Merge pull request #810 from dev-sec/audit_name

Add variable to set name_format for auditd

.aar_doc.yml

@@ -43,6 +43,7 @@ output_template: |
 
   ```
   - hosts: all
+    become: true
     roles:
       - name: {{ role }}
   ```

.config/ansible-lint.yml

@@ -5,9 +5,11 @@
 # option will be parsed relative to the CWD of execution.
 exclude_paths:
   - .cache/ # implicit unless exclude_paths is defined in config
-  - .yamllint
-  - ../molecule/
-  - ../.github/
+  # add all waivers individually, since exclude_files does not support globs
+  - molecule/os_hardening/waivers.yaml
+  - molecule/ssh_hardening_bsd/waivers_freebsd13.yaml
+  - molecule/ssh_hardening_bsd/waivers_freebsd14.yaml
+  - molecule/ssh_hardening_bsd/waivers_openbsd7.yaml
 
 mock_roles:
   - geerlingguy.git
@@ -15,3 +17,4 @@ mock_roles:
 
 skip_list:
   - var-naming[no-role-prefix]
+  - meta-runtime[unsupported-version]

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -31,7 +31,7 @@ body:
     attributes:
       label: "Reproduction steps"
       render: Shell
-      description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, so no need for backticks.
+      description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, no need for backticks.
       value: |
         ...
     validations:

.github/labeler.yml

@@ -1,22 +1,30 @@
 ---
 mysql_hardening:
-  - 'roles/mysql_hardening/**'
-  - 'molecule/mysql_hardening/**'
-  - '.github/workflows/mysql_hardening.yml'
+  - changed-files:
+      - any-glob-to-any-file:
+          - roles/mysql_hardening/**
+          - molecule/mysql_hardening/**
+          - .github/workflows/mysql_hardening.yml
 
 os_hardening:
-  - 'roles/os_hardening/**'
-  - 'molecule/os_hardening/**'
-  - '.github/workflows/os_hardening.yml'
+  - changed-files:
+      - any-glob-to-any-file:
+          - roles/os_hardening/**
+          - molecule/os_hardening/**
+          - .github/workflows/os_hardening.yml
 
 ssh_hardening:
-  - 'roles/ssh_hardening/**'
-  - 'molecule/ssh_hardening/**'
-  - 'molecule/ssh_hardening_custom_tests/**'
-  - '.github/workflows/ssh_hardening.yml'
-  - '.github/workflows/ssh_hardening_custom_tests.yml'
+  - changed-files:
+      - any-glob-to-any-file:
+          - roles/ssh_hardening/**
+          - molecule/ssh_hardening/**
+          - molecule/ssh_hardening_custom_tests/**
+          - .github/workflows/ssh_hardening.yml
+          - .github/workflows/ssh_hardening_custom_tests.yml
 
 nginx_hardening:
-  - 'roles/nginx_hardening/**'
-  - 'molecule/nginx_hardening/**'
-  - '.github/workflows/nginx_hardening.yml'
+  - changed-files:
+      - any-glob-to-any-file:
+          - roles/nginx_hardening/**
+          - molecule/nginx_hardening/**
+          - .github/workflows/nginx_hardening.yml

.github/version-drafter.yml

@@ -0,0 +1,3 @@
+major-labels: ['major']
+minor-labels: ['minor', 'enhancement']
+patch-labels: ['patch', 'bug']

.github/workflows/ansible-lint.yml

@@ -7,22 +7,26 @@ on:  # yamllint disable-line rule:truthy
     branches: [master]
     paths:
       - 'roles/**'
+      - 'molecule/**'
+      - 'requirements.txt'
+      - '.github/workflows/ansible-lint.yml'
+      - '.config/ansible-lint.yml'
   pull_request:
     # The branches below must be a subset of the branches above
     branches: [master]
     paths:
       - 'roles/**'
+      - 'molecule/**'
+      - 'requirements.txt'
+      - '.github/workflows/ansible-lint.yml'
+      - '.config/ansible-lint.yml'
 
 jobs:
   ansible-lint:
     runs-on: ubuntu-latest
 
     steps:
-      # Important: This sets up your GITHUB_WORKSPACE environment variable
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
 
       - name: Lint Ansible Playbook
-        # replace "master" with any valid ref
-        uses: ansible/ansible-lint-action@main
-        with:
-          path: "roles/"
+        uses: ansible/ansible-lint@3b5bee19c2102ea35bc8619795a72c5c73797fc7 # v24

.github/workflows/codespell.yml

@@ -11,4 +11,4 @@ jobs:
   codespell:
     uses: "dev-sec/.github/.github/workflows/codespell.yml@main"
     with:
-      ignore_words_list: "chage"
+      ignore_words_list: "chage,BOOTUP"

.github/workflows/enforce-labels.yml

@@ -4,11 +4,16 @@ name: "Enforce PR labels"
 on:  # yamllint disable-line rule:truthy
   pull_request_target:
     types: [labeled, unlabeled, opened, edited, synchronize]
+
+permissions:
+  contents: read # to read configuration file
+  pull-requests: write # to label PRs
+
 jobs:
   enforce-label:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@main
+      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/galaxy-publish.yml

@@ -4,37 +4,37 @@ name: Publish collection to Ansible Galaxy
 on:  # yamllint disable-line rule:truthy
   release:
     types:
-      - published
+      - released
 
 jobs:
   deploy:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
 
       # deploy the collection first, because if it fails, we don't want
       # to update the galaxy.yml
       - name: Deploy the collection
-        uses: artis3n/ansible_galaxy_collection@v2
+        uses: artis3n/ansible_galaxy_collection@3368f56529a2ef47ef0ac1ecfcda039f90d0174a # v2
         with:
           api_key: ${{ secrets.GALAXY_API_KEY }}
           galaxy_version: ${{ github.event.release.tag_name }}
 
       # checkout master instead of the release-tag so we can push the galaxy.yml
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
         with:
           ref: master
 
       - name: update galaxy.yml with new version
-        uses: microsoft/variable-substitution@v1
+        uses: microsoft/variable-substitution@6287962da9e5b6e68778dc51e840caa03ca84495 # v1
         with:
           files: 'galaxy.yml'
         env:
           version: "${{ github.event.release.tag_name }}"
 
       - name: push galaxy.yml
-        uses: github-actions-x/[email protected]
+        uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           push-branch: 'master'

.github/workflows/mysql_hardening.yml

@@ -9,12 +9,14 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/mysql_hardening/**'
       - 'molecule/mysql_hardening/**'
       - '.github/workflows/mysql_hardening.yml'
+      - 'requirements.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/mysql_hardening/**'
       - 'molecule/mysql_hardening/**'
       - '.github/workflows/mysql_hardening.yml'
+      - 'requirements.txt'
   schedule:
     - cron: '0 6 * * 0'
 
@@ -35,15 +37,12 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
-          - centos7
-          - centosstream8
           - centosstream9
           - rocky8
           - rocky9
-          - ubuntu1804
           - ubuntu2004
           - ubuntu2204
-          - debian10
+          - ubuntu2404
           - debian11
           - debian12
           # - amazon  # geerlingguy.mysql does not support fedora
@@ -52,23 +51,26 @@ jobs:
           # - fedora  # geerlingguy.mysql does not support fedora
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v4
+      - name: Set up Python
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
         with:
-          python-version: 3.11
+          python-version: 3.12
+          cache: 'pip'
 
       - name: Install dependencies
-        run: |
-          sudo apt install git
-          python -m pip install --no-cache-dir --upgrade pip
-          pip install -r requirements.txt
+        run: pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
+      - name: Downgrade Ansible for Rocky 8 tests
+        run: pip install "ansible-core<2.17"
+        working-directory: ansible_collections/devsec/hardening
+        if: matrix.molecule_distro == 'rocky8'
+
       # that was a hard one to fix. robert did it thankfully
       # https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212
       - name: disable apparmor on debian systems
@@ -87,12 +89,11 @@ jobs:
       - name: Temporary fix for roles
         run: |
           mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles /home/runner/.ansible/roles
+          ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles \
+            /home/runner/.ansible/roles
 
       - name: Test with molecule
-        run: |
-          molecule --version
-          molecule test -s mysql_hardening
+        run: molecule test -s mysql_hardening
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
         working-directory: ansible_collections/devsec/hardening

.github/workflows/nginx_hardening.yml

@@ -8,12 +8,14 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/nginx_hardening/**'
       - 'molecule/nginx_hardening/**'
       - '.github/workflows/nginx_hardening.yml'
+      - 'requirements.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/nginx_hardening/**'
       - 'molecule/nginx_hardening/**'
       - '.github/workflows/nginx_hardening.yml'
+      - 'requirements.txt'
   schedule:
     - cron: '0 6 * * 1'
 
@@ -34,15 +36,12 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
-          - centos7
-          - centosstream8
           - centosstream9
           - rocky8
           - rocky9
-          - ubuntu1804
           - ubuntu2004
           - ubuntu2204
-          - debian10
+          - ubuntu2404
           - debian11
           - debian12
           - amazon2023
@@ -51,23 +50,26 @@ jobs:
           # - fedora  # no support from geerlingguy role
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v4
+      - name: Set up Python
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
         with:
-          python-version: 3.11
+          python-version: 3.12
+          cache: 'pip'
 
       - name: Install dependencies
-        run: |
-          sudo apt install git
-          python -m pip install --no-cache-dir --upgrade pip
-          pip install -r requirements.txt
+        run: pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
+      - name: Downgrade Ansible for Rocky 8 tests
+        run: pip install "ansible-core<2.17"
+        working-directory: ansible_collections/devsec/hardening
+        if: matrix.molecule_distro == 'rocky8'
+
       # Molecule has problems detecting the proper location for installing roles
       # https://github.com/ansible/molecule/issues/3806
       # we do not set a custom role path, but the automatically determined install path used is not compatible with the location molecule expects the role
@@ -76,12 +78,11 @@ jobs:
       - name: Temporary fix for roles
         run: |
           mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles /home/runner/.ansible/roles
+          ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles \
+            /home/runner/.ansible/roles
 
       - name: Test with molecule
-        run: |
-          molecule --version
-          molecule test -s nginx_hardening
+        run: molecule test -s nginx_hardening
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
         working-directory: ansible_collections/devsec/hardening

.github/workflows/os_hardening.yml

@@ -8,12 +8,14 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening/**'
       - '.github/workflows/os_hardening.yml'
+      - 'requirements.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening/**'
       - '.github/workflows/os_hardening.yml'
+      - 'requirements.txt'
   schedule:
     - cron: '0 6 * * 3'
 
@@ -33,49 +35,49 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        include:
+          - molecule_distro: opensuse_tumbleweed
+            molecule_docker_command: "/usr/lib/systemd/systemd"
         molecule_distro:
-          - centos7
-          - centosstream8
           - centosstream9
           - rocky8
           - rocky9
-          - fedora38
           - fedora39
-          - ubuntu1804
+          - fedora40
           - ubuntu2004
           - ubuntu2204
-          - debian10
+          - ubuntu2404
           - debian11
           - debian12
           - amazon2023
-          - opensuse_tumbleweed
           - arch
+        molecule_docker_command:
+          - "/lib/systemd/systemd"
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v4
+      - name: Set up Python
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
         with:
-          python-version: 3.11
+          python-version: 3.12
+          cache: 'pip'
 
       - name: Install dependencies
-        run: |
-          sudo apt install git
-          python -m pip install --no-cache-dir --upgrade pip
-          pip install -r requirements.txt
+        run: pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
+      - name: Downgrade Ansible for Rocky 8 tests
+        run: pip install "ansible-core<2.17"
+        working-directory: ansible_collections/devsec/hardening
+        if: matrix.molecule_distro == 'rocky8'
+
       - name: Test with molecule
-        run: |
-          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
-            export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
-          fi
-          molecule --version
-          molecule test -s os_hardening
+        run: molecule test -s os_hardening
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
+          MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
         working-directory: ansible_collections/devsec/hardening

.github/workflows/os_hardening_vm.yml

@@ -8,12 +8,14 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening_vm/**'
       - '.github/workflows/os_hardening_vm.yml'
+      - 'requirements.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening_vm/**'
       - '.github/workflows/os_hardening_vm.yml'
+      - 'requirements.txt'
   schedule:
     - cron: '0 6 * * 2'
 
@@ -34,31 +36,47 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
-          - generic/centos7
-          - generic/centos8s
           - generic/centos9s
           - generic/rocky8
           - generic/rocky9
-          - fedora/38-cloud-base
           - fedora/39-cloud-base
-          - generic/ubuntu1804
+          - fedora/40-cloud-base
           - generic/ubuntu2004
           - generic/ubuntu2204
-          - generic/debian10
+          - alvistack/ubuntu-24.04
           - generic/debian11
           - generic/debian12
           - generic/opensuse15
-          # - generic/arch  # needs fix for audit
+          - generic/arch
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
+      - name: Install dependencies
+        run: |
+          source ~/.venv/ansible-collection-hardening/bin/activate
+          python -m pip install --no-cache-dir --upgrade pip
+          pip install -r requirements.txt
+          pip install python-vagrant
+        working-directory: ansible_collections/devsec/hardening
+
+      - name: Downgrade Ansible for Rocky 8 tests
+        run: |
+          source ~/.venv/ansible-collection-hardening/bin/activate
+          pip install "ansible-core<2.17"
+        working-directory: ansible_collections/devsec/hardening
+        if: matrix.molecule_distro == 'generic/rocky8' || matrix.molecule_distro == 'generic/opensuse15'
+
+      - name: Update Vagrant Box
+        run: |
+          vagrant box update --box ${{ matrix.molecule_distro }} || true
+
       - name: Test with molecule
         run: |
-          molecule --version
+          source ~/.venv/ansible-collection-hardening/bin/activate
           molecule test -s os_hardening_vm
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}

.github/workflows/prettier-md.yml

@@ -16,11 +16,11 @@ jobs:
 
     steps:
       - name: Git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
         with:
           ref: ${{ github.head_ref }}
 
       - name: Prettify code
-        uses: creyD/[email protected]
+        uses: creyD/prettier_action@31355f8eef017f8aeba2e0bc09d8502b13dbbad1 # v4.3
         with:
           prettier_options: --write {**/*,*}.md

.github/workflows/release.yml

@@ -13,7 +13,7 @@ jobs:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
         with:
           fetch-depth: 0
           ref: master
@@ -26,23 +26,23 @@ jobs:
 
       - name: calculate next version
         id: version
-        uses: patrickjahns/version-drafter-action@v1
+        uses: patrickjahns/version-drafter-action@2076fa43abb28f31d0e8b0890253fbd1d1a966fc # v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Generate changelog
-        uses: charmixer/auto-changelog-action@v1
+        uses: charmixer/auto-changelog-action@b25e89c9410e03189f0d48b02b3a8caad6e78015 # v1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           future_release: ${{ steps.version.outputs.next-version }}
           # this excludes all versions prior to the collection-release
           # since they break the changelog generation with the error:
           # "No common ancestor between ... and $version"
-          exclude_tags_regex: '[0-6]\.\d\.\d'
+          exclude_tags_regex: '^[0-6]\.\d\.\d'
           issue_line_labels: mysql_hardening,os_hardening,ssh_hardening,nginx_hardening
 
       - name: push changelog
-        uses: github-actions-x/[email protected]
+        uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           push-branch: 'master'
@@ -58,18 +58,18 @@ jobs:
 
       - name: Read CHANGELOG.md
         id: package
-        uses: juliangruber/read-file-action@v1
+        uses: juliangruber/read-file-action@b549046febe0fe86f8cb4f93c24e284433f9ab58 # v1
         with:
           path: ./CHANGELOGRELEASE.md
 
       - name: Delete old drafts
-        uses: hugo19941994/[email protected]
+        uses: hugo19941994/delete-draft-releases@1bdca1ea7ffb25ae7f468a7bdb40056dae98175e # v1.0.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Create Release draft
         id: create_release
-        uses: actions/create-release@v1
+        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # This token is provided by Actions, you do not need to create your own token
         with:

.github/workflows/roles-readme.yml

@@ -6,10 +6,13 @@ on:  # yamllint disable-line rule:truthy
     branches: [master]
     paths:
       - 'roles/**/meta/argument_specs.yml'
+      - 'roles/**/meta/main.yml'
   pull_request:
     branches: [master]
     paths:
       - 'roles/**/meta/argument_specs.yml'
+      - 'roles/**/meta/main.yml'
+      - 'requirements.txt'
 
 jobs:
   readme:
@@ -24,25 +27,26 @@ jobs:
           - ssh_hardening
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
         with:
-          python-version: 3.11
+          python-version: 3.12
+          cache: 'pip'
 
-      - name: Install aar_doc
-        run: pip3 install aar_doc
+      - name: Install dependencies
+        run: pip install -r requirements.txt
 
-      - name: Run aar_doc
-        run: aar_doc roles/${{ matrix.roles }} markdown
+      - name: Run aar-doc
+        run: aar-doc roles/${{ matrix.roles }} markdown
 
       - name: Output diff
         run: git diff roles/${{ matrix.roles }}/README.md
 
       - name: Push README
         if: github.event_name != 'pull_request'
-        uses: github-actions-x/[email protected]
+        uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: 'update ${{ matrix.roles }} readme'

.github/workflows/ssh_hardening.yml

@@ -8,12 +8,14 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening/**'
       - '.github/workflows/ssh_hardening.yml'
+      - 'requirements.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening/**'
       - '.github/workflows/ssh_hardening.yml'
+      - 'requirements.txt'
   schedule:
     - cron: '0 6 * * 5'
 
@@ -33,49 +35,52 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        include:
+          # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
+          # - molecule_distro: opensuse_tumbleweed
+          #   molecule_docker_command: "/usr/lib/systemd/systemd"
+          - molecule_distro: alpine
+            molecule_docker_command: "/sbin/init"
         molecule_distro:
-          - centos7
-          - centosstream8
           - centosstream9
           - rocky8
           - rocky9
-          - fedora38
           - fedora39
-          - ubuntu1804
+          - fedora40
           - ubuntu2004
           - ubuntu2204
-          - debian10
+          - ubuntu2404
           - debian11
           - debian12
           - amazon2023
           - arch
-          # - opensuse_tumbleweed  # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
+        molecule_docker_command:
+          - "/lib/systemd/systemd"
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v4
+      - name: Set up Python
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
         with:
-          python-version: 3.11
+          python-version: 3.12
+          cache: 'pip'
 
       - name: Install dependencies
-        run: |
-          sudo apt install git
-          python -m pip install --no-cache-dir --upgrade pip
-          pip install -r requirements.txt
+        run: pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
+      - name: Downgrade Ansible for Rocky 8 tests
+        run: pip install "ansible-core<2.17"
+        working-directory: ansible_collections/devsec/hardening
+        if: matrix.molecule_distro == 'rocky8'
+
       - name: Test with molecule
-        run: |
-          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
-            export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
-          fi
-          molecule --version
-          molecule test -s ssh_hardening
+        run: molecule test -s ssh_hardening
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
+          MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
         working-directory: ansible_collections/devsec/hardening

.github/workflows/ssh_hardening_bsd.yml

@@ -8,12 +8,14 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening_bsd/**'
       - '.github/workflows/ssh_hardening_bsd.yml'
+      - 'requirements.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening_bsd/**'
       - '.github/workflows/ssh_hardening_bsd.yml'
+      - 'requirements.txt'
   schedule:
     - cron: '0 6 * * 5'
 
@@ -35,20 +37,20 @@ jobs:
       matrix:
         molecule_distro:
           - openbsd7
-          - freebsd12
           - freebsd13
           - freebsd14
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
+      - name: Update Vagrant Box
+        run: vagrant box update --box generic/${{ matrix.molecule_distro }} || true
+
       - name: Test with molecule
-        run: |
-          molecule --version
-          molecule test -s ssh_hardening_bsd
+        run: molecule test -s ssh_hardening_bsd
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
         working-directory: ansible_collections/devsec/hardening

.github/workflows/ssh_hardening_custom_tests.yml

@@ -8,12 +8,14 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening_custom_tests/**'
       - '.github/workflows/ssh_hardening_custom_tests.yml'
+      - 'requirements.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening_custom_tests/**'
       - '.github/workflows/ssh_hardening_custom_tests.yml'
+      - 'requirements.txt'
   schedule:
     - cron: '0 6 * * 4'
 
@@ -33,49 +35,52 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        include:
+          # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
+          # - molecule_distro: opensuse_tumbleweed
+          #   molecule_docker_command: "/usr/lib/systemd/systemd"
+          - molecule_distro: alpine
+            molecule_docker_command: "/sbin/init"
         molecule_distro:
-          - centos7
-          - centosstream8
           - centosstream9
           - rocky8
           - rocky9
-          - fedora38
           - fedora39
-          - ubuntu1804
+          - fedora40
           - ubuntu2004
           - ubuntu2204
-          - debian10
+          - ubuntu2404
           - debian11
           - debian12
           - amazon2023
           - arch
-          # - opensuse_tumbleweed  # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
+        molecule_docker_command:
+          - "/lib/systemd/systemd"
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v4
+      - name: Set up Python
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
         with:
-          python-version: 3.11
+          python-version: 3.12
+          cache: 'pip'
 
       - name: Install dependencies
-        run: |
-          sudo apt install git
-          python -m pip install --no-cache-dir --upgrade pip
-          pip install -r requirements.txt
+        run: pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
+      - name: Downgrade Ansible for Rocky 8 tests
+        run: pip install "ansible-core<2.17"
+        working-directory: ansible_collections/devsec/hardening
+        if: matrix.molecule_distro == 'rocky8'
+
       - name: Test with molecule
-        run: |
-          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
-            export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
-          fi
-          molecule --version
-          molecule converge -s ssh_hardening_custom_tests
+        run: molecule test -s ssh_hardening_custom_tests
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
+          MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
         working-directory: ansible_collections/devsec/hardening

CHANGELOG.md

@@ -1,11 +1,132 @@
 # Changelog
 
-## [8.9.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.9.0) (2023-11-16)
+## [10.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.1.0) (2024-10-13)
 
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.8.0...8.9.0)
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.0.0...10.1.0)
+
+**Implemented enhancements:**
+
+- Ubuntu 24.04 support [\#764](https://github.com/dev-sec/ansible-collection-hardening/issues/764)
+- feat\(ssh\): add alpine support [\#809](https://github.com/dev-sec/ansible-collection-hardening/pull/809) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Provide granular noop for ssh configuration [\#789](https://github.com/dev-sec/ansible-collection-hardening/pull/789) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([seven-beep](https://github.com/seven-beep))
+
+**Fixed bugs:**
+
+- molecule scenario ssh\_hardening if failing due to missing docker image [\#790](https://github.com/dev-sec/ansible-collection-hardening/issues/790)
+- getent\_shadow empty [\#787](https://github.com/dev-sec/ansible-collection-hardening/issues/787)
+- Error: Missing privilege separation directory: /run/sshd [\#752](https://github.com/dev-sec/ansible-collection-hardening/issues/752)
+- fix\(ssh\_hardening\): test setting kex to false, remove wrong default [\#808](https://github.com/dev-sec/ansible-collection-hardening/pull/808) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Closed issues:**
+
+- Dependency Dashboard [\#655](https://github.com/dev-sec/ansible-collection-hardening/issues/655)
+
+**Merged pull requests:**
+
+- fix\(cicd\): test idempotence on ssh custom tests [\#807](https://github.com/dev-sec/ansible-collection-hardening/pull/807) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Document correct quotes for ssh\_permit\_tunnel parameter [\#806](https://github.com/dev-sec/ansible-collection-hardening/pull/806) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([vmpr](https://github.com/vmpr))
+- fix\(docs\): add 'become: true' to example playbooks. fix \#787 [\#804](https://github.com/dev-sec/ansible-collection-hardening/pull/804) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- chore\(deps\): update dependency ansible-core to v2.17.5 [\#802](https://github.com/dev-sec/ansible-collection-hardening/pull/802) ([renovate[bot]](https://github.com/apps/renovate))
+- Don't run tests if the environment is not correct [\#801](https://github.com/dev-sec/ansible-collection-hardening/pull/801) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- chore\(deps\): update actions/checkout digest to eef6144 [\#800](https://github.com/dev-sec/ansible-collection-hardening/pull/800) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- feat: Corrected package name [\#799](https://github.com/dev-sec/ansible-collection-hardening/pull/799) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([PapaPeskwo](https://github.com/PapaPeskwo))
+- Use Python venv for VM tests [\#798](https://github.com/dev-sec/ansible-collection-hardening/pull/798) ([schurzi](https://github.com/schurzi))
+- Remove unused files and variables [\#797](https://github.com/dev-sec/ansible-collection-hardening/pull/797) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- chore\(deps\): update ansible/ansible-lint digest to 3b5bee1 [\#795](https://github.com/dev-sec/ansible-collection-hardening/pull/795) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 25f783c [\#792](https://github.com/dev-sec/ansible-collection-hardening/pull/792) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency ansible-core to v2.17.4 [\#791](https://github.com/dev-sec/ansible-collection-hardening/pull/791) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/setup-python digest to f677139 [\#788](https://github.com/dev-sec/ansible-collection-hardening/pull/788) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency ansible-core to v2.17.3 [\#786](https://github.com/dev-sec/ansible-collection-hardening/pull/786) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency ansible-core to v2.17.2 [\#756](https://github.com/dev-sec/ansible-collection-hardening/pull/756) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+
+## [10.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.0.0) (2024-08-06)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/9.0.1...10.0.0)
+
+**Implemented enhancements:**
+
+- option to disable regeneration of ssh private key [\#772](https://github.com/dev-sec/ansible-collection-hardening/issues/772)
+- Support systemd socket activation for sshd [\#763](https://github.com/dev-sec/ansible-collection-hardening/issues/763) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
+- Release 9.0.2 [\#758](https://github.com/dev-sec/ansible-collection-hardening/issues/758)
+- Make Publickey authentication configurable  [\#750](https://github.com/dev-sec/ansible-collection-hardening/issues/750)
+- Ansible Linting [\#747](https://github.com/dev-sec/ansible-collection-hardening/issues/747)
+- Make value of kernel.unprivileged\_userns\_clone depending on kernel version [\#727](https://github.com/dev-sec/ansible-collection-hardening/issues/727)
+- Ensure that ssh is installed \(cf \#771\) [\#774](https://github.com/dev-sec/ansible-collection-hardening/pull/774) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Byh0ki](https://github.com/Byh0ki))
+- ssh: explicitly enable or disable the service at boot [\#771](https://github.com/dev-sec/ansible-collection-hardening/pull/771) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Byh0ki](https://github.com/Byh0ki))
+- disable systemd socket activation [\#769](https://github.com/dev-sec/ansible-collection-hardening/pull/769) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Add ssh\_pubkey\_authentication variable to ssh hardening [\#749](https://github.com/dev-sec/ansible-collection-hardening/pull/749) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([debbabi](https://github.com/debbabi))
+
+**Fixed bugs:**
+
+- ssh hardening role fails when `ssh_permit_root_login` var is set on ubuntu 24.04 [\#768](https://github.com/dev-sec/ansible-collection-hardening/issues/768)
+- os\_hardening fails when setting vm.mmap\_rnd\_bits [\#757](https://github.com/dev-sec/ansible-collection-hardening/issues/757)
+- `ssh_gateway_ports` is documented to accept 'clientspecified' string, but only accepts bools [\#755](https://github.com/dev-sec/ansible-collection-hardening/issues/755)
+- harden permissions for directory mount /var/log fails for minimized Ubuntu 22.04  [\#741](https://github.com/dev-sec/ansible-collection-hardening/issues/741)
+- Update Debian compatibility [\#784](https://github.com/dev-sec/ansible-collection-hardening/pull/784) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- do not force type of ssh\_gateway\_ports [\#765](https://github.com/dev-sec/ansible-collection-hardening/pull/765) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Merged pull requests:**
+
+- Update to current Fedora releases [\#783](https://github.com/dev-sec/ansible-collection-hardening/pull/783) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Remove deprecated rebuild of initrd [\#782](https://github.com/dev-sec/ansible-collection-hardening/pull/782) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- chore\(deps\): update patrickjahns/version-drafter-action digest to 2076fa4 [\#781](https://github.com/dev-sec/ansible-collection-hardening/pull/781) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 95382d3 [\#779](https://github.com/dev-sec/ansible-collection-hardening/pull/779) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/setup-python digest to 39cd149 [\#778](https://github.com/dev-sec/ansible-collection-hardening/pull/778) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- remove tests for FreeBSD12 since it's out of support [\#777](https://github.com/dev-sec/ansible-collection-hardening/pull/777) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- chore\(deps\): pin dependencies [\#776](https://github.com/dev-sec/ansible-collection-hardening/pull/776) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- Use best-practice preset for renovate [\#775](https://github.com/dev-sec/ansible-collection-hardening/pull/775) ([schurzi](https://github.com/schurzi))
+- Deprecate Centos Stream 8 [\#770](https://github.com/dev-sec/ansible-collection-hardening/pull/770) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- centos7 is eol, remove it [\#767](https://github.com/dev-sec/ansible-collection-hardening/pull/767) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- fix spelling [\#766](https://github.com/dev-sec/ansible-collection-hardening/pull/766) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- ci: define permissions for enforce-labels workflow  [\#760](https://github.com/dev-sec/ansible-collection-hardening/pull/760) ([fgreinacher](https://github.com/fgreinacher))
+- Update dependency ansible-core to v2.16.5 [\#754](https://github.com/dev-sec/ansible-collection-hardening/pull/754) ([renovate[bot]](https://github.com/apps/renovate))
+- Update dependency ansible-core to v2.16.4 [\#751](https://github.com/dev-sec/ansible-collection-hardening/pull/751) ([renovate[bot]](https://github.com/apps/renovate))
+- Update ansible/ansible-lint action to v24 [\#745](https://github.com/dev-sec/ansible-collection-hardening/pull/745) ([renovate[bot]](https://github.com/apps/renovate))
+- Always update Vagrant Boxes before using [\#744](https://github.com/dev-sec/ansible-collection-hardening/pull/744) ([schurzi](https://github.com/schurzi))
+- Remove Docker containers on self-hosted runner after tests [\#743](https://github.com/dev-sec/ansible-collection-hardening/pull/743) ([schurzi](https://github.com/schurzi))
+- Update dependency ansible-core to v2.16.3 [\#742](https://github.com/dev-sec/ansible-collection-hardening/pull/742) ([renovate[bot]](https://github.com/apps/renovate))
+
+## [9.0.1](https://github.com/dev-sec/ansible-collection-hardening/tree/9.0.1) (2024-01-15)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/9.0.0...9.0.1)
+
+**Implemented enhancements:**
+
+- Extend ansible-lint testing to cover our test cases [\#731](https://github.com/dev-sec/ansible-collection-hardening/issues/731)
+-  Complete tests for OS hardening [\#660](https://github.com/dev-sec/ansible-collection-hardening/issues/660)
+- support restarts of audit service on Arch linux [\#722](https://github.com/dev-sec/ansible-collection-hardening/pull/722) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+
+**Fixed bugs:**
+
+- Fails to install [\#735](https://github.com/dev-sec/ansible-collection-hardening/issues/735)
+- Amazon Linux gpg check fails [\#734](https://github.com/dev-sec/ansible-collection-hardening/issues/734)
+- ssh\_hardening ipv6 [\#719](https://github.com/dev-sec/ansible-collection-hardening/issues/719)
+- boolean variable inconsistency? [\#330](https://github.com/dev-sec/ansible-collection-hardening/issues/330)
+- Restore idempotency for disabling unused filesystems with Ansible 2.16.0 [\#718](https://github.com/dev-sec/ansible-collection-hardening/pull/718) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([akikanellis](https://github.com/akikanellis))
+
+**Closed issues:**
+
+- 9.0.0 version number in galaxy.yml file is wrong [\#740](https://github.com/dev-sec/ansible-collection-hardening/issues/740)
+
+**Merged pull requests:**
+
+- restructure readme to move known limitations up top [\#739](https://github.com/dev-sec/ansible-collection-hardening/pull/739) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- release only on releases, not pre-releases [\#738](https://github.com/dev-sec/ansible-collection-hardening/pull/738) ([rndmh3ro](https://github.com/rndmh3ro))
+- Update dependency ansible-core to v2.16.2 [\#737](https://github.com/dev-sec/ansible-collection-hardening/pull/737) ([renovate[bot]](https://github.com/apps/renovate))
+- fix linting for github config [\#736](https://github.com/dev-sec/ansible-collection-hardening/pull/736) ([rndmh3ro](https://github.com/rndmh3ro))
+- Update actions/setup-python action to v5 [\#733](https://github.com/dev-sec/ansible-collection-hardening/pull/733) ([renovate[bot]](https://github.com/apps/renovate))
+- Update ansible-lint action and revise configuration to scan all Ansible code [\#732](https://github.com/dev-sec/ansible-collection-hardening/pull/732) ([schurzi](https://github.com/schurzi))
+- update labeler to new config format [\#730](https://github.com/dev-sec/ansible-collection-hardening/pull/730) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Update dependency ansible-core to v2.16.1 [\#728](https://github.com/dev-sec/ansible-collection-hardening/pull/728) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- pin Ansible to always let Renovate update to the most current version in our tests [\#721](https://github.com/dev-sec/ansible-collection-hardening/pull/721) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+
+## [9.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/9.0.0) (2023-11-16)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.8.0...9.0.0)
 
 **Breaking changes:**
 
+- make it possible to configure more then yes and no for PermitTunnel [\#715](https://github.com/dev-sec/ansible-collection-hardening/pull/715) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - add role argument spec for os, ssh, mysql [\#687](https://github.com/dev-sec/ansible-collection-hardening/pull/687) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 
 **Implemented enhancements:**
@@ -30,7 +151,6 @@
 
 **Closed issues:**
 
-- Dependency Dashboard [\#655](https://github.com/dev-sec/ansible-collection-hardening/issues/655)
 - Add send-to-mailinglist to github release action [\#434](https://github.com/dev-sec/ansible-collection-hardening/issues/434)
 
 **Merged pull requests:**

CONTRIBUTING.md

@@ -93,6 +93,21 @@ We generally include test for coding guidelines:
 
 Remember: Code is generally read much more often than written.
 
+### Local testing of roles in this collection
+
+We are using Molecule to test our roles.
+If you want to execute the tests on your machine you need Docker and Molecule.
+You will also need to set the `MOLECULE_DISTRO` environment variable to execute the tests.
+To find valid values for the variable you can take a look at our GitHub Action workflows in `.github/workflows/`.
+
+Example for executing tests locally:
+
+```bash
+pip install -r requirements.txt
+export MOLECULE_DISTRO="debian12"
+molecule test -s os_hardening
+```
+
 ### Use Markdown
 
 Wherever possible, please refrain from any other formats and stick to simple markdown.

README.md

@@ -13,13 +13,13 @@
 This collection provides battle tested hardening for:
 
 - Linux operating systems:
-  - CentOS 7/8/9
+  - CentOS 9
   - Rocky Linux 8/9
-  - Debian 10/11/12
-  - Ubuntu 18.04/20.04/22.04
+  - Debian 11/12
+  - Ubuntu 20.04/22.04/24.04
   - Amazon Linux (some roles supported)
   - Arch Linux (some roles supported)
-  - Fedora 37/38 (some roles supported)
+  - Fedora 39/40 (some roles supported)
   - Suse Tumbleweed (some roles supported)
 - MySQL
   - MariaDB >= 5.5.65, >= 10.1.45, >= 10.3.17

galaxy.yml

@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 8.8.0
+version: 10.0.0
 readme: README.md
 authors:
   - dev-sec <[email protected]>
@@ -22,6 +22,9 @@ tags:
   - nginx_hardening
   - os_hardening
   - ssh_hardening
+  - database
+  - linux
+  - security
 dependencies:
   ansible.posix: '>=1.0.0'
   community.crypto: '>=1.0.0'

molecule/mysql_hardening/converge.yml

@@ -1,38 +1,37 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
+- name: Wrapper playbook for kitchen testing "ansible-mysql-hardening"
   hosts: all
   become: true
-  collections:
-    - devsec.hardening
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
-      set_fact:
-        mysql_python_package_debian: "python3-pymysql"
+      ansible.builtin.set_fact:
+        mysql_python_package_debian: python3-pymysql
       when:
         - mysql_python_package_debian is not defined
         - ansible_distribution == "Ubuntu"
         - ansible_distribution_major_version|int > 19
 
     - name: Determine required MySQL Python libraries.
-      set_fact:
-        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
+      ansible.builtin.set_fact:
+        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
       when:
         - mysql_python_package_debian is not defined
         - ansible_distribution != "Ubuntu"
         - ansible_distribution_major_version|int < 20
 
     - name: Use Python 3 on Suse
-      set_fact:
+      ansible.builtin.set_fact:
         ansible_python_interpreter: /usr/bin/python3
       when:
         - ansible_os_family == 'Suse'
 
-    - include_role:
-        name: mysql_hardening
+    - name: Include mysql_hardening role
+      ansible.builtin.include_role:
+        name: devsec.hardening.mysql_hardening
   vars:
     overwrite_global_mycnf: false
     mysql_root_password: iloverandompasswordsbutthiswilldo

molecule/mysql_hardening/molecule.yml

@@ -8,7 +8,7 @@ driver:
   name: docker
 platforms:
   - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -33,6 +33,7 @@ scenario:
     - prepare
   check_sequence:
     - dependency
+    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -48,6 +49,7 @@ scenario:
     - destroy
   test_sequence:
     - dependency
+    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create

molecule/mysql_hardening/prepare.yml

@@ -1,80 +1,74 @@
 ---
-
-- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
+- name: Wrapper playbook for kitchen testing "ansible-mysql-hardening"
   hosts: all
   become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  tasks:
-    - name: Use Python 3 on Debian 11
-      set_fact:
-        ansible_python_interpreter: /usr/bin/python3
-      when:
-        - ansible_distribution == 'Debian'
-        - ansible_distribution_major_version|int >= 11
-
-    - name: Use Python 3 on Suse
-      set_fact:
-        ansible_python_interpreter: /usr/bin/python3
-      when:
-        - ansible_os_family == 'Suse'
-
-    - name: Use Python 2 on Debian 10
-      set_fact:
-        ansible_python_interpreter: /usr/bin/python
-      when:
-        - ansible_distribution == 'Debian'
-        - ansible_distribution_major_version|int == 10
-
-    - name: Run the equivalent of "apt-get update && apt-get upgrade"
-      apt:
-        name: "*"
-        state: latest
-        update_cache: true
-      when: ansible_os_family == 'Debian'
-
-    - name: Install required python packages on Suse
-      ansible.builtin.shell: zypper -n install python-xml python3-rpm python3-PyMySQL
-      when: ansible_os_family == 'Suse'
-
-    - name: create missing directory
-      file:
-        path: "/etc/mysql/conf.d"
-        state: directory
-
-    - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
-      set_fact:
-        mysql_python_package_debian: "python3-pymysql"
-      when:
-        - mysql_python_package_debian is not defined
-        - ansible_distribution == "Ubuntu"
-        - ansible_distribution_major_version|int > 19
-
-    - name: Determine required MySQL Python libraries.
-      set_fact:
-        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
-      when:
-        - mysql_python_package_debian is not defined
-        - ansible_distribution != "Ubuntu"
-        - ansible_distribution_major_version|int < 20
-
-    - name: Install required MySQL Python libraries on RHEL
-      yum:
-        name: "{% if 'python3' in ansible_python_interpreter|default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
-      when:
-        - ansible_os_family == "RedHat"
-        - ansible_distribution_major_version == "7"
-          
-    - include_role:
-        name: dev-sec.mysql
-
-    - name: include MySQL user prepare tasks
-      include_tasks: prepare_tasks/mysql_users.yml
   vars:
     overwrite_global_mycnf: false
     mysql_root_password: iloverandompasswordsbutthiswilldo
     mysql_user_password: iloverandompasswordsbutthiswilldo
     mysql_config_file: /etc/mysql/mariadb.cnf
     mysql_root_password_update: true
+  tasks:
+    - name: Use Python 3 on Debian 11
+      ansible.builtin.set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+      when:
+        - ansible_distribution == 'Debian'
+        - ansible_distribution_major_version|int >= 11
+
+    - name: Use Python 3 on Suse
+      ansible.builtin.set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+      when:
+        - ansible_os_family == 'Suse'
+
+    - name: Run the equivalent of "apt-get update && apt-get upgrade"
+      ansible.builtin.apt:
+        upgrade: safe
+        update_cache: true
+      when: ansible_os_family == 'Debian'
+
+    - name: Install required python packages on Suse
+      ansible.builtin.command: zypper -n install python-xml python3-rpm python3-PyMySQL
+      changed_when: false
+      when: ansible_os_family == 'Suse'
+
+    - name: Create missing directory
+      ansible.builtin.file:
+        path: /etc/mysql
+        state: directory
+        mode: "0755"
+
+    - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
+      ansible.builtin.set_fact:
+        mysql_python_package_debian: python3-pymysql
+      when:
+        - mysql_python_package_debian is not defined
+        - ansible_distribution == "Ubuntu"
+        - ansible_distribution_major_version|int > 19
+
+    - name: Determine required MySQL Python libraries.
+      ansible.builtin.set_fact:
+        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
+      when:
+        - mysql_python_package_debian is not defined
+        - ansible_distribution != "Ubuntu"
+        - ansible_distribution_major_version|int < 20
+
+    - name: Install required MySQL Python libraries on RHEL
+      ansible.builtin.dnf:
+        name: "{% if 'python3' in ansible_python_interpreter | default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
+      when:
+        - ansible_os_family == "RedHat"
+        - ansible_distribution_major_version == "7"
+
+    - name: Install mysql with a generic Ansible role
+      ansible.builtin.include_role:
+        name: dev-sec.mysql
+
+    - name: Include MySQL user prepare tasks
+      ansible.builtin.include_tasks: prepare_tasks/mysql_users.yml

molecule/mysql_hardening/prepare_tasks/mysql_users.yml

@@ -1,17 +1,17 @@
 ---
-- name: create users for test
+- name: Create users for test
   community.mysql.mysql_query:
     query:
-      - "CREATE USER 'user'@'delete';"
-      - "CREATE USER 'user'@'127.0.0.1';"
-      - "CREATE USER 'user'@'::1';"
-      - "CREATE USER 'user'@'%';"
-      - "CREATE USER 'user'@'192.168.0.%';"
-      - "CREATE USER 'user'@'192.168.0.1';"
-      - "CREATE USER    '%'@'192.168.0.1';"
-      - "CREATE USER 'user'@'192.168.0.2' IDENTIFIED BY 'keep';"
-      - "CREATE USER 'user'@'keep' IDENTIFIED BY 'keep';"
-      - "CREATE USER 'user'@'192.168.%' IDENTIFIED BY 'keep';"
+      - CREATE USER 'user'@'delete';
+      - CREATE USER 'user'@'127.0.0.1';
+      - CREATE USER 'user'@'::1';
+      - CREATE USER 'user'@'%';
+      - CREATE USER 'user'@'192.168.0.%';
+      - CREATE USER 'user'@'192.168.0.1';
+      - CREATE USER    '%'@'192.168.0.1';
+      - CREATE USER 'user'@'192.168.0.2' IDENTIFIED BY 'keep';
+      - CREATE USER 'user'@'keep' IDENTIFIED BY 'keep';
+      - CREATE USER 'user'@'192.168.%' IDENTIFIED BY 'keep';
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
 
 - name: Detect role support on MySQL
@@ -23,10 +23,10 @@
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   register: mysql_role_support
 
-- name: create roles for test
+- name: Create roles for test
   community.mysql.mysql_query:
     query:
-       - "CREATE ROLE 'role_keep';"
+      - CREATE ROLE 'role_keep';
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   when:
     - mysql_role_support.rowcount[0] > 0

molecule/mysql_hardening/verify.yml

@@ -8,23 +8,23 @@
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: Use Python 3 on Suse
-      set_fact:
+      ansible.builtin.set_fact:
         ansible_python_interpreter: /usr/bin/python3
       when:
         - ansible_os_family == 'Suse'
 
-    - name: install procps for debian systems
-      apt:
+    - name: Install procps for debian systems
+      ansible.builtin.apt:
         name: procps
         state: present
         update_cache: true
       when: ansible_distribution == 'Debian'
 
-    - name: include tests for the service
-      include_tasks: verify_tasks/service.yml
+    - name: Include tests for the service
+      ansible.builtin.include_tasks: verify_tasks/service.yml
 
-    - name: include tests for MySQL user
-      include_tasks: verify_tasks/mysql_users.yml
+    - name: Include tests for MySQL user
+      ansible.builtin.include_tasks: verify_tasks/mysql_users.yml
 
 - name: Verify
   hosts: localhost
@@ -34,7 +34,7 @@
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: Execute cinc-auditor tests
-      command: >
+      ansible.builtin.command: >
         docker run
         --volume /run/docker.sock:/run/docker.sock
         docker.io/cincproject/auditor exec
@@ -46,10 +46,10 @@
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      fail:
-        msg: "Inspec failed to validate"
+      ansible.builtin.fail:
+        msg: Inspec failed to validate
       when: test_results.rc != 0

molecule/mysql_hardening/verify_tasks/mysql_users.yml

@@ -6,11 +6,11 @@
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   register: mysql_users
 
-- name: create list of users from mysql query
-  set_fact:
+- name: Create list of users from mysql query
+  ansible.builtin.set_fact:
     mysql_users_list: "{{ mysql_users.query_result.0  | json_query('[*].users') | list }}"
 
-- name: assert that only accounts with password remain
+- name: Assert that only accounts with password remain
   ansible.builtin.assert:
     that:
       - '"user@delete" not in mysql_users_list'
@@ -33,9 +33,9 @@
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   register: mysql_role_support
 
-- name: assert that roles remain
+- name: Assert that roles remain
   ansible.builtin.assert:
     that:
-       - '"role_keep@" in mysql_users_list'
+      - '"role_keep@" in mysql_users_list'
   when:
     - mysql_role_support.rowcount[0] > 0

molecule/mysql_hardening/verify_tasks/service.yml

@@ -10,7 +10,7 @@
   ansible.builtin.service_facts:
 
 - name: Check if MySQL is running and enabled
-  assert:
+  ansible.builtin.assert:
     that:
-      - "ansible_facts.services[mysql_daemon + '.service'].state == 'running'"
-      - "ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'"
+      - ansible_facts.services[mysql_daemon + '.service'].state == 'running'
+      - ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'

molecule/nginx_hardening/converge.yml

@@ -1,16 +1,15 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   become: true
   hosts: all
-  collections:
-    - devsec.hardening
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   vars:
-    - nginx_ppa_use: true
-    - nginx_ppa_version: stable
+    nginx_ppa_use: true
+    nginx_ppa_version: stable
   tasks:
-    - include_role:
-        name: nginx_hardening
+    - name: Include nginx_hardening role
+      ansible.builtin.include_role:
+        name: devsec.hardening.nginx_hardening

molecule/nginx_hardening/molecule.yml

@@ -7,7 +7,7 @@ driver:
   name: docker
 platforms:
   - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -32,6 +32,7 @@ scenario:
     - prepare
   check_sequence:
     - dependency
+    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -47,6 +48,7 @@ scenario:
     - destroy
   test_sequence:
     - dependency
+    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create

molecule/nginx_hardening/official-nginx-role-debian.yml

@@ -1,24 +1,24 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   hosts: localhost
   vars:
-    - nginx_main_template_enable: true
-    - nginx_main_template:
-        template_file: nginx.conf.j2
-        conf_file_name: nginx.conf
-        conf_file_location: /etc/nginx/
-        user: www-data
-        worker_processes: auto
-        error_level: warn
-        worker_connections: 1024
-        http_enable: true
-        http_settings:
-          keepalive_timeout: 65
-          cache: false
-          rate_limit: false
-          keyval: false
-        stream_enable: false
-        http_global_autoindex: false
+    nginx_main_template_enable: true
+    nginx_main_template:
+      template_file: nginx.conf.j2
+      conf_file_name: nginx.conf
+      conf_file_location: /etc/nginx/
+      user: www-data
+      worker_processes: auto
+      error_level: warn
+      worker_connections: 1024
+      http_enable: true
+      http_settings:
+        keepalive_timeout: 65
+        cache: false
+        rate_limit: false
+        keyval: false
+      stream_enable: false
+      http_global_autoindex: false
   roles:
     - nginxinc.nginx
     - nginx_hardening

molecule/nginx_hardening/official-nginx-role-redhat.yml

@@ -1,5 +1,5 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   hosts: localhost
   roles:
     - nginxinc.nginx

molecule/nginx_hardening/prepare.yml

@@ -1,5 +1,5 @@
 ---
-- name: prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: Prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   become: true
   hosts: all
   environment:
@@ -7,22 +7,23 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: install required tools on SuSE
+    - name: Install required tools on SuSE
       community.general.zypper:
-        name: "python-xml"
+        name: python-xml
         state: present
       when: ansible_facts.os_family == 'Suse'
 
-    - name: install required packages
-      package:
-        name: "python3-apt"
+    - name: Install required packages
+      ansible.builtin.package:
+        name: python3-apt
         update_cache: true
-      ignore_errors: true  # noqa ignore-errors
+      ignore_errors: true # noqa ignore-errors
 
     - name: Set correct distribution Version for Amazon Linux
-      set_fact:
+      ansible.builtin.set_fact:
         ansible_distribution_major_version: 7
       when: ansible_distribution == 'Amazon'
 
-    - include_role:
+    - name: Install nginx with a generic Ansible role
+      ansible.builtin.include_role:
         name: geerlingguy.nginx

molecule/nginx_hardening/requirements.yml

@@ -1,3 +1,3 @@
 ---
 roles:
-  - geerlingguy.nginx
+  - name: geerlingguy.nginx

molecule/nginx_hardening/verify.yml

@@ -7,8 +7,8 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: install procps for debian systems
-      apt:
+    - name: Install procps for debian systems
+      ansible.builtin.apt:
         name: procps
         state: present
         update_cache: true
@@ -22,7 +22,7 @@
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: Execute cinc-auditor tests
-      command: >
+      ansible.builtin.command: >
         docker run
         --volume /run/docker.sock:/run/docker.sock
         docker.io/cincproject/auditor exec
@@ -34,10 +34,10 @@
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      fail:
-        msg: "Inspec failed to validate"
+      ansible.builtin.fail:
+        msg: Inspec failed to validate
       when: test_results.rc != 0

molecule/os_hardening/converge.yml

@@ -1,38 +1,36 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  collections:
-    - devsec.hardening
   tasks:
-    - name: workaround for https://github.com/ansible/ansible/issues/66304
-      set_fact:
-        ansible_virtualization_type: "docker"
-    - include_role:
-        name: os_hardening
+    - name: Workaround for https://github.com/ansible/ansible/issues/66304
+      ansible.builtin.set_fact:
+        ansible_virtualization_type: docker
+    - name: Include os_hardening role
+      ansible.builtin.include_role:
+        name: devsec.hardening.os_hardening
   vars:
     os_security_users_allow: change_user
     os_security_kernel_enable_core_dump: false
-    os_auditd_num_logs: 10
+    os_auditd_enabled: false
     os_security_suid_sgid_remove_from_unknown: true
     os_auth_pam_passwdqc_enable: false
     os_auth_lockout_time: 15
-    os_desktop_enable: true
-    os_env_extra_user_paths: ['/home']
+    os_env_extra_user_paths: [/home]
     os_auth_allow_homeless: true
-    os_security_suid_sgid_blacklist: ['/bin/umount']
-    os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
+    os_security_suid_sgid_blacklist: [/bin/umount]
+    os_security_suid_sgid_whitelist: [/usr/bin/rlogin]
     os_filesystem_whitelist: []
-    os_yum_repo_file_whitelist: ['foo.repo']
-    os_users_without_password_ageing: ['pw_no_ageing']
+    os_yum_repo_file_whitelist: [foo.repo]
+    os_users_without_password_ageing: [pw_no_ageing]
     os_auth_pw_warn_age: 7
     os_netrc_enabled: false
-    os_ignore_users: ["shell_sys_acc"]
-    os_ignore_home_folder_users: ["user_with_777_home"]
+    os_ignore_users: [shell_sys_acc]
+    os_ignore_home_folder_users: [user_with_777_home]
     sysctl_config:
       net.ipv4.ip_forward: 0
       net.ipv6.conf.all.forwarding: 0
@@ -73,8 +71,6 @@
 # - name: wrapper playbook for kitchen testing "ansible-os-hardening"
 #  hosts: all
 #  become: true
-#  collections:
-#    - devsec.hardening
 #  vars:
 #    os_auditd_enabled: false
 #  tasks:
@@ -84,9 +80,9 @@
 #      when: ansible_facts.distribution == 'Fedora'
 #
 #    - name: Run the equivalent of "apt-get update" as a separate step
-#      apt:
+#      ansible.builtin.apt:
 #        update_cache: yes
 #      when: ansible_facts.os_family == 'Debian'
 #
 #    - include_role:
-#        name: os_hardening
+#        name: devsec.hardening.os_hardening

molecule/os_hardening/molecule.yml

@@ -3,7 +3,7 @@ driver:
   name: docker
 platforms:
   - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -28,6 +28,7 @@ scenario:
     - prepare
   check_sequence:
     - dependency
+    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -43,6 +44,7 @@ scenario:
     - destroy
   test_sequence:
     - dependency
+    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create

molecule/os_hardening/prepare.yml

@@ -1,5 +1,5 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
   environment:
@@ -7,32 +7,32 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
-      set_fact:
-        ansible_python_interpreter: "/usr/bin/python3"
+    - name: Set ansible_python_interpreter to "/usr/bin/python3" on fedora
+      ansible.builtin.set_fact:
+        ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
     - name: Run the equivalent of "apt-get update && apt-get upgrade"
-      apt:
-        name: "*"
-        state: latest
+      ansible.builtin.apt:
+        upgrade: safe
         update_cache: true
       when: ansible_os_family == 'Debian'
 
-    - name: install required tools on SuSE
+    - name: Install required tools on SuSE
       # cannot use zypper module, since it depends on python-xml
-      shell: "zypper -n install python-xml awk"
+      ansible.builtin.command: zypper -n install python-xml awk
+      changed_when: false
       when: ansible_facts.os_family == 'Suse'
 
-    - name: install required tools on fedora
-      dnf:
+    - name: Install required tools on fedora
+      ansible.builtin.dnf:
         name:
           - python
           - findutils
           - procps-ng
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: install required tools on Arch
+    - name: Install required tools on Arch
       community.general.pacman:
         name:
           - awk
@@ -40,8 +40,8 @@
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: install required tools on RHEL  # noqa ignore-errors
-      yum:
+    - name: Install required tools on RHEL # noqa ignore-errors
+      ansible.builtin.dnf:
         name:
           - openssh-clients
           - openssh
@@ -49,15 +49,15 @@
         update_cache: true
       ignore_errors: true
 
-    - name: create recursing symlink to test minimize access
-      shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
+    - name: Create recursing symlink to test minimize access
+      ansible.builtin.shell: rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz
       changed_when: false
 
-    - name: include YUM prepare tasks
-      include_tasks: prepare_tasks/yum.yml
+    - name: Include YUM prepare tasks
+      ansible.builtin.include_tasks: prepare_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'
 
-    - name: include preparation tasks
+    - name: Include preparation tasks
       ansible.builtin.include_tasks:
         file: "{{ item }}"
       loop:

molecule/os_hardening/prepare_tasks/ignore_home_folders.yml

@@ -1,7 +1,7 @@
 ---
 - name: Create user whose home-folder should not be touched
   ansible.builtin.user:
-    name: "user_with_777_home"
+    name: user_with_777_home
 
 - name: Change mode of home-folder for user to 777
   ansible.builtin.file:

molecule/os_hardening/prepare_tasks/netrc.yml

@@ -1,8 +1,8 @@
 ---
 - name: create '.netrc' in /root
   ansible.builtin.copy:
-    dest: '/root/.netrc'
-    mode: '0600'
+    dest: /root/.netrc
+    mode: "0600"
     content: |
       machine localhost
       login root

molecule/os_hardening/prepare_tasks/pw_ageing.yml

@@ -1,9 +1,10 @@
+---
 - name: Create user those password ageing should not be changed
   user:
-    name: "pw_no_ageing"
-    password: "$6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1"
+    name: pw_no_ageing
+    password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
 
 - name: Create user those password ageing should be changed
   user:
-    name: "pw_ageing"
-    password: "$6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1"
+    name: pw_ageing
+    password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1

molecule/os_hardening/prepare_tasks/sys_account_shell.yml

@@ -1,5 +1,5 @@
 ---
 - name: Create system user with shell that should keep it
   user:
-    name: "shell_sys_acc"
-    shell: "/bin/bash"
+    name: shell_sys_acc
+    shell: /bin/bash

molecule/os_hardening/prepare_tasks/yum.yml

@@ -1,5 +1,5 @@
 ---
-- name: create 'foo' repository
+- name: Create 'foo' repository
   ansible.builtin.yum_repository:
     name: foo
     description: mandatory description
@@ -7,7 +7,7 @@
     enabled: false
     gpgcheck: false
 
-- name: create 'bar' repository
+- name: Create 'bar' repository
   ansible.builtin.yum_repository:
     name: bar
     description: mandatory description

molecule/os_hardening/verify.yml

@@ -7,27 +7,27 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: set ansible_python_interpreter to "/usr/bin/python3"
-      set_fact:
-        ansible_python_interpreter: "/usr/bin/python3"
+    - name: Set ansible_python_interpreter to "/usr/bin/python3"
+      ansible.builtin.set_fact:
+        ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: include verification tasks
+    - name: Include verification tasks
       ansible.builtin.include_tasks:
         file: "{{ item }}"
-      loop: 
+      loop:
         - verify_tasks/sys_account_shell.yml
         - verify_tasks/pw_ageing.yml
         - verify_tasks/netrc.yml
         - verify_tasks/ignore_home_folders.yml
 
-# temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
-#    - name: include PAM tests
-#      include_tasks: verify_tasks/pam.yml
-#      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+    # temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
+    #    - name: Include PAM tests
+    #      ansible.builtin.include_tasks: verify_tasks/pam.yml
+    #      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
 
-    - name: include YUM tests
-      include_tasks: verify_tasks/yum.yml
+    - name: Include YUM tests
+      ansible.builtin.include_tasks: verify_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'
 
 - name: Verify
@@ -38,7 +38,7 @@
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: Execute cinc-auditor tests
-      command: >
+      ansible.builtin.command: >
         docker run
         --volume /run/docker.sock:/run/docker.sock
         --volume {{ playbook_dir }}/waivers.yaml:/waivers.yaml
@@ -52,12 +52,12 @@
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      fail:
-        msg: "Inspec failed to validate"
+      ansible.builtin.fail:
+        msg: Inspec failed to validate
       when: test_results.rc != 0
 
 - name: Verify
@@ -67,19 +67,20 @@
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  collections:
-    - devsec.hardening
+  vars:
+    os_auditd_enabled: false
+    os_env_umask: "027 #override"
   tasks:
     # test if variable can be overridden
-    - name: workaround for https://github.com/ansible/ansible/issues/66304
-      set_fact:
-        ansible_virtualization_type: "docker"
-        os_env_umask: "027 #override"
+    - name: Workaround for https://github.com/ansible/ansible/issues/66304
+      ansible.builtin.set_fact:
+        ansible_virtualization_type: docker
 
-    - include_role:
-        name: os_hardening
+    - name: Include os_hardening role
+      ansible.builtin.include_role:
+        name: devsec.hardening.os_hardening
 
-    - name: verify os_env_umask
-      shell:
+    - name: Verify os_env_umask
+      ansible.builtin.command:
         cmd: "grep '027 #override' /etc/login.defs"
       changed_when: false

molecule/os_hardening/verify_tasks/netrc.yml

@@ -1,19 +1,19 @@
 ---
-- name: test that .netrc in root homedir exists
+- name: Test that .netrc in root homedir exists
   ansible.builtin.file:
-    path: '/root/.netrc'
+    path: /root/.netrc
     state: file
   register: result_test_netrc
 
-- name: output result if .netrc for user root exists
+- name: Output result if .netrc for user root exists
   ansible.builtin.assert:
     that:
-      - "result_test_netrc.state == 'file'"
-    fail_msg: ".netrc in /root/ not present"
-    success_msg: ".netrc exists in /root/"
+      - result_test_netrc.state == 'file'
+    fail_msg: .netrc in /root/ not present
+    success_msg: .netrc exists in /root/
 
-- name: delete '.netrc' in /root
+- name: Delete '.netrc' in /root
   ansible.builtin.file:
-    path: '/root/.netrc'
+    path: /root/.netrc
     state: absent
   when: result_test_netrc.state == 'file'

molecule/os_hardening/verify_tasks/pam.yml

@@ -1,5 +1,4 @@
 ---
-
 - name: install pip
   package:
     name:
@@ -14,12 +13,12 @@
     executable: /usr/bin/pip3
 
 - name: set password for test
-  set_fact:
-    test_pw: "myTest!pw"
+  ansible.builtin.set_fact:
+    test_pw: myTest!pw
 
 - name: set locale for test
-  set_fact:
-    locale: "en_US.UTF-8"
+  ansible.builtin.set_fact:
+    locale: en_US.UTF-8
   when:
     - ansible_facts.os_family == 'RedHat'
     - ansible_facts.distribution_major_version < '8'
@@ -30,16 +29,16 @@
     password: "{{ test_pw | password_hash('sha512') }}"
 
 - name: check successful login with correct password
-  shell:
-    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
+  ansible.builtin.shell:
+    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
     LANG: "{{ locale | default('C.UTF-8') }}"
 
 - name: check unsuccessful login with incorrect password
-  shell:
-    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+  ansible.builtin.shell:
+    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -47,8 +46,8 @@
   with_sequence: count=6
 
 - name: check unsuccessful login, with correct password (lockout)
-  shell:
-    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail"
+  ansible.builtin.shell:
+    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -59,8 +58,8 @@
     seconds: 20
 
 - name: check successful login
-  shell:
-    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
+  ansible.builtin.shell:
+    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"

molecule/os_hardening/verify_tasks/pw_ageing.yml

@@ -7,7 +7,7 @@
 - name: Check that the expiry date of pw_no_ageing is "never"
   ansible.builtin.assert:
     that:
-      - "expiry_date.stdout | trim == 'never'"
+      - expiry_date.stdout | trim == 'never'
 
 - name: Get Password Expiry date for pw_ageing
   ansible.builtin.shell: chage -l pw_ageing | grep "Password expires" | cut -d ":" -f 2
@@ -19,7 +19,7 @@
     # this uses the date from the expire_date variable and subtracts the current date.
     # it should be bigger that the password_expire_min of the user "pw_no_ageing"
     that:
-      - "{{ ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_date_time.date | to_datetime('%Y-%m-%d')).days }} == 60"
+      - ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_date_time.date | to_datetime('%Y-%m-%d')).days == 60
 
 - name: Get Password Expiry warning days for pw_ageing
   ansible.builtin.shell: chage -l pw_ageing | grep "warning before password expires" | cut -d ":" -f 2
@@ -29,4 +29,4 @@
 - name: Check that number of days of warning before password expires is 7 days
   ansible.builtin.assert:
     that:
-      - "expiry_warndays.stdout | trim == '7'"
+      - expiry_warndays.stdout | trim == '7'

molecule/os_hardening/verify_tasks/sys_account_shell.yml

@@ -1,8 +1,9 @@
+---
 - name: Read local linux user database
   getent:
     database: passwd
 
 - name: Check that shell_sys_acc's shell is still bash
-  assert:
+  ansible.builtin.assert:
     that:
       - getent_passwd['shell_sys_acc'][5] == "/bin/bash"

molecule/os_hardening/verify_tasks/yum.yml

@@ -1,8 +1,8 @@
 ---
-- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
-  command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
+- name: Verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
+  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
   changed_when: false
 
-- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
-  command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
+- name: Verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
+  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
   changed_when: false

molecule/os_hardening_vm/converge.yml

@@ -1,30 +1,44 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  collections:
-    - devsec.hardening
   tasks:
-    - name: override for arch
-      set_fact: 
+    - name: Override for arch
+      ansible.builtin.set_fact:
         os_mnt_boot_enabled: false
-      when: ansible_facts.os_family == 'Archlinux'
-    - name: overrides for Fedora image
-      set_fact: 
         os_mnt_tmp_enabled: true
-        os_mnt_tmp_src: "tmpfs"
-        os_mnt_tmp_filesystem: "tmpfs"
+        os_mnt_tmp_src: tmpfs
+        os_mnt_tmp_filesystem: tmpfs
+      when: ansible_facts.os_family == 'Archlinux'
+
+    - name: Overrides for Fedora image
+      ansible.builtin.set_fact:
+        os_mnt_tmp_enabled: true
+        os_mnt_tmp_src: tmpfs
+        os_mnt_tmp_filesystem: tmpfs
       when: ansible_facts.distribution == 'Fedora'
-    - include_role:
-        name: os_hardening
+
+    - name: Overrides for Fedora 40 image
+      ansible.builtin.set_fact:
+        os_mnt_var_enabled: true
+        os_mnt_var_src: UUID=282c6d73-afc2-4113-9856-c7679ad51920
+        os_mnt_var_filesystem: btrfs
+        os_mnt_var_options: rw,nosuid,nodev,compress=zstd:1,subvol=var
+      when:
+        - ansible_facts.distribution == 'Fedora'
+        - ansible_distribution_major_version|int == 40
+
+    - name: Include os_hardening role
+      ansible.builtin.include_role:
+        name: devsec.hardening.os_hardening
   vars:
     os_auth_pam_passwdqc_enable: false
     os_auth_lockout_time: 15
-    os_yum_repo_file_whitelist: ['foo.repo']
+    os_yum_repo_file_whitelist: [foo.repo]
     os_mnt_boot_enabled: true
     os_mnt_home_enabled: true
-    os_mnt_boot_src: "/dev/vda1"
+    os_mnt_boot_src: /dev/vda1

molecule/os_hardening_vm/molecule.yml

@@ -2,7 +2,7 @@
 dependency:
   name: galaxy
   options:
-    role-file: molecule/os_hardening/requirements.yml
+    role-file: molecule/os_hardening_vm/requirements.yml
 driver:
   name: vagrant
   provider:
@@ -11,8 +11,8 @@ platforms:
   # we need to name every instance differently to start multiple VMs on the same host (parallelization)
   # since we also need to use different OS users to run the tests because of how molecule operates,
   # the VM names must be predictable by OS user (to clean up canceled runs)
-  - name: "${USER}"
-    box: "${MOLECULE_DISTRO}"
+  - name: ${USER}
+    box: ${MOLECULE_DISTRO}
     memory: 1024
     cpus: 2
 provisioner:
@@ -37,6 +37,7 @@ scenario:
     - prepare
   check_sequence:
     - dependency
+    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -52,6 +53,7 @@ scenario:
     - destroy
   test_sequence:
     - dependency
+    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create

molecule/os_hardening_vm/prepare.yml

@@ -1,5 +1,15 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: Prepare Archliux host
+  hosts: all
+  become: true
+  gather_facts: false
+  tasks:
+    - name: Install python, since it's not installed by default
+      ansible.builtin.raw: pacman --noconfirm -Sy python
+      changed_when: false
+      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
+
+- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
   environment:
@@ -7,30 +17,55 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
-      set_fact:
-        ansible_python_interpreter: "/usr/bin/python3"
+    - name: Set ansible_python_interpreter to "/usr/bin/python3" on fedora
+      ansible.builtin.set_fact:
+        ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
+    - name: Block update of Grub, because of error
+      ansible.builtin.dpkg_selections:
+        name: grub-pc
+        selection: hold
+      when: ansible_os_family == 'Debian'
+
+    # we need to free up space, since the /boot partition in some Vagrant images is
+    # pretty small and system updates might fail
+    - name: Find all initrd.img to delete them
+      ansible.builtin.find:
+        paths: /boot
+        patterns: "initrd.img*"
+      register: find_results
+      when: ansible_os_family == 'Debian'
+
+    - name: Delete all initrd.img to free space on /boot
+      ansible.builtin.file:
+        path: "{{ item['path'] }}"
+        state: absent
+      with_items: "{{ find_results['files'] }}"
+      when: ansible_os_family == 'Debian'
+
     - name: Run the equivalent of "apt-get update && apt-get upgrade"
-      apt:
+      ansible.builtin.apt:
+        upgrade: safe
         update_cache: true
       when: ansible_os_family == 'Debian'
 
-    - name: install required tools on SuSE
+    - name: Install required tools on SuSE
       # cannot use zypper module, since it depends on python-xml
-      shell: "zypper -n install python-xml"
+      ansible.builtin.command: zypper -n install python-xml
+      changed_when: false
       when: ansible_facts.os_family == 'Suse'
 
-    - name: install required tools on fedora
-      dnf:
+    - name: Install required tools on fedora
+      ansible.builtin.dnf:
         name:
           - python
           - findutils
           - procps-ng
+          - python3-libselinux
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: install required tools on Arch
+    - name: Install required tools on Arch
       community.general.pacman:
         name:
           - awk
@@ -38,8 +73,8 @@
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: install required tools on RHEL  # noqa ignore-errors
-      yum:
+    - name: Install required tools on RHEL # noqa ignore-errors
+      ansible.builtin.dnf:
         name:
           - openssh-clients
           - openssh
@@ -47,8 +82,8 @@
         update_cache: true
       ignore_errors: true
 
-    - name: create recursing symlink to test minimize access
-      shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
+    - name: Create recursing symlink to test minimize access
+      ansible.builtin.shell: rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz
       changed_when: false
 
     - name: Unmount EFI partition to get rid of vfat filesystem (qemu has no firmware image that inspec can detect)
@@ -57,6 +92,6 @@
         state: unmounted
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: include YUM prepare tasks
-      include_tasks: prepare_tasks/yum.yml
+    - name: Include YUM prepare tasks
+      ansible.builtin.include_tasks: prepare_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'

molecule/os_hardening_vm/prepare_tasks/yum.yml

@@ -1,5 +1,5 @@
 ---
-- name: create 'foo' repository
+- name: Create 'foo' repository
   ansible.builtin.yum_repository:
     name: foo
     description: mandatory description
@@ -7,7 +7,7 @@
     enabled: false
     gpgcheck: false
 
-- name: create 'bar' repository
+- name: Create 'bar' repository
   ansible.builtin.yum_repository:
     name: bar
     description: mandatory description

molecule/os_hardening_vm/requirements.yml

@@ -1,3 +1,3 @@
 ---
 roles:
-  - geerlingguy.git
+  - name: geerlingguy.git

molecule/os_hardening_vm/verify.yml

@@ -7,14 +7,13 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
+    # temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
+    #    - name: Include PAM tests
+    #      ansible.builtin.include_tasks: verify_tasks/pam.yml
+    #      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
 
-# temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
-#    - name: include PAM tests
-#      include_tasks: verify_tasks/pam.yml
-#      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
-
-    - name: include YUM tests
-      include_tasks: verify_tasks/yum.yml
+    - name: Include YUM tests
+      ansible.builtin.include_tasks: verify_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'
 
 - name: Verify
@@ -24,22 +23,23 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: get ssh-config
-      command:
-        cmd: "vagrant ssh-config"
+    - name: Get ssh-config
+      ansible.builtin.command:
+        cmd: vagrant ssh-config
         chdir: "{{ molecule_ephemeral_directory }}"
       register: ssh_config
       changed_when: false
 
-    - name: create ssh-config file
-      copy:
+    - name: Create ssh-config file
+      ansible.builtin.copy:
         content: "{{ ssh_config.stdout_lines | join ('\n') }}"
         dest: "{{ molecule_ephemeral_directory }}/ssh-config"
+        mode: "0400"
       changed_when: false
 
     - name: Execute cinc-auditor tests
-      command: >
-        docker run
+      ansible.builtin.command: >
+        docker run --rm
         --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
         docker.io/cincproject/auditor exec
         --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
@@ -51,10 +51,10 @@
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      fail:
-        msg: "Inspec failed to validate"
+      ansible.builtin.fail:
+        msg: Inspec failed to validate
       when: test_results.rc != 0

molecule/os_hardening_vm/verify_tasks/pam.yml

@@ -12,12 +12,12 @@
     state: present
 
 - name: set password for test
-  set_fact:
-    test_pw: "myTest!pw"
+  ansible.builtin.set_fact:
+    test_pw: myTest!pw
 
 - name: set locale for test
-  set_fact:
-    locale: "en_US.UTF-8"
+  ansible.builtin.set_fact:
+    locale: en_US.UTF-8
   when:
     - ansible_facts.os_family == 'RedHat'
     - ansible_facts.distribution_major_version < '8'
@@ -28,16 +28,16 @@
     password: "{{ test_pw | password_hash('sha512') }}"
 
 - name: check successful login with correct password
-  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+  ansible.builtin.shell:
+    cmd: pam-tester --user testuser --password {{ test_pw }}
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
     LANG: "{{ locale | default('C.UTF-8') }}"
 
 - name: check unsuccessful login with incorrect password
-  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+  ansible.builtin.shell:
+    cmd: pam-tester --user testuser --password {{ test_pw }}fail --expectfail
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -45,8 +45,8 @@
   with_sequence: count=6
 
 - name: check unsuccessful login, with correct password (lockout)
-  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
+  ansible.builtin.shell:
+    cmd: pam-tester --user testuser --password {{ test_pw }} --expectfail
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -57,8 +57,8 @@
     seconds: 20
 
 - name: check successful login
-  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+  ansible.builtin.shell:
+    cmd: pam-tester --user testuser --password {{ test_pw }}
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"

molecule/os_hardening_vm/verify_tasks/yum.yml

@@ -1,8 +1,8 @@
 ---
-- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
-  command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
+- name: Verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
+  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
   changed_when: false
 
-- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
-  command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
+- name: Verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
+  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
   changed_when: false

molecule/shared/prerequisites.yml

@@ -0,0 +1,9 @@
+---
+- name: Verify prerequisites
+  hosts: localhost
+  tasks:
+    - name: Make sure environment variable for MOLECULE_DISTRO is set
+      ansible.builtin.assert:
+        that:
+          - "lookup('env','MOLECULE_DISTRO')"
+        fail_msg: "You need to set MOLECULE_DISTRO to a supported image name. See CONTRIBUTING.md"

molecule/ssh_hardening/converge.yml

@@ -1,14 +1,13 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  collections:
-    - devsec.hardening
   tasks:
-    - include_role:
-        name: ssh_hardening
+    - name: Include ssh_hardening role
+      ansible.builtin.include_role:
+        name: devsec.hardening.ssh_hardening
   vars:
     sftp_enabled: false

molecule/ssh_hardening/molecule.yml

@@ -3,7 +3,7 @@ driver:
   name: docker
 platforms:
   - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -34,6 +34,7 @@ scenario:
     - prepare
   check_sequence:
     - dependency
+    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -49,6 +50,7 @@ scenario:
     - destroy
   test_sequence:
     - dependency
+    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create

molecule/ssh_hardening/prepare.yml

@@ -1,5 +1,5 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: Prepare the molecule container for the role
   hosts: all
   become: true
   environment:
@@ -7,13 +7,13 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: use python3
-      set_fact:
+    - name: Use python3
+      ansible.builtin.set_fact:
         ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: install packages  # noqa ignore-errors
-      yum:
+    - name: Install packages # noqa ignore-errors
+      ansible.builtin.dnf:
         name:
           - openssh-clients
           - openssh-server
@@ -22,8 +22,8 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install packages  # noqa ignore-errors
-      dnf:
+    - name: Install packages # noqa ignore-errors
+      ansible.builtin.dnf:
         name:
           - openssh-clients
           - openssh-server
@@ -32,8 +32,8 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install packages  # noqa ignore-errors
-      apt:
+    - name: Install packages # noqa ignore-errors
+      ansible.builtin.apt:
         name:
           - openssh-client
           - openssh-server
@@ -41,19 +41,28 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install required tools on SuSE
+    - name: Install required tools on SuSE
       # cannot use zypper module, since it depends on python-xml
-      shell: "zypper -n install python-xml"
+      ansible.builtin.command: zypper -n install python-xml
+      changed_when: false
       when: ansible_facts.os_family == 'Suse'
 
-    - name: install packages
-      zypper:
+    - name: Install packages
+      community.general.zypper:
         name:
-          - "openssh"
+          - openssh
       when: ansible_facts.os_family == 'Suse'
 
-    - name: install required tools on Arch
-      pacman:
+    - name: Install required tools on Alpine
+      community.general.apk:
+        name:
+          - openssh
+        state: present
+        update_cache: true
+      when: ansible_facts.os_family == 'Alpine'
+
+    - name: Install required tools on Arch
+      community.general.pacman:
         name:
           - openssh
           - awk
@@ -61,16 +70,11 @@
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: created needed directory
-      file:
-        path: "/var/run/sshd"
-        state: directory
-
-    - name: create ssh host keys  # noqa ignore-errors
-      command: "ssh-keygen -A"
-      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
-            ansible_facts.distribution == "Fedora" or
-            ansible_facts.distribution == "Amazon" or
-            ansible_facts.os_family == "Suse"
+    - name: Create ssh host keys # noqa ignore-errors
+      ansible.builtin.command: ssh-keygen -A
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
+        or ansible_facts.distribution == "Fedora"
+        or ansible_facts.distribution == "Amazon"
+        or ansible_facts.os_family == "Suse"
       changed_when: false
       ignore_errors: true

molecule/ssh_hardening/verify.yml

@@ -7,7 +7,7 @@
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: Execute cinc-auditor tests
-      command: >
+      ansible.builtin.command: >
         docker run
         --volume /run/docker.sock:/run/docker.sock
         docker.io/cincproject/auditor exec
@@ -19,10 +19,10 @@
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      fail:
-        msg: "Inspec failed to validate"
+      ansible.builtin.fail:
+        msg: Inspec failed to validate
       when: test_results.rc != 0

molecule/ssh_hardening_bsd/converge.yml

@@ -1,14 +1,13 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  collections:
-    - devsec.hardening
   tasks:
-    - include_role:
-        name: ssh_hardening
+    - name: Include ssh_hardening role
+      ansible.builtin.include_role:
+        name: devsec.hardening.ssh_hardening
   vars:
     sftp_enabled: false

molecule/ssh_hardening_bsd/molecule.yml

@@ -7,8 +7,8 @@ platforms:
   # we need to name every instance differently to start multiple VMs on the same host (parallelization)
   # since we also need to use different OS users to run the tests because of how molecule operates,
   # the VM names must be predictable by OS user (to clean up canceled runs)
-  - name: "${USER}"
-    box: "generic/${MOLECULE_DISTRO}"
+  - name: ${USER}
+    box: generic/${MOLECULE_DISTRO}
     memory: 1024
     cpus: 2
 provisioner:
@@ -33,6 +33,7 @@ scenario:
     - prepare
   check_sequence:
     - dependency
+    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -48,6 +49,7 @@ scenario:
     - destroy
   test_sequence:
     - dependency
+    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create

molecule/ssh_hardening_bsd/prepare.yml

@@ -1,15 +1,16 @@
 ---
-- name: prepare OpenBSD host
+- name: Prepare OpenBSD host
   hosts: all
   become: true
   gather_facts: false
   tasks:
-    - name: install python
+    - name: Install python
       # BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
-      raw: "pkg_add python%3.10"
-      when: "lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'"
+      ansible.builtin.raw: pkg_add python%3.10
+      changed_when: false
+      when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
 
-- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
   become: true
   environment:
@@ -17,16 +18,11 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: created needed directory
-      file:
-        path: "/var/run/sshd"
-        state: directory
-
-    - name: create ssh host keys  # noqa ignore-errors
-      command: "ssh-keygen -A"
-      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
-            ansible_facts.distribution == "Fedora" or
-            ansible_facts.distribution == "Amazon" or
-            ansible_facts.os_family == "Suse"
+    - name: Create ssh host keys # noqa ignore-errors
+      ansible.builtin.command: ssh-keygen -A
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
+        or ansible_facts.distribution == "Fedora"
+        or ansible_facts.distribution == "Amazon"
+        or ansible_facts.os_family == "Suse"
       changed_when: false
       ignore_errors: true

molecule/ssh_hardening_bsd/verify.yml

@@ -3,12 +3,13 @@
   hosts: all
   become: true
   tasks:
-    - name: use the type command instead of which to detect existing commands
-      file:
-        src: "/usr/bin/which"
-        dest: "/usr/bin/type"
+    - name: Use the type command instead of which to detect existing commands
+      ansible.builtin.file:
+        src: /usr/bin/which
+        dest: /usr/bin/type
         state: hard
-      when: "lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'"
+        mode: "0770"
+      when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
 
 - name: Verify
   hosts: localhost
@@ -17,22 +18,23 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: get ssh-config
-      command: 
-        cmd: "vagrant ssh-config"
+    - name: Get ssh-config
+      ansible.builtin.command:
+        cmd: vagrant ssh-config
         chdir: "{{ molecule_ephemeral_directory }}"
       register: ssh_config
       changed_when: false
 
-    - name: create ssh-config file
-      copy:
+    - name: Create ssh-config file
+      ansible.builtin.copy:
         content: "{{ ssh_config.stdout_lines | join ('\n') }}"
         dest: "{{ molecule_ephemeral_directory }}/ssh-config"
+        mode: "0400"
       changed_when: false
 
     - name: Execute cinc-auditor tests
-      command: >
-        docker run
+      ansible.builtin.command: >
+        docker run --rm
         --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
         --volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') }}.yaml:/waivers.yaml
         docker.io/cincproject/auditor exec
@@ -46,10 +48,10 @@
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      fail:
-        msg: "Inspec failed to validate"
+      ansible.builtin.fail:
+        msg: Inspec failed to validate
       when: test_results.rc != 0

molecule/ssh_hardening_bsd/waivers_freebsd12.yaml

@@ -1,3 +0,0 @@
-sshd-45:
-  run: false
-  justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"

molecule/ssh_hardening_custom_tests/converge.yml

@@ -1,44 +1,43 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
   hosts: all
   become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  collections:
-    - devsec.hardening
   tasks:
-    - include_role:
-        name: ssh_hardening
+    - name: Include ssh_hardening role
+      ansible.builtin.include_role:
+        name: devsec.hardening.ssh_hardening
   vars:
-    ssh_trusted_user_ca_keys_file: '/etc/ssh/ca.pub'
+    ssh_trusted_user_ca_keys_file: /etc/ssh/ca.pub
     ssh_trusted_user_ca_keys:
-      - '# ssh-rsa ...'
-    ssh_authorized_principals_file: '/etc/ssh/auth_principals/%u'
+      - "# ssh-rsa ..."
+    ssh_authorized_principals_file: /etc/ssh/auth_principals/%u
     ssh_authorized_principals:
-      - path: "/etc/ssh/auth_principals/root"
+      - path: /etc/ssh/auth_principals/root
         principals:
-          - "root"
+          - root
     network_ipv6_enable: true
-    ssh_allow_tcp_forwarding: 'yes'
-    ssh_gateway_ports: true
+    ssh_allow_tcp_forwarding: "yes"
+    ssh_gateway_ports: "clientspecified"
     ssh_allow_agent_forwarding: true
-    ssh_server_permit_environment_vars: 'yes'
-    ssh_server_accept_env_vars: 'PWD HTTP_PROXY'
+    ssh_server_permit_environment_vars: "yes"
+    ssh_server_accept_env_vars: PWD HTTP_PROXY
     ssh_client_alive_interval: 100
     ssh_client_alive_count: 10
     ssh_client_password_login: true
     ssh_challengeresponseauthentication: true
     ssh_compression: true
-    ssh_allow_users: 'root kitchen vagrant'
-    ssh_allow_groups: 'root kitchen vagrant'
-    ssh_deny_users: 'foo bar'
-    ssh_deny_groups: 'foo bar'
-    ssh_authorized_keys_file: '/etc/ssh/authorized_keys/%u'
+    ssh_allow_users: root kitchen vagrant
+    ssh_allow_groups: root kitchen vagrant
+    ssh_deny_users: foo bar
+    ssh_deny_groups: foo bar
+    ssh_authorized_keys_file: /etc/ssh/authorized_keys/%u
     ssh_max_auth_retries: 10
-    ssh_permit_root_login: "without-password"
-    ssh_permit_tunnel: 'yes'
+    ssh_permit_root_login: without-password
+    ssh_permit_tunnel: "yes"
     ssh_print_motd: true
     ssh_print_last_log: true
     ssh_banner: true
@@ -49,33 +48,33 @@
       - 22
       - 222
     ssh_server_match_address:
-      - address: '192.168.1.0/24'
+      - address: 192.168.1.0/24
         rules:
-          - 'AllowTcpForwarding yes'
-          - 'AllowAgentForwarding no'
+          - AllowTcpForwarding yes
+          - AllowAgentForwarding no
     ssh_server_match_group:
-      - group: 'root'
+      - group: root
         rules:
-          - 'AllowTcpForwarding yes'
-          - 'AllowAgentForwarding no'
+          - AllowTcpForwarding yes
+          - AllowAgentForwarding no
     ssh_server_match_user:
-      - user: 'root'
+      - user: root
         rules:
-          - 'AllowTcpForwarding yes'
-          - 'AllowAgentForwarding no'
+          - AllowTcpForwarding yes
+          - AllowAgentForwarding no
     ssh_server_match_local_port:
       - port: 222
         rules:
-          - 'AllowTcpForwarding yes'
-          - 'AllowAgentForwarding no'
+          - AllowTcpForwarding yes
+          - AllowAgentForwarding no
     ssh_remote_hosts:
-      - names: ['example.com', 'example2.com']
-        options: ['Port 2222', 'ForwardAgent yes']
-      - names: ['example3.com']
-        options: ['StrictHostKeyChecking no']
+      - names: [example.com, example2.com]
+        options: [Port 2222, ForwardAgent yes]
+      - names: [example3.com]
+        options: [StrictHostKeyChecking no]
     ssh_use_dns: true
     ssh_use_pam: true
-    ssh_max_startups: '10:30:60'
+    ssh_max_startups: 10:30:60
     ssh_host_key_algorithms:
       - ssh-ed25519
       - rsa-sha2-512
@@ -89,10 +88,9 @@
       - aes192-ctr
       - aes128-ctr
       - aes256-cbc
-    ssh_kex:
-      - diffie-hellman-group-exchange-sha256
-      - diffie-hellman-group-exchange-sha1
+    # these should not be set in the final sshd_config
+    ssh_kex: false
     ssh_custom_options:
-      - "Include /etc/ssh/ssh_config.d/*"
+      - Include /etc/ssh/ssh_config.d/*
     sshd_custom_options:
-      - "AcceptEnv LANG"
+      - AcceptEnv LANG

molecule/ssh_hardening_custom_tests/molecule.yml

@@ -3,7 +3,7 @@ driver:
   name: docker
 platforms:
   - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -28,6 +28,7 @@ scenario:
     - prepare
   check_sequence:
     - dependency
+    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -43,6 +44,7 @@ scenario:
     - destroy
   test_sequence:
     - dependency
+    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create
@@ -50,5 +52,4 @@ scenario:
     - check
     - converge
     - idempotence
-    - verify
     - destroy

molecule/ssh_hardening_custom_tests/prepare.yml

@@ -1,5 +1,5 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
   become: true
   environment:
@@ -7,13 +7,13 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: use python3
-      set_fact:
+    - name: Use python3
+      ansible.builtin.set_fact:
         ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: install packages  # noqa ignore-errors
-      yum:
+    - name: Install packages # noqa ignore-errors
+      ansible.builtin.dnf:
         name:
           - openssh-clients
           - openssh-server
@@ -22,8 +22,8 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install packages  # noqa ignore-errors
-      dnf:
+    - name: Install packages # noqa ignore-errors
+      ansible.builtin.dnf:
         name:
           - openssh-clients
           - openssh-server
@@ -32,8 +32,8 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install packages  # noqa ignore-errors
-      apt:
+    - name: Install packages # noqa ignore-errors
+      ansible.builtin.apt:
         name:
           - openssh-client
           - openssh-server
@@ -41,19 +41,20 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install required tools on SuSE
+    - name: Install required tools on SuSE
       # cannot use zypper module, since it depends on python-xml
-      shell: "zypper -n install python-xml"
+      ansible.builtin.command: zypper -n install python-xml
+      changed_when: false
       when: ansible_facts.os_family == 'Suse'
 
-    - name: install packages
-      zypper:
+    - name: Install packages
+      community.general.zypper:
         name:
-          - "openssh"
+          - openssh
       when: ansible_facts.os_family == 'Suse'
 
-    - name: install required tools on Arch
-      pacman:
+    - name: Install required tools on Arch
+      community.general.pacman:
         name:
           - openssh
           - awk
@@ -61,16 +62,19 @@
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: created needed directory
-      file:
-        path: "/var/run/sshd"
-        state: directory
+    - name: Install required tools on Alpine
+      community.general.apk:
+        name:
+          - openssh
+        state: present
+        update_cache: true
+      when: ansible_facts.os_family == 'Alpine'
 
-    - name: create ssh host keys  # noqa ignore-errors
-      command: "ssh-keygen -A"
-      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
-            ansible_facts.distribution == "Fedora" or
-            ansible_facts.distribution == "Amazon" or
-            ansible_facts.os_family == "Suse"
+    - name: Create ssh host keys # noqa ignore-errors
+      ansible.builtin.command: ssh-keygen -A
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
+        or ansible_facts.distribution == "Fedora"
+        or ansible_facts.distribution == "Amazon"
+        or ansible_facts.os_family == "Suse"
       changed_when: false
       ignore_errors: true

renovate.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:base",
+    "config:best-practices",
     ":gitSignOff"
   ],
   "dependencyDashboard": true,

requirements.txt

@@ -1,8 +1,6 @@
-molecule
-molecule-plugins[docker]
-yamllint
-ansible
-ansible-lint
-docker
-flake8
-jmespath
+molecule==24.9.0
+molecule-plugins[docker]==23.5.3
+ansible-core==2.17.5
+docker==7.1.0
+jmespath==1.0.1
+aar-doc==2.0.0

roles/mysql_hardening/README.md

@@ -26,11 +26,11 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
 ## Supported Operating Systems
 
 - EL
-  - 7, 8, 9
+  - 8, 9
 - Ubuntu
-  - bionic, focal, jammy
+  - focal, jammy, noble
 - Debian
-  - bullseye, buster
+  - bullseye, bookworm
 - Amazon
 - opensuse
 
@@ -135,6 +135,7 @@ None.
 
 ```
 - hosts: all
+  become: true
   roles:
     - name: devsec.hardening.mysql_hardening
 ```

roles/mysql_hardening/meta/main.yml

@@ -8,18 +8,17 @@ galaxy_info:
   platforms:
     - name: EL
       versions:
-        - "7"
         - "8"
         - "9"
     - name: Ubuntu
       versions:
-        - bionic
         - focal
         - jammy
+        - noble
     - name: Debian
       versions:
         - bullseye
-        - buster
+        - bookworm
     - name: Amazon
     - name: opensuse
   galaxy_tags:

roles/nginx_hardening/README.md

@@ -19,11 +19,11 @@ It works with the following nginx-roles, including, but not limited to:
 ## Supported Operating Systems
 
 - EL
-  - 7, 8, 9
+  - 8, 9
 - Ubuntu
-  - bionic, focal, jammy
+  - focal, jammy, noble
 - Debian
-  - buster, bullseye
+  - bookworm, bullseye
 - Amazon
 
 ## Role Variables
@@ -142,6 +142,7 @@ None.
 
 ```
 - hosts: all
+  become: true
   roles:
     - name: devsec.hardening.nginx_hardening
 ```

roles/nginx_hardening/meta/main.yml

@@ -8,17 +8,16 @@ galaxy_info:
   platforms:
     - name: EL
       versions:
-        - "7"
         - "8"
         - "9"
     - name: Ubuntu
       versions:
-        - bionic
         - focal
         - jammy
+        - noble
     - name: Debian
       versions:
-        - buster
+        - bookworm
         - bullseye
     - name: Amazon
   galaxy_tags:

roles/os_hardening/README.md

@@ -53,16 +53,105 @@ We disable the following filesystems, because they're most likely not used:
 
 To prevent some of the filesystems from being disabled, add them to the `os_filesystem_whitelist` variable.
 
+## Known Limitations
+
+### Docker support
+
+If you're using Docker / Kubernetes+Docker you'll need to override the ipv4 ip forward sysctl setting.
+
+```yaml
+- hosts: localhost
+  roles:
+    - devsec.hardening.os_hardening
+  vars:
+    sysctl_overwrite:
+      # Enable IPv4 traffic forwarding.
+      net.ipv4.ip_forward: 1
+```
+
+### hidepid on RHEL/CentOS 7
+
+When having `polkit-0.112-18.el7` (and later) installed and `/proc` mounted with `hidepid=2`, every time someone uses `systemctl` the following error is displayed, but systemctl runs successfully.
+
+```
+Error registering authentication agent: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: Cannot determine user of subject (polkit-error-quark, 0)
+```
+
+We decided to set `hidepid=0` to remove the error message, if you want to use the other proposed workaround, you have to setup the user yourself and set our option to `hidepid_option: 2` via Ansible vars.
+
+For further details see [RedHat: "GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: Cannot determine user of subject" seen when executing systemctl command](https://access.redhat.com/solutions/5005111) or [#364: hidepid=2 gives error when running systemctl on EL7](https://github.com/dev-sec/ansible-collection-hardening/issues/364)
+
+### sysctl - vm.mmap_rnd_bits
+
+We are setting this sysctl to a default of `32`, some systems only support smaller values and this will generate an error. Unfortunately we cannot determine the correct applicable maximum. If you encounter this error you have to override this sysctl in your playbook.
+
+```yaml
+- hosts: localhost
+  roles:
+    - devsec.hardening.os_hardening
+  vars:
+    sysctl_overwrite:
+      vm.mmap_rnd_bits: 16
+```
+
+## Testing with inspec
+
+If you're using inspec to test your machines after applying this role, please make sure to add the connecting user to the `os_ignore_users`-variable.
+Otherwise inspec will fail. For more information, see [issue #124](https://github.com/dev-sec/ansible-os-hardening/issues/124).
+
+We know that this is the case on Raspberry Pi.
+
+## Changing sysctl variables
+
+If you want to override sysctl-variables, you can use the `sysctl_overwrite` variable (in older versions you had to override the whole `sysctl_dict`).
+So for example if you want to change the IPv4 traffic forwarding variable to `1`, do it like this:
+
+```yaml
+- hosts: localhost
+  roles:
+    - devsec.hardening.os_hardening
+  vars:
+    sysctl_overwrite:
+      # Enable IPv4 traffic forwarding.
+      net.ipv4.ip_forward: 1
+```
+
+Alternatively you can change Ansible's [hash-behaviour](https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-hash-behaviour) to `merge`, then you only have to overwrite the single hash you need to. But please be aware that changing the hash-behaviour changes it for all your playbooks and is not recommended by Ansible.
+
+## Improving Kernel Audit logging
+
+By default, any process that starts before the `auditd` daemon will have an AUID of `4294967295`. To improve this and provide more accurate logging, it's recommended to add the kernel boot parameter `audit=1` to you configuration. Without doing this, you will find that your `auditd` logs fail to properly audit all processes.
+
+For more information, please see this [upstream documentation](https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html) and your system's boot loader documentation for how to configure additional kernel parameters.
+
+## PAM configuration
+
+We use specific PAM configuration for every linux distribution. This is a very diverse area, since every vendor seems to push their own system for managing PAM. We used following guides and sources for our configuration.
+
+- on Debian/Ubuntu we use [pam-config-framework](https://wiki.ubuntu.com/PAMConfigFrameworkSpec)
+- RHEL8 and compatible use information from [authselect](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_authentication_and_authorization_in_rhel/configuring-user-authentication-using-authselect_configuring-authentication-and-authorization-in-rhel), but our setup disables the configuration from authselect
+- RHEL 6/7 and compatible use [authconfig](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/authconfig-install), but our setup disables the configuration from authconfig
+- for RHEL 6/7 we also use information from [Desktop Security](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-hardening_your_system_with_tools_and_services#sec-Desktop_Security)
+
+## Acknowledgements
+
+This role is mostly based on guides by:
+
+- [Arch Linux wiki, Sysctl hardening](https://wiki.archlinux.org/index.php/Sysctl)
+- [NSA: Guide to the Secure Configuration of Red Hat Enterprise Linux 5](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf)
+- [Ubuntu Security/Features](https://wiki.ubuntu.com/Security/Features)
+- [Deutsche Telekom, Group IT Security, Security Requirements (German)](https://www.telekom.com/psa)
+
 <!-- BEGIN_ANSIBLE_DOCS -->
 
 ## Supported Operating Systems
 
 - EL
-  - 7, 8, 9
+  - 8, 9
 - Ubuntu
-  - bionic, focal, jammy
+  - focal, jammy, noble
 - Debian
-  - buster, bullseye
+  - bookworm, bullseye
 - Amazon
 - Fedora
 - ArchLinux
@@ -286,11 +375,6 @@ To prevent some of the filesystems from being disabled, add them to the `os_file
   - Description: Set to true to disable ctrl-alt-delete key combination.
   - Type: bool
   - Required: no
-- `os_desktop_enable`
-  - Default: `false`
-  - Description: true if this is a desktop system, ie Xorg, KDE/GNOME/Unity/etc.
-  - Type: bool
-  - Required: no
 - `os_env_extra_user_paths`
   - Default: `"[]"`
   - Description: Specify additional paths that should be checked for binaries where access will be minimized
@@ -751,11 +835,6 @@ To prevent some of the filesystems from being disabled, add them to the `os_file
   - Description: kernel is crashing or otherwise misbehaving and a kernel core dump is created.
   - Type: bool
   - Required: no
-- `os_security_kernel_enable_module_loading`
-  - Default: `true`
-  - Description: true if you want to allowed to change kernel modules once the system is running (eg `modprobe`, `rmmod`). WARNING - Rebuilding initramfs is deprecated and will be removed in the next major release. For more information take a look at this issue <https://github.com/dev-sec/ansible-collection-hardening/pull/591>
-  - Type: bool
-  - Required: no
 - `os_security_packages_clean`
   - Default: `true`
   - Description: removes packages with known issues. See section packages.
@@ -920,101 +999,9 @@ None.
 
 ```
 - hosts: all
+  become: true
   roles:
     - name: devsec.hardening.os_hardening
 ```
 
 <!-- END_ANSIBLE_DOCS -->
-
-## Known Limitations
-
-### Docker support
-
-If you're using Docker / Kubernetes+Docker you'll need to override the ipv4 ip forward sysctl setting.
-
-```yaml
-- hosts: localhost
-  collections:
-    - devsec.hardening
-  roles:
-    - devsec.hardening.os_hardening
-  vars:
-    sysctl_overwrite:
-      # Enable IPv4 traffic forwarding.
-      net.ipv4.ip_forward: 1
-```
-
-### hidepid on RHEL/CentOS 7
-
-When having `polkit-0.112-18.el7` (and later) installed and `/proc` mounted with `hidepid=2`, every time someone uses `systemctl` the following error is displayed, but systemctl runs successfully.
-
-```
-Error registering authentication agent: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: Cannot determine user of subject (polkit-error-quark, 0)
-```
-
-We decided to set `hidepid=0` to remove the error message, if you want to use the other proposed workaround, you have to setup the user yourself and set our option to `hidepid_option: 2` via Ansible vars.
-
-For further details see [RedHat: "GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: Cannot determine user of subject" seen when executing systemctl command](https://access.redhat.com/solutions/5005111) or [#364: hidepid=2 gives error when running systemctl on EL7](https://github.com/dev-sec/ansible-collection-hardening/issues/364)
-
-### sysctl - vm.mmap_rnd_bits
-
-We are setting this sysctl to a default of `32`, some systems only support smaller values and this will generate an error. Unfortunately we cannot determine the correct applicable maximum. If you encounter this error you have to override this sysctl in your playbook.
-
-```yaml
-- hosts: localhost
-  collections:
-    - devsec.hardening
-  roles:
-    - devsec.hardening.os_hardening
-  vars:
-    sysctl_overwrite:
-      vm.mmap_rnd_bits: 16
-```
-
-## Testing with inspec
-
-If you're using inspec to test your machines after applying this role, please make sure to add the connecting user to the `os_ignore_users`-variable.
-Otherwise inspec will fail. For more information, see [issue #124](https://github.com/dev-sec/ansible-os-hardening/issues/124).
-
-We know that this is the case on Raspberry Pi.
-
-## Changing sysctl variables
-
-If you want to override sysctl-variables, you can use the `sysctl_overwrite` variable (in older versions you had to override the whole `sysctl_dict`).
-So for example if you want to change the IPv4 traffic forwarding variable to `1`, do it like this:
-
-```yaml
-- hosts: localhost
-  collections:
-    - devsec.hardening
-  roles:
-    - os_hardening
-  vars:
-    sysctl_overwrite:
-      # Enable IPv4 traffic forwarding.
-      net.ipv4.ip_forward: 1
-```
-
-Alternatively you can change Ansible's [hash-behaviour](https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-hash-behaviour) to `merge`, then you only have to overwrite the single hash you need to. But please be aware that changing the hash-behaviour changes it for all your playbooks and is not recommended by Ansible.
-
-## Improving Kernel Audit logging
-
-By default, any process that starts before the `auditd` daemon will have an AUID of `4294967295`. To improve this and provide more accurate logging, it's recommended to add the kernel boot parameter `audit=1` to you configuration. Without doing this, you will find that your `auditd` logs fail to properly audit all processes.
-
-For more information, please see this [upstream documentation](https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html) and your system's boot loader documentation for how to configure additional kernel parameters.
-
-## More information
-
-We use specific PAM configuration for every linux distribution. This is a very diverse area, since every vendor seems to push their own system for managing PAM. We used following guides and sources for our configuration.
-
-- on Debian/Ubuntu we use [pam-config-framework](https://wiki.ubuntu.com/PAMConfigFrameworkSpec)
-- RHEL8 and compatible use information from [authselect](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_authentication_and_authorization_in_rhel/configuring-user-authentication-using-authselect_configuring-authentication-and-authorization-in-rhel), but our setup disables the configuration from authselect
-- RHEL 6/7 and compatible use [authconfig](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/authconfig-install), but our setup disables the configuration from authconfig
-- for RHEL 6/7 we also use information from [Desktop Security](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-hardening_your_system_with_tools_and_services#sec-Desktop_Security)
-
-This role is mostly based on guides by:
-
-- [Arch Linux wiki, Sysctl hardening](https://wiki.archlinux.org/index.php/Sysctl)
-- [NSA: Guide to the Secure Configuration of Red Hat Enterprise Linux 5](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf)
-- [Ubuntu Security/Features](https://wiki.ubuntu.com/Security/Features)
-- [Deutsche Telekom, Group IT Security, Security Requirements (German)](https://www.telekom.com/psa)

roles/os_hardening/defaults/main.yml

@@ -1,5 +1,4 @@
 ---
-os_desktop_enable: false
 os_env_user_paths: [/usr/local/sbin, /usr/local/bin, /usr/sbin, /usr/bin, /sbin, /bin]
 os_env_extra_user_paths: []
 os_auth_pw_max_age: 60
@@ -40,7 +39,6 @@ os_users_without_password_ageing: []
 
 # Specify system accounts whose login should not be disabled and password not changed
 os_ignore_users: [vagrant, kitchen]
-os_security_kernel_enable_module_loading: true
 os_security_kernel_enable_core_dump: false
 os_security_suid_sgid_enforce: true
 # User-defined blacklist and whitelist
@@ -350,6 +348,7 @@ os_auditd_disk_error_action: SUSPEND
 os_auditd_action_mail_acct: root
 os_auditd_log_group: root
 os_auditd_num_logs: 5
+os_auditd_name_format: NONE
 
 # Set the SELinux state, which can be either disabled, permissive, or enforcing.
 os_selinux_state: enforcing

roles/os_hardening/handlers/main.yml

@@ -2,15 +2,26 @@
 - name: Update-initramfs # noqa no-changed-when
   ansible.builtin.command: update-initramfs -u
 
-- name: Restart auditd # noqa command-instead-of-module no-changed-when
-  ansible.builtin.command:
-    cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
-  when: molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
-
 - name: Reload systemd
   ansible.builtin.systemd:
     daemon_reload: true
 
+- name: Restart auditd via systemd
+  ansible.builtin.systemd:
+    name: auditd.service
+    state: restarted
+  ignore_errors: "{{ ansible_check_mode }}"
+  when:
+    - molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
+    - not ansible_facts.os_family == 'RedHat'
+
+- name: Restart auditd via service # noqa command-instead-of-module no-changed-when
+  ansible.builtin.command:
+    cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
+  when:
+    - molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
+    - ansible_facts.os_family == 'RedHat'
+
 - name: Remount filesystems
   ansible.posix.mount:
     path: "{{ item }}"

roles/os_hardening/meta/argument_specs.yml

@@ -4,10 +4,6 @@ argument_specs:
     short_description: The main entry point for the os hardening role.
     version_added: 8.8.0
     options:
-      os_desktop_enable:
-        default: false
-        type: bool
-        description: true if this is a desktop system, ie Xorg, KDE/GNOME/Unity/etc.
       os_env_user_paths:
         default: [/usr/local/sbin, /usr/local/bin, /usr/sbin, /usr/bin, /sbin, /bin]
         type: list
@@ -73,13 +69,6 @@ argument_specs:
         default: '[]'
         type: list
         description: list of things, that a user is allowed to do. May contain `change_user`.
-      os_security_kernel_enable_module_loading:
-        default: true
-        type: bool
-        description: true if you want to allowed to change kernel modules once the
-          system is running (eg `modprobe`, `rmmod`). WARNING - Rebuilding initramfs
-          is deprecated and will be removed in the next major release. For more information
-          take a look at this issue <https://github.com/dev-sec/ansible-collection-hardening/pull/591>
       os_security_kernel_enable_core_dump:
         default: false
         type: bool
@@ -218,6 +207,16 @@ argument_specs:
         description: This keyword specifies the maximum file size in megabytes. When
           this limit is reached, it will trigger a configurable action. The value
           given must be numeric.
+      os_auditd_name_format:
+        default: NONE
+        type: str
+        description: This keyword specifies how computer node names are inserted
+              into the audit event stream.
+        choices:
+          - NONE
+          - hostname
+          - fqd
+          - numeric
       os_auditd_num_logs:
         default: 5
         type: int

roles/os_hardening/meta/main.yml

@@ -8,17 +8,16 @@ galaxy_info:
   platforms:
     - name: EL
       versions:
-        - "7"
         - "8"
         - "9"
     - name: Ubuntu
       versions:
-        - bionic
         - focal
         - jammy
+        - noble
     - name: Debian
       versions:
-        - buster
+        - bookworm
         - bullseye
     - name: Amazon
     - name: Fedora

roles/os_hardening/tasks/auditd.yml

@@ -12,5 +12,7 @@
     owner: root
     group: root
     mode: "0640"
-  notify: Restart auditd
+  notify:
+    - Restart auditd via service
+    - Restart auditd via systemd
   tags: auditd

roles/os_hardening/tasks/hardening.yml

@@ -123,13 +123,3 @@
   when:
     - ansible_facts.selinux.status == 'enabled'
     - os_selinux_enabled | bool
-
-- name: Raise deprecation warning for initramfs tasks  # noqa ignore-errors
-  ansible.builtin.fail:
-    msg: "WARNING: Rebuilding initramfs is deprecated and will be removed
-          in the next major release. For more information take a look at this issue:
-          https://github.com/dev-sec/ansible-collection-hardening/pull/591"
-  when:
-    - os_security_kernel_enable_module_loading
-  ignore_errors: true
-  tags: always

roles/os_hardening/tasks/pam_rhel.yml

@@ -1,6 +1,6 @@
 ---
 - name: Install sssd-clients
-  ansible.builtin.yum:
+  ansible.builtin.dnf:
     name: sssd-client
     state: present
   when:

roles/os_hardening/tasks/sysctl.yml

@@ -18,29 +18,6 @@
     mode: "0544"
   when: ansible_facts.os_family == 'RedHat'
 
-- name: Install initramfs-tools
-  ansible.builtin.apt:
-    name: initramfs-tools
-    state: present
-    update_cache: true
-  when:
-    - ansible_facts.os_family == 'Debian'
-    - os_security_kernel_enable_module_loading
-
-- name: Rebuild initramfs with starting pack of modules, if module loading at runtime is disabled
-  ansible.builtin.template:
-    src: etc/initramfs-tools/modules.j2
-    dest: /etc/initramfs-tools/modules
-    owner: root
-    group: root
-    mode: "0440"
-  notify:
-    - Update-initramfs
-  when:
-    - ansible_facts.os_family == 'Debian'
-    - os_security_kernel_enable_module_loading
-  register: initramfs
-
 - name: Change sysctls
   when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']
   block:

roles/os_hardening/tasks/yum.yml

@@ -45,7 +45,7 @@
     - /etc/yum/pluginconf.d/rhnplugin.conf
 
 - name: Remove deprecated or insecure packages | package-01 - package-09
-  ansible.builtin.yum:
+  ansible.builtin.dnf:
     name: "{{ os_security_packages_list }}"
     state: absent
   when: os_security_packages_clean | bool

roles/os_hardening/templates/etc/audit/auditd.conf.j2

@@ -11,7 +11,7 @@ freq = {{ os_auditd_freq }}
 num_logs = {{ os_auditd_num_logs }}
 disp_qos = lossy
 dispatcher = /sbin/audispd
-name_format = NONE
+name_format = {{ os_auditd_name_format }}
 max_log_file = {{ os_auditd_max_log_file }}
 max_log_file_action = {{ os_auditd_max_log_file_action }}
 space_left = {{ os_auditd_space_left }}

roles/os_hardening/templates/etc/initramfs-tools/modules.j2

@@ -1,113 +0,0 @@
-{{ ansible_managed | comment }}
-# Generated by Ansible role {{ ansible_role_name }}
-
-# This file contains the names of kernel modules that should be loaded at boot time, one per line. Lines beginning with "#" are ignored.
-#
-# A list of all available kernel modules kann be found with `find /lib/modules/$(uname -r)/kernel/`
-# We will sort by folder.
-
-
-# Arch
-# ----
-#
-# Modules for certains builds, contains support modules and some CPU-specific optimizations.
-
-{% if ansible_facts.architecture == 'x86_64' %}
-# Optimize for x86_64 cryptographic features
-twofish-x86_64-3way
-twofish-x86_64
-aes-x86_64
-salsa20-x86_64
-blowfish-x86_64
-{% endif %}
-
-{% if 'AuthenticAMD' in ansible_facts.processor %}
-# AMD-specific optimizations
-kvm-amd
-{% else %}
-# Intel-specific optimizations
-ghash-clmulni-intel
-aesni-intel
-kvm-intel
-{% endif %}
-
-kvm
-
-# Crypto
-# ------
-
-# Some core modules which comprise strong cryptography.
-blowfish_common
-blowfish_generic
-ctr
-cts
-lrw
-lzo
-rmd160
-rmd256
-rmd320
-serpent
-sha512_generic
-twofish_common
-twofish_generic
-xts
-zlib
-
-
-# Drivers
-# -------
-
-# Basics
-lp
-rtc
-loop
-
-# Filesystems
-ext2
-btrfs
-
-{% if os_desktop_enable %}
-# Desktop
-psmouse
-snd
-snd_ac97_codec
-snd_intel8x0
-snd_page_alloc
-snd_pcm
-snd_timer
-soundcore
-usbhid
-{% endif %}
-
-# Lib
-# ---
-xz
-
-
-# Net
-# ---
-
-# All packets needed for netfilter rules (ie iptables, ebtables).
-ip_tables
-x_tables
-iptable_filter
-iptable_nat
-
-# Targets
-ipt_LOG
-ipt_REJECT
-
-# Modules
-xt_connlimit
-xt_tcpudp
-xt_recent
-xt_limit
-xt_conntrack
-nf_conntrack
-nf_conntrack_ipv4
-nf_defrag_ipv4
-xt_state
-nf_nat
-
-# Addons
-xt_pknock

roles/os_hardening/templates/etc/modprobe.d/modprobe.j2

@@ -1,6 +1,6 @@
 {{ ansible_managed | comment }}
 # Generated by Ansible role {{ ansible_role_name }}
 
-{% for fs in os_unused_filesystems | difference(os_filesystem_whitelist) %}
+{% for fs in os_unused_filesystems | difference(os_filesystem_whitelist) | sort %}
 install {{fs}} /bin/true
 {% endfor %}

roles/os_hardening/templates/etc/sysconfig/rhel_sysconfig_init.j2

@@ -1,9 +1,9 @@
 {{ ansible_managed | comment }}
 # Generated by Ansible role {{ ansible_role_name }}
 
-# color => new RH6.0 bootup
-# verbose => old-style bootup
-# anything else => new style bootup without ANSI colors or positioning
+# color => new RH6.0 boot-up
+# verbose => old-style boot-up
+# anything else => new style boot-up without ANSI colors or positioning
 BOOTUP=color
 # column to start "[  OK  ]" label in
 RES_COL=60

roles/os_hardening/vars/RedHat_7.yml

@@ -1,88 +0,0 @@
----
-os_packages_pam_ccreds: pam_ccreds
-os_nologin_shell_path: /sbin/nologin
-
-# Different distros use different standards for /etc/shadow perms, e.g.
-# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
-# You must provide key/value pairs for owner, group, and mode if overriding.
-os_shadow_perms:
-  owner: root
-  group: root
-  mode: "0000"
-
-os_passwd_perms:
-  owner: root
-  group: root
-  mode: "0644"
-
-os_env_umask: "077"
-
-os_auth_uid_min: 1000
-os_auth_uid_max: 60000
-os_auth_gid_min: 1000
-os_auth_gid_max: 60000
-os_auth_sys_uid_min: 201
-os_auth_sys_uid_max: 999
-os_auth_sys_gid_min: 201
-os_auth_sys_gid_max: 999
-os_auth_sub_uid_min: 100000
-os_auth_sub_uid_max: 600100000
-os_auth_sub_uid_count: 65536
-os_auth_sub_gid_min: 100000
-os_auth_sub_gid_max: 600100000
-os_auth_sub_gid_count: 65536
-
-os_auth_pam_sssd_enable: false
-
-os_mnt_boot_dir_mode: '0700'
-os_mnt_boot_group: 'root'
-os_mnt_boot_owner: 'root'
-
-os_mnt_dev_dir_mode: '0755'
-os_mnt_dev_group: 'root'
-os_mnt_dev_owner: 'root'
-
-os_mnt_dev_shm_dir_mode: '1777'
-os_mnt_dev_shm_group: 'root'
-os_mnt_dev_shm_owner: 'root'
-
-os_mnt_home_dir_mode: '0755'
-os_mnt_home_group: 'root'
-os_mnt_home_owner: 'root'
-
-os_mnt_run_dir_mode: '0755'
-os_mnt_run_group: 'root'
-os_mnt_run_owner: 'root'
-
-os_mnt_tmp_dir_mode: '1777'
-os_mnt_tmp_group: 'root'
-os_mnt_tmp_owner: 'root'
-
-os_mnt_var_dir_mode: '0755'
-os_mnt_var_group: 'root'
-os_mnt_var_owner: 'root'
-
-os_mnt_var_log_dir_mode: '0755'
-os_mnt_var_log_group: 'root'
-os_mnt_var_log_owner: 'root'
-
-os_mnt_var_log_audit_dir_mode: '0700'
-os_mnt_var_log_audit_group: 'root'
-os_mnt_var_log_audit_owner: 'root'
-
-os_mnt_var_tmp_dir_mode: '1777'
-os_mnt_var_tmp_group: 'root'
-os_mnt_var_tmp_owner: 'root'
-
-# defaults for useradd
-os_useradd_mail_dir: /var/spool/mail
-os_useradd_create_home: true
-
-modprobe_package: module-init-tools
-auditd_package: audit
-
-hidepid_option: "0" # allowed values: 0, 1, 2
-
-sysctl_unsupported_entries:
-  - fs.protected_fifos
-  - fs.protected_regular

roles/ssh_hardening/CHANGELOG.md

@@ -669,7 +669,7 @@
 - Make MaxAuthTries configurable [\#31](https://github.com/dev-sec/ansible-ssh-hardening/pull/31) ([rndmh3ro](https://github.com/rndmh3ro))
 - Change oneliner if-statements to be more readable [\#30](https://github.com/dev-sec/ansible-ssh-hardening/pull/30) ([rndmh3ro](https://github.com/rndmh3ro))
 - Make ssh client password login configurable. [\#29](https://github.com/dev-sec/ansible-ssh-hardening/pull/29) ([ypid](https://github.com/ypid))
-- Fix join-filter, jinja-cases, intendation [\#27](https://github.com/dev-sec/ansible-ssh-hardening/pull/27) ([rndmh3ro](https://github.com/rndmh3ro))
+- Fix join-filter, jinja-cases, indentation [\#27](https://github.com/dev-sec/ansible-ssh-hardening/pull/27) ([rndmh3ro](https://github.com/rndmh3ro))
 - Short role review. Fixed role when ssh_client_weak_kex == true. [\#26](https://github.com/dev-sec/ansible-ssh-hardening/pull/26) ([ypid](https://github.com/ypid))
 - Make it configurable to only harden ssh client/server or both \(default\). [\#25](https://github.com/dev-sec/ansible-ssh-hardening/pull/25) ([ypid](https://github.com/ypid))
 - Separate system-vars from editable vars [\#24](https://github.com/dev-sec/ansible-ssh-hardening/pull/24) ([rndmh3ro](https://github.com/rndmh3ro))

roles/ssh_hardening/README.md

@@ -10,22 +10,56 @@ This role provides secure ssh-client and ssh-server configurations. It is intend
 
 Warning: This role disables root-login on the target server! Please make sure you have another user with su or sudo permissions that can login into the server.
 
+## Configuring settings not listed in role-variables
+
+If you want to configure ssh options that are not listed above, you can use `ssh_custom_options` (for `/etc/ssh/ssh_config`) or `sshd_custom_options` (for `/etc/ssh/sshd_config`) to set them. These options will be set on the **beginning** of the file so you can override options further down in the file.
+
+Example playbook:
+
+```yml
+- hosts: localhost
+  roles:
+    - devsec.hardening.ssh_hardening
+  vars:
+    ssh_custom_options:
+      - "Include /etc/ssh/ssh_config.d/*"
+    sshd_custom_options:
+      - "AcceptEnv LANG"
+```
+
+## After using the role Ansibles template/copy/file module does not work anymore
+
+If you use this role to disable SFTP (`sftp_enabled: false`) you will get errors. Ansible uses by default SFTP to transfer files to the remote hosts. You have to set `scp_if_ssh = True` in your ansible.cfg. This way Ansible uses SCP to copy files. If your control node uses OpenSSH version 9.0 or above, you also need to set `scp_extra_args = "-O"`, since starting with that version the `scp` utility also defaults to using SFTP.
+
+## Changing the default port and idempotency
+
+This role uses the default port 22 or the port configured in the inventory to connect to the server. If the default `ssh` port is changed via `ssh_server_ports`, once the ssh server is restarted, it will still try to connect using the previous port. In order to run this role again on the same server the inventory will have to be updated to use the new ssh port.
+
+If idempotency is important, please consider using role [`ssh-hardening-fallback`](https://github.com/nununo/ansible-ssh-hardening-fallback), which is a wrapper around this role that falls back to port 22 if the configured port is unreachable.
+
+## Disabling systemd-socket activation on Debian and Ubuntu systems
+
+Since Debian 12 and Ubuntu 22.04 the ssh-daemon is not running by default anymore but is instead activated via systemd.
+We revert this change to its traditional behaviour.
+For more information, see [this issue](https://github.com/dev-sec/ansible-collection-hardening/issues/763).
+
 <!-- BEGIN_ANSIBLE_DOCS -->
 
 ## Supported Operating Systems
 
 - EL
-  - 7, 8, 9
+  - 8, 9
 - Ubuntu
-  - bionic, focal, jammy
+  - focal, jammy, noble
 - Debian
-  - buster, bullseye
+  - bookworm, bullseye
+- Alpine
 - Amazon
 - Fedora
 - ArchLinux
 - SmartOS
 - FreeBSD
-  - 12.2
+  - 13.2, 14.0
 - OpenBSD
   - 7.0
 
@@ -182,9 +216,9 @@ Warning: This role disables root-login on the target server! Please make sure yo
   - Type: str
   - Required: no
 - `ssh_gateway_ports`
-  - Default: `false`
+  - Default: `False`
   - Description: Set to `false` to disable binding forwarded ports to non-loopback addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified` to allow the client to specify which address to bind to.
-  - Type: bool
+  - Type: raw
   - Required: no
 - `ssh_gssapi_delegation`
   - Default: `false`
@@ -273,7 +307,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
   - Required: no
 - `ssh_permit_tunnel`
   - Default: `no`
-  - Description: Specifies whether tun(4) device forwarding is allowed. The argument must be yes, point-to-point (layer 3), ethernet (layer 2), or no. Specifying yes permits both point-to-point and ethernet.
+  - Description: Specifies whether tun(4) device forwarding is allowed. The argument must be "yes", point-to-point (layer 3), ethernet (layer 2), or "no". Specifying yes permits both point-to-point and ethernet. - The quotes are required!
   - Type: str
   - Required: no
   - Choices:
@@ -371,6 +405,11 @@ Warning: This role disables root-login on the target server! Please make sure yo
   - Description: a list of revoked public keys that the ssh server will always reject, useful to revoke known weak or compromised keys.
   - Type: list
   - Required: no
+- `ssh_server_service_enabled`
+  - Default: `true`
+  - Description: Set to `false` to disable starting sshd at boot.
+  - Type: bool
+  - Required: no
 - `ssh_trusted_user_ca_keys`
   - Default: ``
   - Description: set the trusted certificate authorities public keys used to sign user certificates. Only used if `ssh_trusted_user_ca_keys_file` is set.
@@ -440,37 +479,9 @@ None.
 
 ```
 - hosts: all
+  become: true
   roles:
     - name: devsec.hardening.ssh_hardening
 ```
 
 <!-- END_ANSIBLE_DOCS -->
-
-## Configuring settings not listed in role-variables
-
-If you want to configure ssh options that are not listed above, you can use `ssh_custom_options` (for `/etc/ssh/ssh_config`) or `sshd_custom_options` (for `/etc/ssh/sshd_config`) to set them. These options will be set on the **beginning** of the file so you can override options further down in the file.
-
-Example playbook:
-
-```yml
-- hosts: localhost
-  collections:
-    - devsec.hardening
-  roles:
-    - ssh_hardening
-  vars:
-    ssh_custom_options:
-      - "Include /etc/ssh/ssh_config.d/*"
-    sshd_custom_options:
-      - "AcceptEnv LANG"
-```
-
-## After using the role Ansibles template/copy/file module does not work anymore
-
-If you use this role to disable SFTP (`sftp_enabled: false`) you will get errors. Ansible uses by default SFTP to transfer files to the remote hosts. You have to set `scp_if_ssh = True` in your ansible.cfg. This way Ansible uses SCP to copy files. If your control node uses OpenSSH version 9.0 or above, you also need to set `scp_extra_args = "-O"`, since starting with that version the `scp` utility also defaults to using SFTP.
-
-## Changing the default port and idempotency
-
-This role uses the default port 22 or the port configured in the inventory to connect to the server. If the default `ssh` port is changed via `ssh_server_ports`, once the ssh server is restarted, it will still try to connect using the previous port. In order to run this role again on the same server the inventory will have to be updated to use the new ssh port.
-
-If idempotency is important, please consider using role [`ssh-hardening-fallback`](https://github.com/nununo/ansible-ssh-hardening-fallback), which is a wrapper around this role that falls back to port 22 if the configured port is unreachable.

roles/ssh_hardening/defaults/main.yml

@@ -1,4 +1,5 @@
 ---
+
 # true if IPv6 is needed
 network_ipv6_enable: true # sshd + ssh
 
@@ -6,9 +7,12 @@ network_ipv6_enable: true # sshd + ssh
 ssh_client_config_file: /etc/ssh/ssh_config # ssh
 ssh_server_config_file: /etc/ssh/sshd_config # sshd
 
-# true if sshd should be started and enabled
+# true if sshd should be started
 ssh_server_enabled: true # sshd
 
+# true if sshd should be enabled at boot
+ssh_server_service_enabled: true # sshd
+
 # true if DNS resolutions are needed, look up the remote host name,
 # defaults to false from 6.8, see: http://www.openssh.com/txt/release-6.8
 ssh_use_dns: false # sshd
@@ -36,9 +40,6 @@ ssh_client_port: "22" # ssh
 # Default is empty, but should be configured for security reasons!
 ssh_listen_to: [0.0.0.0] # sshd
 
-# Host keys to look for when starting sshd.
-ssh_host_key_files: [] # sshd
-
 # Host RSA key size in bits
 ssh_host_rsa_key_size: 4096 # sshd
 
@@ -96,6 +97,9 @@ ssh_x11_forwarding: false # sshd
 # false to disable pam authentication.
 ssh_use_pam: true # sshd
 
+# false to disable publickey authentication
+ssh_pubkey_authentication: true
+
 # specify AuthenticationMethods
 sshd_authenticationmethods: publickey
 
@@ -199,9 +203,6 @@ ssh_max_startups: 10:30:60 # sshd
 
 ssh_ps59: sandbox
 
-ssh_macs: []
-ssh_ciphers: []
-ssh_kex: []
 # directory where to store ssh_password policy
 ssh_custom_selinux_dir: /etc/selinux/local-policies
 

roles/ssh_hardening/meta/argument_specs.yml

@@ -29,7 +29,6 @@ argument_specs:
           Default is all IPv4 addresses, but should be configured to specific addresses
           for security reasons
       ssh_host_key_files:
-        default: []
         type: list
         description: Host keys for sshd. If empty ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key',
           '/etc/ssh/ssh_host_ed25519_key'] will be used, as far as supported by the
@@ -65,8 +64,8 @@ argument_specs:
       ssh_permit_tunnel:
         default: 'no'
         description: Specifies whether tun(4) device forwarding is allowed. The argument
-          must be yes, point-to-point (layer 3), ethernet (layer 2), or no. Specifying
-          yes permits both point-to-point and ethernet.
+          must be "yes", point-to-point (layer 3), ethernet (layer 2), or "no". Specifying
+          yes permits both point-to-point and ethernet. - The quotes are required!
         choices:
           - 'no'
           - 'yes'
@@ -88,7 +87,7 @@ argument_specs:
           you can specify `'yes'`, `'no'`, `'all'`, `'local'`or`'remote'`.
       ssh_gateway_ports:
         default: false
-        type: bool
+        type: raw
         description: Set to `false` to disable binding forwarded ports to non-loopback
           addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified`
           to allow the client to specify which address to bind to.
@@ -259,6 +258,10 @@ argument_specs:
         default: true
         type: bool
         description: Set to `false` to disable the opensshd server.
+      ssh_server_service_enabled:
+        default: true
+        type: bool
+        description: Set to `false` to disable starting sshd at boot.
       ssh_server_hardening:
         default: true
         type: bool
@@ -314,15 +317,12 @@ argument_specs:
         description: Specifies the maximum number of concurrent unauthenticated connections
           to the SSH daemon.
       ssh_macs:
-        default: []
         type: list
         description: Change this list to overwrite macs. Defaults found in `defaults/main.yml`
       ssh_kex:
-        default: []
         type: list
         description: Change this list to overwrite kexs. Defaults found in `defaults/main.yml`
       ssh_ciphers:
-        default: []
         type: list
         description: Change this list to overwrite ciphers. Defaults found in `defaults/main.yml`
       ssh_custom_options:

roles/ssh_hardening/meta/main.yml

@@ -8,25 +8,24 @@ galaxy_info:
   platforms:
     - name: EL
       versions:
-        - "7"
         - "8"
         - "9"
     - name: Ubuntu
       versions:
-        - bionic
         - focal
         - jammy
+        - noble
     - name: Debian
       versions:
-        - buster
+        - bookworm
         - bullseye
+    - name: Alpine
     - name: Amazon
     - name: Fedora
     - name: ArchLinux
     - name: SmartOS
     - name: FreeBSD
       versions:
-        - "12.2"
         - "13.2"
         - "14.0"
     - name: OpenBSD

roles/ssh_hardening/tasks/disable-systemd-socket.yml

@@ -0,0 +1,16 @@
+---
+- name: Remove ssh service systemd-socket file
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - /etc/systemd/system/ssh.service.d/00-socket.conf
+    - /etc/systemd/system/ssh.service.requires/ssh.socket
+    - /etc/systemd/system/sockets.target.wants/ssh.socket
+
+- name: Disable systemd-socket activation
+  ansible.builtin.systemd:
+    name: ssh.socket
+    state: stopped
+    enabled: false
+    masked: true

roles/ssh_hardening/tasks/hardening.yml

@@ -22,6 +22,9 @@
   with_dict: "{{ os_vars }}"
   tags: always
 
+- name: Install openssh package and configure the service
+  ansible.builtin.include_tasks: install.yml
+
 - name: Get openssh-version
   ansible.builtin.command: ssh -V
   register: sshd_version_raw
@@ -36,19 +39,22 @@
   ansible.builtin.include_tasks: crypto_hostkeys.yml
   when:
     - ssh_server_hardening | bool
-    - not ssh_host_key_files
+    - ssh_host_key_files is undefined
 
 - name: Set default for ssh_macs if not supplied
   ansible.builtin.include_tasks: crypto_macs.yml
-  when: not ssh_macs
+  when:
+    - ssh_macs is undefined
 
 - name: Set default for ssh_ciphers if not supplied
   ansible.builtin.include_tasks: crypto_ciphers.yml
-  when: not ssh_ciphers
+  when:
+    - ssh_ciphers is undefined
 
 - name: Set default for ssh_kex if not supplied
   ansible.builtin.include_tasks: crypto_kex.yml
-  when: not ssh_kex
+  when:
+    - ssh_kex is undefined
 
 - name: Create revoked_keys and set permissions to root/600
   ansible.builtin.template:
@@ -135,3 +141,8 @@
   when:
     - sshd_disable_crypto_policy | bool
     - ('crypto-policies' in ansible_facts.packages)
+
+- name: Enable or disable sshd service
+  ansible.builtin.service:
+    name: "{{ sshd_service_name }}"
+    enabled: "{{ ssh_server_service_enabled }}"