
+          - opensuse_tumbleweed
           # - fedora  # geerlingguy.mysql does not support fedora
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python 3.7
+      - name: Set up Python 3.11
         uses: actions/setup-python@v4
         with:
-          python-version: 3.7
+          python-version: 3.11
 
       - name: Install dependencies
         run: |
@@ -66,11 +69,6 @@ jobs:
           pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
-      - name: Create default collection path symlink
-        run: |
-          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
-
       # that was a hard one to fix. robert did it thankfully
       # https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212
       - name: disable apparmor on debian systems
@@ -81,6 +79,16 @@ jobs:
             sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld
         if: ${{ startsWith(matrix.molecule_distro, 'Debian') }}
 
+      # Molecule has problems detecting the proper location for installing roles
+      # https://github.com/ansible/molecule/issues/3806
+      # we do not set a custom role path, but the automatically determined install path used is not compatible with the location molecule expects the role
+      # see CI logs of this action "INFO     Set ANSIBLE_ROLES_PATH" should not be present, since we do not set a custom path
+      # we have to find a proper way to configure this
+      - name: Temporary fix for roles
+        run: |
+          mkdir -p /home/runner/.ansible
+          ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles /home/runner/.ansible/roles
+
       - name: Test with molecule
         run: |
           molecule --version

.github/workflows/nginx_hardening.yml

@@ -14,6 +14,8 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/nginx_hardening/**'
       - 'molecule/nginx_hardening/**'
       - '.github/workflows/nginx_hardening.yml'
+  schedule:
+    - cron: '0 6 * * 1'
 
 concurrency:
   group: >-
@@ -24,7 +26,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -42,21 +44,22 @@ jobs:
           - ubuntu2204
           - debian10
           - debian11
-          - amazon
+          - debian12
+          - amazon2023
           # - arch  # needs to be fixed
           # - opensuse_tumbleweed  # needs to be fixed
           # - fedora  # no support from geerlingguy role
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python 3.7
+      - name: Set up Python 3.11
         uses: actions/setup-python@v4
         with:
-          python-version: 3.7
+          python-version: 3.11
 
       - name: Install dependencies
         run: |
@@ -65,10 +68,15 @@ jobs:
           pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
-      - name: Create default collection path symlink
+      # Molecule has problems detecting the proper location for installing roles
+      # https://github.com/ansible/molecule/issues/3806
+      # we do not set a custom role path, but the automatically determined install path used is not compatible with the location molecule expects the role
+      # see CI logs of this action "INFO     Set ANSIBLE_ROLES_PATH" should not be present, since we do not set a custom path
+      # we have to find a proper way to configure this
+      - name: Temporary fix for roles
         run: |
           mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
+          ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles /home/runner/.ansible/roles
 
       - name: Test with molecule
         run: |

.github/workflows/os_hardening.yml

@@ -14,6 +14,8 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening/**'
       - '.github/workflows/os_hardening.yml'
+  schedule:
+    - cron: '0 6 * * 3'
 
 concurrency:
   group: >-
@@ -24,7 +26,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -37,25 +39,28 @@ jobs:
           - centosstream9
           - rocky8
           - rocky9
+          - fedora38
+          - fedora39
           - ubuntu1804
           - ubuntu2004
           - ubuntu2204
           - debian10
           - debian11
-          - amazon
+          - debian12
+          - amazon2023
           - opensuse_tumbleweed
-          # - arch  # needs to be fixed
+          - arch
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python 3.7
+      - name: Set up Python 3.11
         uses: actions/setup-python@v4
         with:
-          python-version: 3.7
+          python-version: 3.11
 
       - name: Install dependencies
         run: |
@@ -64,11 +69,6 @@ jobs:
           pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
-      - name: Create default collection path symlink
-        run: |
-          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
-
       - name: Test with molecule
         run: |
           if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then

.github/workflows/os_hardening_vm.yml

@@ -14,6 +14,8 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening_vm/**'
       - '.github/workflows/os_hardening_vm.yml'
+  schedule:
+    - cron: '0 6 * * 2'
 
 concurrency:
   group: >-
@@ -32,30 +34,28 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
-          - centos7
-          - centos8s
-          # - centos9s  # problems with vagrant
-          - rocky8
-          # - rocky9  # problems with vagrant
-          - ubuntu1804
-          - ubuntu2004
-          - ubuntu2204
-          - debian10
-          - debian11
-          # - opensuse42  # opensuse currently cannot get an ip address
-          # - arch  # arch is currently not supported by cinc-auditor
+          - generic/centos7
+          - generic/centos8s
+          - generic/centos9s
+          - generic/rocky8
+          - generic/rocky9
+          - fedora/38-cloud-base
+          - fedora/39-cloud-base
+          - generic/ubuntu1804
+          - generic/ubuntu2004
+          - generic/ubuntu2204
+          - generic/debian10
+          - generic/debian11
+          - generic/debian12
+          - generic/opensuse15
+          # - generic/arch  # needs fix for audit
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Create default collection path symlink
-        run: |
-          mkdir -p /home/runner/.ansible
-          ln -fs /opt/actions-runner/_work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections /home/runner/.ansible/collections
-
       - name: Test with molecule
         run: |
           molecule --version

.github/workflows/prettier-md.yml

@@ -16,11 +16,11 @@ jobs:
 
     steps:
       - name: Git checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ github.head_ref }}
 
       - name: Prettify code
-        uses: creyD/prettier_action@v4.2
+        uses: creyD/prettier_action@v4.3
         with:
           prettier_options: --write {**/*,*}.md

.github/workflows/release.yml

@@ -13,7 +13,7 @@ jobs:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: master

.github/workflows/roles-readme.yml

@@ -0,0 +1,52 @@
+---
+name: create roles readme
+
+on:  # yamllint disable-line rule:truthy
+  push:
+    branches: [master]
+    paths:
+      - 'roles/**/meta/argument_specs.yml'
+  pull_request:
+    branches: [master]
+    paths:
+      - 'roles/**/meta/argument_specs.yml'
+
+jobs:
+  readme:
+    name: create roles readme
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        roles:
+          - mysql_hardening
+          - nginx_hardening
+          - os_hardening
+          - ssh_hardening
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: 3.11
+
+      - name: Install aar_doc
+        run: pip3 install aar_doc
+
+      - name: Run aar_doc
+        run: aar_doc roles/${{ matrix.roles }} markdown
+
+      - name: Output diff
+        run: git diff roles/${{ matrix.roles }}/README.md
+
+      - name: Push README
+        if: github.event_name != 'pull_request'
+        uses: github-actions-x/[email protected]
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: 'update ${{ matrix.roles }} readme'
+          files: roles/${{ matrix.roles }}/README.md
+          rebase: true
+          name: dev-sec CI
+          email: [email protected]

.github/workflows/ssh_hardening.yml

@@ -14,6 +14,8 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening/**'
       - '.github/workflows/ssh_hardening.yml'
+  schedule:
+    - cron: '0 6 * * 5'
 
 concurrency:
   group: >-
@@ -24,7 +26,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -37,26 +39,28 @@ jobs:
           - centosstream9
           - rocky8
           - rocky9
-          - fedora
+          - fedora38
+          - fedora39
           - ubuntu1804
           - ubuntu2004
           - ubuntu2204
           - debian10
           - debian11
-          - amazon
-          # - arch  # needs to be fixed
-          # - opensuse_tumbleweed  # baseline is not compatible with suse
+          - debian12
+          - amazon2023
+          - arch
+          # - opensuse_tumbleweed  # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python 3.7
+      - name: Set up Python 3.11
         uses: actions/setup-python@v4
         with:
-          python-version: 3.7
+          python-version: 3.11
 
       - name: Install dependencies
         run: |
@@ -65,11 +69,6 @@ jobs:
           pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
-      - name: Create default collection path symlink
-        run: |
-          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
-
       - name: Test with molecule
         run: |
           if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then

.github/workflows/ssh_hardening_bsd.yml

@@ -0,0 +1,54 @@
+---
+name: "devsec.ssh_hardening BSD"
+on:  # yamllint disable-line rule:truthy
+  workflow_dispatch:
+  push:
+    branches: [master]
+    paths:
+      - 'roles/ssh_hardening/**'
+      - 'molecule/ssh_hardening_bsd/**'
+      - '.github/workflows/ssh_hardening_bsd.yml'
+  pull_request:
+    branches: [master]
+    paths:
+      - 'roles/ssh_hardening/**'
+      - 'molecule/ssh_hardening_bsd/**'
+      - '.github/workflows/ssh_hardening_bsd.yml'
+  schedule:
+    - cron: '0 6 * * 5'
+
+concurrency:
+  group: >-
+    ${{ github.workflow }}-${{
+      github.event.pull_request.number || github.sha
+    }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: self-hosted
+    env:
+      PY_COLORS: 1
+      ANSIBLE_FORCE_COLOR: 1
+    strategy:
+      fail-fast: false
+      matrix:
+        molecule_distro:
+          - openbsd7
+          - freebsd12
+          - freebsd13
+          - freebsd14
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+        with:
+          path: ansible_collections/devsec/hardening
+          submodules: true
+
+      - name: Test with molecule
+        run: |
+          molecule --version
+          molecule test -s ssh_hardening_bsd
+        env:
+          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
+        working-directory: ansible_collections/devsec/hardening

.github/workflows/ssh_hardening_custom_tests.yml

@@ -14,6 +14,8 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening_custom_tests/**'
       - '.github/workflows/ssh_hardening_custom_tests.yml'
+  schedule:
+    - cron: '0 6 * * 4'
 
 concurrency:
   group: >-
@@ -24,7 +26,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -37,26 +39,28 @@ jobs:
           - centosstream9
           - rocky8
           - rocky9
-          - fedora
+          - fedora38
+          - fedora39
           - ubuntu1804
           - ubuntu2004
           - ubuntu2204
           - debian10
           - debian11
-          - amazon
-          # - arch  # needs to be fixed
-          # - opensuse_tumbleweed  # baseline is not compatible with suse
+          - debian12
+          - amazon2023
+          - arch
+          # - opensuse_tumbleweed  # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python 3.7
+      - name: Set up Python 3.11
         uses: actions/setup-python@v4
         with:
-          python-version: 3.7
+          python-version: 3.11
 
       - name: Install dependencies
         run: |
@@ -65,11 +69,6 @@ jobs:
           pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
-      - name: Create default collection path symlink
-        run: |
-          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
-
       - name: Test with molecule
         run: |
           if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then

CHANGELOG.md

@@ -1,8 +1,132 @@
 # Changelog
 
-## [8.5.1](https://github.com/dev-sec/ansible-collection-hardening/tree/8.5.1) (2023-02-01)
+## [8.9.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.9.0) (2023-11-16)
 
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.5.0...8.5.1)
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.8.0...8.9.0)
+
+**Breaking changes:**
+
+- add role argument spec for os, ssh, mysql [\#687](https://github.com/dev-sec/ansible-collection-hardening/pull/687) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Implemented enhancements:**
+
+- Create role documentation with Automated-Ansible-Role-Documentation [\#694](https://github.com/dev-sec/ansible-collection-hardening/issues/694)
+- Minimize access user paths should be fully configurable [\#689](https://github.com/dev-sec/ansible-collection-hardening/issues/689)
+- Add support for Debian 12 [\#672](https://github.com/dev-sec/ansible-collection-hardening/issues/672)
+- add testing and support for current versions of Fedora and FreeBSD [\#709](https://github.com/dev-sec/ansible-collection-hardening/pull/709) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- feat: workflow for roles readme [\#705](https://github.com/dev-sec/ansible-collection-hardening/pull/705) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
+- do not try to drop roles in mysql hardening [\#649](https://github.com/dev-sec/ansible-collection-hardening/pull/649) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Fixed bugs:**
+
+- nginx conf.d directory is missing on Rocky Linux 8 [\#707](https://github.com/dev-sec/ansible-collection-hardening/issues/707)
+- Default value of `ssh_client_alive_interval` is inconsistent with what documentation says [\#701](https://github.com/dev-sec/ansible-collection-hardening/issues/701)
+- \[devsec.hardening.os\_hardening : restart-auditd\] fails [\#698](https://github.com/dev-sec/ansible-collection-hardening/issues/698)
+- sshd\_hardening role cannot be used to build system images [\#697](https://github.com/dev-sec/ansible-collection-hardening/issues/697)
+- Error: No file was found when using first\_found on Ubuntu 20.04 [\#676](https://github.com/dev-sec/ansible-collection-hardening/issues/676)
+- PUBLIC-role breaks mysql-hardening [\#648](https://github.com/dev-sec/ansible-collection-hardening/issues/648)
+- Error deploying the playbook [\#630](https://github.com/dev-sec/ansible-collection-hardening/issues/630)
+- Gather facts when os\_hardening role is executed with tags [\#708](https://github.com/dev-sec/ansible-collection-hardening/pull/708) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+
+**Closed issues:**
+
+- Dependency Dashboard [\#655](https://github.com/dev-sec/ansible-collection-hardening/issues/655)
+- Add send-to-mailinglist to github release action [\#434](https://github.com/dev-sec/ansible-collection-hardening/issues/434)
+
+**Merged pull requests:**
+
+- update status badges in README [\#714](https://github.com/dev-sec/ansible-collection-hardening/pull/714) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- fix CI test for os\_hardening [\#711](https://github.com/dev-sec/ansible-collection-hardening/pull/711) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- fix nginx CI tests [\#710](https://github.com/dev-sec/ansible-collection-hardening/pull/710) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- fix: roles-readme action default value [\#706](https://github.com/dev-sec/ansible-collection-hardening/pull/706) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
+- fix some wrong defaults and types in the readmes [\#703](https://github.com/dev-sec/ansible-collection-hardening/pull/703) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- update links to new Ansible Galaxy [\#702](https://github.com/dev-sec/ansible-collection-hardening/pull/702) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Fix typo in login.defs.j2 [\#700](https://github.com/dev-sec/ansible-collection-hardening/pull/700) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))
+- chore\(deps\): update actions/checkout action to v4 [\#696](https://github.com/dev-sec/ansible-collection-hardening/pull/696) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- test debian12 on VM [\#695](https://github.com/dev-sec/ansible-collection-hardening/pull/695) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix descriptions in readme [\#693](https://github.com/dev-sec/ansible-collection-hardening/pull/693) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- feat: customize user paths default [\#692](https://github.com/dev-sec/ansible-collection-hardening/pull/692) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([S0obi](https://github.com/S0obi))
+- disable PAM tests [\#691](https://github.com/dev-sec/ansible-collection-hardening/pull/691) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [8.8.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.8.0) (2023-08-04)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.7.0...8.8.0)
+
+**Implemented enhancements:**
+
+- Add support for Fedora 38 [\#671](https://github.com/dev-sec/ansible-collection-hardening/issues/671)
+- auditd: add possibility to override config template [\#685](https://github.com/dev-sec/ansible-collection-hardening/pull/685) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Meecr0b](https://github.com/Meecr0b))
+- add debian 12 support [\#684](https://github.com/dev-sec/ansible-collection-hardening/pull/684) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- feat: explicitly support Fedora 37 and 38 [\#682](https://github.com/dev-sec/ansible-collection-hardening/pull/682) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([nejch](https://github.com/nejch))
+- Replace ssh\_keys group with root, where applicable and use less permissive file mode [\#677](https://github.com/dev-sec/ansible-collection-hardening/pull/677) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Add oddjob mkhomedir option rhel pam [\#675](https://github.com/dev-sec/ansible-collection-hardening/pull/675) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([imp1sh](https://github.com/imp1sh))
+
+**Fixed bugs:**
+
+- How does one set `sshd_authenticationmethods`  to include password authentication? [\#686](https://github.com/dev-sec/ansible-collection-hardening/issues/686)
+- FreeIPA environment mkhomedir fails [\#664](https://github.com/dev-sec/ansible-collection-hardening/issues/664)
+
+**Closed issues:**
+
+- What is the uscase of sysctl\_overwrite over ansible.posix.sysctl? [\#683](https://github.com/dev-sec/ansible-collection-hardening/issues/683)
+-  `Ensure permissions on mysql-logfile are correct` chokes when `log_error` is set to `stderr` [\#673](https://github.com/dev-sec/ansible-collection-hardening/issues/673)
+- TASK TASK FAILED: \[devsec.hardening.os\_hardening : Set password ageing for existing regular \(non-system, non-root\) accounts\]  [\#670](https://github.com/dev-sec/ansible-collection-hardening/issues/670)
+- After os\_hardening ssh not working  [\#663](https://github.com/dev-sec/ansible-collection-hardening/issues/663)
+- Unsupported parameters for \(ansible.builtin.user\) module [\#650](https://github.com/dev-sec/ansible-collection-hardening/issues/650)
+
+**Merged pull requests:**
+
+- setting gets ignored [\#680](https://github.com/dev-sec/ansible-collection-hardening/pull/680) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add var-naming\[no-role-prefix\] to skip-list [\#679](https://github.com/dev-sec/ansible-collection-hardening/pull/679) ([rndmh3ro](https://github.com/rndmh3ro))
+- expand on check conditions for non-file locations of logs [\#674](https://github.com/dev-sec/ansible-collection-hardening/pull/674) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([whysthatso](https://github.com/whysthatso))
+- use new molecule-plugins [\#667](https://github.com/dev-sec/ansible-collection-hardening/pull/667) ([schurzi](https://github.com/schurzi))
+- add spellchecking with codespell [\#662](https://github.com/dev-sec/ansible-collection-hardening/pull/662) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+
+## [8.7.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.7.0) (2023-04-12)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.6.0...8.7.0)
+
+**Implemented enhancements:**
+
+- Support BSD and other operating systems CI with VM based tests [\#599](https://github.com/dev-sec/ansible-collection-hardening/issues/599)
+- add check mode to molecule tests [\#644](https://github.com/dev-sec/ansible-collection-hardening/pull/644) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- add testing for OpenBSD and FreeBSD [\#642](https://github.com/dev-sec/ansible-collection-hardening/pull/642) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Only skip audit restart handler in docker [\#637](https://github.com/dev-sec/ansible-collection-hardening/pull/637) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))
+- Make action\_mail\_acct configurable in auditd [\#631](https://github.com/dev-sec/ansible-collection-hardening/pull/631) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))
+
+**Fixed bugs:**
+
+- getent task is skipped if user previously ran it with a key parameter [\#646](https://github.com/dev-sec/ansible-collection-hardening/issues/646)
+- Error running devsec.hardening.os\_hardening role [\#645](https://github.com/dev-sec/ansible-collection-hardening/issues/645)
+- devsec.hardening.mysql\_hardening - Get all users that have no authentication\_string - Hello world [\#640](https://github.com/dev-sec/ansible-collection-hardening/issues/640)
+- fixes \#646 - add another condition to getent task [\#647](https://github.com/dev-sec/ansible-collection-hardening/pull/647) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([gbolo](https://github.com/gbolo))
+
+**Closed issues:**
+
+- Invalid login.defs for RHEL6 [\#651](https://github.com/dev-sec/ansible-collection-hardening/issues/651)
+- Deprecation warnings for os\_hardening [\#638](https://github.com/dev-sec/ansible-collection-hardening/issues/638)
+- Write tests for MySQL user-deletion [\#445](https://github.com/dev-sec/ansible-collection-hardening/issues/445)
+
+**Merged pull requests:**
+
+- Update minimum required Ansible version for os\_hardening [\#657](https://github.com/dev-sec/ansible-collection-hardening/pull/657) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Update test environment [\#656](https://github.com/dev-sec/ansible-collection-hardening/pull/656) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Update dependency geerlingguy.git to v3.0.1 [\#654](https://github.com/dev-sec/ansible-collection-hardening/pull/654) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- Configure Renovate [\#653](https://github.com/dev-sec/ansible-collection-hardening/pull/653) ([renovate[bot]](https://github.com/apps/renovate))
+- simplify MySQL queries for user deletion [\#641](https://github.com/dev-sec/ansible-collection-hardening/pull/641) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([schurzi](https://github.com/schurzi))
+- Bump creyD/prettier\_action from 4.2 to 4.3 [\#639](https://github.com/dev-sec/ansible-collection-hardening/pull/639) ([dependabot[bot]](https://github.com/apps/dependabot))
+- Fix molecule tests for EL7 [\#636](https://github.com/dev-sec/ansible-collection-hardening/pull/636) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- run our CI tests periodically [\#634](https://github.com/dev-sec/ansible-collection-hardening/pull/634) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- try to fix molecule local tests [\#632](https://github.com/dev-sec/ansible-collection-hardening/pull/632) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- remove unnecessary tasks for VM based test [\#629](https://github.com/dev-sec/ansible-collection-hardening/pull/629) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+
+## [8.6.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.6.0) (2023-02-04)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.5.0...8.6.0)
+
+**Implemented enhancements:**
+
+- make number of warning days before user password expires configurable [\#628](https://github.com/dev-sec/ansible-collection-hardening/pull/628) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Normo](https://github.com/Normo))
 
 **Merged pull requests:**
 
@@ -20,7 +144,7 @@
 - Add support for /etc/auditd.conf num\_logs to go with max\_log\_file\_action [\#617](https://github.com/dev-sec/ansible-collection-hardening/pull/617) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([richardlock](https://github.com/richardlock))
 - Preserve default ownership and dir mode for /var/log on Ubuntu [\#615](https://github.com/dev-sec/ansible-collection-hardening/pull/615) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([stdtom](https://github.com/stdtom))
 - rewrite user home dir hardening [\#584](https://github.com/dev-sec/ansible-collection-hardening/pull/584) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
-- apply password age settings to exisiting regular users [\#582](https://github.com/dev-sec/ansible-collection-hardening/pull/582) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
+- apply password age settings to existing regular users [\#582](https://github.com/dev-sec/ansible-collection-hardening/pull/582) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 - Parametrize more auditd.conf options [\#535](https://github.com/dev-sec/ansible-collection-hardening/pull/535) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([kravietz](https://github.com/kravietz))
 
 **Fixed bugs:**
@@ -155,7 +279,7 @@
 **Implemented enhancements:**
 
 - revert debian 9 change, only one tls variable now [\#562](https://github.com/dev-sec/ansible-collection-hardening/pull/562) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- add posibility to run ssh\_hardening as unprivileged user [\#561](https://github.com/dev-sec/ansible-collection-hardening/pull/561) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- add possibility to run ssh\_hardening as unprivileged user [\#561](https://github.com/dev-sec/ansible-collection-hardening/pull/561) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
 - add basic support for ubuntu22.04 [\#554](https://github.com/dev-sec/ansible-collection-hardening/pull/554) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
 - Add full support for Debian 11 [\#538](https://github.com/dev-sec/ansible-collection-hardening/pull/538) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([addianto](https://github.com/addianto))
 
@@ -226,7 +350,7 @@
 
 **Closed issues:**
 
-- No such file directory error triggered by the  kernel.unpriviliged\_userns\_clone configuration. [\#514](https://github.com/dev-sec/ansible-collection-hardening/issues/514)
+- No such file directory error triggered by the  kernel.unprivileged\_userns\_clone configuration. [\#514](https://github.com/dev-sec/ansible-collection-hardening/issues/514)
 
 **Merged pull requests:**
 
@@ -665,7 +789,7 @@
 - Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-collection-hardening/pull/259) ([jaredledvina](https://github.com/jaredledvina))
 - Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-collection-hardening/pull/254) ([kravietz](https://github.com/kravietz))
 - Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-collection-hardening/pull/251) ([dustinmiller](https://github.com/dustinmiller))
-- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
+- Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
 - Make max\_log\_file\_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-collection-hardening/pull/246) ([jandd](https://github.com/jandd))
 - Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-collection-hardening/pull/240) ([ghost](https://github.com/ghost))
 - Fedora - Use new auto ansible\_python\_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-collection-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
@@ -716,7 +840,7 @@
 - Docker [\#90](https://github.com/dev-sec/ansible-collection-hardening/pull/90) ([rndmh3ro](https://github.com/rndmh3ro))
 - debian 8 support [\#88](https://github.com/dev-sec/ansible-collection-hardening/pull/88) ([rndmh3ro](https://github.com/rndmh3ro))
 - Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-collection-hardening/pull/85) ([fitz123](https://github.com/fitz123))
-- replace ignore\_errors to failed\_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-collection-hardening/pull/81) ([fitz123](https://github.com/fitz123))
+- replace ignore\_errors to failed\_when to suppress ugly error warnings [\#81](https://github.com/dev-sec/ansible-collection-hardening/pull/81) ([fitz123](https://github.com/fitz123))
 - fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-collection-hardening/pull/79) ([fitz123](https://github.com/fitz123))
 - update platforms in meta-file [\#69](https://github.com/dev-sec/ansible-collection-hardening/pull/69) ([rndmh3ro](https://github.com/rndmh3ro))
 - add webhook for ansible galaxy [\#68](https://github.com/dev-sec/ansible-collection-hardening/pull/68) ([rndmh3ro](https://github.com/rndmh3ro))
@@ -742,7 +866,7 @@
 - \[lots of\] deprecation warnings in Ansible 2.8 [\#221](https://github.com/dev-sec/ansible-collection-hardening/issues/221)
 - `squash_actions` deprecation warning [\#218](https://github.com/dev-sec/ansible-collection-hardening/issues/218)
 - login.defs.j2 template: ENV\_PATH is missing ':' before variable substitution [\#202](https://github.com/dev-sec/ansible-collection-hardening/issues/202)
-- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-collection-hardening/issues/191)
+- auditd causing v5.0 to fail on unprivileged LXC's [\#191](https://github.com/dev-sec/ansible-collection-hardening/issues/191)
 - Setting os\_security\_users\_allow has no effect [\#175](https://github.com/dev-sec/ansible-collection-hardening/issues/175)
 - minimize\_access: maximum recursion depth exceeded on Ansible 2.5 [\#171](https://github.com/dev-sec/ansible-collection-hardening/issues/171)
 - wrong permissions passwdqc [\#170](https://github.com/dev-sec/ansible-collection-hardening/issues/170)
@@ -830,7 +954,7 @@
 - adjust permissions on shadow file on suse [\#311](https://github.com/dev-sec/ansible-collection-hardening/pull/311) ([rndmh3ro](https://github.com/rndmh3ro))
 - fix fedora build [\#296](https://github.com/dev-sec/ansible-collection-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
 - do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-collection-hardening/pull/289) ([schurzi](https://github.com/schurzi))
-- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-collection-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
+- move hidepid vars into defaults so they're overwritable [\#285](https://github.com/dev-sec/ansible-collection-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
 - install procps in debian so sysctl.conf exists [\#282](https://github.com/dev-sec/ansible-collection-hardening/pull/282) ([rndmh3ro](https://github.com/rndmh3ro))
 - move defaults to os-specific vars [\#157](https://github.com/dev-sec/ansible-collection-hardening/pull/157) ([rndmh3ro](https://github.com/rndmh3ro))
 - Converts set to JSON-serializable list [\#126](https://github.com/dev-sec/ansible-collection-hardening/pull/126) ([pestaa](https://github.com/pestaa))
@@ -882,7 +1006,7 @@
 - Repair debian install script [\#8](https://github.com/dev-sec/ansible-collection-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
 - Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-collection-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
 - Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-collection-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
-- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-collection-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accommodate test-repo [\#4](https://github.com/dev-sec/ansible-collection-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
 - treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-collection-hardening/pull/3) ([arlimus](https://github.com/arlimus))
 - Add Securetty-support [\#2](https://github.com/dev-sec/ansible-collection-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
 - Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-collection-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))

OS_HARDENING_CHANGELOG.md

@@ -26,7 +26,7 @@
 
 - fix fedora build [\#296](https://github.com/dev-sec/ansible-os-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
 - do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-os-hardening/pull/289) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([schurzi](https://github.com/schurzi))
-- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))
+- move hidepid vars into defaults so they're overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))
 
 ## [6.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/6.1.0) (2020-07-21)
 
@@ -90,7 +90,7 @@
 - Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-os-hardening/pull/259) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jaredledvina](https://github.com/jaredledvina))
 - Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-os-hardening/pull/254) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([kravietz](https://github.com/kravietz))
 - Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-os-hardening/pull/251) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
-- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
+- Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
 - Make max_log_file_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-os-hardening/pull/246) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jandd](https://github.com/jandd))
 - Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-os-hardening/pull/240) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([ghost](https://github.com/ghost))
 - Fedora - Use new auto ansible_python_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-os-hardening/pull/239) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jaredledvina](https://github.com/jaredledvina))
@@ -165,7 +165,7 @@
 
 **Fixed bugs:**
 
-- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- auditd causing v5.0 to fail on unprivileged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
 - Setting os_security_users_allow has no effect [\#175](https://github.com/dev-sec/ansible-os-hardening/issues/175) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
 - add /usr/bin/su to suid_guid whitelist [\#199](https://github.com/dev-sec/ansible-os-hardening/pull/199) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([ccolic](https://github.com/ccolic))
 - ensure that permissions to su-binary are not restricted to root user and group only, if os_security_users_allow contains the value change_user [\#197](https://github.com/dev-sec/ansible-os-hardening/pull/197) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([szEvEz](https://github.com/szEvEz))
@@ -346,7 +346,7 @@
 - Docker [\#90](https://github.com/dev-sec/ansible-os-hardening/pull/90) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
 - debian 8 support [\#88](https://github.com/dev-sec/ansible-os-hardening/pull/88) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-os-hardening/pull/85) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
-- replace ignore_errors to failed_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
+- replace ignore_errors to failed_when to suppress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
 - fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-os-hardening/pull/79) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
 
 **Fixed bugs:**
@@ -459,7 +459,7 @@
 - Repair debian install script [\#8](https://github.com/dev-sec/ansible-os-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
 - Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-os-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
 - Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-os-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
-- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accommodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
 - treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-os-hardening/pull/3) ([arlimus](https://github.com/arlimus))
 - Add Securetty-support [\#2](https://github.com/dev-sec/ansible-os-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
 - Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-os-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))

README.md

@@ -1,23 +1,25 @@
 # Ansible Collection - devsec.hardening
 
-![devsec.os_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening/badge.svg)
-![devsec.os_hardening VM](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening%20VM/badge.svg)
-![devsec.ssh_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.ssh_hardening/badge.svg)
-![devsec.nginx_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.nginx_hardening/badge.svg)
-![devsec.mysql_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.mysql_hardening/badge.svg)
+[![devsec.os_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml)
+[![devsec.os_hardening VM](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml)
+[![devsec.ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml)
+[![devsec.ssh_hardening BSD](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml)
+[![devsec.ssh_hardening with custom tests](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml)
+[![devsec.nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml)
+[![devsec.mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
 
 ## Description
 
 This collection provides battle tested hardening for:
 
 - Linux operating systems:
-  - CentOS 7
-  - Rocky Linux 8
-  - Debian 10/11
+  - CentOS 7/8/9
+  - Rocky Linux 8/9
+  - Debian 10/11/12
   - Ubuntu 18.04/20.04/22.04
   - Amazon Linux (some roles supported)
   - Arch Linux (some roles supported)
-  - Fedora (some roles supported)
+  - Fedora 37/38 (some roles supported)
   - Suse Tumbleweed (some roles supported)
 - MySQL
   - MariaDB >= 5.5.65, >= 10.1.45, >= 10.3.17

galaxy.yml

@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 8.5.0
+version: 8.8.0
 readme: README.md
 authors:
   - dev-sec <[email protected]>
@@ -42,3 +42,4 @@ build_ignore:
   - .tox
   - tox.ini
   - .yamllint
+  - renovate.json

molecule/mysql_hardening/molecule.yml

@@ -15,15 +15,6 @@ platforms:
     privileged: true
     cgroupns_mode: host
     pre_build_image: true
-    environment:
-      container: docker
-    security_opts:
-      - apparmor=unconfined
-    env:
-      http_proxy: "${http_proxy}"
-      https_proxy: "${https_proxy}"
-      no_proxy: "${no_proxy}"
-      container: docker
 provisioner:
   name: ansible
   options:
@@ -31,7 +22,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
   name: ansible
 
@@ -61,7 +52,8 @@ scenario:
     - syntax
     - create
     - prepare
+    - check
     - converge
-    # - idempotence  # not idempotent
+    - idempotence
     - verify
     - destroy

molecule/mysql_hardening/prepare.yml

@@ -60,14 +60,18 @@
         - ansible_distribution != "Ubuntu"
         - ansible_distribution_major_version|int < 20
 
+    - name: Install required MySQL Python libraries on RHEL
+      yum:
+        name: "{% if 'python3' in ansible_python_interpreter|default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
+      when:
+        - ansible_os_family == "RedHat"
+        - ansible_distribution_major_version == "7"
+          
     - include_role:
         name: dev-sec.mysql
 
-    - name: create a user with an empty password
-      community.mysql.mysql_query:
-        query:
-          - "CREATE USER foo@bar;"
-        login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+    - name: include MySQL user prepare tasks
+      include_tasks: prepare_tasks/mysql_users.yml
   vars:
     overwrite_global_mycnf: false
     mysql_root_password: iloverandompasswordsbutthiswilldo

molecule/mysql_hardening/prepare_tasks/mysql_users.yml

@@ -0,0 +1,32 @@
+---
+- name: create users for test
+  community.mysql.mysql_query:
+    query:
+      - "CREATE USER 'user'@'delete';"
+      - "CREATE USER 'user'@'127.0.0.1';"
+      - "CREATE USER 'user'@'::1';"
+      - "CREATE USER 'user'@'%';"
+      - "CREATE USER 'user'@'192.168.0.%';"
+      - "CREATE USER 'user'@'192.168.0.1';"
+      - "CREATE USER    '%'@'192.168.0.1';"
+      - "CREATE USER 'user'@'192.168.0.2' IDENTIFIED BY 'keep';"
+      - "CREATE USER 'user'@'keep' IDENTIFIED BY 'keep';"
+      - "CREATE USER 'user'@'192.168.%' IDENTIFIED BY 'keep';"
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+
+- name: Detect role support on MySQL
+  community.mysql.mysql_query:
+    query: >
+      SELECT 1 FROM information_schema.COLUMNS
+                WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
+                AND COLUMN_NAME = 'is_role';
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_role_support
+
+- name: create roles for test
+  community.mysql.mysql_query:
+    query:
+       - "CREATE ROLE 'role_keep';"
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  when:
+    - mysql_role_support.rowcount[0] > 0

molecule/mysql_hardening/requirements.yml

@@ -1,7 +1,5 @@
 ---
 roles:
-  - name: geerlingguy.git
-    version: 3.0.0
   - name: dev-sec.mysql
     version: master
 

molecule/mysql_hardening/verify.yml

@@ -6,26 +6,12 @@
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  roles:
-    - geerlingguy.git
   tasks:
-    - name: install fake SuSE-release for cinc compatibility
-      copy:
-        content: |
-          openSUSE Faked Enterprise 2020 (x86_64)
-          VERSION = 2020
-          CODENAME = Faked Feature
-        dest: /etc/SuSE-release
-        owner: root
-        group: root
-        mode: '0444'
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: install git for SuSE since geerlinguy.git does not support it
-      zypper:
-        name: git
-        state: present
-      when: ansible_facts.os_family == 'Suse'
+    - name: Use Python 3 on Suse
+      set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+      when:
+        - ansible_os_family == 'Suse'
 
     - name: install procps for debian systems
       apt:
@@ -37,17 +23,24 @@
     - name: include tests for the service
       include_tasks: verify_tasks/service.yml
 
-    - name: download cinc-auditor
-      get_url:
-        url: https://omnitruck.cinc.sh/install.sh
-        dest: /tmp/install.sh
-        mode: '0775'
-
-    - name: install cinc-auditor
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
+    - name: include tests for MySQL user
+      include_tasks: verify_tasks/mysql_users.yml
 
+- name: Verify
+  hosts: localhost
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
     - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/mysql-baseline/archive/refs/heads/master.zip"
+      command: >
+        docker run
+        --volume /run/docker.sock:/run/docker.sock
+        docker.io/cincproject/auditor exec
+        -t docker://instance
+        --no-show-progress --no-color
+        --no-distinct-exit https://github.com/dev-sec/mysql-baseline/archive/refs/heads/master.zip
       register: test_results
       changed_when: false
       ignore_errors: true

molecule/mysql_hardening/verify_tasks/mysql_users.yml

@@ -0,0 +1,41 @@
+---
+- name: Get all users from MySQL server
+  community.mysql.mysql_query:
+    query: >
+      SELECT CONCAT(USER, '@', HOST) AS users FROM mysql.user;
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_users
+
+- name: create list of users from mysql query
+  set_fact:
+    mysql_users_list: "{{ mysql_users.query_result.0  | json_query('[*].users') | list }}"
+
+- name: assert that only accounts with password remain
+  ansible.builtin.assert:
+    that:
+      - '"user@delete" not in mysql_users_list'
+      - '"[email protected]" not in mysql_users_list'
+      - '"user@::1" not in mysql_users_list'
+      - '"user@%" not in mysql_users_list'
+      - '"[email protected].%" not in mysql_users_list'
+      - '"[email protected]" not in mysql_users_list'
+      - '"%@192.168.0.1" not in mysql_users_list'
+      - '"[email protected]" in mysql_users_list'
+      - '"user@keep" in mysql_users_list'
+      - '"[email protected].%" in mysql_users_list'
+
+- name: Detect role support on MySQL
+  community.mysql.mysql_query:
+    query: >
+      SELECT 1 FROM information_schema.COLUMNS
+                WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
+                AND COLUMN_NAME = 'is_role';
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_role_support
+
+- name: assert that roles remain
+  ansible.builtin.assert:
+    that:
+       - '"role_keep@" in mysql_users_list'
+  when:
+    - mysql_role_support.rowcount[0] > 0

molecule/nginx_hardening/converge.yml

@@ -2,6 +2,8 @@
 - name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   become: true
   hosts: all
+  collections:
+    - devsec.hardening
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"

molecule/nginx_hardening/molecule.yml

@@ -14,15 +14,6 @@ platforms:
     privileged: true
     cgroupns_mode: host
     pre_build_image: true
-    environment:
-      container: docker
-    security_opts:
-      - apparmor=unconfined
-    env:
-      http_proxy: "${http_proxy}"
-      https_proxy: "${https_proxy}"
-      no_proxy: "${no_proxy}"
-      container: docker
 provisioner:
   name: ansible
   options:
@@ -30,7 +21,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
   name: ansible
 
@@ -60,6 +51,7 @@ scenario:
     - syntax
     - create
     - prepare
+    - check
     - converge
     - idempotence
     - verify

molecule/nginx_hardening/requirements.yml

@@ -1,4 +1,3 @@
 ---
 roles:
-  - geerlingguy.git
   - geerlingguy.nginx

molecule/nginx_hardening/verify.yml

@@ -6,48 +6,29 @@
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  roles:
-    - geerlingguy.git
   tasks:
-    - name: install fake SuSE-release for cinc compatibility
-      copy:
-        content: |
-          openSUSE Faked Enterprise 2020 (x86_64)
-          VERSION = 2020
-          CODENAME = Faked Feature
-        dest: /etc/SuSE-release
-        owner: root
-        group: root
-        mode: '0444'
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: install git for SuSE since geerlinguy.git does not support it
-      zypper:
-        name: git
-        state: present
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: Run the equivalent of "apt-get update" as a separate step
-      apt:
-        update_cache: true
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: install required tools on debian
+    - name: install procps for debian systems
       apt:
         name: procps
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: download cinc-auditor
-      get_url:
-        url: https://omnitruck.cinc.sh/install.sh
-        dest: /tmp/install.sh
-        mode: '0775'
-
-    - name: install cinc-auditor
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
+        state: present
+        update_cache: true
+      when: ansible_distribution == 'Debian'
 
+- name: Verify
+  hosts: localhost
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
     - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/nginx-baseline/archive/refs/heads/master.zip"
+      command: >
+        docker run
+        --volume /run/docker.sock:/run/docker.sock
+        docker.io/cincproject/auditor exec
+        -t docker://instance
+        --no-show-progress --no-color
+        --no-distinct-exit https://github.com/dev-sec/nginx-baseline/archive/refs/heads/master.zip
       register: test_results
       changed_when: false
       ignore_errors: true

molecule/os_hardening/molecule.yml

@@ -1,8 +1,4 @@
 ---
-dependency:
-  name: galaxy
-  options:
-    role-file: molecule/os_hardening/requirements.yml
 driver:
   name: docker
 platforms:
@@ -14,15 +10,6 @@ platforms:
     privileged: true
     cgroupns_mode: host
     pre_build_image: true
-    environment:
-      container: docker
-    security_opts:
-      - apparmor=unconfined
-    env:
-      http_proxy: "${http_proxy}"
-      https_proxy: "${https_proxy}"
-      no_proxy: "${no_proxy}"
-      container: docker
 provisioner:
   name: ansible
   options:
@@ -30,7 +17,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
   name: ansible
 
@@ -60,6 +47,7 @@ scenario:
     - syntax
     - create
     - prepare
+    - check
     - converge
     - idempotence
     - verify

molecule/os_hardening/prepare.yml

@@ -2,8 +2,6 @@
 - name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
-  collections:
-    - devsec.hardening
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
@@ -23,7 +21,7 @@
 
     - name: install required tools on SuSE
       # cannot use zypper module, since it depends on python-xml
-      shell: "zypper -n install python-xml"
+      shell: "zypper -n install python-xml awk"
       when: ansible_facts.os_family == 'Suse'
 
     - name: install required tools on fedora

molecule/os_hardening/requirements.yml

@@ -1,3 +0,0 @@
----
-roles:
-  - geerlingguy.git

molecule/os_hardening/verify.yml

@@ -6,36 +6,11 @@
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  roles:
-    - geerlingguy.git
   tasks:
-    - name: install fake SuSE-release for cinc compatibility
-      copy:
-        content: |
-          openSUSE Faked Enterprise 2020 (x86_64)
-          VERSION = 2020
-          CODENAME = Faked Feature
-        dest: /etc/SuSE-release
-        owner: root
-        group: root
-        mode: '0444'
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: install git for SuSE since geerlinguy.git does not support it
-      zypper:
-        name: git
-        state: present
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: Run the equivalent of "apt-get update" as a separate step
-      apt:
-        update_cache: true
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: install required tools on debian
-      apt:
-        name: procps
-      when: ansible_facts.os_family == 'Debian'
+    - name: set ansible_python_interpreter to "/usr/bin/python3"
+      set_fact:
+        ansible_python_interpreter: "/usr/bin/python3"
+      when: ansible_facts.distribution == 'Fedora'
 
     - name: include verification tasks
       ansible.builtin.include_tasks:
@@ -46,25 +21,32 @@
         - verify_tasks/netrc.yml
         - verify_tasks/ignore_home_folders.yml
 
-    - name: include PAM tests
-      include_tasks: verify_tasks/pam.yml
-      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+# temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
+#    - name: include PAM tests
+#      include_tasks: verify_tasks/pam.yml
+#      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
 
     - name: include YUM tests
       include_tasks: verify_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'
 
-    - name: download cinc-auditor
-      get_url:
-        url: https://omnitruck.cinc.sh/install.sh
-        dest: /tmp/install.sh
-        mode: '0775'
-
-    - name: install cinc-auditor
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
-
-    - name: Execute cinc-auditor tests  # noqa ignore-errors
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit --waiver-file waivers.yaml https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
+- name: Verify
+  hosts: localhost
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: Execute cinc-auditor tests
+      command: >
+        docker run
+        --volume /run/docker.sock:/run/docker.sock
+        --volume {{ playbook_dir }}/waivers.yaml:/waivers.yaml
+        docker.io/cincproject/auditor exec
+        -t docker://instance
+        --no-show-progress --no-color
+        --waiver-file /waivers.yaml
+        --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip
       register: test_results
       changed_when: false
       ignore_errors: true
@@ -78,6 +60,16 @@
         msg: "Inspec failed to validate"
       when: test_results.rc != 0
 
+- name: Verify
+  hosts: all
+  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  collections:
+    - devsec.hardening
+  tasks:
     # test if variable can be overridden
     - name: workaround for https://github.com/ansible/ansible/issues/66304
       set_fact:

molecule/os_hardening/verify_tasks/pam.yml

@@ -1,9 +1,17 @@
 ---
-- name: download pam-tester
-  get_url:
-    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
-    dest: /bin/pam-tester
-    mode: 0555
+
+- name: install pip
+  package:
+    name:
+      - python3-pip
+      - python3-setuptools
+    state: present
+
+- name: install pam-tester
+  ansible.builtin.pip:
+    name: pam-tester
+    state: present
+    executable: /usr/bin/pip3
 
 - name: set password for test
   set_fact:
@@ -21,26 +29,26 @@
     name: testuser
     password: "{{ test_pw | password_hash('sha512') }}"
 
-- name: check successfull login with correct password
+- name: check successful login with correct password
   shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
     LANG: "{{ locale | default('C.UTF-8') }}"
 
-- name: check unsuccessfull login with incorrect password
+- name: check unsuccessful login with incorrect password
   shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
     LANG: "{{ locale | default('C.UTF-8') }}"
   with_sequence: count=6
 
-- name: check unsuccessfull login, with correct password (lockout)
+- name: check unsuccessful login, with correct password (lockout)
   shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -50,9 +58,9 @@
   pause:
     seconds: 20
 
-- name: check successfull login
+- name: check successful login
   shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"

molecule/os_hardening_vm/converge.yml

@@ -13,6 +13,12 @@
       set_fact: 
         os_mnt_boot_enabled: false
       when: ansible_facts.os_family == 'Archlinux'
+    - name: overrides for Fedora image
+      set_fact: 
+        os_mnt_tmp_enabled: true
+        os_mnt_tmp_src: "tmpfs"
+        os_mnt_tmp_filesystem: "tmpfs"
+      when: ansible_facts.distribution == 'Fedora'
     - include_role:
         name: os_hardening
   vars:
@@ -20,4 +26,5 @@
     os_auth_lockout_time: 15
     os_yum_repo_file_whitelist: ['foo.repo']
     os_mnt_boot_enabled: true
+    os_mnt_home_enabled: true
     os_mnt_boot_src: "/dev/vda1"

molecule/os_hardening_vm/molecule.yml

@@ -8,8 +8,11 @@ driver:
   provider:
     name: libvirt
 platforms:
-  - name: instance
-    box: "generic/${MOLECULE_DISTRO}"
+  # we need to name every instance differently to start multiple VMs on the same host (parallelization)
+  # since we also need to use different OS users to run the tests because of how molecule operates,
+  # the VM names must be predictable by OS user (to clean up canceled runs)
+  - name: "${USER}"
+    box: "${MOLECULE_DISTRO}"
     memory: 1024
     cpus: 2
 provisioner:
@@ -21,7 +24,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
   name: ansible
   env:
@@ -53,6 +56,7 @@ scenario:
     - syntax
     - create
     - prepare
+    - check
     - converge
     - idempotence
     - verify

molecule/os_hardening_vm/prepare.yml

@@ -2,8 +2,6 @@
 - name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
-  collections:
-    - devsec.hardening
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
@@ -53,6 +51,12 @@
       shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
       changed_when: false
 
+    - name: Unmount EFI partition to get rid of vfat filesystem (qemu has no firmware image that inspec can detect)
+      ansible.posix.mount:
+        path: /boot/efi
+        state: unmounted
+      when: ansible_facts.distribution == 'Fedora'
+
     - name: include YUM prepare tasks
       include_tasks: prepare_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'

molecule/os_hardening_vm/verify.yml

@@ -6,56 +6,46 @@
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  roles:
-    - geerlingguy.git
   tasks:
-    - name: install fake SuSE-release for cinc compatibility
-      copy:
-        content: |
-          openSUSE Faked Enterprise 2020 (x86_64)
-          VERSION = 2020
-          CODENAME = Faked Feature
-        dest: /etc/SuSE-release
-        owner: root
-        group: root
-        mode: '0444'
-      when: ansible_facts.os_family == 'Suse'
 
-    - name: install git for SuSE since geerlinguy.git does not support it
-      zypper:
-        name: git
-        state: present
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: Run the equivalent of "apt-get update" as a separate step
-      apt:
-        update_cache: true
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: install required tools on debian
-      apt:
-        name: procps
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: include PAM tests
-      include_tasks: verify_tasks/pam.yml
-      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+# temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
+#    - name: include PAM tests
+#      include_tasks: verify_tasks/pam.yml
+#      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
 
     - name: include YUM tests
       include_tasks: verify_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'
 
-    - name: download cinc-auditor
-      get_url:
-        url: https://omnitruck.cinc.sh/install.sh
-        dest: /tmp/install.sh
-        mode: '0775'
+- name: Verify
+  hosts: localhost
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: get ssh-config
+      command:
+        cmd: "vagrant ssh-config"
+        chdir: "{{ molecule_ephemeral_directory }}"
+      register: ssh_config
+      changed_when: false
 
-    - name: install cinc-auditor
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
+    - name: create ssh-config file
+      copy:
+        content: "{{ ssh_config.stdout_lines | join ('\n') }}"
+        dest: "{{ molecule_ephemeral_directory }}/ssh-config"
+      changed_when: false
 
-    - name: Execute cinc-auditor tests  # noqa ignore-errors
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
+    - name: Execute cinc-auditor tests
+      command: >
+        docker run
+        --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
+        docker.io/cincproject/auditor exec
+        --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
+        -t ssh://{{ lookup('env', 'USER') }}
+        --sudo --no-show-progress --no-color
+        --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip
       register: test_results
       changed_when: false
       ignore_errors: true

molecule/os_hardening_vm/verify_tasks/pam.yml

@@ -1,9 +1,15 @@
 ---
-- name: download pam-tester
-  get_url:
-    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
-    dest: /bin/pam-tester
-    mode: 0555
+- name: install pip
+  package:
+    name:
+      - python3-pip
+      - python3-setuptools
+    state: present
+
+- name: install pam-tester
+  ansible.builtin.pip:
+    name: pam-tester
+    state: present
 
 - name: set password for test
   set_fact:
@@ -21,7 +27,7 @@
     name: testuser
     password: "{{ test_pw | password_hash('sha512') }}"
 
-- name: check successfull login with correct password
+- name: check successful login with correct password
   shell:
     cmd: "pam-tester --user testuser --password {{ test_pw }}"
   environment:
@@ -29,7 +35,7 @@
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
     LANG: "{{ locale | default('C.UTF-8') }}"
 
-- name: check unsuccessfull login with incorrect password
+- name: check unsuccessful login with incorrect password
   shell:
     cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
   environment:
@@ -38,7 +44,7 @@
     LANG: "{{ locale | default('C.UTF-8') }}"
   with_sequence: count=6
 
-- name: check unsuccessfull login, with correct password (lockout)
+- name: check unsuccessful login, with correct password (lockout)
   shell:
     cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
   environment:
@@ -50,7 +56,7 @@
   pause:
     seconds: 20
 
-- name: check successfull login
+- name: check successful login
   shell:
     cmd: "pam-tester --user testuser --password {{ test_pw }}"
   environment:

molecule/ssh_hardening/molecule.yml

@@ -1,8 +1,4 @@
 ---
-dependency:
-  name: galaxy
-  options:
-    role-file: molecule/ssh_hardening/requirements.yml
 driver:
   name: docker
 platforms:
@@ -14,15 +10,6 @@ platforms:
     privileged: true
     cgroupns_mode: host
     pre_build_image: true
-    environment:
-      container: docker
-    security_opts:
-      - apparmor=unconfined
-    env:
-      http_proxy: "${http_proxy}"
-      https_proxy: "${https_proxy}"
-      no_proxy: "${no_proxy}"
-      container: docker
 provisioner:
   name: ansible
   options:
@@ -30,7 +17,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
   inventory:
     host_vars:
       # https://molecule.readthedocs.io/en/latest/examples.html#docker-with-non-privileged-user
@@ -66,6 +53,7 @@ scenario:
     - syntax
     - create
     - prepare
+    - check
     - converge
     - idempotence
     - verify

molecule/ssh_hardening/requirements.yml

@@ -1,3 +0,0 @@
----
-roles:
-  - geerlingguy.git

molecule/ssh_hardening/verify.yml

@@ -1,48 +1,19 @@
 ---
 - name: Verify
-  hosts: all
-  become: true
+  hosts: localhost
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  roles:
-    - geerlingguy.git
   tasks:
-    - name: install fake SuSE-release for cinc compatibility
-      copy:
-        content: |
-          openSUSE Faked Enterprise 2020 (x86_64)
-          VERSION = 2020
-          CODENAME = Faked Feature
-        dest: /etc/SuSE-release
-        owner: root
-        group: root
-        mode: '0444'
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: install git for SuSE since geerlinguy.git does not support it
-      zypper:
-        name: git
-        state: present
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: install crypto compat modules on fedora
-      dnf:
-        name: libxcrypt-compat
-      when: ansible_facts.distribution == 'Fedora'
-
-    - name: download cinc-auditor
-      get_url:
-        url: https://omnitruck.cinc.sh/install.sh
-        dest: /tmp/install.sh
-        mode: '0775'
-
-    - name: install cinc-auditor
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
-
     - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip"
+      command: >
+        docker run
+        --volume /run/docker.sock:/run/docker.sock
+        docker.io/cincproject/auditor exec
+        -t docker://instance
+        --no-show-progress --no-color
+        --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip
       register: test_results
       changed_when: false
       ignore_errors: true

molecule/ssh_hardening_bsd/INSTALL.rst

@@ -0,0 +1,22 @@
+*******
+Docker driver installation guide
+*******
+
+Requirements
+============
+
+* Docker Engine
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ python3 -m pip install 'molecule[docker]'

molecule/ssh_hardening_bsd/converge.yml

@@ -0,0 +1,14 @@
+---
+- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+  hosts: all
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  collections:
+    - devsec.hardening
+  tasks:
+    - include_role:
+        name: ssh_hardening
+  vars:
+    sftp_enabled: false

molecule/ssh_hardening_bsd/molecule.yml

@@ -0,0 +1,58 @@
+---
+driver:
+  name: vagrant
+  provider:
+    name: libvirt
+platforms:
+  # we need to name every instance differently to start multiple VMs on the same host (parallelization)
+  # since we also need to use different OS users to run the tests because of how molecule operates,
+  # the VM names must be predictable by OS user (to clean up canceled runs)
+  - name: "${USER}"
+    box: "generic/${MOLECULE_DISTRO}"
+    memory: 1024
+    cpus: 2
+provisioner:
+  name: ansible
+  options:
+    diff: true
+  env:
+    ANSIBLE_PIPELINING: "True"
+  config_options:
+    defaults:
+      interpreter_python: auto_silent
+      callbacks_enabled: profile_tasks, timer, yaml
+verifier:
+  name: ansible
+  env:
+    ANSIBLE_PIPELINING: "True"
+
+scenario:
+  create_sequence:
+    - dependency
+    - create
+    - prepare
+  check_sequence:
+    - dependency
+    - destroy
+    - create
+    - prepare
+    - converge
+    - check
+    - destroy
+  converge_sequence:
+    - dependency
+    - create
+    - prepare
+    - converge
+  destroy_sequence:
+    - destroy
+  test_sequence:
+    - dependency
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - verify
+    - destroy

molecule/ssh_hardening_bsd/prepare.yml

@@ -0,0 +1,32 @@
+---
+- name: prepare OpenBSD host
+  hosts: all
+  become: true
+  gather_facts: false
+  tasks:
+    - name: install python
+      # BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
+      raw: "pkg_add python%3.10"
+      when: "lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'"
+
+- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+  hosts: all
+  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: created needed directory
+      file:
+        path: "/var/run/sshd"
+        state: directory
+
+    - name: create ssh host keys  # noqa ignore-errors
+      command: "ssh-keygen -A"
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
+            ansible_facts.distribution == "Fedora" or
+            ansible_facts.distribution == "Amazon" or
+            ansible_facts.os_family == "Suse"
+      changed_when: false
+      ignore_errors: true

molecule/ssh_hardening_bsd/verify.yml

@@ -0,0 +1,55 @@
+---
+- name: OpenBSD workaround - inspec detects OpenSBD as unix and not linux compatible
+  hosts: all
+  become: true
+  tasks:
+    - name: use the type command instead of which to detect existing commands
+      file:
+        src: "/usr/bin/which"
+        dest: "/usr/bin/type"
+        state: hard
+      when: "lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'"
+
+- name: Verify
+  hosts: localhost
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: get ssh-config
+      command: 
+        cmd: "vagrant ssh-config"
+        chdir: "{{ molecule_ephemeral_directory }}"
+      register: ssh_config
+      changed_when: false
+
+    - name: create ssh-config file
+      copy:
+        content: "{{ ssh_config.stdout_lines | join ('\n') }}"
+        dest: "{{ molecule_ephemeral_directory }}/ssh-config"
+      changed_when: false
+
+    - name: Execute cinc-auditor tests
+      command: >
+        docker run
+        --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
+        --volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') }}.yaml:/waivers.yaml
+        docker.io/cincproject/auditor exec
+        --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
+        -t ssh://{{ lookup('env', 'USER') }}
+        --sudo --no-show-progress --no-color
+        --waiver-file /waivers.yaml
+        --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip
+      register: test_results
+      changed_when: false
+      ignore_errors: true
+
+    - name: Display details about the cinc-auditor results
+      debug:
+        msg: "{{ test_results.stdout_lines }}"
+
+    - name: Fail when tests fail
+      fail:
+        msg: "Inspec failed to validate"
+      when: test_results.rc != 0

molecule/ssh_hardening_bsd/waivers_freebsd12.yaml

@@ -0,0 +1,3 @@
+sshd-45:
+  run: false
+  justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"

molecule/ssh_hardening_bsd/waivers_freebsd13.yaml

@@ -0,0 +1,3 @@
+sshd-45:
+  run: false
+  justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"

molecule/ssh_hardening_bsd/waivers_freebsd14.yaml

@@ -0,0 +1,3 @@
+sshd-45:
+  run: false
+  justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"

molecule/ssh_hardening_bsd/waivers_openbsd7.yaml

@@ -0,0 +1,21 @@
+ssh-17:
+  run: false
+  justification: "GSSAPIAuthentication is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
+ssh-18:
+  run: false
+  justification: "GSSAPIDelegateCredentials is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
+sshd-30:
+  run: false
+  justification: "KerberosAuthentication is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
+sshd-31:
+  run: false
+  justification: "KerberosOrLocalPasswd is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
+sshd-32:
+  run: false
+  justification: "KerberosTicketCleanup is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
+sshd-33:
+  run: false
+  justification: "GSSAPIAuthentication is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
+sshd-34:
+  run: false
+  justification: "GSSAPICleanupCredentials is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"

molecule/ssh_hardening_custom_tests/converge.yml

@@ -20,11 +20,6 @@
       - path: "/etc/ssh/auth_principals/root"
         principals:
           - "root"
-        owner: "{{ ssh_owner }}"
-        group: "{{ ssh_group }}"
-        directoryowner: "{{ ssh_owner }}"
-        directorygroup: "{{ ssh_group }}"
-        directorymode: "0700"
     network_ipv6_enable: true
     ssh_allow_tcp_forwarding: 'yes'
     ssh_gateway_ports: true
@@ -43,7 +38,7 @@
     ssh_authorized_keys_file: '/etc/ssh/authorized_keys/%u'
     ssh_max_auth_retries: 10
     ssh_permit_root_login: "without-password"
-    ssh_permit_tunnel: true
+    ssh_permit_tunnel: 'yes'
     ssh_print_motd: true
     ssh_print_last_log: true
     ssh_banner: true

molecule/ssh_hardening_custom_tests/molecule.yml

@@ -1,8 +1,4 @@
 ---
-dependency:
-  name: galaxy
-  options:
-    role-file: molecule/ssh_hardening/requirements.yml
 driver:
   name: docker
 platforms:
@@ -14,15 +10,6 @@ platforms:
     privileged: true
     cgroupns_mode: host
     pre_build_image: true
-    environment:
-      container: docker
-    security_opts:
-      - apparmor=unconfined
-    env:
-      http_proxy: "${http_proxy}"
-      https_proxy: "${https_proxy}"
-      no_proxy: "${no_proxy}"
-      container: docker
 provisioner:
   name: ansible
   options:
@@ -30,7 +17,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
   name: ansible
 
@@ -60,6 +47,7 @@ scenario:
     - syntax
     - create
     - prepare
+    - check
     - converge
     - idempotence
     - verify

molecule/ssh_hardening_custom_tests/requirements.yml

@@ -1,3 +0,0 @@
----
-roles:
-  - geerlingguy.git

renovate.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:base",
+    ":gitSignOff"
+  ],
+  "dependencyDashboard": true,
+  "dependencyDashboardAutoclose": true,
+  "packageRules": [
+    {
+      "matchUpdateTypes": ["patch", "minor"],
+      "automerge": true
+    }
+  ]
+}

requirements.txt

@@ -1,4 +1,5 @@
-molecule[docker]
+molecule
+molecule-plugins[docker]
 yamllint
 ansible
 ansible-lint

roles/mysql_hardening/CHANGELOG.md

@@ -91,7 +91,7 @@
 
 **Implemented enhancements:**
 
-- add follow=yes to my.cnf protect task, incase its a symlink. fixes \#20 [\#21](https://github.com/dev-sec/ansible-mysql-hardening/pull/21) ([rndmh3ro](https://github.com/rndmh3ro))
+- add follow=yes to my.cnf protect task, in case its a symlink. fixes \#20 [\#21](https://github.com/dev-sec/ansible-mysql-hardening/pull/21) ([rndmh3ro](https://github.com/rndmh3ro))
 - add changelog generator [\#7](https://github.com/dev-sec/ansible-mysql-hardening/pull/7) ([chris-rock](https://github.com/chris-rock))
 
 **Closed issues:**

roles/mysql_hardening/README.md

@@ -1,6 +1,6 @@
 # devsec.mysql_hardening
 
-![devsec.mysql_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.mysql_hardening/badge.svg)
+[![devsec.mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
 
 ## Description
 
@@ -12,74 +12,131 @@ It configures:
 - Removes anonymous users, users without a password or authentication_string and test databases
 - various hardening options inside MySQL
 
+Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.
+
+Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
+
 ## Requirements
 
-- Ansible 2.9.0
-- An existing MySQL installation
+- An existing installation of MySQL or MariaDB.
 - python-jmespath on the ansible host
 
-### Example playbook
+<!-- BEGIN_ANSIBLE_DOCS -->
 
-```yml
-- hosts: localhost
-  collections:
-    - devsec.hardening
-  roles:
-    - mysql_hardening
-```
+## Supported Operating Systems
 
-This role expects an existing installation of MySQL or MariaDB. Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.  
-Please ensure that the following variables are set accordingly:
-
-- `mysql_hardening_enabled: yes` role is enabled by default and can be disabled without removing it from a playbook. You can use conditional variable, for example: `mysql_hardening_enabled: "{{ true if mysql_enabled else false }}"`
-- `mysql_hardening_user: 'mysql'` The user that mysql runs as.
-- `mysql_hardening_mysql_hardening_conf_file: '/etc/mysql/conf.d/hardening.cnf'` The path to the configuration file where the hardening will be performed
-- _deprecated: `mysql_datadir: '/var/lib/mysql'` The MySQL data directory_
-  - `mysql_datadir` is no longer necessary, as MySQL data directory is automatically taken from `mysql_info`. But it can still be defined and will also be checked for correct permissions.
+- EL
+  - 7, 8, 9
+- Ubuntu
+  - bionic, focal, jammy
+- Debian
+  - bullseye, buster
+- Amazon
+- opensuse
 
 ## Role Variables
 
+- `mysql_daemon_enabled`
+  - Default: `true`
+  - Description: Whether to enable the MySQL-service so it starts on boot
+  - Type: bool
+  - Required: no
 - `mysql_hardening_chroot`
-  - Default: ""
+  - Default: ``
   - Description: [chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)
-- `mysql_hardening_options.safe-user-create`
-  - Default: 1
-  - Description: [safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)
-- `mysql_hardening_options.secure-auth`
-  - Default: 1
-  - Description: [secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)
-- `mysql_hardening_options.skip-symbolic-links`
-  - Default: 1
-  - Description: [skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)
-- `mysql_hardening_skip_grant_tables:`
-  - Default: false
-  - Description: [skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)
-- `mysql_hardening_skip_show_database`
-  - Default: 1
-  - Description: [skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)
-- `mysql_hardening_options.local-infile`
-  - Default: 0
-  - Description: [local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)
-- `mysql_hardening_options.allow-suspicious-udfs`
-  - Default: 0
-  - Description: [allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)
+  - Type: str
+  - Required: no
 - `mysql_hardening_chroot.automatic-sp-privileges`
-  - Default: 0
+  - Default: `0`
   - Description: [automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)
+  - Type: int
+  - Required: no
+- `mysql_hardening_enabled`
+  - Default: `true`
+  - Description: Whether to run the hardening
+  - Type: bool
+  - Required: no
+- `mysql_hardening_options.allow-suspicious-udfs`
+  - Default: `0`
+  - Description: [allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)
+  - Type: int
+  - Required: no
+- `mysql_hardening_options.local-infile`
+  - Default: `0`
+  - Description: [local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)
+  - Type: int
+  - Required: no
+- `mysql_hardening_options.safe-user-create`
+  - Default: `1`
+  - Description: [safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)
+  - Type: int
+  - Required: no
+- `mysql_hardening_options.secure-auth`
+  - Default: `1`
+  - Description: [secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)
+  - Type: int
+  - Required: no
 - `mysql_hardening_options.secure-file-priv`
-  - Default: /tmp
+  - Default: `/tmp`
   - Description: [secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)
-- `mysql_allow_remote_root`
-  - Default: false
-  - Description: delete remote root users
-- `mysql_remove_anonymous_users`
-  - Default: true
-  - Description: remove users without authentication
-- `mysql_remove_test_database`
-  - Default: true
-  - Description: remove test database
+  - Type: str
+  - Required: no
+- `mysql_hardening_options.skip-symbolic-links`
+  - Default: `1`
+  - Description: [skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)
+  - Type: int
+  - Required: no
 - `mysql_hardening_restart_mysql`
-  - Default: true
+  - Default: `true`
   - Description: Restart mysql after running this role
+  - Type: bool
+  - Required: no
+- `mysql_hardening_skip_grant_tables:`
+  - Default: `false`
+  - Description: [skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)
+  - Type: bool
+  - Required: no
+- `mysql_hardening_skip_show_database`
+  - Default: `1`
+  - Description: [skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)
+  - Type: int
+  - Required: no
+- `mysql_remove_anonymous_users`
+  - Default: `true`
+  - Description: Set to `false` to keep users without authentication
+  - Type: bool
+  - Required: no
+- `mysql_remove_remote_root`
+  - Default: `true`
+  - Description: If `true`, root can only connect from localhost. Set to `false` to not remove remote root users.
+  - Type: bool
+  - Required: no
+- `mysql_remove_test_database`
+  - Default: `true`
+  - Description: Set to `false` to keep the test database
+  - Type: bool
+  - Required: no
+- `mysql_root_password`
+  - Default: `-----====>SetR00tPa$$wordH3r3!!!<====-----`
+  - Description: The default password. Please change or overwrite it
+  - Type: str
+  - Required: no
+- `mysql_user_home`
+  - Default: `{{ ansible_env.HOME }}`
+  - Description: The path where the `.my.cnf` will be stored
+  - Type: str
+  - Required: no
 
-Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
+## Dependencies
+
+None.
+
+## Example Playbook
+
+```
+- hosts: all
+  roles:
+    - name: devsec.hardening.mysql_hardening
+```
+
+<!-- END_ANSIBLE_DOCS -->

roles/mysql_hardening/defaults/main.yml

@@ -6,8 +6,6 @@ mysql_daemon_enabled: true
 
 mysql_hardening_restart_mysql: true
 
-# general configuration
-mysql_hardening_mysql_hardening_conf_file: "{{ mysql_hardening_mysql_confd_dir }}/hardening.cnf"
 # You have to change this to your own strong enough mysql root password
 mysql_root_password: "-----====>SetR00tPa$$wordH3r3!!!<====-----"
 # There .my.cnf with mysql root credentials will be installed

roles/mysql_hardening/meta/argument_specs.yml

@@ -0,0 +1,79 @@
+---
+argument_specs:
+  main:
+    short_description: The main entry point for the mysql hardening role.
+    version_added: 8.8.0
+    options:
+      mysql_hardening_chroot:
+        default: ''
+        type: str
+        description: '[chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)'
+      mysql_hardening_options.safe-user-create:
+        default: 1
+        type: int
+        description: '[safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)'
+      mysql_hardening_options.secure-auth:
+        default: 1
+        type: int
+        description: '[secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)'
+      mysql_hardening_options.skip-symbolic-links:
+        default: 1
+        type: int
+        description: '[skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)'
+      'mysql_hardening_skip_grant_tables:':
+        default: false
+        type: bool
+        description: '[skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)'
+      mysql_hardening_skip_show_database:
+        default: 1
+        type: int
+        description: '[skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)'
+      mysql_hardening_options.local-infile:
+        default: 0
+        type: int
+        description: '[local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)'
+      mysql_hardening_options.allow-suspicious-udfs:
+        default: 0
+        type: int
+        description: '[allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)'
+      mysql_hardening_chroot.automatic-sp-privileges:
+        default: 0
+        type: int
+        description: '[automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)'
+      mysql_hardening_options.secure-file-priv:
+        default: /tmp
+        type: str
+        description: '[secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)'
+      mysql_remove_anonymous_users:
+        default: true
+        type: bool
+        description: Set to `false` to keep users without authentication
+      mysql_remove_test_database:
+        default: true
+        type: bool
+        description: Set to `false` to keep the test database
+      mysql_hardening_restart_mysql:
+        default: true
+        type: bool
+        description: Restart mysql after running this role
+      mysql_hardening_enabled:
+        default: true
+        type: bool
+        description: Whether to run the hardening
+      mysql_daemon_enabled:
+        default: true
+        type: bool
+        description: Whether to enable the MySQL-service so it starts on boot
+      mysql_root_password:
+        default: '-----====>SetR00tPa$$wordH3r3!!!<====-----'
+        type: str
+        description: The default password. Please change or overwrite it
+      mysql_user_home:
+        default: '{{ ansible_env.HOME }}'
+        type: str
+        description: The path where the `.my.cnf` will be stored
+      mysql_remove_remote_root:
+        default: true
+        type: bool
+        description: If `true`, root can only connect from localhost. Set to `false`
+          to not remove remote root users.

roles/mysql_hardening/meta/main.yml

@@ -10,6 +10,7 @@ galaxy_info:
       versions:
         - "7"
         - "8"
+        - "9"
     - name: Ubuntu
       versions:
         - bionic
@@ -20,7 +21,7 @@ galaxy_info:
         - bullseye
         - buster
     - name: Amazon
-    - name: Fedora
+    - name: opensuse
   galaxy_tags:
     - system
     - security

roles/mysql_hardening/tasks/configure.yml

@@ -27,7 +27,11 @@
     owner: "{{ mysql_hardening_user }}"
     group: "{{ mysql_hardening_group }}"
     mode: "0640"
-  when: item is defined and item != ""
+  when:
+    - item is defined
+    - item != ""
+    - item != "stderr"
+    - item != "stdout"
   loop:
     - "{{ mysql_settings.settings.log_error }}"
     - '{{ mysql_hardening_log_file | default("") }}'
@@ -52,7 +56,7 @@
 - name: Apply hardening configuration
   ansible.builtin.template:
     src: hardening.cnf.j2
-    dest: "{{ mysql_hardening_mysql_hardening_conf_file }}"
+    dest: "{{ mysql_hardening_mysql_confd_dir + '/hardening.cnf' }}"
     owner: "{{ mysql_cnf_owner }}"
     group: "{{ mysql_cnf_group }}"
     mode: "0640"

roles/mysql_hardening/tasks/main.yml

@@ -14,7 +14,7 @@
 
 # we only override variables with our default if they have not been specified already.
 # by default the lookup functions finds all varnames containing the string, therefore
-# we add ^ and $ to denote start and end of string, so this returns only exact maches.
+# we add ^ and $ to denote start and end of string, so this returns only exact matches.
 - name: Set OS dependent variables, if not already defined by user # noqa var-naming
   ansible.builtin.set_fact:
     "{{ item.key }}": "{{ item.value }}"

roles/mysql_hardening/tasks/mysql_secure_installation.yml

@@ -46,19 +46,30 @@
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   when: mysql_remove_remote_root
 
+- name: Detect role support on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
+  community.mysql.mysql_query:
+    query: >
+      SELECT 1 FROM information_schema.COLUMNS
+                WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
+                AND COLUMN_NAME = 'is_role';
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_role_support
+  check_mode: false
+
 - name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
   community.mysql.mysql_query:
     query: >
-      SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
+      SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
       FROM mysql.user
       WHERE (length(authentication_string)=0
              OR authentication_string="")
         AND USER NOT IN ('mysql.sys',
                          'mysqlxsys',
-                         'mariadb.sys');
-
+                         'mariadb.sys')
+        {{ 'AND CONVERT(is_role USING utf8) = "N"' if mysql_role_support.rowcount[0] > 0 }};
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   register: mysql_users_wo_passwords_or_auth_string
+  check_mode: false
   when: >
     (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '>=')) or
     (mysql_distribution == "mariadb" and mysql_version.version.full
@@ -67,7 +78,7 @@
 - name: Get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
   community.mysql.mysql_query:
     query: >
-      SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
+      SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
       FROM mysql.user
       WHERE (length(password)=0
              OR password="")
@@ -75,33 +86,21 @@
              OR authentication_string="")
         AND USER NOT IN ('mysql.sys',
                          'mysqlxsys',
-                         'mariadb.sys');
+                         'mariadb.sys')
+        {{ 'AND is_role = "N"' if mysql_role_support.rowcount[0] > 0 }};
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   register: mysql_users_wo_passwords
+  check_mode: false
   when: >
     (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '<')) or
     (mysql_distribution == "mariadb" and mysql_version.version.full is
     version('10.4.0', '<'))
 
-- name: Create a fact for users without password or authentication_string
-  ansible.builtin.set_fact:
-    users_wo_auth: "{{ mysql_users_wo_passwords_or_auth_string.query_result.0.0 | community.general.json_query('users') }}"
-  when:
-    - mysql_users_wo_passwords_or_auth_string.query_result is defined
-    - mysql_users_wo_passwords_or_auth_string.query_result != "" # noqa empty-string-compare
-
-- name: Create a fact for users without password
-  ansible.builtin.set_fact:
-    users_wo_auth: "{{ mysql_users_wo_passwords.query_result.0.0 | community.general.json_query('users') }}"
-  when:
-    - mysql_users_wo_passwords.query_result is defined
-    - mysql_users_wo_passwords.query_result != "" # noqa empty-string-compare
-
 - name: Ensure that there are no users without password or authentication_string
   community.mysql.mysql_query:
     query:
-      - DROP USER {{ users_wo_auth }}
+      - DROP USER {{ item.user }}
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
-  when:
-    - users_wo_auth is defined
-    - users_wo_auth != "" # noqa empty-string-compare
+  with_community.general.flattened:
+    - "{{ mysql_users_wo_passwords.query_result | default([]) }}"
+    - "{{ mysql_users_wo_passwords_or_auth_string.query_result | default([]) }}"

roles/nginx_hardening/README.md

@@ -1,6 +1,6 @@
 # devsec.nginx_hardening
 
-![devsec.nginx_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.nginx_hardening/badge.svg)
+[![devsec.nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml)
 
 ## Description
 
@@ -8,110 +8,142 @@ This role provides secure nginx configuration. It is intended to be compliant wi
 
 It works with the following nginx-roles, including, but not limited to:
 
-- [geerlingguy.nginx](https://galaxy.ansible.com/geerlingguy/nginx/)
-- [nginxinc.nginx](https://galaxy.ansible.com/nginxinc/nginx)
-- [jdauphant.nginx](https://galaxy.ansible.com/jdauphant/nginx/)
-- [franklinkim.nginx](https://galaxy.ansible.com/franklinkim/nginx/)
+- [nginxinc.nginx](https://galaxy.ansible.com/ui/standalone/roles/nginxinc/nginx/)
+- [geerlinggux.nginx](https://galaxy.ansible.com/ui/standalone/roles/geerlingguy/nginx/)
+- [jdauphant.nginx](https://galaxy.ansible.com/ui/standalone/roles/jdauphant/nginx/)
 
 **NOTE: This role does not work with nginx 1.0.15 or older! Please use the latest version from the official nginx repositories!**
 
-## Requirements
+<!-- BEGIN_ANSIBLE_DOCS -->
 
-- Ansible >= 2.9
+## Supported Operating Systems
+
+- EL
+  - 7, 8, 9
+- Ubuntu
+  - bionic, focal, jammy
+- Debian
+  - buster, bullseye
+- Amazon
 
 ## Role Variables
 
-- [nginx_client_body_buffer_size][]
+- `nginx_add_header`
+  - Default: `["X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"", "Content-Security-Policy \\\"script-src 'self'; object-src 'self'\\\""]`
+  - Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See [nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
+  - Type: list
+  - Required: no
+- `nginx_client_body_buffer_size`
   - Default: `1k`
-  - Description: Sets buffer size for reading client request body. In case the request body is larger than the buffer, the whole body or only its part is written to a temporary file.
-- nginx_remove_default_site
+  - Description: Sets buffer size for reading client request body. In case the request body is larger than the buffer, the whole body or only its part is written to a temporary file. See [nginx_client_body_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size)
+  - Type: str
+  - Required: no
+- `nginx_client_body_timeout`
+  - Default: `10`
+  - Description: Defines a timeout for reading client request body. See [nginx_client_body_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout)
+  - Type: int
+  - Required: no
+- `nginx_client_header_buffer_size`
+  - Default: `1k`
+  - Description: Sets buffer size for reading client request header. For most requests, a buffer of 1K bytes is enough. See [nginx_client_header_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client
+  - Type: str
+  - Required: no
+- `nginx_client_header_timeout`
+  - Default: `10`
+  - Description: Defines a timeout for reading client request header. See [nginx_client_header_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout)
+  - Type: int
+  - Required: no
+- `nginx_client_max_body_size`
+  - Default: `1k`
+  - Description: Sets the maximum allowed size of the client request body, specified in the "Content-Length" request header field. If the size in a request exceeds the configured value, the 413 (Request Entity Too Large) error is returned to the client. See [nginx_client_max_body_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size)
+  - Type: str
+  - Required: no
+- `nginx_configuration_dir`
+  - Default: `/etc/nginx`
+  - Description: The main location for all nginx configuration files
+  - Type: str
+  - Required: no
+- `nginx_configuration_hardening_dir`
+  - Default: `/etc/nginx`
+  - Description: The location for the nginx hardening configuration file (Could be different e.g. when used in jails)
+  - Type: str
+  - Required: no
+- `nginx_dh_size`
+  - Default: `2048`
+  - Description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam)
+  - Type: int
+  - Required: no
+- `nginx_keepalive_timeout`
+  - Default: `5 5`
+  - Description: The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The optional second parameter sets a value in the "Keep-Alive timeout=time" response header field. See [nginx_keepalive_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout)
+  - Type: str
+  - Required: no
+- `nginx_large_client_header_buffers`
+  - Default: `2 1k`
+  - Description: Sets the maximum number and size of buffers used for reading large client request header. See [nginx_large_client_header_buffers](http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers)
+  - Type: str
+  - Required: no
+- `nginx_limit_conn`
+  - Default: `default 5`
+  - Description: Sets the shared memory zone and the maximum allowed number of connections for a given key value. See [nginx_limit_conn](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn)
+  - Type: str
+  - Required: no
+- `nginx_limit_conn_zone`
+  - Default: `$binary_remote_addr zone=default:10m`
+  - Description: Sets parameters for a shared memory zone that will keep states for various keys. See [nginx_limit_conn_zone](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone)
+  - Type: str
+  - Required: no
+- `nginx_owner_group`
+  - Default: `root`
+  - Description: The owner group of the nginx configuration files
+  - Type: str
+  - Required: no
+- `nginx_owner_user`
+  - Default: `root`
+  - Description: The owner user of the nginx configuration files
+  - Type: str
+  - Required: no
+- `nginx_remove_default_site`
   - Default: `true`
   - Description: Disables the default site. Set to false to enable the default site in nginx.
-- [nginx_client_max_body_size][]
-  - Default: `1k`
-  - Description: Sets the maximum allowed size of the client request body, specified in the “Content-Length” request header field. If the size in a request exceeds the configured value, the 41
-    3 (Request Entity Too Large) error is returned to the client.
-- [nginx_keepalive_timeout][]
-  - Default: `5 5`
-  - Description: The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The op
-    tional second parameter sets a value in the “Keep-Alive: timeout=time” response header field.
-- [nginx_server_tokens][]
+  - Type: bool
+  - Required: no
+- `nginx_send_timeout`
+  - Default: `10`
+  - Description: Sets a timeout for transmitting a response to the client. See [nginx_send_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout)
+  - Type: int
+  - Required: no
+- `nginx_server_tokens`
   - Default: `off`
-  - Description: Disables emitting nginx version in error messages and in the "Server" response header field. Set to on to enable the nginx version in error messages and "Server" response head
-    er.
-- [nginx_client_header_buffer_size][]
-  - Default: `1k`
-  - Description: Sets buffer size for reading client request header. For most requests, a buffer of 1K bytes is enough.
-- [nginx_large_client_header_buffers][]
-  - Default: `2 1k`
-  - Description: Sets the maximum number and size of buffers used for reading large client request header.
-- [nginx_client_body_timeout][]
-  - Default: `10`
-  - Description: Defines a timeout for reading client request body.
-- [nginx_client_header_timeout][]
-  - Default: `10`
-  - Description: Defines a timeout for reading client request header.
-- [nginx_send_timeout][]
-  - Default: `10`
-  - Description: Sets a timeout for transmitting a response to the client.
-- [nginx_limit_conn_zone][]
-  - Default: `$binary_remote_addr zone=default:10m`
-  - Description: Sets parameters for a shared memory zone that will keep states for various keys.
-- [nginx_limit_conn][]
-  - Default: `default 5`
-  - Description: Sets the shared memory zone and the maximum allowed number of connections for a given key value.
-- [nginx_add_header][]
-  - Default: `[ "X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"", Content-Security-Policy \"script-src 'self'; object-src 'self'\" ]`
-  - Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307.
-- [nginx_ssl_protocols][]
-  - Default: `TLSv1.2`
-  - Description: Specifies the SSL protocol which should be used.
-- [nginx_ssl_ciphers][]
-  - Default: _see defaults.yml_
-  - Description: Specifies the TLS ciphers which should be used.
-- [nginx_ssl_prefer_server_ciphers][]
+  - Description: Disables emitting nginx version in error messages and in the "Server" response header field. Set to on to enable the nginx version in error messages and "Server" response header. See [nginx_server_tokens](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens)
+  - Type: str
+  - Required: no
+- `nginx_ssl_ciphers`
+  - Default: `ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256`
+  - Description: Specifies the TLS ciphers which should be used. See [nginx_ssl_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers)
+  - Type: str
+  - Required: no
+- `nginx_ssl_prefer_server_ciphers`
   - Default: `on`
-  - Description: Specifies that server ciphers should be preferred over client ciphers when using the TLS protocols. Set to false to disable it.
-- [nginx_dh_size][]
-  - Default: `2048`
-  - Description: Specifies the length of DH parameters for EDH ciphers.
-- [nginx_configuration_dir][]
-  - default: "/etc/nginx"
-  - Description: The main location for all nginx configuration files
-- [nginx_configuration_hardening_dir][]
-  - default: "/etc/nginx"
-  - Description: The location for the nginx hardening configuration file (Could be different e.g. when used in jails)
-- [nginx_owner_user][]
-  - default: "root"
-  - Description: The owner user of the nginx configuration files
-- [nginx_owner_group][]
-  - default: "root"
-  - Description: The owner group of the nginx configuration files
+  - Description: Specifies that server ciphers should be preferred over client ciphers when using the TLS protocols. Set to false to disable it. See [nginx_ssl_prefer_server_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers)
+  - Type: str
+  - Required: no
+- `nginx_ssl_protocols`
+  - Default: `TLSv1.2`
+  - Description: Specifies the SSL protocol which should be used. See [nginx_ssl_protocols](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols)
+  - Type: str
+  - Required: no
+
+## Dependencies
+
+None.
 
 ## Example Playbook
 
 ```
-- hosts: localhost
-  collections:
-    - devsec.hardening
+- hosts: all
   roles:
-    - nginx_hardening
+    - name: devsec.hardening.nginx_hardening
 ```
 
-[nginx_client_body_buffer_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size
-[nginx_client_max_body_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
-[nginx_keepalive_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout
-[nginx_server_tokens]: http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens
-[nginx_more_clear_headers]: http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header
-[nginx_client_header_buffer_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_buffer_size
-[nginx_large_client_header_buffers]: http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers
-[nginx_client_body_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout
-[nginx_client_header_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout
-[nginx_send_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout
-[nginx_limit_conn_zone]: http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone
-[nginx_limit_conn]: http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn
-[nginx_add_header]: http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header
-[nginx_ssl_protocols]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols
-[nginx_ssl_ciphers]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers
-[nginx_ssl_prefer_server_ciphers]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers
-[nginx_dh_size]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam
+<!-- END_ANSIBLE_DOCS -->

roles/nginx_hardening/defaults/main.yml

@@ -25,7 +25,6 @@ nginx_add_header:
   - Strict-Transport-Security max-age=15768000
   - Content-Security-Policy "script-src 'self'; object-src 'self'"
 
-nginx_set_cookie_flag: "* HttpOnly secure"
 nginx_ssl_prefer_server_ciphers: "on"
 nginx_ssl_protocols: TLSv1.2 TLSv1.3
 # yamllint disable-line rule:line-length

roles/nginx_hardening/meta/argument_specs.yml

@@ -0,0 +1,112 @@
+---
+argument_specs:
+  main:
+    short_description: The main entry point for the nginx hardening role.
+    version_added: 8.8.0
+    options:
+      nginx_client_body_buffer_size:
+        default: 1k
+        type: str
+        description: Sets buffer size for reading client request body. In case the
+          request body is larger than the buffer, the whole body or only its part
+          is written to a temporary file. See [nginx_client_body_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size)
+      nginx_remove_default_site:
+        default: true
+        type: bool
+        description: Disables the default site. Set to false to enable the default
+          site in nginx.
+      nginx_client_max_body_size:
+        default: 1k
+        type: str
+        description: Sets the maximum allowed size of the client request body, specified
+          in the "Content-Length" request header field. If the size in a request exceeds
+          the configured value, the 413 (Request Entity Too Large) error is returned
+          to the client. See [nginx_client_max_body_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size)
+      nginx_keepalive_timeout:
+        default: 5 5
+        type: str
+        description: The first parameter sets a timeout during which a keep-alive
+          client connection will stay open on the server side. The zero value disables
+          keep-alive client connections. The optional second parameter sets a value
+          in the "Keep-Alive timeout=time" response header field. See [nginx_keepalive_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout)  # noqa yaml[line-length]
+      nginx_server_tokens:
+        default: 'off'
+        type: str
+        description: Disables emitting nginx version in error messages and in the
+          "Server" response header field. Set to on to enable the nginx version in
+          error messages and "Server" response header. See [nginx_server_tokens](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens)
+      nginx_client_header_buffer_size:
+        default: 1k
+        type: str
+        description: Sets buffer size for reading client request header. For most
+          requests, a buffer of 1K bytes is enough. See [nginx_client_header_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client
+      nginx_large_client_header_buffers:
+        default: 2 1k
+        type: str
+        description: Sets the maximum number and size of buffers used for reading
+          large client request header. See [nginx_large_client_header_buffers](http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers)  # noqa yaml[line-length]
+      nginx_client_body_timeout:
+        default: 10
+        type: int
+        description: Defines a timeout for reading client request body. See [nginx_client_body_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout)  # noqa yaml[line-length]
+      nginx_client_header_timeout:
+        default: 10
+        type: int
+        description: Defines a timeout for reading client request header. See [nginx_client_header_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout)  # noqa yaml[line-length]
+      nginx_send_timeout:
+        default: 10
+        type: int
+        description: Sets a timeout for transmitting a response to the client. See
+          [nginx_send_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout)
+      nginx_limit_conn_zone:
+        default: $binary_remote_addr zone=default:10m
+        type: str
+        description: Sets parameters for a shared memory zone that will keep states
+          for various keys. See [nginx_limit_conn_zone](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone)
+      nginx_limit_conn:
+        default: default 5
+        type: str
+        description: Sets the shared memory zone and the maximum allowed number of
+          connections for a given key value. See [nginx_limit_conn](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn)
+      nginx_add_header:
+        default: [X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff, X-XSS-Protection
+              "1; mode=block", Content-Security-Policy \"script-src 'self'; object-src
+              'self'\"]
+        type: list
+        description: Adds the specified field to a response header provided that the
+          response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See
+          [nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
+      nginx_ssl_protocols:
+        default: TLSv1.2
+        type: str
+        description: Specifies the SSL protocol which should be used. See [nginx_ssl_protocols](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols)  # noqa yaml[line-length]
+      nginx_ssl_ciphers:
+        default: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256  # noqa yaml[line-length]
+        type: str
+        description: Specifies the TLS ciphers which should be used. See [nginx_ssl_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers)
+      nginx_ssl_prefer_server_ciphers:
+        default: 'on'
+        type: str
+        description: Specifies that server ciphers should be preferred over client
+          ciphers when using the TLS protocols. Set to false to disable it. See [nginx_ssl_prefer_server_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers)  # noqa yaml[line-length]
+      nginx_dh_size:
+        default: 2048
+        type: int
+        description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam)  # noqa yaml[line-length]
+      nginx_configuration_dir:
+        default: /etc/nginx
+        type: str
+        description: The main location for all nginx configuration files
+      nginx_configuration_hardening_dir:
+        default: /etc/nginx
+        type: str
+        description: The location for the nginx hardening configuration file (Could
+          be different e.g. when used in jails)
+      nginx_owner_user:
+        default: root
+        type: str
+        description: The owner user of the nginx configuration files
+      nginx_owner_group:
+        default: root
+        type: str
+        description: The owner group of the nginx configuration files

roles/nginx_hardening/meta/main.yml

@@ -10,6 +10,7 @@ galaxy_info:
       versions:
         - "7"
         - "8"
+        - "9"
     - name: Ubuntu
       versions:
         - bionic
@@ -19,6 +20,7 @@ galaxy_info:
       versions:
         - buster
         - bullseye
+    - name: Amazon
   galaxy_tags:
     - system
     - security

roles/os_hardening/CHANGELOG.md

@@ -54,7 +54,7 @@
 
 - fix fedora build [\#296](https://github.com/dev-sec/ansible-os-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
 - do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-os-hardening/pull/289) ([schurzi](https://github.com/schurzi))
-- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
+- move hidepid vars into defaults so they're overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
 
 ## [6.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/6.1.0) (2020-07-21)
 
@@ -118,7 +118,7 @@
 - Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-os-hardening/pull/259) ([jaredledvina](https://github.com/jaredledvina))
 - Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-os-hardening/pull/254) ([kravietz](https://github.com/kravietz))
 - Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-os-hardening/pull/251) ([dustinmiller1337](https://github.com/dustinmiller1337))
-- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) ([dustinmiller1337](https://github.com/dustinmiller1337))
+- Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) ([dustinmiller1337](https://github.com/dustinmiller1337))
 - Make max_log_file_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-os-hardening/pull/246) ([jandd](https://github.com/jandd))
 - Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-os-hardening/pull/240) ([ghost](https://github.com/ghost))
 - Fedora - Use new auto ansible_python_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-os-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
@@ -193,7 +193,7 @@
 
 **Fixed bugs:**
 
-- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191)
+- auditd causing v5.0 to fail on unprivileged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191)
 - Setting os_security_users_allow has no effect [\#175](https://github.com/dev-sec/ansible-os-hardening/issues/175)
 - add /usr/bin/su to suid_guid whitelist [\#199](https://github.com/dev-sec/ansible-os-hardening/pull/199) ([ccolic](https://github.com/ccolic))
 - ensure that permissions to su-binary are not restricted to root user and group only, if os_security_users_allow contains the value change_user [\#197](https://github.com/dev-sec/ansible-os-hardening/pull/197) ([szEvEz](https://github.com/szEvEz))
@@ -374,7 +374,7 @@
 - Docker [\#90](https://github.com/dev-sec/ansible-os-hardening/pull/90) ([rndmh3ro](https://github.com/rndmh3ro))
 - debian 8 support [\#88](https://github.com/dev-sec/ansible-os-hardening/pull/88) ([rndmh3ro](https://github.com/rndmh3ro))
 - Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-os-hardening/pull/85) ([fitz123](https://github.com/fitz123))
-- replace ignore_errors to failed_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) ([fitz123](https://github.com/fitz123))
+- replace ignore_errors to failed_when to suppress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) ([fitz123](https://github.com/fitz123))
 - fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-os-hardening/pull/79) ([fitz123](https://github.com/fitz123))
 
 **Fixed bugs:**
@@ -487,7 +487,7 @@
 - Repair debian install script [\#8](https://github.com/dev-sec/ansible-os-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
 - Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-os-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
 - Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-os-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
-- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accommodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
 - treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-os-hardening/pull/3) ([arlimus](https://github.com/arlimus))
 - Add Securetty-support [\#2](https://github.com/dev-sec/ansible-os-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
 - Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-os-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))

roles/os_hardening/defaults/main.yml

@@ -1,5 +1,6 @@
 ---
 os_desktop_enable: false
+os_env_user_paths: [/usr/local/sbin, /usr/local/bin, /usr/sbin, /usr/bin, /sbin, /bin]
 os_env_extra_user_paths: []
 os_auth_pw_max_age: 60
 os_auth_pw_min_age: 7 # Discourage password cycling
@@ -9,6 +10,7 @@ os_auth_retries: 5
 os_auth_lockout_time: 600 # Seconds (600 = 10min)
 os_auth_timeout: 60
 os_auth_allow_homeless: false
+os_auth_pam_oddjob_mkhomedir: false
 os_auth_pam_passwdqc_enable: true
 os_auth_pam_passwdqc_options: min=disabled,disabled,16,12,8 # Used in Debian
 os_auth_pam_pwquality_options: try_first_pass retry=3 authtok_type= # Used in RHEL7 and RHEL8
@@ -157,8 +159,8 @@ sysctl_config:
   # https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening#ptrace
   #
   # For applications launching crash handlers that need PTRACE, exceptions can
-  # be registered by the debugee by declaring in the segfault handler
-  # specifically which process will be using PTRACE on the debugee:
+  # be registered by the debuggee by declaring in the segfault handler
+  # specifically which process will be using PTRACE on the debuggee:
   #   prctl(PR_SET_PTRACER, debugger_pid, 0, 0, 0);
   #
   # In general, PTRACE is not needed for the average running Ubuntu system.
@@ -305,7 +307,7 @@ sysctl_config:
 
 # Do not delete the following line or otherwise the playbook will fail
 # at task 'create a combined sysctl-dict if overwrites are defined'
-sysctl_overwrite:
+sysctl_overwrite: {}
 # Disable unused filesystems
 os_unused_filesystems:
   - cramfs
@@ -331,9 +333,13 @@ os_hardening_enabled: true
 
 # Set to false to disable installing and configuring auditd.
 os_auditd_enabled: true
+os_auditd_template: etc/audit/auditd.conf.j2
 os_auditd_flush: INCREMENTAL
+os_auditd_freq: 20
 os_auditd_max_log_file: 6
 os_auditd_max_log_file_action: keep_logs
+os_auditd_write_logs: true
+os_auditd_log_file: /var/log/audit/audit.log
 os_auditd_log_format: RAW
 os_auditd_admin_space_left: 50
 os_auditd_space_left: 75
@@ -341,6 +347,7 @@ os_auditd_space_left_action: SYSLOG
 os_auditd_admin_space_left_action: SUSPEND
 os_auditd_disk_full_action: SUSPEND
 os_auditd_disk_error_action: SUSPEND
+os_auditd_action_mail_acct: root
 os_auditd_log_group: root
 os_auditd_num_logs: 5
 
@@ -350,7 +357,7 @@ os_selinux_state: enforcing
 os_selinux_policy: targeted
 
 # Mount options for proc in /etc/fstab.
-proc_mnt_options: rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}
+proc_mnt_options: rw,nosuid,nodev,noexec,relatime
 
 # Set to false to disable installing and configuring cron.
 os_cron_enabled: true

roles/os_hardening/handlers/main.yml

@@ -1,11 +1,11 @@
 ---
-- name: Update-initramfs
+- name: Update-initramfs # noqa no-changed-when
   ansible.builtin.command: update-initramfs -u
 
-- name: Restart auditd # noqa command-instead-of-module
+- name: Restart auditd # noqa command-instead-of-module no-changed-when
   ansible.builtin.command:
     cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
-  when: molecule_yml is not defined # restarting auditd in a container does not work
+  when: molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
 
 - name: Reload systemd
   ansible.builtin.systemd:

roles/os_hardening/meta/argument_specs.yml

@@ -0,0 +1,847 @@
+---
+argument_specs:
+  main:
+    short_description: The main entry point for the os hardening role.
+    version_added: 8.8.0
+    options:
+      os_desktop_enable:
+        default: false
+        type: bool
+        description: true if this is a desktop system, ie Xorg, KDE/GNOME/Unity/etc.
+      os_env_user_paths:
+        default: [/usr/local/sbin, /usr/local/bin, /usr/sbin, /usr/bin, /sbin, /bin]
+        type: list
+        description: Specify paths that should be checked for binaries where access will be minimized
+      os_env_extra_user_paths:
+        default: '[]'
+        type: list
+        description: Specify additional paths that should be checked for binaries where access will be minimized
+      os_auth_pw_max_age:
+        default: 60
+        type: int
+        description: maximum password age (set to `99999` to effectively disable it).
+      os_auth_pw_min_age:
+        default: 7
+        type: int
+        description: minimum password age (before allowing any other password change).
+      os_auth_pw_warn_age:
+        default: 7
+        type: int
+        description: number of days of warning before password expires.
+      os_auth_pw_remember:
+        default: 5
+        type: int
+        description: how many used passwords are record.
+      os_auth_retries:
+        default: 5
+        type: int
+        description: the maximum number of authentication attempts, before the account
+          is locked for some time.
+      os_auth_lockout_time:
+        default: 600
+        type: int
+        description: time in seconds that needs to pass, if the account was locked
+          due to too many failed authentication attempts.
+      os_auth_timeout:
+        default: 60
+        type: int
+        description: authentication timeout in seconds, so login will exit if this
+          time passes.
+      os_auth_allow_homeless:
+        default: false
+        type: bool
+        description: true if to allow users without home to login.
+      os_auth_pam_passwdqc_enable:
+        default: true
+        type: bool
+        description: true if you want to use strong password checking in PAM using
+          passwdqc.
+      os_auth_pam_passwdqc_options:
+        default: min=disabled,disabled,16,12,8
+        type: str
+        description: set to any option line (as a string) that you want to pass to
+          passwdqc.
+      os_auth_pam_oddjob_mkhomedir:
+        default: false
+        type: bool
+        description: Enables automatic homedir e.g. in FreeIPA environments
+      os_auth_pam_pwquality_options:
+        default: try_first_pass retry=3 authtok_type=
+        type: str
+        description: Options to pass to the PAM module pwquality
+      os_security_users_allow:
+        default: '[]'
+        type: list
+        description: list of things, that a user is allowed to do. May contain `change_user`.
+      os_security_kernel_enable_module_loading:
+        default: true
+        type: bool
+        description: true if you want to allowed to change kernel modules once the
+          system is running (eg `modprobe`, `rmmod`). WARNING - Rebuilding initramfs
+          is deprecated and will be removed in the next major release. For more information
+          take a look at this issue <https://github.com/dev-sec/ansible-collection-hardening/pull/591>
+      os_security_kernel_enable_core_dump:
+        default: false
+        type: bool
+        description: kernel is crashing or otherwise misbehaving and a kernel core
+          dump is created.
+      os_security_suid_sgid_enforce:
+        default: true
+        type: bool
+        description: true if you want to reduce SUID/SGID bits. There is already a
+          list of items which are searched for configured, but you can also add your
+          own.
+      os_security_suid_sgid_blacklist:
+        default: '[]'
+        type: list
+        description: a list of paths which should have their SUID/SGID bits removed.
+      os_security_suid_sgid_whitelist:
+        default: '[]'
+        type: list
+        description: a list of paths which should not have their SUID/SGID bits altered.
+      os_security_suid_sgid_remove_from_unknown:
+        default: false
+        type: bool
+        description: true if you want to remove SUID/SGID bits from any file, that
+          is not explicitly configured in a `blacklist`. This will make every Ansible-run
+          search through the mounted filesystems looking for SUID/SGID bits that are
+          not configured in the default and user blacklist. If it finds an SUID/SGID
+          bit, it will be removed, unless this file is in your `whitelist`.
+      os_auth_uid_min:
+        default: 1000
+        type: int
+        description: minimum number for automatic uid selection in useradd.
+      os_auth_uid_max:
+        default: 60000
+        type: int
+        description: maximum number for automatic uid selection in useradd.
+      os_auth_gid_min:
+        default: 1000
+        type: int
+        description: minimum number for automatic gid selection in groupadd.
+      os_auth_gid_max:
+        default: 60000
+        type: int
+        description: maximum number for automatic gid selection in groupadd.
+      os_auth_sub_uid_count:
+        default: 65536
+        type: int
+        description: If /etc/subuid exists, the commands useradd and newusers (unless
+          the user already have subordinate user IDs) allocate SUB_UID_COUNT unused
+          user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user. See
+          also `os_auth_sub_uid_min` and `os_auth_sub_uid_max`.
+      os_auth_sub_uid_min:
+        default: 100000
+        type: int
+        description: minimum number for automatic subordinate uid selection in useradd
+          and newusers.
+      os_auth_sub_uid_max:
+        default: 600100000
+        type: int
+        description: maximum number for automatic subordinate uid selection in useradd
+          and newusers.
+      os_auth_sub_gid_count:
+        default: 65536
+        type: int
+        description: If /etc/subuid exists, the commands useradd and newusers (unless
+          the user already have subordinate group IDs) allocate SUB_GID_COUNT unused
+          group IDs from the range SUB_GID_MIN to SUB_GID_MAX for each new user. See
+          also `os_auth_sub_gid_min` and `os_auth_sub_gid_max`.
+      os_auth_sub_gid_min:
+        default: 100000
+        type: int
+        description: minimum number for automatic subordinate gid selection in useradd
+          and newusers.
+      os_auth_sub_gid_max:
+        default: 600100000
+        type: int
+        description: maximum number for automatic subordinate gid selection in useradd
+          and newusers.
+      os_security_packages_clean:
+        default: true
+        type: bool
+        description: removes packages with known issues. See section packages.
+      os_selinux_state:
+        default: enforcing
+        type: str
+        description: Set the SELinux state, can be either disabled, permissive, or
+          enforcing.
+      os_selinux_policy:
+        default: targeted
+        type: str
+        description: Set the SELinux polixy.
+      ufw_manage_defaults:
+        default: true
+        type: bool
+        description: true means apply all settings with `ufw_` prefix.
+      ufw_ipt_sysctl:
+        default: "''"
+        type: str
+        description: by default it disables IPT_SYSCTL in /etc/default/ufw. If you
+          want to overwrite /etc/sysctl.conf values using ufw - set it to your sysctl
+          dictionary, for example `/etc/ufw/sysctl.conf`.
+      ufw_default_input_policy:
+        default: DROP
+        type: str
+        description: set default input policy of ufw to `DROP`.
+      ufw_default_output_policy:
+        default: ACCEPT
+        type: str
+        description: set default output policy of ufw to `ACCEPT`.
+      ufw_default_forward_policy:
+        default: DROP
+        type: str
+        description: set default forward policy of ufw to `DROP`.
+      ufw_enable_ipv6:
+        default: true
+        type: bool
+        description: Set to `true` to apply rules to support IPv6 (no means only IPv6
+          on loopback accepted).
+      os_auditd_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring auditd.
+      os_auditd_log_format:
+        default: RAW
+        type: str
+        description: Describes how the information should be stored on disk. There
+          are 2 options - raw and enriched.
+      os_auditd_max_log_file_action:
+        default: keep_logs
+        type: str
+        description: Defines the behaviour of auditd when its log file is filled up.
+          Possible other values are described in the auditd.conf man page. The most
+          common alternative to the default may be `rotate`.
+      os_auditd_max_log_file:
+        default: 6
+        type: int
+        description: This keyword specifies the maximum file size in megabytes. When
+          this limit is reached, it will trigger a configurable action. The value
+          given must be numeric.
+      os_auditd_num_logs:
+        default: 5
+        type: int
+        description: This keyword specifies the number of log files to keep if `rotate`
+          is given as the max_log_file_action. The value given must be numeric.
+      os_auditd_flush:
+        default: INCREMENTAL
+        type: str
+        description: Valid values are none, incremental, incremental_async, data,
+          and sync.
+      os_auditd_admin_space_left:
+        default: 50
+        type: int
+        description: This is a numeric value in megabytes that tells the audit daemon
+          when to perform a configurable action because the system is running low
+          on disk space.
+      os_auditd_admin_space_left_action:
+        default: SUSPEND
+        type: str
+        description: This parameter tells the system what action to take when the
+          system has detected that it is low on disk space. Valid values are ignore,
+          syslog, rotate, email, exec, suspend, single, and halt.
+      os_auditd_space_left:
+        default: 75
+        type: int
+        description: If the free space in the filesystem containing log_file drops
+          below this value, the audit daemon takes the action specified by space_left_action.
+      os_auditd_space_left_action:
+        default: SYSLOG
+        type: str
+        description: This parameter tells the system what action to take when the
+          system has detected that it is starting to get low on disk space. Valid
+          values are ignore, syslog, rotate, email, exec, suspend, single, and halt.
+      os_auditd_action_mail_acct:
+        default: root
+        type: str
+        description: If `space_left_action` or `admin_space_left_action` are set to
+          `email`, uses the address or alias to send the email using `/usr/lib/sendmail`.
+          of events created on one system but reported/analyzed on another system.
+      os_auditd_disk_error_action:
+        default: SUSPEND
+        type: str
+        description: This parameter tells the system what action to take whenever
+          there is an error detected when writing audit events to disk or rotating
+          logs. Valid values are ignore, syslog, exec, suspend, single, and halt.
+      os_auditd_disk_full_action:
+        default: SUSPEND
+        type: str
+        description: This parameter tells the system what action to take when the
+          system has detected that the partition to which log files are written has
+          become full. Valid values are ignore, syslog, rotate, exec, suspend, single,
+          and halt.
+      os_auditd_log_group:
+        default: root
+        type: str
+        description: specifies the group that is applied to the log file's permissions.
+          The group name can be either numeric or spelled out.
+      proc_mnt_options:
+        default: rw,nosuid,nodev,noexec,relatime
+        type: str
+        description: Mount proc with hardenized options. Note that the hidepid option
+          is set separately in vars/.
+      os_ignore_users:
+        default: [vagrant, kitchen]
+        type: list
+        description: Specify system accounts whose login should not be disabled and
+          password not changed
+      os_chmod_home_folders:
+        default: true
+        type: bool
+        description: Set to `false` to disable "chmod 700" of home folders for regular
+          users
+      os_ignore_home_folder_users:
+        default: '[]'
+        type: list
+        description: Specify user accounts, whose home folders shouldn't be chmodded
+          to 700 when "os_chmod_home_folders" is enabled.
+      os_chmod_rootuser_home_folder:
+        default: true
+        type: bool
+        description: Set to `false` to disable "chmod 700" of root's home folder
+      os_rootuser_pw_ageing:
+        default: false
+        type: bool
+        description: Set to true to enforce password age settings for root user(s)
+      os_remove_additional_root_users:
+        default: false
+        type: bool
+        description: When enabled and there are multiple users with UID=0, only "root"
+          will be kept. Others will be deleted.
+      os_user_pw_ageing:
+        default: true
+        type: bool
+        description: Set to false to disable password age enforcement on existing
+          users
+      os_users_without_password_ageing:
+        default: '[]'
+        type: list
+        description: List of users, where password ageing should not be enforced even
+          if "os_user_pw_ageing" is enabled
+      os_cron_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring cron.
+      os_ctrlaltdel_disabled:
+        default: false
+        type: bool
+        description: Set to true to disable ctrl-alt-delete key combination.
+      os_limits_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring limits.
+      os_login_defs_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring login_defs
+          for newly created users.
+      os_minimize_access_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring minimize_access.
+      os_pam_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring pam.
+      os_modprobe_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring modprobe.
+      os_profile_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring profile.
+      os_security_auto_logout:
+        default: 0
+        type: int
+        description: Set timeout in seconds for logout users automatically after time.
+          Setting this to `0` disables the timeout.
+      os_securetty_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring securetty.
+      os_sysctl_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring sysctl.
+      os_user_accounts_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring user_accounts.
+      os_rhosts_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring rhosts.
+      os_yum_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring yum.
+      os_yum_repo_file_whitelist:
+        default: '[]'
+        type: list
+        description: List of yum repository files under /etc/yum.repos.d/ which should
+          not be altered.
+      os_apt_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring apt.
+      os_selinux_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring selinux.
+      os_sha_crypt_min_rounds:
+        default: 640000
+        type: int
+        description: Define the number of minimum SHA rounds. With a lot of rounds
+          brute forcing the password is more difficult. But note also that it more
+          CPU resources will be needed to authenticate users. The values must be inside
+          the 1000-999999999 range.
+      os_sha_crypt_max_rounds:
+        default: 640000
+        type: int
+        description: Define the number of maximum SHA rounds. With a lot of rounds
+          brute forcing the password is more difficult. But note also that it more
+          CPU resources will be needed to authenticate users. The values must be inside
+          the 1000-999999999 range.
+      os_mnt_boot_dir_mode:
+        default: '0700'
+        type: str
+        description: Set default perimissions for /boot
+      os_mnt_boot_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /boot mountpoint
+      os_mnt_boot_src:
+        default: "''"
+        type: str
+        description: Set mount source for /boot
+      os_mnt_boot_options:
+        default: rw,nosuid,nodev,noexec
+        description: Configure mount options for /boot
+      os_mnt_boot_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /boot. If empty, the current
+          file system type will be used.
+      os_mnt_boot_dump:
+        default: ext3 + ext4 = 1 / other = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_boot_passno:
+        default: ext3 + ext4 = 2 / other = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_dev_dir_mode:
+        default: '0755'
+        type: str
+        description: Set default perimissions for /dev
+      os_mnt_dev_enabled:
+        default: true
+        type: bool
+        description: Set to false to ignore /dev mountpoint
+      os_mnt_dev_src:
+        default: devtmpfs
+        type: str
+        description: Set mount source for /dev
+      os_mnt_dev_options:
+        default: rw,nosuid,noexec
+        type: str
+        description: Configure mount options for /dev
+      os_mnt_dev_filesystem:
+        default: devtmpfs
+        type: str
+        description: Configure file system for fstab entry /dev
+      os_mnt_dev_dump:
+        default: '0'
+        type: str
+        description: Configure dump for fstab entry /var/tmp.
+      os_mnt_dev_passno:
+        default: '0'
+        type: str
+        description: Configure passno for fstab entry /var/tmp.
+      os_mnt_dev_shm_dir_mode:
+        default: '1777'
+        type: str
+        description: Set default perimissions for /dev/shm
+      os_mnt_dev_shm_enabled:
+        default: true
+        type: bool
+        description: Set to false to ignore /dev/shm mountpoint
+      os_mnt_dev_shm_src:
+        default: tmpfs
+        type: str
+        description: Set mount source for /dev/shm
+      os_mnt_dev_shm_options:
+        default: rw,nosuid,nodev,noexec
+        type: str
+        description: Configure mount options for /dev/shm
+      os_mnt_dev_shm_filesystem:
+        default: tmpfs
+        type: str
+        description: Configure file system for fstab entry /dev/shm
+      os_mnt_dev_shm_dump:
+        default: '0'
+        type: str
+        description: Configure dump for fstab entry /var/tmp.
+      os_mnt_dev_shm_passno:
+        default: '0'
+        type: str
+        description: Configure passno for fstab entry /var/tmp.
+      os_mnt_home_dir_mode:
+        default: '0755'
+        type: str
+        description: Set default perimissions for /home
+      os_mnt_home_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /home mountpoint
+      os_mnt_home_src:
+        default: "''"
+        type: str
+        description: Set mount source for /home. If empty, the current file system
+          source device will be used.
+      os_mnt_home_options:
+        default: rw,nosuid,nodev
+        type: str
+        description: Configure mount options for /home
+      os_mnt_home_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /home. If empty, the current
+          file system type will be used.
+      os_mnt_home_dump:
+        default: ext3/4 = 1, others = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_home_passno:
+        default: ext3/4 = 2, others = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_run_dir_mode:
+        default: '0755'
+        type: str
+        description: Set default perimissions for /run
+      os_mnt_run_enabled:
+        default: true
+        type: bool
+        description: Set to false to ignore /run mountpoint
+      os_mnt_run_src:
+        default: tmpfs
+        type: str
+        description: Set mount source for /run
+      os_mnt_run_options:
+        default: rw,nosuid,nodev
+        type: str
+        description: Configure mount options for /run
+      os_mnt_run_filesystem:
+        default: tmpfs
+        type: str
+        description: Configure file system for fstab entry /run
+      os_mnt_run_dump:
+        default: '0'
+        type: str
+        description: Configure dump for fstab entry /var/tmp.
+      os_mnt_run_passno:
+        default: '0'
+        type: str
+        description: Configure passno for fstab entry /var/tmp.
+      os_mnt_tmp_dir_mode:
+        default: '1777'
+        type: str
+        description: Set default perimissions for /tmp
+      os_mnt_tmp_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /tmp mountpoint
+      os_mnt_tmp_src:
+        default: "''"
+        type: str
+        description: Set mount source for /tmp. If empty, the current file system
+          source device will be used.
+      os_mnt_tmp_options:
+        default: rw,nosuid,nodev,noexec
+        type: str
+        description: Configure mount options for /tmp
+      os_mnt_tmp_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /tmp. If empty, the current
+          file system type will be used.
+      os_mnt_tmp_dump:
+        default: ext3/4 = 1, others = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_tmp_passno:
+        default: ext3/4 = 2, others = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_dir_mode:
+        default: '0755'
+        type: str
+        description: Set default perimissions for /var
+      os_mnt_var_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /var mountpoint
+      os_mnt_var_src:
+        default: "''"
+        type: str
+        description: Set mount source for /var. If empty, the current file system
+          source device will be used.
+      os_mnt_var_options:
+        default: rw,nosuid,nodev
+        type: str
+        description: Configure mount options for /var
+      os_mnt_var_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /var. If empty, the current
+          file system type will be used.
+      os_mnt_var_dump:
+        default: ext3/4 = 1, others = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_passno:
+        default: ext3/4 = 2, others = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_log_dir_mode:
+        default: '0755'
+        type: str
+        description: Set default perimissions for /var/log
+      os_mnt_var_log_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /var/log mountpoint
+      os_mnt_var_log_src:
+        default: "''"
+        type: str
+        description: Set mount source for /var/log. If empty, the current file system
+          source device will be used.
+      os_mnt_var_log_options:
+        default: rw,nosuid,nodev,noexec
+        type: str
+        description: Configure mount options for /var/log
+      os_mnt_var_log_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /var/log. If empty, the
+          current file system type will be used.
+      os_mnt_var_log_dump:
+        default: ext3/4 = 1, others = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_log_passno:
+        default: ext3/4 = 2, others = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_log_audit_dir_mode:
+        default: '0640'
+        type: str
+        description: Set default perimissions for /var/log/audit
+      os_mnt_var_log_audit_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /var/log/audit mountpoint
+      os_mnt_var_log_audit_src:
+        default: "''"
+        type: str
+        description: Set mount source for /var/log/audit. If empty, the current file
+          system source device will be used.
+      os_mnt_var_log_audit_options:
+        default: rw,nosuid,nodev,noexec
+        type: str
+        description: Configure mount options for /var/log/audit
+      os_mnt_var_log_audit_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /var/log/audit. If empty,
+          the current file system type will be used.
+      os_mnt_var_log_audit_dump:
+        default: ext3/4 = 1, others = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_log_audit_passno:
+        default: ext3/4 = 2, others = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_tmp_dir_mode:
+        default: '1777'
+        type: str
+        description: Set default perimissions for /var/tmp
+      os_mnt_var_tmp_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /var/tmp mountpoint
+      os_mnt_var_tmp_src:
+        default: "''"
+        type: str
+        description: Set mount source for /var/tmp. If empty, the current file system
+          source device will be used.
+      os_mnt_var_tmp_options:
+        default: rw,nosuid,nodev,noexec
+        type: str
+        description: Configure mount options for /var/tmp
+      os_mnt_var_tmp_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /var/tmp. If empty, the
+          current file system type will be used.
+      os_mnt_var_tmp_dump:
+        default: ext3/4 = 1, others = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_tmp_passno:
+        default: ext3/4 = 2, others = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_netrc_enabled:
+        default: true
+        type: bool
+        description: Configure filesystem for existence of .netrc file in homedir
+      os_netrc_whitelist_user:
+        default: '[]'
+        type: list
+        description: Add list of user to allow creation of .netrc in users homedir
+      sysctl_overwrite:
+        default: '{}'
+        type: dict
+        description: To overwrite options in the `sysctl_config`-dict, overwrite them
+          here.
+      sysctl_config:
+        type: dict
+        description: various sysctl-settings
+        default:
+          fs.protected_hardlinks: 1
+          fs.protected_symlinks: 1
+          fs.protected_fifos: 1
+          fs.protected_regular: 2
+          fs.suid_dumpable: 0
+          kernel.core_uses_pid: 1
+          kernel.kptr_restrict: 2
+          kernel.kexec_load_disabled: 1
+          kernel.sysrq: 0
+          kernel.randomize_va_space: 2
+          kernel.yama.ptrace_scope: 1
+          net.ipv4.ip_forward: 0
+          net.ipv6.conf.all.forwarding: 0
+          net.ipv4.conf.all.rp_filter: 1
+          net.ipv4.conf.default.rp_filter: 1
+          net.ipv4.icmp_echo_ignore_broadcasts: 1
+          net.ipv4.icmp_ignore_bogus_error_responses: 1
+          net.ipv4.icmp_ratelimit: 100
+          net.ipv4.icmp_ratemask: 88089
+          net.ipv4.tcp_timestamps: 0
+          net.ipv4.conf.all.arp_ignore: 1
+          net.ipv4.conf.all.arp_announce: 2
+          net.ipv4.tcp_rfc1337: 1
+          net.ipv4.tcp_syncookies: 1
+          net.ipv4.conf.all.shared_media: 1
+          net.ipv4.conf.default.shared_media: 1
+          net.ipv4.conf.all.accept_source_route: 0
+          net.ipv4.conf.default.accept_source_route: 0
+          net.ipv6.conf.all.accept_source_route: 0
+          net.ipv6.conf.default.accept_source_route: 0
+          net.ipv4.conf.all.send_redirects: 0
+          net.ipv4.conf.default.send_redirects: 0
+          net.ipv4.conf.all.log_martians: 1
+          net.ipv4.conf.default.log_martians: 1
+          net.ipv4.conf.default.accept_redirects: 0
+          net.ipv4.conf.all.accept_redirects: 0
+          net.ipv4.conf.all.secure_redirects: 0
+          net.ipv4.conf.default.secure_redirects: 0
+          net.ipv6.conf.default.accept_redirects: 0
+          net.ipv6.conf.all.accept_redirects: 0
+          net.ipv6.conf.all.accept_ra: 0
+          net.ipv6.conf.default.accept_ra: 0
+          net.ipv6.conf.default.router_solicitations: 0
+          net.ipv6.conf.all.router_solicitations: 0
+          net.ipv6.conf.default.accept_ra_rtr_pref: 0
+          net.ipv6.conf.default.accept_ra_pinfo: 0
+          net.ipv6.conf.default.accept_ra_defrtr: 0
+          net.ipv6.conf.default.autoconf: 0
+          net.ipv6.conf.all.autoconf: 0
+          net.ipv6.conf.default.dad_transmits: 0
+          net.ipv6.conf.default.max_addresses: 1
+          vm.mmap_min_addr: 65536
+          vm.mmap_rnd_bits: 32
+          vm.mmap_rnd_compat_bits: 16
+      os_unused_filesystems:
+        default:
+          - cramfs
+          - freevxfs
+          - jffs2
+          - hfs
+          - hfsplus
+          - squashfs
+          - udf
+          - vfat
+          - dccp
+          - rds
+          - sctp
+          - tipc
+        type: list
+        description: Disable this list of unused filesystems
+      os_filesystem_whitelist:
+        default: '[]'
+        type: list
+        description: A list of filesystems that should not be disabled
+      os_hardening_enabled:
+        default: true
+        type: bool
+        description: Whether to run the hardening
+      os_auth_root_ttys:
+        default: [console, tty1, tty2, tty3, tty4, tty5, tty6]
+        type: list
+        description: A list of TTYs, from which root can log in, see `man securetty`
+          for reference
+      os_chfn_restrict:
+        default: "''"
+        type: str
+        description: Indicate which fields are changeable by chfn.
+      os_security_init_prompt:
+        default: true
+        type: bool
+        description: The PROMPT option provides console users the ability to interactively
+          boot the system and select which services to start on boot.
+      os_security_init_single:
+        default: false
+        type: bool
+        description: Single-user mode is intended as a system recovery method, providing
+          a single user root access to the system by providing a boot option at startup.
+          By default, no authentication is performed if single-user mode is selected.
+          To require entry of the root password even if the system is started in single-user
+          mode, set this to false
+      os_security_packages_list:
+        default: [xinetd, inetd, ypserv, telnet-server, rsh-server, prelink]
+        type: list
+        description: List of deprecated or insecure packages to remove
+      ufw_default_application_policy:
+        default: SKIP
+        type: str
+        description: The default application policy is skip, which means that the
+          update --add-new command will do nothing
+      ufw_ipt_modules:
+        default: nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns
+        type: str
+        description: Define which netfilter modules to load
+      ufw_manage_builtins:
+        default: 'no'
+        type: str
+        description: If this variable is set to 'yes', on stop and reload the built-in
+          chains are flushed. If it is set to 'no', on stop and reload the ufw secondary
+          chains are removed and the ufw primary chains are flushed

roles/os_hardening/meta/main.yml

@@ -4,12 +4,13 @@ galaxy_info:
   description: This Ansible role provides numerous security-related ssh configurations, providing all-round base protection.
   company: Hardening Framework Team
   license: Apache License 2.0
-  min_ansible_version: 2.9.10
+  min_ansible_version: "2.11"
   platforms:
     - name: EL
       versions:
         - "7"
         - "8"
+        - "9"
     - name: Ubuntu
       versions:
         - bionic

roles/os_hardening/tasks/auditd.yml

@@ -7,7 +7,7 @@
 
 - name: Configure auditd | package-08
   ansible.builtin.template:
-    src: etc/audit/auditd.conf.j2
+    src: "{{ os_auditd_template }}"
     dest: /etc/audit/auditd.conf
     owner: root
     group: root

roles/os_hardening/tasks/hardening.yml

@@ -1,4 +1,10 @@
 ---
+- name: Gather facts, if not present
+  ansible.builtin.setup:
+  when: not ansible_facts
+  tags:
+    - always
+
 - name: Fetch OS dependent variables
   ansible.builtin.include_vars:
     file: "{{ item }}"

roles/os_hardening/tasks/limits.yml

@@ -18,6 +18,7 @@
         limit_item: core
         value: "0"
         comment: Prevent core dumps for all users. These are usually not needed and may contain sensitive information
+      when: not ansible_check_mode  # the directory needs to be created first, which does not happen in check_mode
 
     - name: Set 10.hardcore.conf perms to 0400 and root ownership
       ansible.builtin.file:
@@ -34,7 +35,7 @@
         path: /etc/systemd/coredump.conf.d
         owner: root
         group: root
-        mode: 0755
+        mode: "0755"
         state: directory
       when: ansible_service_mgr == "systemd"
 
@@ -44,7 +45,7 @@
         dest: /etc/systemd/coredump.conf.d/custom.conf
         owner: root
         group: root
-        mode: 0644
+        mode: "0644"
       when: ansible_service_mgr == "systemd"
       notify: Reload systemd
 

roles/os_hardening/tasks/minimize_access.yml

@@ -7,12 +7,7 @@
 - name: Find files with write-permissions for group # noqa command-instead-of-shell
   ansible.builtin.shell: find -L {{ item }} -perm /go+w -type f
   with_community.general.flattened:
-    - /usr/local/sbin
-    - /usr/local/bin
-    - /usr/sbin
-    - /usr/bin
-    - /sbin
-    - /bin
+    - "{{ os_env_user_paths }}"
     - "{{ os_env_extra_user_paths }}"
   register: minimize_access_directories
   ignore_errors: true
@@ -73,12 +68,23 @@
     mode: "0750"
   when: '"change_user" not in os_security_users_allow'
 
+# we have to define this combined variable here, because when defining it
+# in the defaults like this:
+# proc_mnt_options: rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}
+# the role argument validator complains about the missing hidepid_option-variable.
+# If we define the hidepid_option-variable in the defaults, we cannot
+# overwrite it anymore in the vars (for some reason).
+
+- name: Define proc_mnt_options including hidepid_option
+  ansible.builtin.set_fact:
+    _proc_mnt_options: "{{ proc_mnt_options }},hidepid={{ hidepid_option }}"
+
 - name: Set option hidepid for proc filesystem
   ansible.posix.mount:
     path: /proc
     src: proc
     fstype: proc
-    opts: "{{ proc_mnt_options }}"
+    opts: "{{ _proc_mnt_options }}"
     state: mounted
 
 - name: Generate list of current available mounted filesystems on the system
@@ -87,7 +93,7 @@
 
 - name: Append special devices list to valid mountpoint list
   ansible.builtin.set_fact:
-    mountpoints_list: "{{ mountpoints_list + ['/dev', '/dev/shm', '/run'] }}"
+    mountpoints_list: "{{ mountpoints_list + ['/dev', '/dev/shm', '/run', '/tmp'] }}"
 
 - name: Minimize access for filesystems
   ansible.builtin.include_tasks: minimize_access_fs.yml

roles/os_hardening/tasks/suid_sgid.yml

@@ -15,6 +15,7 @@
   register: sbit_binaries
   when: os_security_suid_sgid_remove_from_unknown | bool
   changed_when: false
+  check_mode: false
 
 - name: Gather files from which to remove suids/sgids and remove system white-listed files | os-06
   ansible.builtin.set_fact:

roles/os_hardening/tasks/user_accounts.yml

@@ -3,7 +3,9 @@
   ansible.builtin.getent:
     database: passwd
     # creates a dict for each user containing UID/HOMEDIR etc...
-  when: getent_passwd is undefined # skip this task if "getent" has run before
+  # skip this task if getent was run before without specifying a key (single entry)
+  when: getent_passwd is undefined or
+        getent_passwd | length <= 1
 
 - name: Read local linux shadow database
   ansible.builtin.getent:
@@ -51,7 +53,7 @@
 
 - name: Set ownership of root user home directory(s) to 0700
   ansible.builtin.file:
-    mode: 0700
+    mode: "0700"
     owner: "{{ item }}"
     path: "{{ getent_passwd[item][4] }}"
     state: directory
@@ -98,7 +100,7 @@
 
 - name: Limit access to home directories of regular (non-system, non-root) accounts
   ansible.builtin.file:
-    mode: 0700
+    mode: "0700"
     owner: "{{ item }}"
     path: "{{ getent_passwd[item][4] }}"
     state: directory

roles/os_hardening/templates/etc/audit/auditd.conf.j2

@@ -1,12 +1,13 @@
 {{ ansible_managed | comment }}
 # Generated by Ansible role {{ ansible_role_name }}
 
-log_file = /var/log/audit/audit.log
+write_logs = {{ os_auditd_write_logs | bool | ternary('yes', 'no') }}
+log_file = {{ os_auditd_log_file }}
 log_format = {{ os_auditd_log_format }}
 log_group = {{ os_auditd_log_group }}
 priority_boost = 4
 flush = {{ os_auditd_flush }}
-freq = 20
+freq = {{ os_auditd_freq }}
 num_logs = {{ os_auditd_num_logs }}
 disp_qos = lossy
 dispatcher = /sbin/audispd
@@ -15,7 +16,7 @@ max_log_file = {{ os_auditd_max_log_file }}
 max_log_file_action = {{ os_auditd_max_log_file_action }}
 space_left = {{ os_auditd_space_left }}
 space_left_action = {{ os_auditd_space_left_action }}
-action_mail_acct = root
+action_mail_acct = {{ os_auditd_action_mail_acct }}
 admin_space_left = {{ os_auditd_admin_space_left }}
 admin_space_left_action = {{ os_auditd_admin_space_left_action }}
 disk_full_action = {{ os_auditd_disk_full_action }}

roles/os_hardening/templates/etc/login.defs.j2

@@ -136,7 +136,7 @@ SUB_GID_MIN       {{ os_auth_sub_gid_min }}
 SUB_GID_MAX       {{ os_auth_sub_gid_max }}
 SUB_GID_COUNT     {{ os_auth_sub_gid_count }}
 
-# Max number of login retries if password is bad. This will most likely be overriden by PAM, since the default pam_unix module has it's own built in of 3 retries. However, this is a safe fallback in case you are using an authentication module that does not enforce PAM_MAXTRIES.
+# Max number of login retries if password is bad. This will most likely be overridden by PAM, since the default pam_unix module has it's own built in of 3 retries. However, this is a safe fallback in case you are using an authentication module that does not enforce PAM_MAXTRIES.
 LOGIN_RETRIES     {{ os_auth_retries }}
 
 # Max time in seconds for login
@@ -155,7 +155,7 @@ DEFAULT_HOME      {{ 'yes' if os_auth_allow_homeless else 'no' }}
 # the user to be removed (passed as the first argument).
 #USERDEL_CMD       /usr/sbin/userdel_local
 
-# Instead of the real user shell, the program specified by this parameter will be launched, although its visible name (`argv[0]`) will be the shell's. The program may do whatever it wants (logging, additional authentification, banner, ...) before running the actual shell.
+# Instead of the real user shell, the program specified by this parameter will be launched, although its visible name (`argv[0]`) will be the shell's. The program may do whatever it wants (logging, additional authentication, banner, ...) before running the actual shell.
 #FAKE_SHELL        /bin/fakeshell
 
 # If defined, either full pathname of a file containing device names or a ":" delimited list of device names.  Root logins will be allowed only upon these devices.
@@ -189,7 +189,7 @@ SHA_CRYPT_MAX_ROUNDS    {{ os_sha_crypt_max_rounds }}
 
 # Obsoleted by PAM
 # ================
-# These options are now handled by PAM. Please edit the appropriate file in `/etc/pam.d/` to enable the equivelants of them.
+# These options are now handled by PAM. Please edit the appropriate file in `/etc/pam.d/` to enable their equivalents.
 #MOTD_FILE
 #DIALUPS_CHECK_ENAB
 #LASTLOG_ENAB

roles/os_hardening/templates/etc/pam.d/rhel_auth.j2

@@ -47,6 +47,9 @@ password    required      pam_deny.so
 session     optional      pam_keyinit.so revoke
 session     required      pam_limits.so
 -session    optional      pam_systemd.so
+{% if (os_auth_pam_oddjob_mkhomedir | bool) %}
+session     optional      pam_oddjob_mkhomedir.so
+{% endif %}
 session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
 session     required      pam_unix.so
 {% if (os_auth_pam_sssd_enable | bool) %}

roles/os_hardening/vars/Amazon.yml

@@ -81,6 +81,6 @@ os_useradd_create_home: true
 modprobe_package: module-init-tools
 auditd_package: audit
 
-# system accounts that do not get their login disabled and pasword changed
+# system accounts that do not get their login disabled and password changed
 os_always_ignore_users: [root, sync, shutdown, halt, ec2-user]
 hidepid_option: "2" # allowed values: 0, 1, 2

roles/os_hardening/vars/Suse.yml

@@ -79,3 +79,6 @@ modprobe_package: kmod-compat
 auditd_package: audit
 
 hidepid_option: "2" # allowed values: 0, 1, 2
+
+sysctl_unsupported_entries:
+  - kernel.yama.ptrace_scope  # SuSE has disabled yama by default - https://bugzilla.suse.com/show_bug.cgi?id=1128245

roles/os_hardening/vars/main.yml

@@ -108,5 +108,5 @@ os_security_suid_sgid_system_whitelist:
   - /usr/lib/libvte9/gnome-pty-helper # gnome
   - /usr/lib/libvte-2.90-9/gnome-pty-helper # gnome
 
-# system accounts that do not get their login disabled and pasword changed
+# system accounts that do not get their login disabled and password changed
 os_always_ignore_users: [root, sync, shutdown, halt]

roles/ssh_hardening/CHANGELOG.md

@@ -195,7 +195,7 @@
 - SFTP: set default umask to 0027 [\#252](https://github.com/dev-sec/ansible-ssh-hardening/pull/252) ([Slamdunk](https://github.com/Slamdunk))
 - Separate PermitUserEnviroment from AcceptEnv [\#251](https://github.com/dev-sec/ansible-ssh-hardening/pull/251) ([szEvEz](https://github.com/szEvEz))
 - Feature: Debian 10 \(Buster\) support [\#249](https://github.com/dev-sec/ansible-ssh-hardening/pull/249) ([jaredledvina](https://github.com/jaredledvina))
-- fix broken packages, extend README with furhter development instructions [\#246](https://github.com/dev-sec/ansible-ssh-hardening/pull/246) ([szEvEz](https://github.com/szEvEz))
+- fix broken packages, extend README with further development instructions [\#246](https://github.com/dev-sec/ansible-ssh-hardening/pull/246) ([szEvEz](https://github.com/szEvEz))
 - refactor authenticationmethod settings, allow user to set authenticat… [\#245](https://github.com/dev-sec/ansible-ssh-hardening/pull/245) ([szEvEz](https://github.com/szEvEz))
 - RHEL/OL/CentOS 8 support [\#242](https://github.com/dev-sec/ansible-ssh-hardening/pull/242) ([Furragen](https://github.com/Furragen))
 - Added ssh_syslog_facility, ssh_log_level and ssh_strict_modes parameters [\#240](https://github.com/dev-sec/ansible-ssh-hardening/pull/240) ([bschonec](https://github.com/bschonec))

roles/ssh_hardening/README.md

@@ -1,6 +1,8 @@
 # dev-sec.ssh_hardening
 
-![devsec.ssh_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.ssh_hardening/badge.svg)
+[![devsec.ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml)
+[![devsec.ssh_hardening BSD](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml)
+[![devsec.ssh_hardening with custom tests](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml)
 
 ## Description
 
@@ -8,250 +10,441 @@ This role provides secure ssh-client and ssh-server configurations. It is intend
 
 Warning: This role disables root-login on the target server! Please make sure you have another user with su or sudo permissions that can login into the server.
 
-## Requirements
+<!-- BEGIN_ANSIBLE_DOCS -->
 
-- Ansible >= 2.9
-- root-privileges on the target system
+## Supported Operating Systems
 
-As this role requires root-privileges, we added `become: true` to all tasks. So please make sure you run the role as root or as a user with become-privileges.
+- EL
+  - 7, 8, 9
+- Ubuntu
+  - bionic, focal, jammy
+- Debian
+  - buster, bullseye
+- Amazon
+- Fedora
+- ArchLinux
+- SmartOS
+- FreeBSD
+  - 12.2
+- OpenBSD
+  - 7.0
 
 ## Role Variables
 
 - `network_ipv6_enable`
   - Default: `true`
-  - Description: false if IPv6 is not needed. `ssh_listen_to` must also be set to listen to IPv6 addresses (for example `[::]`).
-- `ssh_client_config_file`
-  - Default: `'/etc/ssh/ssh_config'`
-  - Description: path of the ssh client configuration file, e.g. `/etc/ssh/ssh_config.d/custom.conf`.
-- `ssh_server_config_file`
-  - Default: `'/etc/ssh/sshd_config'`
-  - Description: path of the ssh server configuration file, e.g. `/etc/ssh/sshd_config.d/custom.conf`.
-- `ssh_server_ports`
-  - Default: `['22']`
-  - Description: ports on which ssh-server should listen.
-- `ssh_client_port`
-  - Default: `'22'`
-  - Description: Specifies the port number to connect on the remote host.
-- `ssh_listen_to`
-  - Default: `['0.0.0.0']`
-  - Description: one or more ip addresses, to which ssh-server should listen to. Default is all IPv4 adresses, but should be configured to specific addresses for security reasons!
-- `ssh_host_key_files`
-  - Default: `[]`
-  - Description: Host keys for sshd. If empty ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key', '/etc/ssh/ssh_host_ed25519_key'] will be used, as far as supported by the installed sshd version.
-- `ssh_host_rsa_key_size`
-  - Default: `4096`
-  - Description: Specifies the number of bits in the private host RSA key to create.
-- `ssh_host_key_algorithms`
-  - Default: `[]`
-  - Description: Host key algorithms that the server offers. If empty the default list will be used. Otherwise overrides the setting with specified list of algorithms. Check `man sshd_config`, `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make sure you check the correct version!
-- `ssh_client_host_key_algorithms`
-  - Default: `[]`
-  - Description: Specifies the host key algorithms that the client wants to use in order of preference. If empty the default list will be used. Otherwise overrides the setting with specified list of algorithms. Check `man ssh_config`, `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make sure you check the correct version!.
-- `ssh_client_alive_interval`
-  - Default: `600`
-  - Description: specifies an interval for sending keepalive messages.
-- `ssh_client_alive_count`
-  - Default: `3`
-  - Description: Defines the number of acceptable unanswered client alive messages before disconnecting clients.
-- `ssh_permit_tunnel`
-  - Default: `false`
-  - Description: true if SSH Port Tunneling is required.
-- `ssh_remote_hosts`
-  - Default: `[]`
-  - Description: one or more hosts and their custom options for the ssh-client. Default is empty. See examples in `defaults/main.yml`.
-- `ssh_permit_root_login`
-  - Default: `no`
-  - Description: Disable root-login. Set to `'without-password'` or `'yes'` to enable root-login - The quotes are required!
-- `ssh_allow_tcp_forwarding`
-  - Default: `no`
-  - Description: `'no'` or `False` to disable TCP Forwarding. Set to `'yes'` or `True` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all'`, `'local'`or`'remote'`.
-- `ssh_gateway_ports`
-  - Default: `false`
-  - Description: `false` to disable binding forwarded ports to non-loopback addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified` to allow the client to specify which address to bind to.
-- `ssh_allow_agent_forwarding`
-  - Default: `false`
-  - Description: false to disable Agent Forwarding. Set to true to allow Agent Forwarding.
-- `ssh_x11_forwarding`
-  - Default: `false`
-  - Description: false to disable X11 Forwarding. Set to true to allow X11 Forwarding.
-- `ssh_pam_support`
-  - Default: `true`
-  - Description: true if SSH has PAM support.
-- `ssh_use_pam`
-  - Default: `true`
-  - Description: false to disable pam authentication.
-- `ssh_gssapi_support`
-  - Default: `false`
-  - Description: Set to true to enable GSSAPI authentication (both client and server).
-- `ssh_gssapi_delegation`
-  - Default: `false`
-  - Description: Set to true to enable GSSAPI credential forwarding.
-- `ssh_kerberos_support`
-  - Default: `true`
-  - Description: true if SSH has Kerberos support.
-- `ssh_deny_users`
-  - Default: `''`
-  - Description: if specified, login is disallowed for user names that match one of the patterns.
-- `ssh_allow_users`
-  - Default: `''`
-  - Description: if specified, login is allowed only for user names that match one of the patterns.
-- `ssh_deny_groups`
-  - Default: `''`
-  - Description: if specified, login is disallowed for users whose primary group or supplementary group list matches one of the patterns.
-- `ssh_allow_groups`
-  - Default: `''`
-  - Description: if specified, login is allowed only for users whose primary group or supplementary group list matches one of the patterns.
-- `ssh_authorized_keys_file`
-  - Default: `''`
-  - Description: change default file that contains the public keys that can be used for user authentication.
-- `ssh_trusted_user_ca_keys_file`
-  - Default: `''`
-  - Description: specifies the file containing trusted certificate authorities public keys used to sign user certificates.
-- `ssh_trusted_user_ca_keys`
-  - Default: `[]`
-  - Description: set the trusted certificate authorities public keys used to sign user certificates. Only used if `ssh_trusted_user_ca_keys_file` is set.
-- `ssh_authorized_principals_file`
-  - Default: `''`
-  - Description: specifies the file containing principals that are allowed. Only used if `ssh_trusted_user_ca_keys_file` is set.
-- `ssh_authorized_principals`
-  - Default: `[]`
-  - Description: list of hashes containing file paths and authorized principals, see `default_custom.yml` for all options. Only used if `ssh_authorized_principals_file` is set.
-- `ssh_print_motd`
-  - Default: `false`
-  - Description: false to disable printing of the MOTD.
-- `ssh_print_pam_motd`
-  - Default: `false`
-  - Description: false to disable printing of the MOTD via pam (Debian and Ubuntu).
-- `ssh_print_last_log`
-  - Default: `false`
-  - Description: false to disable display of last login information.
-- `sftp_enabled`
-  - Default: `true`
-  - Description: false to disable sftp configuration.
-- `sftp_umask`
-  - Default: `'0027'`
-  - Description: Specifies the umask for sftp.
+  - Description: `false` if IPv6 is not needed. `ssh_listen_to` must also be set to listen to IPv6 addresses (for example `[::]`).
+  - Type: bool
+  - Required: no
 - `sftp_chroot`
   - Default: `true`
-  - Description: false to disable chroot for sftp.
+  - Description: Set to `false` to disable chroot for sftp.
+  - Type: bool
+  - Required: no
 - `sftp_chroot_dir`
   - Default: `/home/%u`
-  - Description: change default sftp chroot location.
-- `ssh_client_roaming`
+  - Description: change default stp chroot location
+  - Type: str
+  - Required: no
+- `sftp_enabled`
+  - Default: `true`
+  - Description: Set to `false` to disable sftp configuration.
+  - Type: bool
+  - Required: no
+- `sftp_umask`
+  - Default: `0027`
+  - Description: Specifies the umask for sftp.
+  - Type: str
+  - Required: no
+- `ssh_allow_agent_forwarding`
   - Default: `false`
-  - Description: enable experimental client roaming.
-- `sshd_moduli_file`
-  - Default: `'/etc/ssh/moduli'`
-  - Description: path to the SSH moduli file.
-- `sshd_moduli_minimum`
-  - Default: `2048`
-  - Description: remove Diffie-Hellman parameters smaller than the defined size to mitigate logjam.
+  - Description: Set to `false` to disable Agent Forwarding. Set to `true` to allow Agent Forwarding.
+  - Type: bool
+  - Required: no
+- `ssh_allow_groups`
+  - Default: ``
+  - Description: if specified, login is allowed only for users whose primary group or supplementary group list matches one of the patterns.
+  - Type: str
+  - Required: no
+- `ssh_allow_tcp_forwarding`
+  - Default: `no`
+  - Description: Set to `'no'` or `false` to disable TCP Forwarding. Set to `'yes'` or`True` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all'`, `'local'`or`'remote'`.
+  - Type: str
+  - Required: no
+- `ssh_allow_users`
+  - Default: ``
+  - Description: if specified, login is allowed only for user names that match one of the patterns.
+  - Type: str
+  - Required: no
+- `ssh_authorized_keys_file`
+  - Default: ``
+  - Description: change default file that contains the public keys that can be used for user authentication
+  - Type: str
+  - Required: no
+- `ssh_authorized_principals`
+  - Default: ``
+  - Description: list of hashes containing file paths and authorized principals, see `default_cstom.yml` for all options. Only used if `ssh_authorized_principals_file` is set
+  - Type: list
+  - Required: no
+- `ssh_authorized_principals_file`
+  - Default: ``
+  - Description: specifies the file containing principals that are allowed. Only used if `ssh_trusted_user_ca_keys_file` is set.
+  - Type: str
+  - Required: no
+- `ssh_banner`
+  - Default: `false`
+  - Description: Set to `true` to print a banner on login.
+  - Type: bool
+  - Required: no
+- `ssh_banner_path`
+  - Default: `/etc/sshd/banner.txt`
+  - Description: path to the SSH banner file.
+  - Type: str
+  - Required: no
 - `ssh_challengeresponseauthentication`
   - Default: `false`
   - Description: Specifies whether challenge-response authentication is allowed (e.g. via PAM).
-- `ssh_client_password_login`
-  - Default: `false`
-  - Description: `true` to allow password-based authentication with the ssh client.
-- `ssh_server_password_login`
-  - Default: `false`
-  - Description: `true` to allow password-based authentication to the ssh server. You probably also need to change `sshd_authenticationmethods` to include `password` if you set `ssh_server_password_login`: `true`.
-- `ssh_banner`
-  - Default: `false`
-  - Description: `true` to print a banner on login.
-- `ssh_banner_path`
-  - Default: `'/etc/sshd/banner.txt'`
-  - Description: path to the SSH banner file.
-- `ssh_client_hardening`
-  - Default: `true`
-  - Description: `false` to stop harden the client.
+  - Type: bool
+  - Required: no
+- `ssh_ciphers`
+  - Default: ``
+  - Description: Change this list to overwrite ciphers. Defaults found in `defaults/main.yml`
+  - Type: list
+  - Required: no
+- `ssh_client_alive_count`
+  - Default: `3`
+  - Description: Defines the number of acceptable unanswered client alive messages before disconnecting clients.
+  - Type: int
+  - Required: no
+- `ssh_client_alive_interval`
+  - Default: `300`
+  - Description: specifies an interval for sending keepalive messages.
+  - Type: int
+  - Required: no
 - `ssh_client_compression`
   - Default: `false`
   - Description: Specifies whether the client requests compression.
+  - Type: bool
+  - Required: no
+- `ssh_client_config_file`
+  - Default: `/etc/ssh/ssh_config`
+  - Description: path of the ssh client configuration file, e.g. `/etc/ssh/ssh_config.d/custom.conf`.
+  - Type: str
+  - Required: no
+- `ssh_client_hardening`
+  - Default: `true`
+  - Description: Set to `false` to stop harden the client.
+  - Type: bool
+  - Required: no
+- `ssh_client_host_key_algorithms`
+  - Default: ``
+  - Description: Specifies the host key algorithms that the client wants to use in order of preference. If empty the default list will be used. Otherwise overrides the setting with specified list of algorithms. Check `man ssh_config`, `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make sure you check the correct version!
+  - Type: list
+  - Required: no
+- `ssh_client_password_login`
+  - Default: `false`
+  - Description: Set to `true` to allow password-based authentication with the ssh client.
+  - Type: bool
+  - Required: no
+- `ssh_client_port`
+  - Default: `22`
+  - Description: Specifies the port number to connect on the remote host.
+  - Type: str
+  - Required: no
+- `ssh_client_roaming`
+  - Default: `false`
+  - Description: enable experimental client roaming.
+  - Type: bool
+  - Required: no
 - `ssh_compression`
   - Default: `false`
   - Description: Specifies whether server-side compression is enabled after the user has authenticated successfully.
+  - Type: bool
+  - Required: no
+- `ssh_custom_options`
+  - Default: ``
+  - Description: Custom lines for SSH client configuration.
+  - Type: list
+  - Required: no
+- `ssh_custom_selinux_dir`
+  - Default: `/etc/selinux/local-policies`
+  - Description: directory where to store the ssh_password policy
+  - Type: str
+  - Required: no
+- `ssh_deny_groups`
+  - Default: ``
+  - Description: if specified, login is disallowed for users whose primary group or supplementary group list matches one of the patterns.
+  - Type: str
+  - Required: no
+- `ssh_deny_users`
+  - Default: ``
+  - Description: if specified, login is disallowed for user names that match one of the patterns.
+  - Type: str
+  - Required: no
+- `ssh_gateway_ports`
+  - Default: `false`
+  - Description: Set to `false` to disable binding forwarded ports to non-loopback addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified` to allow the client to specify which address to bind to.
+  - Type: bool
+  - Required: no
+- `ssh_gssapi_delegation`
+  - Default: `false`
+  - Description: Set to `true` to enable GSSAPI credential forwarding.
+  - Type: bool
+  - Required: no
+- `ssh_gssapi_support`
+  - Default: `false`
+  - Description: Set to `true` to enable GSSAPI authentication (both client and server).
+  - Type: bool
+  - Required: no
+- `ssh_hardening_enabled`
+  - Default: `true`
+  - Description: Whether to run the hardening
+  - Type: bool
+  - Required: no
+- `ssh_host_certificates`
+  - Default: ``
+  - Description: Host certificates to look for when starting sshd
+  - Type: list
+  - Required: no
+- `ssh_host_key_algorithms`
+  - Default: ``
+  - Description: Host key algorithms that the server offers. If empty the default list will be used. Otherwise overrides the setting with specified list of algorithms. Check `man sshd_config`, `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make sure you check the correct version
+  - Type: list
+  - Required: no
+- `ssh_host_key_files`
+  - Default: ``
+  - Description: Host keys for sshd. If empty ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key', '/etc/ssh/ssh_host_ed25519_key'] will be used, as far as supported by the installed sshd version.
+  - Type: list
+  - Required: no
+- `ssh_host_rsa_key_size`
+  - Default: `4096`
+  - Description: Specifies the number of bits in the private host RSA key to create.
+  - Type: int
+  - Required: no
+- `ssh_kerberos_support`
+  - Default: `true`
+  - Description: Set to `true` if SSH has Kerberos support.
+  - Type: bool
+  - Required: no
+- `ssh_kex`
+  - Default: ``
+  - Description: Change this list to overwrite kexs. Defaults found in `defaults/main.yml`
+  - Type: list
+  - Required: no
+- `ssh_listen_to`
+  - Default: `["0.0.0.0"]`
+  - Description: one or more ip addresses, to which ssh-server should listen to. Default is all IPv4 addresses, but should be configured to specific addresses for security reasons
+  - Type: list
+  - Required: no
 - `ssh_login_grace_time`
   - Default: `30s`
   - Description: specifies the time allowed for successful authentication to the SSH server.
+  - Type: str
+  - Required: no
+- `ssh_macs`
+  - Default: ``
+  - Description: Change this list to overwrite macs. Defaults found in `defaults/main.yml`
+  - Type: list
+  - Required: no
 - `ssh_max_auth_retries`
   - Default: `2`
   - Description: Specifies the maximum number of authentication attempts permitted per connection.
+  - Type: int
+  - Required: no
 - `ssh_max_sessions`
   - Default: `10`
   - Description: Specifies the maximum number of open sessions permitted from a given connection.
+  - Type: int
+  - Required: no
+- `ssh_max_startups`
+  - Default: `10:30:60`
+  - Description: Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon.
+  - Type: str
+  - Required: no
+- `ssh_pam_support`
+  - Default: `true`
+  - Description: Set to `true` if SSH has PAM support.
+  - Type: bool
+  - Required: no
+- `ssh_permit_root_login`
+  - Default: `no`
+  - Description: Disable root-login. Set to `'without-password'` or `'yes'` to enable root-login - The quotes are required!
+  - Type: str
+  - Required: no
+- `ssh_permit_tunnel`
+  - Default: `no`
+  - Description: Specifies whether tun(4) device forwarding is allowed. The argument must be yes, point-to-point (layer 3), ethernet (layer 2), or no. Specifying yes permits both point-to-point and ethernet.
+  - Type: str
+  - Required: no
+  - Choices:
+    - no
+    - yes
+    - point-to-point
+    - ethernet
 - `ssh_print_debian_banner`
   - Default: `false`
-  - Description: `true` to print debian specific banner.
+  - Description: Set to `true` to print debian specific banner.
+  - Type: bool
+  - Required: no
+- `ssh_print_last_log`
+  - Default: `false`
+  - Description: Set to `false` to disable display of last login information.
+  - Type: bool
+  - Required: no
+- `ssh_print_motd`
+  - Default: `false`
+  - Description: Set to `false` to disable printing of the MOTD.
+  - Type: bool
+  - Required: no
+- `ssh_print_pam_motd`
+  - Default: `false`
+  - Description: Set to `false` to disable printing of the MOTD via pam (Debian and Ubuntu).
+  - Type: bool
+  - Required: no
+- `ssh_ps59`
+  - Default: `sandbox`
+  - Description: Specifies whether sshd separates privileges by creating an unprivileged child process to deal with incoming network traffic.
+  - Type: str
+  - Required: no
+- `ssh_remote_hosts`
+  - Default: ``
+  - Description: one or more hosts and their custom options for the ssh-client. Default is empty. See examples in `defaults/main.yml`
+  - Type: list
+  - Required: no
+- `ssh_server_accept_env_vars`
+  - Default: ``
+  - Description: Specifies what environment variables sent by the client will be copied into the session's environment, multiple environment variables may be separated by whitespace.
+  - Type: str
+  - Required: no
+- `ssh_server_config_file`
+  - Default: `/etc/ssh/sshd_config`
+  - Description: path of the ssh server configuration file, e.g. `/etc/ssh/sshd_config.d/custom.conf`.
+  - Type: str
+  - Required: no
 - `ssh_server_enabled`
   - Default: `true`
-  - Description: `false` to disable the opensshd server.
+  - Description: Set to `false` to disable the opensshd server.
+  - Type: bool
+  - Required: no
 - `ssh_server_hardening`
   - Default: `true`
-  - Description: `false` to stop harden the server.
+  - Description: Set to `false` to stop harden the server.
+  - Type: bool
+  - Required: no
 - `ssh_server_match_address`
-  - Default: `''`
+  - Default: ``
   - Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
+  - Type: str
+  - Required: no
 - `ssh_server_match_group`
-  - Default: `''`
-  - Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
-- `ssh_server_match_user`
-  - Default: `''`
+  - Default: ``
   - Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
+  - Type: str
+  - Required: no
 - `ssh_server_match_local_port`
-  - Default: `''`
+  - Default: ``
   - Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
+  - Type: str
+  - Required: no
+- `ssh_server_match_user`
+  - Default: ``
+  - Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
+  - Type: str
+  - Required: no
+- `ssh_server_password_login`
+  - Default: `false`
+  - Description: Set to `true` to allow password-based authentication to the ssh server. You probably also need to change `sshd_authenticationmethods` to include `password` if you set `ssh_server_password_login`: `true`.
+  - Type: bool
+  - Required: no
 - `ssh_server_permit_environment_vars`
   - Default: `no`
-  - Description: `yes` to specify that ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys are processed by sshd. With openssh version 7.8 it is possible to specify a whitelist of environment variable names in addition to global "yes" or "no" settings.
-- `ssh_server_accept_env_vars`
-  - Default: `''`
-  - Description: Specifies what environment variables sent by the client will be copied into the session's environment, multiple environment variables may be separated by whitespace.
+  - Description: `yes` to specify that ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys are processed by sshd. With openssh version 7.8 it is possible to specify a whitelist of environment variable names in addition to global 'yes' or 'no' settings.
+  - Type: str
+  - Required: no
+- `ssh_server_ports`
+  - Default: `["22"]`
+  - Description: ports on which ssh-server should listen.
+  - Type: list
+  - Required: no
+- `ssh_server_revoked_keys`
+  - Default: ``
+  - Description: a list of revoked public keys that the ssh server will always reject, useful to revoke known weak or compromised keys.
+  - Type: list
+  - Required: no
+- `ssh_trusted_user_ca_keys`
+  - Default: ``
+  - Description: set the trusted certificate authorities public keys used to sign user certificates. Only used if `ssh_trusted_user_ca_keys_file` is set.
+  - Type: list
+  - Required: no
+- `ssh_trusted_user_ca_keys_file`
+  - Default: ``
+  - Description: specifies the file containing trusted certificate authorities public keys used to sign user certificates.
+  - Type: str
+  - Required: no
 - `ssh_use_dns`
   - Default: `false`
   - Description: Specifies whether sshd should look up the remote host name, and to check that the resolved host name for the remote IP address maps back to the very same IP address.
-- `ssh_server_revoked_keys`
-  - Default: `[]`
-  - Description: a list of revoked public keys that the ssh server will always reject, useful to revoke known weak or compromised keys.
-- `ssh_max_startups`
-  - Default: `'10:30:60'`
-  - Description: Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon.
-- `ssh_macs`
-  - Default: `[]`
-  - Description: Change this list to overwrite macs. Defaults found in `defaults/main.yml`.
-- `ssh_kex`
-  - Default: `[]`
-  - Description: Change this list to overwrite kexs. Defaults found in `defaults/main.yml`.
-- `ssh_ciphers`
-  - Default: `[]`
-  - Description: Change this list to overwrite ciphers. Defaults found in `defaults/main.yml`.
-- `ssh_custom_options`
-  - Default: `[]`
-  - Description: Custom lines for SSH client configuration.
+  - Type: bool
+  - Required: no
+- `ssh_use_pam`
+  - Default: `true`
+  - Description: Set to `false` to disable pam authentication.
+  - Type: bool
+  - Required: no
+- `ssh_x11_forwarding`
+  - Default: `false`
+  - Description: Set to `false` to disable X11 Forwarding. Set to `true` to allow X11 Forwarding.
+  - Type: bool
+  - Required: no
+- `sshd_authenticationmethods`
+  - Default: `publickey`
+  - Description: Specifies the authentication methods that must be successfully completed for a user to be granted access. Make sure to set all required variables for your selected authentication method. Defaults found in `defaults/main.yml`
+  - Type: str
+  - Required: no
 - `sshd_custom_options`
-  - Default: `[]`
+  - Default: ``
   - Description: Custom lines for SSH daemon configuration.
-- `sshd_syslog_facility`
-  - Default: `'AUTH'`
-  - Description: The facility code that is used when logging messages from sshd.
+  - Type: list
+  - Required: no
 - `sshd_log_level`
-  - Default: `'VERBOSE'`
+  - Default: `VERBOSE`
   - Description: the verbosity level that is used when logging messages from sshd.
+  - Type: str
+  - Required: no
+- `sshd_moduli_file`
+  - Default: `/etc/ssh/moduli`
+  - Description: path to the SSH moduli file.
+  - Type: str
+  - Required: no
+- `sshd_moduli_minimum`
+  - Default: `2048`
+  - Description: remove Diffie-Hellman parameters smaller than the defined size to mitigate logjam.
+  - Type: int
+  - Required: no
 - `sshd_strict_modes`
   - Default: `true`
   - Description: Check file modes and ownership of the user's files and home directory before accepting login.
-- `sshd_authenticationmethods`
-  - Default: `publickey`
-  - Description: Specifies the authentication methods that must be successfully completed for a user to be granted access. Make sure to set all required variables for your selected authentication method. Defaults found in `defaults/main.yml`.
+  - Type: bool
+  - Required: no
+- `sshd_syslog_facility`
+  - Default: `AUTH`
+  - Description: The facility code that is used when logging messages from sshd.
+  - Type: str
+  - Required: no
+
+## Dependencies
+
+None.
 
 ## Example Playbook
 
-```yml
-- hosts: localhost
-  collections:
-    - devsec.hardening
-  roles:
-    - ssh_hardening
 ```
+- hosts: all
+  roles:
+    - name: devsec.hardening.ssh_hardening
+```
+
+<!-- END_ANSIBLE_DOCS -->
 
 ## Configuring settings not listed in role-variables
 

roles/ssh_hardening/defaults/main.yml

@@ -65,7 +65,7 @@ ssh_client_alive_interval: 300 # sshd
 ssh_client_alive_count: 3 # sshd
 
 # Allow SSH Tunnels
-ssh_permit_tunnel: false
+ssh_permit_tunnel: "no"
 
 # Hosts with custom options.        # ssh
 # Example:

roles/ssh_hardening/meta/argument_specs.yml

@@ -0,0 +1,367 @@
+---
+argument_specs:
+  main:
+    short_description: The main entry point for the ssh hardening role.
+    version_added: 8.8.0
+    options:
+      network_ipv6_enable:
+        default: true
+        type: bool
+        description: '`false` if IPv6 is not needed. `ssh_listen_to` must also be
+          set to listen to IPv6 addresses (for example `[::]`).'
+      ssh_client_config_file:
+        default: /etc/ssh/ssh_config
+        description: path of the ssh client configuration file, e.g. `/etc/ssh/ssh_config.d/custom.conf`.
+      ssh_server_config_file:
+        default: /etc/ssh/sshd_config
+        description: path of the ssh server configuration file, e.g. `/etc/ssh/sshd_config.d/custom.conf`.
+      ssh_server_ports:
+        default: ['22']
+        type: list
+        description: ports on which ssh-server should listen.
+      ssh_client_port:
+        default: '22'
+        description: Specifies the port number to connect on the remote host.
+      ssh_listen_to:
+        default: [0.0.0.0]
+        type: list
+        description: one or more ip addresses, to which ssh-server should listen to.
+          Default is all IPv4 addresses, but should be configured to specific addresses
+          for security reasons
+      ssh_host_key_files:
+        default: []
+        type: list
+        description: Host keys for sshd. If empty ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key',
+          '/etc/ssh/ssh_host_ed25519_key'] will be used, as far as supported by the
+          installed sshd version.
+      ssh_host_rsa_key_size:
+        default: 4096
+        type: int
+        description: Specifies the number of bits in the private host RSA key to create.
+      ssh_host_key_algorithms:
+        default: []
+        type: list
+        description: Host key algorithms that the server offers. If empty the default
+          list will be used. Otherwise overrides the setting with specified list of
+          algorithms. Check `man sshd_config`, `ssh -Q HostKeyAlgorithms` or other
+          sources for supported algorithms - make sure you check the correct version
+      ssh_client_host_key_algorithms:
+        default: []
+        type: list
+        description: Specifies the host key algorithms that the client wants to use
+          in order of preference. If empty the default list will be used. Otherwise
+          overrides the setting with specified list of algorithms. Check `man ssh_config`,
+          `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make
+          sure you check the correct version!
+      ssh_client_alive_interval:
+        default: 300
+        description: specifies an interval for sending keepalive messages.
+        type: int
+      ssh_client_alive_count:
+        default: 3
+        description: Defines the number of acceptable unanswered client alive messages
+          before disconnecting clients.
+        type: int
+      ssh_permit_tunnel:
+        default: 'no'
+        description: Specifies whether tun(4) device forwarding is allowed. The argument
+          must be yes, point-to-point (layer 3), ethernet (layer 2), or no. Specifying
+          yes permits both point-to-point and ethernet.
+        choices:
+          - 'no'
+          - 'yes'
+          - point-to-point
+          - ethernet
+      ssh_remote_hosts:
+        default: []
+        type: list
+        description: one or more hosts and their custom options for the ssh-client.
+          Default is empty. See examples in `defaults/main.yml`
+      ssh_permit_root_login:
+        default: 'no'
+        description: Disable root-login. Set to `'without-password'` or `'yes'` to
+          enable root-login - The quotes are required!
+      ssh_allow_tcp_forwarding:
+        default: 'no'
+        description: Set to `'no'` or `false` to disable TCP Forwarding. Set to `'yes'`
+          or`True` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version,
+          you can specify `'yes'`, `'no'`, `'all'`, `'local'`or`'remote'`.
+      ssh_gateway_ports:
+        default: false
+        type: bool
+        description: Set to `false` to disable binding forwarded ports to non-loopback
+          addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified`
+          to allow the client to specify which address to bind to.
+      ssh_allow_agent_forwarding:
+        default: false
+        type: bool
+        description: Set to `false` to disable Agent Forwarding. Set to `true` to
+          allow Agent Forwarding.
+      ssh_x11_forwarding:
+        default: false
+        type: bool
+        description: Set to `false` to disable X11 Forwarding. Set to `true` to allow
+          X11 Forwarding.
+      ssh_pam_support:
+        default: true
+        type: bool
+        description: Set to `true` if SSH has PAM support.
+      ssh_use_pam:
+        default: true
+        type: bool
+        description: Set to `false` to disable pam authentication.
+      ssh_gssapi_support:
+        default: false
+        type: bool
+        description: Set to `true` to enable GSSAPI authentication (both client and
+          server).
+      ssh_gssapi_delegation:
+        default: false
+        type: bool
+        description: Set to `true` to enable GSSAPI credential forwarding.
+      ssh_kerberos_support:
+        default: true
+        type: bool
+        description: Set to `true` if SSH has Kerberos support.
+      ssh_deny_users:
+        default: ''
+        description: if specified, login is disallowed for user names that match one
+          of the patterns.
+      ssh_allow_users:
+        default: ''
+        description: if specified, login is allowed only for user names that match
+          one of the patterns.
+      ssh_deny_groups:
+        default: ''
+        description: if specified, login is disallowed for users whose primary group
+          or supplementary group list matches one of the patterns.
+      ssh_allow_groups:
+        default: ''
+        description: if specified, login is allowed only for users whose primary group
+          or supplementary group list matches one of the patterns.
+      ssh_authorized_keys_file:
+        default: ''
+        description: change default file that contains the public keys that can be
+          used for user authentication
+      ssh_trusted_user_ca_keys_file:
+        default: ''
+        description: specifies the file containing trusted certificate authorities
+          public keys used to sign user certificates.
+      ssh_trusted_user_ca_keys:
+        default: []
+        type: list
+        description: set the trusted certificate authorities public keys used to sign
+          user certificates. Only used if `ssh_trusted_user_ca_keys_file` is set.
+      ssh_authorized_principals_file:
+        default: ''
+        description: specifies the file containing principals that are allowed. Only
+          used if `ssh_trusted_user_ca_keys_file` is set.
+      ssh_authorized_principals:
+        default: []
+        type: list
+        description: list of hashes containing file paths and authorized principals,
+          see `default_cstom.yml` for all options. Only used if `ssh_authorized_principals_file`
+          is set
+      ssh_print_motd:
+        default: false
+        type: bool
+        description: Set to `false` to disable printing of the MOTD.
+      ssh_print_pam_motd:
+        default: false
+        type: bool
+        description: Set to `false` to disable printing of the MOTD via pam (Debian
+          and Ubuntu).
+      ssh_print_last_log:
+        default: false
+        type: bool
+        description: Set to `false` to disable display of last login information.
+      sftp_enabled:
+        default: true
+        type: bool
+        description: Set to `false` to disable sftp configuration.
+      sftp_umask:
+        default: '0027'
+        description: Specifies the umask for sftp.
+      sftp_chroot:
+        default: true
+        type: bool
+        description: Set to `false` to disable chroot for sftp.
+      sftp_chroot_dir:
+        default: /home/%u
+        description: change default stp chroot location
+      ssh_client_roaming:
+        default: false
+        type: bool
+        description: enable experimental client roaming.
+      sshd_moduli_file:
+        default: /etc/ssh/moduli
+        description: path to the SSH moduli file.
+      sshd_moduli_minimum:
+        default: 2048
+        description: remove Diffie-Hellman parameters smaller than the defined size
+          to mitigate logjam.
+        type: int
+      ssh_challengeresponseauthentication:
+        default: false
+        type: bool
+        description: Specifies whether challenge-response authentication is allowed
+          (e.g. via PAM).
+      ssh_client_password_login:
+        default: false
+        type: bool
+        description: Set to `true` to allow password-based authentication with the
+          ssh client.
+      ssh_server_password_login:
+        default: false
+        type: bool
+        description: 'Set to `true` to allow password-based authentication to the
+          ssh server. You probably also need to change `sshd_authenticationmethods`
+          to include `password` if you set `ssh_server_password_login`: `true`.'
+      ssh_banner:
+        default: false
+        type: bool
+        description: Set to `true` to print a banner on login.
+      ssh_banner_path:
+        default: /etc/sshd/banner.txt
+        description: path to the SSH banner file.
+      ssh_client_hardening:
+        default: true
+        type: bool
+        description: Set to `false` to stop harden the client.
+      ssh_client_compression:
+        default: false
+        type: bool
+        description: Specifies whether the client requests compression.
+      ssh_compression:
+        default: false
+        type: bool
+        description: Specifies whether server-side compression is enabled after the
+          user has authenticated successfully.
+      ssh_login_grace_time:
+        default: 30s
+        description: specifies the time allowed for successful authentication to the
+          SSH server.
+      ssh_max_auth_retries:
+        default: 2
+        description: Specifies the maximum number of authentication attempts permitted
+          per connection.
+        type: int
+      ssh_max_sessions:
+        default: 10
+        description: Specifies the maximum number of open sessions permitted from
+          a given connection.
+        type: int
+      ssh_print_debian_banner:
+        default: false
+        type: bool
+        description: Set to `true` to print debian specific banner.
+      ssh_server_enabled:
+        default: true
+        type: bool
+        description: Set to `false` to disable the opensshd server.
+      ssh_server_hardening:
+        default: true
+        type: bool
+        description: Set to `false` to stop harden the server.
+      ssh_server_match_address:
+        default: ''
+        description: Introduces a conditional block. If all of the criteria on the
+          Match line are satisfied, the keywords on the following lines override those
+          set in the global section of the config file, until either another Match
+          line or the end of the file.
+      ssh_server_match_group:
+        default: ''
+        description: Introduces a conditional block. If all of the criteria on the
+          Match line are satisfied, the keywords on the following lines override those
+          set in the global section of the config file, until either another Match
+          line or the end of the file.
+      ssh_server_match_user:
+        default: ''
+        description: Introduces a conditional block. If all of the criteria on the
+          Match line are satisfied, the keywords on the following lines override those
+          set in the global section of the config file, until either another Match
+          line or the end of the file.
+      ssh_server_match_local_port:
+        default: ''
+        description: Introduces a conditional block. If all of the criteria on the
+          Match line are satisfied, the keywords on the following lines override those
+          set in the global section of the config file, until either another Match
+          line or the end of the file.
+      ssh_server_permit_environment_vars:
+        default: 'no'
+        description: "`yes` to specify that ~/.ssh/environment and environment= options\
+          \ in ~/.ssh/authorized_keys are processed by sshd. With openssh version\
+          \ 7.8 it is possible to specify a whitelist of environment variable names\
+          \ in addition to global 'yes' or 'no' settings."
+      ssh_server_accept_env_vars:
+        default: ''
+        description: Specifies what environment variables sent by the client will
+          be copied into the session's environment, multiple environment variables
+          may be separated by whitespace.
+      ssh_use_dns:
+        default: false
+        type: bool
+        description: Specifies whether sshd should look up the remote host name, and
+          to check that the resolved host name for the remote IP address maps back
+          to the very same IP address.
+      ssh_server_revoked_keys:
+        default: []
+        type: list
+        description: a list of revoked public keys that the ssh server will always
+          reject, useful to revoke known weak or compromised keys.
+      ssh_max_startups:
+        default: 10:30:60
+        description: Specifies the maximum number of concurrent unauthenticated connections
+          to the SSH daemon.
+      ssh_macs:
+        default: []
+        type: list
+        description: Change this list to overwrite macs. Defaults found in `defaults/main.yml`
+      ssh_kex:
+        default: []
+        type: list
+        description: Change this list to overwrite kexs. Defaults found in `defaults/main.yml`
+      ssh_ciphers:
+        default: []
+        type: list
+        description: Change this list to overwrite ciphers. Defaults found in `defaults/main.yml`
+      ssh_custom_options:
+        default: []
+        type: list
+        description: Custom lines for SSH client configuration.
+      sshd_custom_options:
+        default: []
+        type: list
+        description: Custom lines for SSH daemon configuration.
+      sshd_syslog_facility:
+        default: AUTH
+        description: The facility code that is used when logging messages from sshd.
+        type: str
+      sshd_log_level:
+        default: VERBOSE
+        description: the verbosity level that is used when logging messages from sshd.
+      sshd_strict_modes:
+        default: true
+        type: bool
+        description: Check file modes and ownership of the user's files and home directory
+          before accepting login.
+      sshd_authenticationmethods:
+        default: publickey
+        description: Specifies the authentication methods that must be successfully
+          completed for a user to be granted access. Make sure to set all required
+          variables for your selected authentication method. Defaults found in `defaults/main.yml`
+      ssh_custom_selinux_dir:
+        default: /etc/selinux/local-policies
+        description: directory where to store the ssh_password policy
+      ssh_hardening_enabled:
+        default: true
+        type: bool
+        description: Whether to run the hardening
+      ssh_host_certificates:
+        default: []
+        type: list
+        description: Host certificates to look for when starting sshd
+      ssh_ps59:
+        default: sandbox
+        description: Specifies whether sshd separates privileges by creating an unprivileged
+          child process to deal with incoming network traffic.

roles/ssh_hardening/meta/main.yml

@@ -10,6 +10,7 @@ galaxy_info:
       versions:
         - "7"
         - "8"
+        - "9"
     - name: Ubuntu
       versions:
         - bionic
@@ -23,7 +24,14 @@ galaxy_info:
     - name: Fedora
     - name: ArchLinux
     - name: SmartOS
-    - name: opensuse
+    - name: FreeBSD
+      versions:
+        - "12.2"
+        - "13.2"
+        - "14.0"
+    - name: OpenBSD
+      versions:
+        - "7.0"
   galaxy_tags:
     - system
     - security

roles/ssh_hardening/tasks/crypto_hostkeys.yml

@@ -8,16 +8,6 @@
     force: false
     regenerate: partial_idempotence
 
-# In RHEL and Fedora, the 'ssh_keys' group is the group owner of the host private SSH keys.
-# Since the openssh_keypair module needs to read the key to provide idempotency, we need to set ownership and group based on specific OS vars.
-- name: Change host private key ownership, group and permissions
-  ansible.builtin.file:
-    path: "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
-    owner: "{{ ssh_host_keys_owner }}"
-    group: "{{ ssh_host_keys_group }}"
-    mode: "0640"
-  when: ansible_facts.os_family == 'RedHat'
-
 - name: Set hostkeys according to openssh-version if openssh >= 5.3
   ansible.builtin.set_fact:
     ssh_host_key_files:
@@ -38,3 +28,11 @@
       - "{{ ssh_host_keys_dir }}/ssh_host_ecdsa_key"
       - "{{ ssh_host_keys_dir }}/ssh_host_ed25519_key"
   when: sshd_version is version('6.3', '>=')
+
+- name: Change host private key ownership, group and permissions
+  ansible.builtin.file:
+    path: "{{ item }}"
+    owner: "{{ ssh_host_keys_owner }}"
+    group: "{{ ssh_host_keys_group }}"
+    mode: "{{ ssh_host_keys_mode }}"
+  loop: "{{ ssh_host_key_files }}"

roles/ssh_hardening/tasks/hardening.yml

@@ -100,7 +100,7 @@
   check_mode: false
   when: ssh_server_hardening | bool
 
-- name: Remove all small primes
+- name: Remove all small primes # noqa no-changed-when
   ansible.builtin.shell: >
     awk '$5 >= {{ sshd_moduli_minimum }}' {{ sshd_moduli_file }} > {{ sshd_moduli_file }}.new ; [ -r {{ sshd_moduli_file }}.new
     -a -s {{ sshd_moduli_file }}.new ] && mv {{ sshd_moduli_file }}.new {{ sshd_moduli_file }} || true

roles/ssh_hardening/tasks/selinux.yml

@@ -57,7 +57,7 @@
 # The following tasks only get executed when selinux is installed, UsePam is
 # 'yes' and the ssh_password module is installed. See
 # http://danwalsh.livejournal.com/12333.html for more info
-- name: Remove selinux-policy when Pam is used, because Allowing sshd to read the shadow file directly is considered a potential security risk
+- name: Remove selinux-policy when PAM is used, because allowing sshd to read the shadow file is considered a security risk # noqa no-changed-when
   ansible.builtin.command: semodule -r ssh_password
   when:
     - ssh_use_pam | bool

roles/ssh_hardening/templates/opensshd.conf.j2

@@ -152,7 +152,7 @@ GSSAPICleanupCredentials yes
 {% endif %}
 {% if ssh_deny_users %}
 # In case you don't use PAM (`UsePAM no`), you can alternatively restrict users and groups here.
-# For key-based authentication this is not necessary, since all keys must be explicitely enabled.
+# For key-based authentication this is not necessary, since all keys must be explicitly enabled.
 DenyUsers {{ ssh_deny_users }}
 
 {% endif %}
@@ -192,7 +192,7 @@ ClientAliveInterval {{ ssh_client_alive_interval }}
 ClientAliveCountMax {{ ssh_client_alive_count }}
 
 # Disable tunneling
-PermitTunnel {{ 'yes' if (ssh_permit_tunnel|bool) else 'no' }}
+PermitTunnel {{ ssh_permit_tunnel }}
 
 # Disable forwarding tcp connections.
 # no real advantage without denied shell access

roles/ssh_hardening/vars/Amazon_2.yml

@@ -1,11 +1,12 @@
 ---
 sshd_path: /usr/sbin/sshd
-ssh_host_keys_dir: '/etc/ssh'
+ssh_host_keys_dir: /etc/ssh
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root
-ssh_host_keys_owner: 'root'
-ssh_host_keys_group: 'ssh_keys'
+ssh_host_keys_owner: root
+ssh_host_keys_group: ssh_keys
+ssh_host_keys_mode: "0600"
 ssh_selinux_packages:
   - policycoreutils-python
   - checkpolicy
@@ -16,7 +17,7 @@ ssh_kerberos_support: true
 # true if SSH has PAM support
 ssh_pam_support: true
 
-sshd_moduli_file: '/etc/ssh/moduli'
+sshd_moduli_file: /etc/ssh/moduli
 
 # disable CRYPTO_POLICY to take settings from sshd configuration
 # see: https://access.redhat.com/solutions/4410591

roles/ssh_hardening/vars/Archlinux.yml

@@ -6,6 +6,7 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: root
+ssh_host_keys_mode: "0600"
 
 # true if SSH support Kerberos
 ssh_kerberos_support: true

roles/ssh_hardening/vars/Debian.yml

@@ -6,6 +6,7 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: root
+ssh_host_keys_mode: "0600"
 ssh_selinux_packages:
   - policycoreutils-python
   - checkpolicy

roles/ssh_hardening/vars/Fedora.yml

@@ -5,7 +5,8 @@ sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
-ssh_host_keys_group: ssh_keys
+ssh_host_keys_group: root
+ssh_host_keys_mode: "0600"
 ssh_selinux_packages:
   - python3-policycoreutils
   - checkpolicy