Merge pull request #739 from dev-sec/restruct_vars

restructure readme to move known problems up top
2024-01-15 14:51:08 +01:00 · 2024-01-12 09:30:48 +01:00 · 2023-12-22 09:56:52 +00:00 · 2023-12-22 10:54:13 +01:00 · 2023-12-12 00:11:54 +00:00 · 2023-12-12 00:09:03 +00:00
71 changed files with 736 additions and 643 deletions
@@ -5,9 +5,12 @@
 # option will be parsed relative to the CWD of execution.
 exclude_paths:
  - .cache/ # implicit unless exclude_paths is defined in config
-  - .yamllint
-  - ../molecule/
-  - ../.github/
+  # add all waivers individually, since exclude_files does not support globs
+  - molecule/os_hardening/waivers.yaml
+  - molecule/ssh_hardening_bsd/waivers_freebsd12.yaml
+  - molecule/ssh_hardening_bsd/waivers_freebsd13.yaml
+  - molecule/ssh_hardening_bsd/waivers_freebsd14.yaml
+  - molecule/ssh_hardening_bsd/waivers_openbsd7.yaml

 mock_roles:
  - geerlingguy.git
@@ -15,3 +18,4 @@ mock_roles:

 skip_list:
  - var-naming[no-role-prefix]
+  - meta-runtime[unsupported-version]
@@ -31,7 +31,7 @@ body:
    attributes:
      label: "Reproduction steps"
      render: Shell
-      description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, so no need for backticks.
+      description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, no need for backticks.
      value: |
        ...
    validations:
@@ -1,22 +1,30 @@
 ---
 mysql_hardening:
-  - 'roles/mysql_hardening/**'
-  - 'molecule/mysql_hardening/**'
-  - '.github/workflows/mysql_hardening.yml'
+  - changed-files:
+      - any-glob-to-any-file:
+          - roles/mysql_hardening/**
+          - molecule/mysql_hardening/**
+          - .github/workflows/mysql_hardening.yml

 os_hardening:
-  - 'roles/os_hardening/**'
-  - 'molecule/os_hardening/**'
-  - '.github/workflows/os_hardening.yml'
+  - changed-files:
+      - any-glob-to-any-file:
+          - roles/os_hardening/**
+          - molecule/os_hardening/**
+          - .github/workflows/os_hardening.yml

 ssh_hardening:
-  - 'roles/ssh_hardening/**'
-  - 'molecule/ssh_hardening/**'
-  - 'molecule/ssh_hardening_custom_tests/**'
-  - '.github/workflows/ssh_hardening.yml'
-  - '.github/workflows/ssh_hardening_custom_tests.yml'
+  - changed-files:
+      - any-glob-to-any-file:
+          - roles/ssh_hardening/**
+          - molecule/ssh_hardening/**
+          - molecule/ssh_hardening_custom_tests/**
+          - .github/workflows/ssh_hardening.yml
+          - .github/workflows/ssh_hardening_custom_tests.yml

 nginx_hardening:
-  - 'roles/nginx_hardening/**'
-  - 'molecule/nginx_hardening/**'
-  - '.github/workflows/nginx_hardening.yml'
+  - changed-files:
+      - any-glob-to-any-file:
+          - roles/nginx_hardening/**
+          - molecule/nginx_hardening/**
+          - .github/workflows/nginx_hardening.yml
@@ -7,22 +7,26 @@ on:  # yamllint disable-line rule:truthy
    branches: [master]
    paths:
      - 'roles/**'
+      - 'molecule/**'
+      - 'requirements.txt'
+      - '.github/workflows/ansible-lint.yml'
+      - '.config/ansible-lint.yml'
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [master]
    paths:
      - 'roles/**'
+      - 'molecule/**'
+      - 'requirements.txt'
+      - '.github/workflows/ansible-lint.yml'
+      - '.config/ansible-lint.yml'

 jobs:
  ansible-lint:
    runs-on: ubuntu-latest

    steps:
-      # Important: This sets up your GITHUB_WORKSPACE environment variable
      - uses: actions/checkout@v4

      - name: Lint Ansible Playbook
-        # replace "master" with any valid ref
-        uses: ansible/ansible-lint-action@main
-        with:
-          path: "roles/"
+        uses: ansible/ansible-lint@v6
@@ -9,6 +9,6 @@ jobs:
    if: github.repository == 'dev-sec/ansible-collection-hardening'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/labeler@main
+      - uses: actions/labeler@v5.0.0
        with:
          repo-token: "${{ secrets.GITHUB_TOKEN }}"
@@ -4,7 +4,7 @@ name: Publish collection to Ansible Galaxy
 on:  # yamllint disable-line rule:truthy
  release:
    types:
-      - published
+      - released

 jobs:
  deploy:
@@ -9,12 +9,14 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/mysql_hardening/**'
      - 'molecule/mysql_hardening/**'
      - '.github/workflows/mysql_hardening.yml'
+      - 'requirements.txt'
  pull_request:
    branches: [master]
    paths:
      - 'roles/mysql_hardening/**'
      - 'molecule/mysql_hardening/**'
      - '.github/workflows/mysql_hardening.yml'
+      - 'requirements.txt'
  schedule:
    - cron: '0 6 * * 0'

@@ -57,10 +59,10 @@ jobs:
          path: ansible_collections/devsec/hardening
          submodules: true

-      - name: Set up Python 3.11
-        uses: actions/setup-python@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
        with:
-          python-version: 3.11
+          python-version: 3.12

      - name: Install dependencies
        run: |
@@ -87,7 +89,8 @@ jobs:
      - name: Temporary fix for roles
        run: |
          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles /home/runner/.ansible/roles
+          ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles \
+            /home/runner/.ansible/roles

      - name: Test with molecule
        run: |
@@ -8,12 +8,14 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/nginx_hardening/**'
      - 'molecule/nginx_hardening/**'
      - '.github/workflows/nginx_hardening.yml'
+      - 'requirements.txt'
  pull_request:
    branches: [master]
    paths:
      - 'roles/nginx_hardening/**'
      - 'molecule/nginx_hardening/**'
      - '.github/workflows/nginx_hardening.yml'
+      - 'requirements.txt'
  schedule:
    - cron: '0 6 * * 1'

@@ -56,10 +58,10 @@ jobs:
          path: ansible_collections/devsec/hardening
          submodules: true

-      - name: Set up Python 3.11
-        uses: actions/setup-python@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
        with:
-          python-version: 3.11
+          python-version: 3.12

      - name: Install dependencies
        run: |
@@ -76,7 +78,8 @@ jobs:
      - name: Temporary fix for roles
        run: |
          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles /home/runner/.ansible/roles
+          ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles \
+            /home/runner/.ansible/roles

      - name: Test with molecule
        run: |
@@ -8,12 +8,14 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening/**'
      - '.github/workflows/os_hardening.yml'
+      - 'requirements.txt'
  pull_request:
    branches: [master]
    paths:
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening/**'
      - '.github/workflows/os_hardening.yml'
+      - 'requirements.txt'
  schedule:
    - cron: '0 6 * * 3'

@@ -57,10 +59,10 @@ jobs:
          path: ansible_collections/devsec/hardening
          submodules: true

-      - name: Set up Python 3.11
-        uses: actions/setup-python@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
        with:
-          python-version: 3.11
+          python-version: 3.12

      - name: Install dependencies
        run: |
@@ -8,12 +8,14 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening_vm/**'
      - '.github/workflows/os_hardening_vm.yml'
+      - 'requirements.txt'
  pull_request:
    branches: [master]
    paths:
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening_vm/**'
      - '.github/workflows/os_hardening_vm.yml'
+      - 'requirements.txt'
  schedule:
    - cron: '0 6 * * 2'

@@ -48,7 +50,7 @@ jobs:
          - generic/debian11
          - generic/debian12
          - generic/opensuse15
-          # - generic/arch  # needs fix for audit
+          - generic/arch
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
@@ -27,9 +27,9 @@ jobs:
        uses: actions/checkout@v4

      - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
        with:
-          python-version: 3.11
+          python-version: 3.12

      - name: Install aar_doc
        run: pip3 install aar_doc
@@ -8,12 +8,14 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening/**'
      - '.github/workflows/ssh_hardening.yml'
+      - 'requirements.txt'
  pull_request:
    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening/**'
      - '.github/workflows/ssh_hardening.yml'
+      - 'requirements.txt'
  schedule:
    - cron: '0 6 * * 5'

@@ -57,10 +59,10 @@ jobs:
          path: ansible_collections/devsec/hardening
          submodules: true

-      - name: Set up Python 3.11
-        uses: actions/setup-python@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
        with:
-          python-version: 3.11
+          python-version: 3.12

      - name: Install dependencies
        run: |
@@ -8,12 +8,14 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening_bsd/**'
      - '.github/workflows/ssh_hardening_bsd.yml'
+      - 'requirements.txt'
  pull_request:
    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening_bsd/**'
      - '.github/workflows/ssh_hardening_bsd.yml'
+      - 'requirements.txt'
  schedule:
    - cron: '0 6 * * 5'

@@ -8,12 +8,14 @@ on:  # yamllint disable-line rule:truthy
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening_custom_tests/**'
      - '.github/workflows/ssh_hardening_custom_tests.yml'
+      - 'requirements.txt'
  pull_request:
    branches: [master]
    paths:
      - 'roles/ssh_hardening/**'
      - 'molecule/ssh_hardening_custom_tests/**'
      - '.github/workflows/ssh_hardening_custom_tests.yml'
+      - 'requirements.txt'
  schedule:
    - cron: '0 6 * * 4'

@@ -57,10 +59,10 @@ jobs:
          path: ansible_collections/devsec/hardening
          submodules: true

-      - name: Set up Python 3.11
-        uses: actions/setup-python@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
        with:
-          python-version: 3.11
+          python-version: 3.12

      - name: Install dependencies
        run: |
@@ -1,11 +1,45 @@
 # Changelog

-## [8.9.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.9.0) (2023-11-16)
+## [9.0.1](https://github.com/dev-sec/ansible-collection-hardening/tree/9.0.1) (2023-12-22)

-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.8.0...8.9.0)
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/9.0.0...9.0.1)
+
+**Implemented enhancements:**
+
+- Extend ansible-lint testing to cover our test cases [\#731](https://github.com/dev-sec/ansible-collection-hardening/issues/731)
+-  Complete tests for OS hardening [\#660](https://github.com/dev-sec/ansible-collection-hardening/issues/660)
+- support restarts of audit service on Arch linux [\#722](https://github.com/dev-sec/ansible-collection-hardening/pull/722) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+
+**Fixed bugs:**
+
+- Fails to install [\#735](https://github.com/dev-sec/ansible-collection-hardening/issues/735)
+- Amazon Linux gpg check fails [\#734](https://github.com/dev-sec/ansible-collection-hardening/issues/734)
+- ssh\_hardening ipv6 [\#719](https://github.com/dev-sec/ansible-collection-hardening/issues/719)
+- boolean variable inconsistency? [\#330](https://github.com/dev-sec/ansible-collection-hardening/issues/330)
+- Restore idempotency for disabling unused filesystems with Ansible 2.16.0 [\#718](https://github.com/dev-sec/ansible-collection-hardening/pull/718) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([akikanellis](https://github.com/akikanellis))
+
+**Closed issues:**
+
+- Dependency Dashboard [\#655](https://github.com/dev-sec/ansible-collection-hardening/issues/655)
+
+**Merged pull requests:**
+
+- release only on releases, not pre-releases [\#738](https://github.com/dev-sec/ansible-collection-hardening/pull/738) ([rndmh3ro](https://github.com/rndmh3ro))
+- Update dependency ansible-core to v2.16.2 [\#737](https://github.com/dev-sec/ansible-collection-hardening/pull/737) ([renovate[bot]](https://github.com/apps/renovate))
+- fix linting for github config [\#736](https://github.com/dev-sec/ansible-collection-hardening/pull/736) ([rndmh3ro](https://github.com/rndmh3ro))
+- Update actions/setup-python action to v5 [\#733](https://github.com/dev-sec/ansible-collection-hardening/pull/733) ([renovate[bot]](https://github.com/apps/renovate))
+- Update ansible-lint action and revise configuration to scan all Ansible code [\#732](https://github.com/dev-sec/ansible-collection-hardening/pull/732) ([schurzi](https://github.com/schurzi))
+- update labeler to new config format [\#730](https://github.com/dev-sec/ansible-collection-hardening/pull/730) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Update dependency ansible-core to v2.16.1 [\#728](https://github.com/dev-sec/ansible-collection-hardening/pull/728) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- pin Ansible to always let Renovate update to the most current version in our tests [\#721](https://github.com/dev-sec/ansible-collection-hardening/pull/721) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+
+## [9.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/9.0.0) (2023-11-16)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.8.0...9.0.0)

 **Breaking changes:**

+- make it possible to configure more then yes and no for PermitTunnel [\#715](https://github.com/dev-sec/ansible-collection-hardening/pull/715) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - add role argument spec for os, ssh, mysql [\#687](https://github.com/dev-sec/ansible-collection-hardening/pull/687) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))

 **Implemented enhancements:**
@@ -30,7 +64,6 @@

 **Closed issues:**

- Dependency Dashboard [\#655](https://github.com/dev-sec/ansible-collection-hardening/issues/655)
 - Add send-to-mailinglist to github release action [\#434](https://github.com/dev-sec/ansible-collection-hardening/issues/434)

 **Merged pull requests:**
@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 8.8.0
+version: 9.0.0
 readme: README.md
 authors:
  - dev-sec <[email protected]>
@@ -22,6 +22,9 @@ tags:
  - nginx_hardening
  - os_hardening
  - ssh_hardening
+  - database
+  - linux
+  - security
 dependencies:
  ansible.posix: '>=1.0.0'
  community.crypto: '>=1.0.0'
@@ -1,38 +1,37 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
+- name: Wrapper playbook for kitchen testing "ansible-mysql-hardening"
  hosts: all
  become: true
-  collections:
-    - devsec.hardening
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
-      set_fact:
-        mysql_python_package_debian: "python3-pymysql"
+      ansible.builtin.set_fact:
+        mysql_python_package_debian: python3-pymysql
      when:
        - mysql_python_package_debian is not defined
        - ansible_distribution == "Ubuntu"
        - ansible_distribution_major_version|int > 19

    - name: Determine required MySQL Python libraries.
-      set_fact:
-        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
+      ansible.builtin.set_fact:
+        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
      when:
        - mysql_python_package_debian is not defined
        - ansible_distribution != "Ubuntu"
        - ansible_distribution_major_version|int < 20

    - name: Use Python 3 on Suse
-      set_fact:
+      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
        - ansible_os_family == 'Suse'

-    - include_role:
-        name: mysql_hardening
+    - name: Include mysql_hardening role
+      ansible.builtin.include_role:
+        name: devsec.hardening.mysql_hardening
  vars:
    overwrite_global_mycnf: false
    mysql_root_password: iloverandompasswordsbutthiswilldo
@@ -8,7 +8,7 @@ driver:
  name: docker
 platforms:
  - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -1,80 +1,81 @@
 ---
-
- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
+- name: Wrapper playbook for kitchen testing "ansible-mysql-hardening"
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  tasks:
-    - name: Use Python 3 on Debian 11
-      set_fact:
-        ansible_python_interpreter: /usr/bin/python3
-      when:
-        - ansible_distribution == 'Debian'
-        - ansible_distribution_major_version|int >= 11
-
-    - name: Use Python 3 on Suse
-      set_fact:
-        ansible_python_interpreter: /usr/bin/python3
-      when:
-        - ansible_os_family == 'Suse'
-
-    - name: Use Python 2 on Debian 10
-      set_fact:
-        ansible_python_interpreter: /usr/bin/python
-      when:
-        - ansible_distribution == 'Debian'
-        - ansible_distribution_major_version|int == 10
-
-    - name: Run the equivalent of "apt-get update && apt-get upgrade"
-      apt:
-        name: "*"
-        state: latest
-        update_cache: true
-      when: ansible_os_family == 'Debian'
-
-    - name: Install required python packages on Suse
-      ansible.builtin.shell: zypper -n install python-xml python3-rpm python3-PyMySQL
-      when: ansible_os_family == 'Suse'
-
-    - name: create missing directory
-      file:
-        path: "/etc/mysql/conf.d"
-        state: directory
-
-    - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
-      set_fact:
-        mysql_python_package_debian: "python3-pymysql"
-      when:
-        - mysql_python_package_debian is not defined
-        - ansible_distribution == "Ubuntu"
-        - ansible_distribution_major_version|int > 19
-
-    - name: Determine required MySQL Python libraries.
-      set_fact:
-        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
-      when:
-        - mysql_python_package_debian is not defined
-        - ansible_distribution != "Ubuntu"
-        - ansible_distribution_major_version|int < 20
-
-    - name: Install required MySQL Python libraries on RHEL
-      yum:
-        name: "{% if 'python3' in ansible_python_interpreter|default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
-      when:
-        - ansible_os_family == "RedHat"
-        - ansible_distribution_major_version == "7"
-          
-    - include_role:
-        name: dev-sec.mysql
-
-    - name: include MySQL user prepare tasks
-      include_tasks: prepare_tasks/mysql_users.yml
  vars:
    overwrite_global_mycnf: false
    mysql_root_password: iloverandompasswordsbutthiswilldo
    mysql_user_password: iloverandompasswordsbutthiswilldo
    mysql_config_file: /etc/mysql/mariadb.cnf
    mysql_root_password_update: true
+  tasks:
+    - name: Use Python 3 on Debian 11
+      ansible.builtin.set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+      when:
+        - ansible_distribution == 'Debian'
+        - ansible_distribution_major_version|int >= 11
+
+    - name: Use Python 3 on Suse
+      ansible.builtin.set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+      when:
+        - ansible_os_family == 'Suse'
+
+    - name: Use Python 2 on Debian 10
+      ansible.builtin.set_fact:
+        ansible_python_interpreter: /usr/bin/python
+      when:
+        - ansible_distribution == 'Debian'
+        - ansible_distribution_major_version|int == 10
+
+    - name: Run the equivalent of "apt-get update && apt-get upgrade"
+      ansible.builtin.apt:
+        upgrade: safe
+        update_cache: true
+      when: ansible_os_family == 'Debian'
+
+    - name: Install required python packages on Suse
+      ansible.builtin.command: zypper -n install python-xml python3-rpm python3-PyMySQL
+      changed_when: false
+      when: ansible_os_family == 'Suse'
+
+    - name: Create missing directory
+      ansible.builtin.file:
+        path: /etc/mysql
+        state: directory
+        mode: "0755"
+
+    - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
+      ansible.builtin.set_fact:
+        mysql_python_package_debian: python3-pymysql
+      when:
+        - mysql_python_package_debian is not defined
+        - ansible_distribution == "Ubuntu"
+        - ansible_distribution_major_version|int > 19
+
+    - name: Determine required MySQL Python libraries.
+      ansible.builtin.set_fact:
+        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
+      when:
+        - mysql_python_package_debian is not defined
+        - ansible_distribution != "Ubuntu"
+        - ansible_distribution_major_version|int < 20
+
+    - name: Install required MySQL Python libraries on RHEL
+      ansible.builtin.yum:
+        name: "{% if 'python3' in ansible_python_interpreter | default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
+      when:
+        - ansible_os_family == "RedHat"
+        - ansible_distribution_major_version == "7"
+
+    - name: Install mysql with a generic Ansible role
+      ansible.builtin.include_role:
+        name: dev-sec.mysql
+
+    - name: Include MySQL user prepare tasks
+      ansible.builtin.include_tasks: prepare_tasks/mysql_users.yml
@@ -1,17 +1,17 @@
 ---
- name: create users for test
+- name: Create users for test
  community.mysql.mysql_query:
    query:
-      - "CREATE USER 'user'@'delete';"
-      - "CREATE USER 'user'@'127.0.0.1';"
-      - "CREATE USER 'user'@'::1';"
-      - "CREATE USER 'user'@'%';"
-      - "CREATE USER 'user'@'192.168.0.%';"
-      - "CREATE USER 'user'@'192.168.0.1';"
-      - "CREATE USER    '%'@'192.168.0.1';"
-      - "CREATE USER 'user'@'192.168.0.2' IDENTIFIED BY 'keep';"
-      - "CREATE USER 'user'@'keep' IDENTIFIED BY 'keep';"
-      - "CREATE USER 'user'@'192.168.%' IDENTIFIED BY 'keep';"
+      - CREATE USER 'user'@'delete';
+      - CREATE USER 'user'@'127.0.0.1';
+      - CREATE USER 'user'@'::1';
+      - CREATE USER 'user'@'%';
+      - CREATE USER 'user'@'192.168.0.%';
+      - CREATE USER 'user'@'192.168.0.1';
+      - CREATE USER    '%'@'192.168.0.1';
+      - CREATE USER 'user'@'192.168.0.2' IDENTIFIED BY 'keep';
+      - CREATE USER 'user'@'keep' IDENTIFIED BY 'keep';
+      - CREATE USER 'user'@'192.168.%' IDENTIFIED BY 'keep';
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"

 - name: Detect role support on MySQL
@@ -23,10 +23,10 @@
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_role_support

- name: create roles for test
+- name: Create roles for test
  community.mysql.mysql_query:
    query:
-       - "CREATE ROLE 'role_keep';"
+      - CREATE ROLE 'role_keep';
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when:
    - mysql_role_support.rowcount[0] > 0
@@ -8,23 +8,23 @@
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Use Python 3 on Suse
-      set_fact:
+      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
        - ansible_os_family == 'Suse'

-    - name: install procps for debian systems
-      apt:
+    - name: Install procps for debian systems
+      ansible.builtin.apt:
        name: procps
        state: present
        update_cache: true
      when: ansible_distribution == 'Debian'

-    - name: include tests for the service
-      include_tasks: verify_tasks/service.yml
+    - name: Include tests for the service
+      ansible.builtin.include_tasks: verify_tasks/service.yml

-    - name: include tests for MySQL user
-      include_tasks: verify_tasks/mysql_users.yml
+    - name: Include tests for MySQL user
+      ansible.builtin.include_tasks: verify_tasks/mysql_users.yml

 - name: Verify
  hosts: localhost
@@ -34,7 +34,7 @@
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Execute cinc-auditor tests
-      command: >
+      ansible.builtin.command: >
        docker run
        --volume /run/docker.sock:/run/docker.sock
        docker.io/cincproject/auditor exec
@@ -46,10 +46,10 @@
      ignore_errors: true

    - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
        msg: "{{ test_results.stdout_lines }}"

    - name: Fail when tests fail
-      fail:
-        msg: "Inspec failed to validate"
+      ansible.builtin.fail:
+        msg: Inspec failed to validate
      when: test_results.rc != 0
@@ -6,11 +6,11 @@
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_users

- name: create list of users from mysql query
-  set_fact:
+- name: Create list of users from mysql query
+  ansible.builtin.set_fact:
    mysql_users_list: "{{ mysql_users.query_result.0  | json_query('[*].users') | list }}"

- name: assert that only accounts with password remain
+- name: Assert that only accounts with password remain
  ansible.builtin.assert:
    that:
      - '"user@delete" not in mysql_users_list'
@@ -33,9 +33,9 @@
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_role_support

- name: assert that roles remain
+- name: Assert that roles remain
  ansible.builtin.assert:
    that:
-       - '"role_keep@" in mysql_users_list'
+      - '"role_keep@" in mysql_users_list'
  when:
    - mysql_role_support.rowcount[0] > 0
@@ -10,7 +10,7 @@
  ansible.builtin.service_facts:

 - name: Check if MySQL is running and enabled
-  assert:
+  ansible.builtin.assert:
    that:
-      - "ansible_facts.services[mysql_daemon + '.service'].state == 'running'"
-      - "ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'"
+      - ansible_facts.services[mysql_daemon + '.service'].state == 'running'
+      - ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'
@@ -1,16 +1,15 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
  become: true
  hosts: all
-  collections:
-    - devsec.hardening
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  vars:
-    - nginx_ppa_use: true
-    - nginx_ppa_version: stable
+    nginx_ppa_use: true
+    nginx_ppa_version: stable
  tasks:
-    - include_role:
-        name: nginx_hardening
+    - name: Include nginx_hardening role
+      ansible.builtin.include_role:
+        name: devsec.hardening.nginx_hardening
@@ -7,7 +7,7 @@ driver:
  name: docker
 platforms:
  - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -1,24 +1,24 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
  hosts: localhost
  vars:
-    - nginx_main_template_enable: true
-    - nginx_main_template:
-        template_file: nginx.conf.j2
-        conf_file_name: nginx.conf
-        conf_file_location: /etc/nginx/
-        user: www-data
-        worker_processes: auto
-        error_level: warn
-        worker_connections: 1024
-        http_enable: true
-        http_settings:
-          keepalive_timeout: 65
-          cache: false
-          rate_limit: false
-          keyval: false
-        stream_enable: false
-        http_global_autoindex: false
+    nginx_main_template_enable: true
+    nginx_main_template:
+      template_file: nginx.conf.j2
+      conf_file_name: nginx.conf
+      conf_file_location: /etc/nginx/
+      user: www-data
+      worker_processes: auto
+      error_level: warn
+      worker_connections: 1024
+      http_enable: true
+      http_settings:
+        keepalive_timeout: 65
+        cache: false
+        rate_limit: false
+        keyval: false
+      stream_enable: false
+      http_global_autoindex: false
  roles:
    - nginxinc.nginx
    - nginx_hardening
@@ -1,5 +1,5 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
  hosts: localhost
  roles:
    - nginxinc.nginx
@@ -1,5 +1,5 @@
 ---
- name: prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: Prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
  become: true
  hosts: all
  environment:
@@ -7,22 +7,23 @@
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
-    - name: install required tools on SuSE
+    - name: Install required tools on SuSE
      community.general.zypper:
-        name: "python-xml"
+        name: python-xml
        state: present
      when: ansible_facts.os_family == 'Suse'

-    - name: install required packages
-      package:
-        name: "python3-apt"
+    - name: Install required packages
+      ansible.builtin.package:
+        name: python3-apt
        update_cache: true
-      ignore_errors: true  # noqa ignore-errors
+      ignore_errors: true # noqa ignore-errors

    - name: Set correct distribution Version for Amazon Linux
-      set_fact:
+      ansible.builtin.set_fact:
        ansible_distribution_major_version: 7
      when: ansible_distribution == 'Amazon'

-    - include_role:
+    - name: Install nginx with a generic Ansible role
+      ansible.builtin.include_role:
        name: geerlingguy.nginx
@@ -1,3 +1,3 @@
 ---
 roles:
-  - geerlingguy.nginx
+  - name: geerlingguy.nginx
@@ -7,8 +7,8 @@
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
-    - name: install procps for debian systems
-      apt:
+    - name: Install procps for debian systems
+      ansible.builtin.apt:
        name: procps
        state: present
        update_cache: true
@@ -22,7 +22,7 @@
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Execute cinc-auditor tests
-      command: >
+      ansible.builtin.command: >
        docker run
        --volume /run/docker.sock:/run/docker.sock
        docker.io/cincproject/auditor exec
@@ -34,10 +34,10 @@
      ignore_errors: true

    - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
        msg: "{{ test_results.stdout_lines }}"

    - name: Fail when tests fail
-      fail:
-        msg: "Inspec failed to validate"
+      ansible.builtin.fail:
+        msg: Inspec failed to validate
      when: test_results.rc != 0
@@ -1,19 +1,18 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  collections:
-    - devsec.hardening
  tasks:
-    - name: workaround for https://github.com/ansible/ansible/issues/66304
-      set_fact:
-        ansible_virtualization_type: "docker"
-    - include_role:
-        name: os_hardening
+    - name: Workaround for https://github.com/ansible/ansible/issues/66304
+      ansible.builtin.set_fact:
+        ansible_virtualization_type: docker
+    - name: Include os_hardening role
+      ansible.builtin.include_role:
+        name: devsec.hardening.os_hardening
  vars:
    os_security_users_allow: change_user
    os_security_kernel_enable_core_dump: false
@@ -22,17 +21,17 @@
    os_auth_pam_passwdqc_enable: false
    os_auth_lockout_time: 15
    os_desktop_enable: true
-    os_env_extra_user_paths: ['/home']
+    os_env_extra_user_paths: [/home]
    os_auth_allow_homeless: true
-    os_security_suid_sgid_blacklist: ['/bin/umount']
-    os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
+    os_security_suid_sgid_blacklist: [/bin/umount]
+    os_security_suid_sgid_whitelist: [/usr/bin/rlogin]
    os_filesystem_whitelist: []
-    os_yum_repo_file_whitelist: ['foo.repo']
-    os_users_without_password_ageing: ['pw_no_ageing']
+    os_yum_repo_file_whitelist: [foo.repo]
+    os_users_without_password_ageing: [pw_no_ageing]
    os_auth_pw_warn_age: 7
    os_netrc_enabled: false
-    os_ignore_users: ["shell_sys_acc"]
-    os_ignore_home_folder_users: ["user_with_777_home"]
+    os_ignore_users: [shell_sys_acc]
+    os_ignore_home_folder_users: [user_with_777_home]
    sysctl_config:
      net.ipv4.ip_forward: 0
      net.ipv6.conf.all.forwarding: 0
@@ -73,8 +72,6 @@
 # - name: wrapper playbook for kitchen testing "ansible-os-hardening"
 #  hosts: all
 #  become: true
-#  collections:
-#    - devsec.hardening
 #  vars:
 #    os_auditd_enabled: false
 #  tasks:
@@ -84,9 +81,9 @@
 #      when: ansible_facts.distribution == 'Fedora'
 #
 #    - name: Run the equivalent of "apt-get update" as a separate step
-#      apt:
+#      ansible.builtin.apt:
 #        update_cache: yes
 #      when: ansible_facts.os_family == 'Debian'
 #
 #    - include_role:
-#        name: os_hardening
+#        name: devsec.hardening.os_hardening
@@ -3,7 +3,7 @@ driver:
  name: docker
 platforms:
  - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -1,5 +1,5 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
  hosts: all
  become: true
  environment:
@@ -7,32 +7,32 @@
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
-    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
-      set_fact:
-        ansible_python_interpreter: "/usr/bin/python3"
+    - name: Set ansible_python_interpreter to "/usr/bin/python3" on fedora
+      ansible.builtin.set_fact:
+        ansible_python_interpreter: /usr/bin/python3
      when: ansible_facts.distribution == 'Fedora'

    - name: Run the equivalent of "apt-get update && apt-get upgrade"
-      apt:
-        name: "*"
-        state: latest
+      ansible.builtin.apt:
+        upgrade: safe
        update_cache: true
      when: ansible_os_family == 'Debian'

-    - name: install required tools on SuSE
+    - name: Install required tools on SuSE
      # cannot use zypper module, since it depends on python-xml
-      shell: "zypper -n install python-xml awk"
+      ansible.builtin.command: zypper -n install python-xml awk
+      changed_when: false
      when: ansible_facts.os_family == 'Suse'

-    - name: install required tools on fedora
-      dnf:
+    - name: Install required tools on fedora
+      ansible.builtin.dnf:
        name:
          - python
          - findutils
          - procps-ng
      when: ansible_facts.distribution == 'Fedora'

-    - name: install required tools on Arch
+    - name: Install required tools on Arch
      community.general.pacman:
        name:
          - awk
@@ -40,8 +40,8 @@
        update_cache: true
      when: ansible_facts.os_family == 'Archlinux'

-    - name: install required tools on RHEL  # noqa ignore-errors
-      yum:
+    - name: Install required tools on RHEL # noqa ignore-errors
+      ansible.builtin.yum:
        name:
          - openssh-clients
          - openssh
@@ -49,15 +49,15 @@
        update_cache: true
      ignore_errors: true

-    - name: create recursing symlink to test minimize access
-      shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
+    - name: Create recursing symlink to test minimize access
+      ansible.builtin.shell: rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz
      changed_when: false

-    - name: include YUM prepare tasks
-      include_tasks: prepare_tasks/yum.yml
+    - name: Include YUM prepare tasks
+      ansible.builtin.include_tasks: prepare_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'

-    - name: include preparation tasks
+    - name: Include preparation tasks
      ansible.builtin.include_tasks:
        file: "{{ item }}"
      loop:
@@ -1,7 +1,7 @@
 ---
 - name: Create user whose home-folder should not be touched
  ansible.builtin.user:
-    name: "user_with_777_home"
+    name: user_with_777_home

 - name: Change mode of home-folder for user to 777
  ansible.builtin.file:
@@ -1,8 +1,8 @@
 ---
 - name: create '.netrc' in /root
  ansible.builtin.copy:
-    dest: '/root/.netrc'
-    mode: '0600'
+    dest: /root/.netrc
+    mode: "0600"
    content: |
      machine localhost
      login root
@@ -1,9 +1,10 @@
+---
 - name: Create user those password ageing should not be changed
  user:
-    name: "pw_no_ageing"
-    password: "$6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1"
+    name: pw_no_ageing
+    password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1

 - name: Create user those password ageing should be changed
  user:
-    name: "pw_ageing"
-    password: "$6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1"
+    name: pw_ageing
+    password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
@@ -1,5 +1,5 @@
 ---
 - name: Create system user with shell that should keep it
  user:
-    name: "shell_sys_acc"
-    shell: "/bin/bash"
+    name: shell_sys_acc
+    shell: /bin/bash
@@ -1,5 +1,5 @@
 ---
- name: create 'foo' repository
+- name: Create 'foo' repository
  ansible.builtin.yum_repository:
    name: foo
    description: mandatory description
@@ -7,7 +7,7 @@
    enabled: false
    gpgcheck: false

- name: create 'bar' repository
+- name: Create 'bar' repository
  ansible.builtin.yum_repository:
    name: bar
    description: mandatory description
@@ -7,27 +7,27 @@
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
-    - name: set ansible_python_interpreter to "/usr/bin/python3"
-      set_fact:
-        ansible_python_interpreter: "/usr/bin/python3"
+    - name: Set ansible_python_interpreter to "/usr/bin/python3"
+      ansible.builtin.set_fact:
+        ansible_python_interpreter: /usr/bin/python3
      when: ansible_facts.distribution == 'Fedora'

-    - name: include verification tasks
+    - name: Include verification tasks
      ansible.builtin.include_tasks:
        file: "{{ item }}"
-      loop: 
+      loop:
        - verify_tasks/sys_account_shell.yml
        - verify_tasks/pw_ageing.yml
        - verify_tasks/netrc.yml
        - verify_tasks/ignore_home_folders.yml

-# temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
-#    - name: include PAM tests
-#      include_tasks: verify_tasks/pam.yml
-#      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+    # temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
+    #    - name: Include PAM tests
+    #      ansible.builtin.include_tasks: verify_tasks/pam.yml
+    #      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'

-    - name: include YUM tests
-      include_tasks: verify_tasks/yum.yml
+    - name: Include YUM tests
+      ansible.builtin.include_tasks: verify_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'

 - name: Verify
@@ -38,7 +38,7 @@
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Execute cinc-auditor tests
-      command: >
+      ansible.builtin.command: >
        docker run
        --volume /run/docker.sock:/run/docker.sock
        --volume {{ playbook_dir }}/waivers.yaml:/waivers.yaml
@@ -52,12 +52,12 @@
      ignore_errors: true

    - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
        msg: "{{ test_results.stdout_lines }}"

    - name: Fail when tests fail
-      fail:
-        msg: "Inspec failed to validate"
+      ansible.builtin.fail:
+        msg: Inspec failed to validate
      when: test_results.rc != 0

 - name: Verify
@@ -67,19 +67,18 @@
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  collections:
-    - devsec.hardening
  tasks:
    # test if variable can be overridden
-    - name: workaround for https://github.com/ansible/ansible/issues/66304
-      set_fact:
-        ansible_virtualization_type: "docker"
+    - name: Workaround for https://github.com/ansible/ansible/issues/66304
+      ansible.builtin.set_fact:
+        ansible_virtualization_type: docker
        os_env_umask: "027 #override"

-    - include_role:
-        name: os_hardening
+    - name: Include os_hardening role
+      ansible.builtin.include_role:
+        name: devsec.hardening.os_hardening

-    - name: verify os_env_umask
-      shell:
+    - name: Verify os_env_umask
+      ansible.builtin.command:
        cmd: "grep '027 #override' /etc/login.defs"
      changed_when: false
@@ -1,19 +1,19 @@
 ---
- name: test that .netrc in root homedir exists
+- name: Test that .netrc in root homedir exists
  ansible.builtin.file:
-    path: '/root/.netrc'
+    path: /root/.netrc
    state: file
  register: result_test_netrc

- name: output result if .netrc for user root exists
+- name: Output result if .netrc for user root exists
  ansible.builtin.assert:
    that:
-      - "result_test_netrc.state == 'file'"
-    fail_msg: ".netrc in /root/ not present"
-    success_msg: ".netrc exists in /root/"
+      - result_test_netrc.state == 'file'
+    fail_msg: .netrc in /root/ not present
+    success_msg: .netrc exists in /root/

- name: delete '.netrc' in /root
+- name: Delete '.netrc' in /root
  ansible.builtin.file:
-    path: '/root/.netrc'
+    path: /root/.netrc
    state: absent
  when: result_test_netrc.state == 'file'
@@ -1,5 +1,4 @@
 ---
-
 - name: install pip
  package:
    name:
@@ -14,12 +13,12 @@
    executable: /usr/bin/pip3

 - name: set password for test
-  set_fact:
-    test_pw: "myTest!pw"
+  ansible.builtin.set_fact:
+    test_pw: myTest!pw

 - name: set locale for test
-  set_fact:
-    locale: "en_US.UTF-8"
+  ansible.builtin.set_fact:
+    locale: en_US.UTF-8
  when:
    - ansible_facts.os_family == 'RedHat'
    - ansible_facts.distribution_major_version < '8'
@@ -30,16 +29,16 @@
    password: "{{ test_pw | password_hash('sha512') }}"

 - name: check successful login with correct password
-  shell:
-    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
+  ansible.builtin.shell:
+    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"

 - name: check unsuccessful login with incorrect password
-  shell:
-    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+  ansible.builtin.shell:
+    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -47,8 +46,8 @@
  with_sequence: count=6

 - name: check unsuccessful login, with correct password (lockout)
-  shell:
-    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail"
+  ansible.builtin.shell:
+    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -59,8 +58,8 @@
    seconds: 20

 - name: check successful login
-  shell:
-    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
+  ansible.builtin.shell:
+    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -7,7 +7,7 @@
 - name: Check that the expiry date of pw_no_ageing is "never"
  ansible.builtin.assert:
    that:
-      - "expiry_date.stdout | trim == 'never'"
+      - expiry_date.stdout | trim == 'never'

 - name: Get Password Expiry date for pw_ageing
  ansible.builtin.shell: chage -l pw_ageing | grep "Password expires" | cut -d ":" -f 2
@@ -19,7 +19,7 @@
    # this uses the date from the expire_date variable and subtracts the current date.
    # it should be bigger that the password_expire_min of the user "pw_no_ageing"
    that:
-      - "{{ ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_date_time.date | to_datetime('%Y-%m-%d')).days }} == 60"
+      - ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_date_time.date | to_datetime('%Y-%m-%d')).days == 60

 - name: Get Password Expiry warning days for pw_ageing
  ansible.builtin.shell: chage -l pw_ageing | grep "warning before password expires" | cut -d ":" -f 2
@@ -29,4 +29,4 @@
 - name: Check that number of days of warning before password expires is 7 days
  ansible.builtin.assert:
    that:
-      - "expiry_warndays.stdout | trim == '7'"
+      - expiry_warndays.stdout | trim == '7'
@@ -1,8 +1,9 @@
+---
 - name: Read local linux user database
  getent:
    database: passwd

 - name: Check that shell_sys_acc's shell is still bash
-  assert:
+  ansible.builtin.assert:
    that:
      - getent_passwd['shell_sys_acc'][5] == "/bin/bash"
@@ -1,8 +1,8 @@
 ---
- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
-  command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
+- name: Verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
+  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
  changed_when: false

- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
-  command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
+- name: Verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
+  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
  changed_when: false
@@ -1,30 +1,32 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  collections:
-    - devsec.hardening
  tasks:
-    - name: override for arch
-      set_fact: 
+    - name: Override for arch
+      ansible.builtin.set_fact:
        os_mnt_boot_enabled: false
-      when: ansible_facts.os_family == 'Archlinux'
-    - name: overrides for Fedora image
-      set_fact: 
        os_mnt_tmp_enabled: true
-        os_mnt_tmp_src: "tmpfs"
-        os_mnt_tmp_filesystem: "tmpfs"
+        os_mnt_tmp_src: tmpfs
+        os_mnt_tmp_filesystem: tmpfs
+      when: ansible_facts.os_family == 'Archlinux'
+    - name: Overrides for Fedora image
+      ansible.builtin.set_fact:
+        os_mnt_tmp_enabled: true
+        os_mnt_tmp_src: tmpfs
+        os_mnt_tmp_filesystem: tmpfs
      when: ansible_facts.distribution == 'Fedora'
-    - include_role:
-        name: os_hardening
+    - name: Include os_hardening role
+      ansible.builtin.include_role:
+        name: devsec.hardening.os_hardening
  vars:
    os_auth_pam_passwdqc_enable: false
    os_auth_lockout_time: 15
-    os_yum_repo_file_whitelist: ['foo.repo']
+    os_yum_repo_file_whitelist: [foo.repo]
    os_mnt_boot_enabled: true
    os_mnt_home_enabled: true
-    os_mnt_boot_src: "/dev/vda1"
+    os_mnt_boot_src: /dev/vda1
@@ -2,7 +2,7 @@
 dependency:
  name: galaxy
  options:
-    role-file: molecule/os_hardening/requirements.yml
+    role-file: molecule/os_hardening_vm/requirements.yml
 driver:
  name: vagrant
  provider:
@@ -11,8 +11,8 @@ platforms:
  # we need to name every instance differently to start multiple VMs on the same host (parallelization)
  # since we also need to use different OS users to run the tests because of how molecule operates,
  # the VM names must be predictable by OS user (to clean up canceled runs)
-  - name: "${USER}"
-    box: "${MOLECULE_DISTRO}"
+  - name: ${USER}
+    box: ${MOLECULE_DISTRO}
    memory: 1024
    cpus: 2
 provisioner:
@@ -1,5 +1,15 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: Prepare Archliux host
+  hosts: all
+  become: true
+  gather_facts: false
+  tasks:
+    - name: Install python, since it's not installed by default
+      ansible.builtin.raw: pacman --noconfirm -Sy python
+      changed_when: false
+      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
+
+- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
  hosts: all
  become: true
  environment:
@@ -7,30 +17,38 @@
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
-    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
-      set_fact:
-        ansible_python_interpreter: "/usr/bin/python3"
+    - name: Set ansible_python_interpreter to "/usr/bin/python3" on fedora
+      ansible.builtin.set_fact:
+        ansible_python_interpreter: /usr/bin/python3
      when: ansible_facts.distribution == 'Fedora'

+    - name: Block update of Grub, because of error
+      ansible.builtin.dpkg_selections:
+        name: grub-pc
+        selection: hold
+      when: ansible_os_family == 'Debian'
+
    - name: Run the equivalent of "apt-get update && apt-get upgrade"
-      apt:
+      ansible.builtin.apt:
+        upgrade: safe
        update_cache: true
      when: ansible_os_family == 'Debian'

-    - name: install required tools on SuSE
+    - name: Install required tools on SuSE
      # cannot use zypper module, since it depends on python-xml
-      shell: "zypper -n install python-xml"
+      ansible.builtin.command: zypper -n install python-xml
+      changed_when: false
      when: ansible_facts.os_family == 'Suse'

-    - name: install required tools on fedora
-      dnf:
+    - name: Install required tools on fedora
+      ansible.builtin.dnf:
        name:
          - python
          - findutils
          - procps-ng
      when: ansible_facts.distribution == 'Fedora'

-    - name: install required tools on Arch
+    - name: Install required tools on Arch
      community.general.pacman:
        name:
          - awk
@@ -38,8 +56,8 @@
        update_cache: true
      when: ansible_facts.os_family == 'Archlinux'

-    - name: install required tools on RHEL  # noqa ignore-errors
-      yum:
+    - name: Install required tools on RHEL # noqa ignore-errors
+      ansible.builtin.yum:
        name:
          - openssh-clients
          - openssh
@@ -47,8 +65,8 @@
        update_cache: true
      ignore_errors: true

-    - name: create recursing symlink to test minimize access
-      shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
+    - name: Create recursing symlink to test minimize access
+      ansible.builtin.shell: rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz
      changed_when: false

    - name: Unmount EFI partition to get rid of vfat filesystem (qemu has no firmware image that inspec can detect)
@@ -57,6 +75,6 @@
        state: unmounted
      when: ansible_facts.distribution == 'Fedora'

-    - name: include YUM prepare tasks
-      include_tasks: prepare_tasks/yum.yml
+    - name: Include YUM prepare tasks
+      ansible.builtin.include_tasks: prepare_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'
@@ -1,5 +1,5 @@
 ---
- name: create 'foo' repository
+- name: Create 'foo' repository
  ansible.builtin.yum_repository:
    name: foo
    description: mandatory description
@@ -7,7 +7,7 @@
    enabled: false
    gpgcheck: false

- name: create 'bar' repository
+- name: Create 'bar' repository
  ansible.builtin.yum_repository:
    name: bar
    description: mandatory description
@@ -1,3 +1,3 @@
 ---
 roles:
-  - geerlingguy.git
+  - name: geerlingguy.git
@@ -7,14 +7,13 @@
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
+    # temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
+    #    - name: Include PAM tests
+    #      ansible.builtin.include_tasks: verify_tasks/pam.yml
+    #      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'

-# temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
-#    - name: include PAM tests
-#      include_tasks: verify_tasks/pam.yml
-#      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
-
-    - name: include YUM tests
-      include_tasks: verify_tasks/yum.yml
+    - name: Include YUM tests
+      ansible.builtin.include_tasks: verify_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'

 - name: Verify
@@ -24,21 +23,22 @@
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
-    - name: get ssh-config
-      command:
-        cmd: "vagrant ssh-config"
+    - name: Get ssh-config
+      ansible.builtin.command:
+        cmd: vagrant ssh-config
        chdir: "{{ molecule_ephemeral_directory }}"
      register: ssh_config
      changed_when: false

-    - name: create ssh-config file
-      copy:
+    - name: Create ssh-config file
+      ansible.builtin.copy:
        content: "{{ ssh_config.stdout_lines | join ('\n') }}"
        dest: "{{ molecule_ephemeral_directory }}/ssh-config"
+        mode: "0400"
      changed_when: false

    - name: Execute cinc-auditor tests
-      command: >
+      ansible.builtin.command: >
        docker run
        --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
        docker.io/cincproject/auditor exec
@@ -51,10 +51,10 @@
      ignore_errors: true

    - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
        msg: "{{ test_results.stdout_lines }}"

    - name: Fail when tests fail
-      fail:
-        msg: "Inspec failed to validate"
+      ansible.builtin.fail:
+        msg: Inspec failed to validate
      when: test_results.rc != 0
@@ -12,12 +12,12 @@
    state: present

 - name: set password for test
-  set_fact:
-    test_pw: "myTest!pw"
+  ansible.builtin.set_fact:
+    test_pw: myTest!pw

 - name: set locale for test
-  set_fact:
-    locale: "en_US.UTF-8"
+  ansible.builtin.set_fact:
+    locale: en_US.UTF-8
  when:
    - ansible_facts.os_family == 'RedHat'
    - ansible_facts.distribution_major_version < '8'
@@ -28,16 +28,16 @@
    password: "{{ test_pw | password_hash('sha512') }}"

 - name: check successful login with correct password
-  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+  ansible.builtin.shell:
+    cmd: pam-tester --user testuser --password {{ test_pw }}
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"

 - name: check unsuccessful login with incorrect password
-  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+  ansible.builtin.shell:
+    cmd: pam-tester --user testuser --password {{ test_pw }}fail --expectfail
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -45,8 +45,8 @@
  with_sequence: count=6

 - name: check unsuccessful login, with correct password (lockout)
-  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
+  ansible.builtin.shell:
+    cmd: pam-tester --user testuser --password {{ test_pw }} --expectfail
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -57,8 +57,8 @@
    seconds: 20

 - name: check successful login
-  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+  ansible.builtin.shell:
+    cmd: pam-tester --user testuser --password {{ test_pw }}
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -1,8 +1,8 @@
 ---
- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
-  command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
+- name: Verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
+  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
  changed_when: false

- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
-  command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
+- name: Verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
+  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
  changed_when: false
@@ -1,14 +1,13 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
  hosts: all
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  collections:
-    - devsec.hardening
  tasks:
-    - include_role:
-        name: ssh_hardening
+    - name: Include ssh_hardening role
+      ansible.builtin.include_role:
+        name: devsec.hardening.ssh_hardening
  vars:
    sftp_enabled: false
@@ -3,7 +3,7 @@ driver:
  name: docker
 platforms:
  - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -1,5 +1,5 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
  hosts: all
  become: true
  environment:
@@ -7,13 +7,13 @@
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
-    - name: use python3
-      set_fact:
+    - name: Use python3
+      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when: ansible_facts.distribution == 'Fedora'

-    - name: install packages  # noqa ignore-errors
-      yum:
+    - name: Install packages # noqa ignore-errors
+      ansible.builtin.yum:
        name:
          - openssh-clients
          - openssh-server
@@ -22,8 +22,8 @@
        update_cache: true
      ignore_errors: true

-    - name: install packages  # noqa ignore-errors
-      dnf:
+    - name: Install packages # noqa ignore-errors
+      ansible.builtin.dnf:
        name:
          - openssh-clients
          - openssh-server
@@ -32,8 +32,8 @@
        update_cache: true
      ignore_errors: true

-    - name: install packages  # noqa ignore-errors
-      apt:
+    - name: Install packages # noqa ignore-errors
+      ansible.builtin.apt:
        name:
          - openssh-client
          - openssh-server
@@ -41,19 +41,20 @@
        update_cache: true
      ignore_errors: true

-    - name: install required tools on SuSE
+    - name: Install required tools on SuSE
      # cannot use zypper module, since it depends on python-xml
-      shell: "zypper -n install python-xml"
+      ansible.builtin.command: zypper -n install python-xml
+      changed_when: false
      when: ansible_facts.os_family == 'Suse'

-    - name: install packages
-      zypper:
+    - name: Install packages
+      community.general.zypper:
        name:
-          - "openssh"
+          - openssh
      when: ansible_facts.os_family == 'Suse'

-    - name: install required tools on Arch
-      pacman:
+    - name: Install required tools on Arch
+      community.general.pacman:
        name:
          - openssh
          - awk
@@ -61,16 +62,17 @@
        update_cache: true
      when: ansible_facts.os_family == 'Archlinux'

-    - name: created needed directory
-      file:
-        path: "/var/run/sshd"
+    - name: Created needed directory
+      ansible.builtin.file:
+        path: /var/run/sshd
        state: directory
+        mode: "0755"

-    - name: create ssh host keys  # noqa ignore-errors
-      command: "ssh-keygen -A"
-      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
-            ansible_facts.distribution == "Fedora" or
-            ansible_facts.distribution == "Amazon" or
-            ansible_facts.os_family == "Suse"
+    - name: Create ssh host keys # noqa ignore-errors
+      ansible.builtin.command: ssh-keygen -A
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
+        or ansible_facts.distribution == "Fedora"
+        or ansible_facts.distribution == "Amazon"
+        or ansible_facts.os_family == "Suse"
      changed_when: false
      ignore_errors: true
@@ -7,7 +7,7 @@
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Execute cinc-auditor tests
-      command: >
+      ansible.builtin.command: >
        docker run
        --volume /run/docker.sock:/run/docker.sock
        docker.io/cincproject/auditor exec
@@ -19,10 +19,10 @@
      ignore_errors: true

    - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
        msg: "{{ test_results.stdout_lines }}"

    - name: Fail when tests fail
-      fail:
-        msg: "Inspec failed to validate"
+      ansible.builtin.fail:
+        msg: Inspec failed to validate
      when: test_results.rc != 0
@@ -1,14 +1,13 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
  hosts: all
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  collections:
-    - devsec.hardening
  tasks:
-    - include_role:
-        name: ssh_hardening
+    - name: Include ssh_hardening role
+      ansible.builtin.include_role:
+        name: devsec.hardening.ssh_hardening
  vars:
    sftp_enabled: false
@@ -7,8 +7,8 @@ platforms:
  # we need to name every instance differently to start multiple VMs on the same host (parallelization)
  # since we also need to use different OS users to run the tests because of how molecule operates,
  # the VM names must be predictable by OS user (to clean up canceled runs)
-  - name: "${USER}"
-    box: "generic/${MOLECULE_DISTRO}"
+  - name: ${USER}
+    box: generic/${MOLECULE_DISTRO}
    memory: 1024
    cpus: 2
 provisioner:
@@ -1,15 +1,16 @@
 ---
- name: prepare OpenBSD host
+- name: Prepare OpenBSD host
  hosts: all
  become: true
  gather_facts: false
  tasks:
-    - name: install python
+    - name: Install python
      # BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
-      raw: "pkg_add python%3.10"
-      when: "lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'"
+      ansible.builtin.raw: pkg_add python%3.10
+      changed_when: false
+      when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'

- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
  hosts: all
  become: true
  environment:
@@ -17,16 +18,17 @@
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
-    - name: created needed directory
-      file:
-        path: "/var/run/sshd"
+    - name: Created needed directory
+      ansible.builtin.file:
+        path: /var/run/sshd
        state: directory
+        mode: "0755"

-    - name: create ssh host keys  # noqa ignore-errors
-      command: "ssh-keygen -A"
-      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
-            ansible_facts.distribution == "Fedora" or
-            ansible_facts.distribution == "Amazon" or
-            ansible_facts.os_family == "Suse"
+    - name: Create ssh host keys # noqa ignore-errors
+      ansible.builtin.command: ssh-keygen -A
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
+        or ansible_facts.distribution == "Fedora"
+        or ansible_facts.distribution == "Amazon"
+        or ansible_facts.os_family == "Suse"
      changed_when: false
      ignore_errors: true
@@ -3,12 +3,13 @@
  hosts: all
  become: true
  tasks:
-    - name: use the type command instead of which to detect existing commands
-      file:
-        src: "/usr/bin/which"
-        dest: "/usr/bin/type"
+    - name: Use the type command instead of which to detect existing commands
+      ansible.builtin.file:
+        src: /usr/bin/which
+        dest: /usr/bin/type
        state: hard
-      when: "lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'"
+        mode: "0770"
+      when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'

 - name: Verify
  hosts: localhost
@@ -17,21 +18,22 @@
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
-    - name: get ssh-config
-      command: 
-        cmd: "vagrant ssh-config"
+    - name: Get ssh-config
+      ansible.builtin.command:
+        cmd: vagrant ssh-config
        chdir: "{{ molecule_ephemeral_directory }}"
      register: ssh_config
      changed_when: false

-    - name: create ssh-config file
-      copy:
+    - name: Create ssh-config file
+      ansible.builtin.copy:
        content: "{{ ssh_config.stdout_lines | join ('\n') }}"
        dest: "{{ molecule_ephemeral_directory }}/ssh-config"
+        mode: "0400"
      changed_when: false

    - name: Execute cinc-auditor tests
-      command: >
+      ansible.builtin.command: >
        docker run
        --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
        --volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') }}.yaml:/waivers.yaml
@@ -46,10 +48,10 @@
      ignore_errors: true

    - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
        msg: "{{ test_results.stdout_lines }}"

    - name: Fail when tests fail
-      fail:
-        msg: "Inspec failed to validate"
+      ansible.builtin.fail:
+        msg: Inspec failed to validate
      when: test_results.rc != 0
@@ -1,44 +1,43 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  collections:
-    - devsec.hardening
  tasks:
-    - include_role:
-        name: ssh_hardening
+    - name: Include ssh_hardening role
+      ansible.builtin.include_role:
+        name: devsec.hardening.ssh_hardening
  vars:
-    ssh_trusted_user_ca_keys_file: '/etc/ssh/ca.pub'
+    ssh_trusted_user_ca_keys_file: /etc/ssh/ca.pub
    ssh_trusted_user_ca_keys:
-      - '# ssh-rsa ...'
-    ssh_authorized_principals_file: '/etc/ssh/auth_principals/%u'
+      - "# ssh-rsa ..."
+    ssh_authorized_principals_file: /etc/ssh/auth_principals/%u
    ssh_authorized_principals:
-      - path: "/etc/ssh/auth_principals/root"
+      - path: /etc/ssh/auth_principals/root
        principals:
-          - "root"
+          - root
    network_ipv6_enable: true
-    ssh_allow_tcp_forwarding: 'yes'
+    ssh_allow_tcp_forwarding: "yes"
    ssh_gateway_ports: true
    ssh_allow_agent_forwarding: true
-    ssh_server_permit_environment_vars: 'yes'
-    ssh_server_accept_env_vars: 'PWD HTTP_PROXY'
+    ssh_server_permit_environment_vars: "yes"
+    ssh_server_accept_env_vars: PWD HTTP_PROXY
    ssh_client_alive_interval: 100
    ssh_client_alive_count: 10
    ssh_client_password_login: true
    ssh_challengeresponseauthentication: true
    ssh_compression: true
-    ssh_allow_users: 'root kitchen vagrant'
-    ssh_allow_groups: 'root kitchen vagrant'
-    ssh_deny_users: 'foo bar'
-    ssh_deny_groups: 'foo bar'
-    ssh_authorized_keys_file: '/etc/ssh/authorized_keys/%u'
+    ssh_allow_users: root kitchen vagrant
+    ssh_allow_groups: root kitchen vagrant
+    ssh_deny_users: foo bar
+    ssh_deny_groups: foo bar
+    ssh_authorized_keys_file: /etc/ssh/authorized_keys/%u
    ssh_max_auth_retries: 10
-    ssh_permit_root_login: "without-password"
-    ssh_permit_tunnel: 'yes'
+    ssh_permit_root_login: without-password
+    ssh_permit_tunnel: "yes"
    ssh_print_motd: true
    ssh_print_last_log: true
    ssh_banner: true
@@ -49,33 +48,33 @@
      - 22
      - 222
    ssh_server_match_address:
-      - address: '192.168.1.0/24'
+      - address: 192.168.1.0/24
        rules:
-          - 'AllowTcpForwarding yes'
-          - 'AllowAgentForwarding no'
+          - AllowTcpForwarding yes
+          - AllowAgentForwarding no
    ssh_server_match_group:
-      - group: 'root'
+      - group: root
        rules:
-          - 'AllowTcpForwarding yes'
-          - 'AllowAgentForwarding no'
+          - AllowTcpForwarding yes
+          - AllowAgentForwarding no
    ssh_server_match_user:
-      - user: 'root'
+      - user: root
        rules:
-          - 'AllowTcpForwarding yes'
-          - 'AllowAgentForwarding no'
+          - AllowTcpForwarding yes
+          - AllowAgentForwarding no
    ssh_server_match_local_port:
      - port: 222
        rules:
-          - 'AllowTcpForwarding yes'
-          - 'AllowAgentForwarding no'
+          - AllowTcpForwarding yes
+          - AllowAgentForwarding no
    ssh_remote_hosts:
-      - names: ['example.com', 'example2.com']
-        options: ['Port 2222', 'ForwardAgent yes']
-      - names: ['example3.com']
-        options: ['StrictHostKeyChecking no']
+      - names: [example.com, example2.com]
+        options: [Port 2222, ForwardAgent yes]
+      - names: [example3.com]
+        options: [StrictHostKeyChecking no]
    ssh_use_dns: true
    ssh_use_pam: true
-    ssh_max_startups: '10:30:60'
+    ssh_max_startups: 10:30:60
    ssh_host_key_algorithms:
      - ssh-ed25519
      - rsa-sha2-512
@@ -93,6 +92,6 @@
      - diffie-hellman-group-exchange-sha256
      - diffie-hellman-group-exchange-sha1
    ssh_custom_options:
-      - "Include /etc/ssh/ssh_config.d/*"
+      - Include /etc/ssh/ssh_config.d/*
    sshd_custom_options:
-      - "AcceptEnv LANG"
+      - AcceptEnv LANG
@@ -3,7 +3,7 @@ driver:
  name: docker
 platforms:
  - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -1,5 +1,5 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
  hosts: all
  become: true
  environment:
@@ -7,13 +7,13 @@
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
-    - name: use python3
-      set_fact:
+    - name: Use python3
+      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when: ansible_facts.distribution == 'Fedora'

-    - name: install packages  # noqa ignore-errors
-      yum:
+    - name: Install packages # noqa ignore-errors
+      ansible.builtin.yum:
        name:
          - openssh-clients
          - openssh-server
@@ -22,8 +22,8 @@
        update_cache: true
      ignore_errors: true

-    - name: install packages  # noqa ignore-errors
-      dnf:
+    - name: Install packages # noqa ignore-errors
+      ansible.builtin.dnf:
        name:
          - openssh-clients
          - openssh-server
@@ -32,8 +32,8 @@
        update_cache: true
      ignore_errors: true

-    - name: install packages  # noqa ignore-errors
-      apt:
+    - name: Install packages # noqa ignore-errors
+      ansible.builtin.apt:
        name:
          - openssh-client
          - openssh-server
@@ -41,19 +41,20 @@
        update_cache: true
      ignore_errors: true

-    - name: install required tools on SuSE
+    - name: Install required tools on SuSE
      # cannot use zypper module, since it depends on python-xml
-      shell: "zypper -n install python-xml"
+      ansible.builtin.command: zypper -n install python-xml
+      changed_when: false
      when: ansible_facts.os_family == 'Suse'

-    - name: install packages
-      zypper:
+    - name: Install packages
+      community.general.zypper:
        name:
-          - "openssh"
+          - openssh
      when: ansible_facts.os_family == 'Suse'

-    - name: install required tools on Arch
-      pacman:
+    - name: Install required tools on Arch
+      community.general.pacman:
        name:
          - openssh
          - awk
@@ -61,16 +62,17 @@
        update_cache: true
      when: ansible_facts.os_family == 'Archlinux'

-    - name: created needed directory
-      file:
-        path: "/var/run/sshd"
+    - name: Created needed directory
+      ansible.builtin.file:
+        path: /var/run/sshd
        state: directory
+        mode: "0755"

-    - name: create ssh host keys  # noqa ignore-errors
-      command: "ssh-keygen -A"
-      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
-            ansible_facts.distribution == "Fedora" or
-            ansible_facts.distribution == "Amazon" or
-            ansible_facts.os_family == "Suse"
+    - name: Create ssh host keys # noqa ignore-errors
+      ansible.builtin.command: ssh-keygen -A
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
+        or ansible_facts.distribution == "Fedora"
+        or ansible_facts.distribution == "Amazon"
+        or ansible_facts.os_family == "Suse"
      changed_when: false
      ignore_errors: true
@@ -1,7 +1,7 @@
 molecule
 molecule-plugins[docker]
 yamllint
-ansible
+ansible-core==2.16.2
 ansible-lint
 docker
 flake8
@@ -24,7 +24,6 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
 <!-- BEGIN_ANSIBLE_DOCS -->

 ## Supported Operating Systems
-
 - EL
  - 7, 8, 9
 - Ubuntu
@@ -17,7 +17,6 @@ It works with the following nginx-roles, including, but not limited to:
 <!-- BEGIN_ANSIBLE_DOCS -->

 ## Supported Operating Systems
-
 - EL
  - 7, 8, 9
 - Ubuntu
@@ -53,10 +53,99 @@ We disable the following filesystems, because they're most likely not used:

 To prevent some of the filesystems from being disabled, add them to the `os_filesystem_whitelist` variable.

+## Known Limitations
+
+### Docker support
+
+If you're using Docker / Kubernetes+Docker you'll need to override the ipv4 ip forward sysctl setting.
+
+```yaml
+- hosts: localhost
+  roles:
+    - devsec.hardening.os_hardening
+  vars:
+    sysctl_overwrite:
+      # Enable IPv4 traffic forwarding.
+      net.ipv4.ip_forward: 1
+```
+
+### hidepid on RHEL/CentOS 7
+
+When having `polkit-0.112-18.el7` (and later) installed and `/proc` mounted with `hidepid=2`, every time someone uses `systemctl` the following error is displayed, but systemctl runs successfully.
+
+```
+Error registering authentication agent: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: Cannot determine user of subject (polkit-error-quark, 0)
+```
+
+We decided to set `hidepid=0` to remove the error message, if you want to use the other proposed workaround, you have to setup the user yourself and set our option to `hidepid_option: 2` via Ansible vars.
+
+For further details see [RedHat: "GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: Cannot determine user of subject" seen when executing systemctl command](https://access.redhat.com/solutions/5005111) or [#364: hidepid=2 gives error when running systemctl on EL7](https://github.com/dev-sec/ansible-collection-hardening/issues/364)
+
+### sysctl - vm.mmap_rnd_bits
+
+We are setting this sysctl to a default of `32`, some systems only support smaller values and this will generate an error. Unfortunately we cannot determine the correct applicable maximum. If you encounter this error you have to override this sysctl in your playbook.
+
+```yaml
+- hosts: localhost
+  roles:
+    - devsec.hardening.os_hardening
+  vars:
+    sysctl_overwrite:
+      vm.mmap_rnd_bits: 16
+```
+
+## Testing with inspec
+
+If you're using inspec to test your machines after applying this role, please make sure to add the connecting user to the `os_ignore_users`-variable.
+Otherwise inspec will fail. For more information, see [issue #124](https://github.com/dev-sec/ansible-os-hardening/issues/124).
+
+We know that this is the case on Raspberry Pi.
+
+## Changing sysctl variables
+
+If you want to override sysctl-variables, you can use the `sysctl_overwrite` variable (in older versions you had to override the whole `sysctl_dict`).
+So for example if you want to change the IPv4 traffic forwarding variable to `1`, do it like this:
+
+```yaml
+- hosts: localhost
+  roles:
+    - devsec.hardening.os_hardening
+  vars:
+    sysctl_overwrite:
+      # Enable IPv4 traffic forwarding.
+      net.ipv4.ip_forward: 1
+```
+
+Alternatively you can change Ansible's [hash-behaviour](https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-hash-behaviour) to `merge`, then you only have to overwrite the single hash you need to. But please be aware that changing the hash-behaviour changes it for all your playbooks and is not recommended by Ansible.
+
+## Improving Kernel Audit logging
+
+By default, any process that starts before the `auditd` daemon will have an AUID of `4294967295`. To improve this and provide more accurate logging, it's recommended to add the kernel boot parameter `audit=1` to you configuration. Without doing this, you will find that your `auditd` logs fail to properly audit all processes.
+
+For more information, please see this [upstream documentation](https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html) and your system's boot loader documentation for how to configure additional kernel parameters.
+
+## PAM configuration
+
+We use specific PAM configuration for every linux distribution. This is a very diverse area, since every vendor seems to push their own system for managing PAM. We used following guides and sources for our configuration.
+
+- on Debian/Ubuntu we use [pam-config-framework](https://wiki.ubuntu.com/PAMConfigFrameworkSpec)
+- RHEL8 and compatible use information from [authselect](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_authentication_and_authorization_in_rhel/configuring-user-authentication-using-authselect_configuring-authentication-and-authorization-in-rhel), but our setup disables the configuration from authselect
+- RHEL 6/7 and compatible use [authconfig](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/authconfig-install), but our setup disables the configuration from authconfig
+- for RHEL 6/7 we also use information from [Desktop Security](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-hardening_your_system_with_tools_and_services#sec-Desktop_Security)
+
+
+## Acknowledgements
+
+This role is mostly based on guides by:
+
+- [Arch Linux wiki, Sysctl hardening](https://wiki.archlinux.org/index.php/Sysctl)
+- [NSA: Guide to the Secure Configuration of Red Hat Enterprise Linux 5](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf)
+- [Ubuntu Security/Features](https://wiki.ubuntu.com/Security/Features)
+- [Deutsche Telekom, Group IT Security, Security Requirements (German)](https://www.telekom.com/psa)
+
 <!-- BEGIN_ANSIBLE_DOCS -->

 ## Supported Operating Systems
-
 - EL
  - 7, 8, 9
 - Ubuntu
@@ -925,96 +1014,3 @@ None.
 ```

 <!-- END_ANSIBLE_DOCS -->
-
-## Known Limitations
-
-### Docker support
-
-If you're using Docker / Kubernetes+Docker you'll need to override the ipv4 ip forward sysctl setting.
-
-```yaml
- hosts: localhost
-  collections:
-    - devsec.hardening
-  roles:
-    - devsec.hardening.os_hardening
-  vars:
-    sysctl_overwrite:
-      # Enable IPv4 traffic forwarding.
-      net.ipv4.ip_forward: 1
-```
-
-### hidepid on RHEL/CentOS 7
-
-When having `polkit-0.112-18.el7` (and later) installed and `/proc` mounted with `hidepid=2`, every time someone uses `systemctl` the following error is displayed, but systemctl runs successfully.
-
-```
-Error registering authentication agent: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: Cannot determine user of subject (polkit-error-quark, 0)
-```
-
-We decided to set `hidepid=0` to remove the error message, if you want to use the other proposed workaround, you have to setup the user yourself and set our option to `hidepid_option: 2` via Ansible vars.
-
-For further details see [RedHat: "GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: Cannot determine user of subject" seen when executing systemctl command](https://access.redhat.com/solutions/5005111) or [#364: hidepid=2 gives error when running systemctl on EL7](https://github.com/dev-sec/ansible-collection-hardening/issues/364)
-
-### sysctl - vm.mmap_rnd_bits
-
-We are setting this sysctl to a default of `32`, some systems only support smaller values and this will generate an error. Unfortunately we cannot determine the correct applicable maximum. If you encounter this error you have to override this sysctl in your playbook.
-
-```yaml
- hosts: localhost
-  collections:
-    - devsec.hardening
-  roles:
-    - devsec.hardening.os_hardening
-  vars:
-    sysctl_overwrite:
-      vm.mmap_rnd_bits: 16
-```
-
-## Testing with inspec
-
-If you're using inspec to test your machines after applying this role, please make sure to add the connecting user to the `os_ignore_users`-variable.
-Otherwise inspec will fail. For more information, see [issue #124](https://github.com/dev-sec/ansible-os-hardening/issues/124).
-
-We know that this is the case on Raspberry Pi.
-
-## Changing sysctl variables
-
-If you want to override sysctl-variables, you can use the `sysctl_overwrite` variable (in older versions you had to override the whole `sysctl_dict`).
-So for example if you want to change the IPv4 traffic forwarding variable to `1`, do it like this:
-
-```yaml
- hosts: localhost
-  collections:
-    - devsec.hardening
-  roles:
-    - os_hardening
-  vars:
-    sysctl_overwrite:
-      # Enable IPv4 traffic forwarding.
-      net.ipv4.ip_forward: 1
-```
-
-Alternatively you can change Ansible's [hash-behaviour](https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-hash-behaviour) to `merge`, then you only have to overwrite the single hash you need to. But please be aware that changing the hash-behaviour changes it for all your playbooks and is not recommended by Ansible.
-
-## Improving Kernel Audit logging
-
-By default, any process that starts before the `auditd` daemon will have an AUID of `4294967295`. To improve this and provide more accurate logging, it's recommended to add the kernel boot parameter `audit=1` to you configuration. Without doing this, you will find that your `auditd` logs fail to properly audit all processes.
-
-For more information, please see this [upstream documentation](https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html) and your system's boot loader documentation for how to configure additional kernel parameters.
-
-## More information
-
-We use specific PAM configuration for every linux distribution. This is a very diverse area, since every vendor seems to push their own system for managing PAM. We used following guides and sources for our configuration.
-
- on Debian/Ubuntu we use [pam-config-framework](https://wiki.ubuntu.com/PAMConfigFrameworkSpec)
- RHEL8 and compatible use information from [authselect](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_authentication_and_authorization_in_rhel/configuring-user-authentication-using-authselect_configuring-authentication-and-authorization-in-rhel), but our setup disables the configuration from authselect
- RHEL 6/7 and compatible use [authconfig](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/authconfig-install), but our setup disables the configuration from authconfig
- for RHEL 6/7 we also use information from [Desktop Security](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-hardening_your_system_with_tools_and_services#sec-Desktop_Security)
-
-This role is mostly based on guides by:
-
- [Arch Linux wiki, Sysctl hardening](https://wiki.archlinux.org/index.php/Sysctl)
- [NSA: Guide to the Secure Configuration of Red Hat Enterprise Linux 5](http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf)
- [Ubuntu Security/Features](https://wiki.ubuntu.com/Security/Features)
- [Deutsche Telekom, Group IT Security, Security Requirements (German)](https://www.telekom.com/psa)
@@ -2,15 +2,26 @@
 - name: Update-initramfs # noqa no-changed-when
  ansible.builtin.command: update-initramfs -u

- name: Restart auditd # noqa command-instead-of-module no-changed-when
-  ansible.builtin.command:
-    cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
-  when: molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
-
 - name: Reload systemd
  ansible.builtin.systemd:
    daemon_reload: true

+- name: Restart auditd via systemd
+  ansible.builtin.systemd:
+    name: auditd.service
+    state: restarted
+  ignore_errors: "{{ ansible_check_mode }}"
+  when:
+    - molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
+    - not ansible_facts.os_family == 'RedHat'
+
+- name: Restart auditd via service # noqa command-instead-of-module no-changed-when
+  ansible.builtin.command:
+    cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
+  when:
+    - molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
+    - ansible_facts.os_family == 'RedHat'
+
 - name: Remount filesystems
  ansible.posix.mount:
    path: "{{ item }}"
@@ -12,5 +12,7 @@
    owner: root
    group: root
    mode: "0640"
-  notify: Restart auditd
+  notify:
+    - Restart auditd via service
+    - Restart auditd via systemd
  tags: auditd
@@ -1,6 +1,6 @@
 {{ ansible_managed | comment }}
 # Generated by Ansible role {{ ansible_role_name }}

-{% for fs in os_unused_filesystems | difference(os_filesystem_whitelist) %}
+{% for fs in os_unused_filesystems | difference(os_filesystem_whitelist) | sort %}
 install {{fs}} /bin/true
 {% endfor %}
@@ -10,10 +10,36 @@ This role provides secure ssh-client and ssh-server configurations. It is intend

 Warning: This role disables root-login on the target server! Please make sure you have another user with su or sudo permissions that can login into the server.

+## Configuring settings not listed in role-variables
+
+If you want to configure ssh options that are not listed above, you can use `ssh_custom_options` (for `/etc/ssh/ssh_config`) or `sshd_custom_options` (for `/etc/ssh/sshd_config`) to set them. These options will be set on the **beginning** of the file so you can override options further down in the file.
+
+Example playbook:
+
+```yml
+- hosts: localhost
+  roles:
+    - devsec.hardening.ssh_hardening
+  vars:
+    ssh_custom_options:
+      - "Include /etc/ssh/ssh_config.d/*"
+    sshd_custom_options:
+      - "AcceptEnv LANG"
+```
+
+## After using the role Ansibles template/copy/file module does not work anymore
+
+If you use this role to disable SFTP (`sftp_enabled: false`) you will get errors. Ansible uses by default SFTP to transfer files to the remote hosts. You have to set `scp_if_ssh = True` in your ansible.cfg. This way Ansible uses SCP to copy files. If your control node uses OpenSSH version 9.0 or above, you also need to set `scp_extra_args = "-O"`, since starting with that version the `scp` utility also defaults to using SFTP.
+
+## Changing the default port and idempotency
+
+This role uses the default port 22 or the port configured in the inventory to connect to the server. If the default `ssh` port is changed via `ssh_server_ports`, once the ssh server is restarted, it will still try to connect using the previous port. In order to run this role again on the same server the inventory will have to be updated to use the new ssh port.
+
+If idempotency is important, please consider using role [`ssh-hardening-fallback`](https://github.com/nununo/ansible-ssh-hardening-fallback), which is a wrapper around this role that falls back to port 22 if the configured port is unreachable.
+
 <!-- BEGIN_ANSIBLE_DOCS -->

 ## Supported Operating Systems
-
 - EL
  - 7, 8, 9
 - Ubuntu
@@ -25,7 +51,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
 - ArchLinux
 - SmartOS
 - FreeBSD
-  - 12.2
+  - 12.2, 13.2, 14.0
 - OpenBSD
  - 7.0

@@ -443,34 +469,4 @@ None.
  roles:
    - name: devsec.hardening.ssh_hardening
 ```
-
 <!-- END_ANSIBLE_DOCS -->
-
-## Configuring settings not listed in role-variables
-
-If you want to configure ssh options that are not listed above, you can use `ssh_custom_options` (for `/etc/ssh/ssh_config`) or `sshd_custom_options` (for `/etc/ssh/sshd_config`) to set them. These options will be set on the **beginning** of the file so you can override options further down in the file.
-
-Example playbook:
-
-```yml
- hosts: localhost
-  collections:
-    - devsec.hardening
-  roles:
-    - ssh_hardening
-  vars:
-    ssh_custom_options:
-      - "Include /etc/ssh/ssh_config.d/*"
-    sshd_custom_options:
-      - "AcceptEnv LANG"
-```
-
-## After using the role Ansibles template/copy/file module does not work anymore
-
-If you use this role to disable SFTP (`sftp_enabled: false`) you will get errors. Ansible uses by default SFTP to transfer files to the remote hosts. You have to set `scp_if_ssh = True` in your ansible.cfg. This way Ansible uses SCP to copy files. If your control node uses OpenSSH version 9.0 or above, you also need to set `scp_extra_args = "-O"`, since starting with that version the `scp` utility also defaults to using SFTP.
-
-## Changing the default port and idempotency
-
-This role uses the default port 22 or the port configured in the inventory to connect to the server. If the default `ssh` port is changed via `ssh_server_ports`, once the ssh server is restarted, it will still try to connect using the previous port. In order to run this role again on the same server the inventory will have to be updated to use the new ssh port.
-
-If idempotency is important, please consider using role [`ssh-hardening-fallback`](https://github.com/nununo/ansible-ssh-hardening-fallback), which is a wrapper around this role that falls back to port 22 if the configured port is unreachable.
Author	SHA1	Message	Date
schurzi	94a49a4916	Merge pull request #739 from dev-sec/restruct_vars restructure readme to move known problems up top	2024-01-15 14:51:08 +01:00
Sebastian Gumprich	e5cc9bbf43	restructure readme to move known problems up top Signed-off-by: Sebastian Gumprich <[email protected]>	2024-01-12 09:30:48 +01:00
dev-sec CI	aca4bc7cb7	update changelog	2023-12-22 09:56:52 +00:00
Sebastian Gumprich	81e177b80c	release only on releases, not pre-releases (#738 )	2023-12-22 10:54:13 +01:00
dev-sec CI	3794251a94	update changelog	2023-12-12 00:11:54 +00:00
renovate[bot]	4974bb3422	Update dependency ansible-core to v2.16.2 Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2023-12-12 00:09:03 +00:00
dev-sec CI	b12e212d9d	update changelog	2023-12-10 10:12:04 +00:00
schurzi	e7bad430f2	Merge pull request #733 from dev-sec/renovate/actions-setup-python-5.x Update actions/setup-python action to v5	2023-12-10 11:10:36 +01:00
dev-sec CI	bf13c44a2d	update changelog	2023-12-09 20:26:26 +00:00
schurzi	d93c7401cf	Merge pull request #728 from dev-sec/renovate/ansible-core-2.x Update dependency ansible-core to v2.16.1	2023-12-09 21:25:04 +01:00
Martin Schurz	d8c9ac71ec	fix assertion Signed-off-by: Martin Schurz <[email protected]>	2023-12-09 19:14:41 +01:00
renovate[bot]	ce741c9f47	Update dependency ansible-core to v2.16.1 Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2023-12-08 11:20:38 +00:00
dev-sec CI	6b11603c5b	update changelog	2023-12-08 08:32:34 +00:00
Sebastian Gumprich	05cc027919	fix linting for github config (#736 ) Signed-off-by: Sebastian Gumprich <[email protected]>	2023-12-08 09:31:05 +01:00
dev-sec CI	7b209b831d	update changelog	2023-12-07 08:34:58 +00:00
schurzi	b9a0e65e19	Merge pull request #730 from dev-sec/labeler5 update labeler to new config format	2023-12-07 09:32:28 +01:00
schurzi	e37f01df26	Merge pull request #732 from dev-sec/lintall Update ansible-lint action and revise configuration to scan all Ansible code	2023-12-07 09:32:12 +01:00
Martin Schurz	1f0d2d5b73	add noconfirm Signed-off-by: Martin Schurz <[email protected]>	2023-12-06 21:29:02 +01:00
Martin Schurz	5843b03449	add prepare for archlinux Signed-off-by: Martin Schurz <[email protected]>	2023-12-06 20:29:43 +01:00
Martin Schurz	bf51b96a0b	add prepare for archlinux Signed-off-by: Martin Schurz <[email protected]>	2023-12-06 20:21:49 +01:00
Martin Schurz	4bc5725836	hold grub updates in vm Signed-off-by: Martin Schurz <[email protected]>	2023-12-06 17:51:39 +01:00
Martin Schurz	62340c79c6	re-add mysql config directory because it is needed by some os Signed-off-by: Martin Schurz <[email protected]>	2023-12-06 16:33:31 +01:00
Martin Schurz	bc8b5f60f4	remove mysql config directory creation Signed-off-by: Martin Schurz <[email protected]>	2023-12-06 16:08:31 +01:00
Martin Schurz	dff224f4c4	correct typo Signed-off-by: Martin Schurz <[email protected]>	2023-12-06 15:57:08 +01:00
Martin Schurz	422fb940a9	manually fix remaining problems Signed-off-by: Martin Schurz <[email protected]>	2023-12-06 15:27:21 +01:00
Martin Schurz	7e33ea0bae	use ansible-lint to autofix problems Signed-off-by: Martin Schurz <[email protected]>	2023-12-06 14:37:09 +01:00
renovate[bot]	459113a1e6	Update actions/setup-python action to v5 Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2023-12-06 13:19:19 +00:00
Martin Schurz	5381a23a4a	fix paste error Signed-off-by: Martin Schurz <[email protected]>	2023-12-06 11:38:49 +01:00
Martin Schurz	e00716df62	fix lint findings Signed-off-by: Martin Schurz <[email protected]>	2023-12-06 11:36:08 +01:00
Martin Schurz	6ce8b68650	adjust exclude paths Signed-off-by: Martin Schurz <[email protected]>	2023-12-06 11:11:21 +01:00
Martin Schurz	f4500457fa	extend action triggers Signed-off-by: Martin Schurz <[email protected]>	2023-12-06 11:09:24 +01:00
Martin Schurz	2bbfe2dd6b	exclude waiver files Signed-off-by: Martin Schurz <[email protected]>	2023-12-06 11:07:43 +01:00
Martin Schurz	db437c79f5	extend action triggers Signed-off-by: Martin Schurz <[email protected]>	2023-12-06 11:00:22 +01:00
Martin Schurz	099145c9b3	remove excludes Signed-off-by: Martin Schurz <[email protected]>	2023-12-06 10:58:26 +01:00
Martin Schurz	9862676ecf	use new ansible-lint action Signed-off-by: Martin Schurz <[email protected]>	2023-12-06 10:57:45 +01:00
Martin Schurz	6ef52a125d	use base branch Signed-off-by: Martin Schurz <[email protected]>	2023-12-05 21:46:15 +01:00
Martin Schurz	bde286fe47	update config Signed-off-by: Martin Schurz <[email protected]>	2023-12-05 21:42:01 +01:00
Martin Schurz	a58fc24301	use correct tag Signed-off-by: Martin Schurz <[email protected]>	2023-12-05 21:38:36 +01:00
Martin Schurz	12240fea63	test labler Signed-off-by: Martin Schurz <[email protected]>	2023-12-05 21:37:36 +01:00
Martin Schurz	82a0188b8c	update labeler to new config format Signed-off-by: Martin Schurz <[email protected]>	2023-12-05 21:31:37 +01:00
dev-sec CI	5a062c6db2	update changelog	2023-11-24 12:37:45 +00:00
schurzi	508b993570	Merge pull request #722 from dev-sec/arch_audit support restarts of audit service on Arch linux	2023-11-24 13:36:18 +01:00
Martin Schurz	54f9ef42a1	don't try to restart audit in check mode Signed-off-by: Martin Schurz <[email protected]>	2023-11-22 00:45:38 +01:00
Martin Schurz	25acb76c05	reload systemd after installation Signed-off-by: Martin Schurz <[email protected]>	2023-11-21 23:59:22 +01:00
Martin Schurz	0f6b8e4a3a	use full service name for handler Signed-off-by: Martin Schurz <[email protected]>	2023-11-21 23:04:41 +01:00
Martin Schurz	571cec1a5c	re-add vm tests Signed-off-by: Martin Schurz <[email protected]>	2023-11-21 22:12:50 +01:00
Martin Schurz	20dd04c9cb	split notify, add tmp options for arch Signed-off-by: Martin Schurz <[email protected]>	2023-11-21 21:58:58 +01:00
Martin Schurz	60d10811d4	add separate handlers for audit restart Signed-off-by: Martin Schurz <[email protected]>	2023-11-21 21:45:05 +01:00
Martin Schurz	84c43c0550	limit tests to some distros Signed-off-by: Martin Schurz <[email protected]>	2023-11-21 21:27:23 +01:00
dev-sec CI	c76862831b	update changelog	2023-11-21 15:58:10 +00:00
schurzi	f9a1cab023	Merge pull request #721 from dev-sec/python_version pin Ansible to always let Renovate update to the most current version in our tests	2023-11-21 16:38:21 +01:00
Martin Schurz	f15ff3fc83	remove unneeded mysql vars Signed-off-by: Martin Schurz <[email protected]>	2023-11-21 16:37:50 +01:00
Martin Schurz	aae720c977	update python version for all tests Signed-off-by: Martin Schurz <[email protected]>	2023-11-21 12:23:49 +01:00
dev-sec CI	af8045a55a	update changelog	2023-11-21 11:23:22 +00:00
Martin Schurz	c3b9245900	fix for mysql role Signed-off-by: Martin Schurz <[email protected]>	2023-11-21 12:22:47 +01:00
Martin Schurz	5c5f2ce446	remove the base ansible package Signed-off-by: Martin Schurz <[email protected]>	2023-11-21 12:22:47 +01:00
Martin Schurz	7b32deca17	pin the right ansible package Signed-off-by: Martin Schurz <[email protected]>	2023-11-21 12:22:47 +01:00
Martin Schurz	e2c2d0d5e2	pin Ansible version Signed-off-by: Martin Schurz <[email protected]>	2023-11-21 12:22:47 +01:00
Martin Schurz	addbbd32cf	run tests on update of dependencied Signed-off-by: Martin Schurz <[email protected]>	2023-11-21 12:22:47 +01:00
Martin Schurz	01cc9c811f	update python versions for testing Signed-off-by: Martin Schurz <[email protected]>	2023-11-21 12:22:47 +01:00
schurzi	e98d766c6c	Merge pull request #718 from akikanellis/fix-disabling-filesystems-idempotency Restore idempotency for disabling unused filesystems with Ansible 2.16.0	2023-11-21 12:20:42 +01:00
Aki Kanellis	a15159d072	Make disabling unused filesystems idempotent The `os_unused_filesystems` was lacking sorting, making the task not idempotent. This was especially apparent and random in Molecule tests when this collection was added as a dependency. Signed-off-by: Aki Kanellis <[email protected]>	2023-11-19 19:57:31 +00:00
dev-sec CI	dc432ba71c	update galaxy.yml with new version	2023-11-16 14:42:54 +00:00
dev-sec CI	2c91f89903	update nginx_hardening readme	2023-11-16 14:33:13 +00:00
dev-sec CI	83cf8aedcc	update changelog	2023-11-16 14:21:56 +00:00
dev-sec CI	9c848839d9	update mysql_hardening readme	2023-11-16 14:20:48 +00:00
dev-sec CI	1b69855d51	update os_hardening readme	2023-11-16 14:20:47 +00:00
dev-sec CI	512e31f1ae	update ssh_hardening readme	2023-11-16 14:20:44 +00:00