update changelog

Signed-off-by: Sebastian Gumprich <[email protected]>

.config/ansible-lint.yml

@@ -11,6 +11,7 @@ exclude_paths:
 
 skip_list:
   - fqcn-builtins
+  - name[template]
 
 mock_roles:
   - geerlingguy.git

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,49 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
----
-
-**Describe the bug**
-A clear and concise description of what the bug is.
-
-**Expected behavior**
-A clear and concise description of what you expected to happen.
-
-**Actual behavior**
-
-<!--- Paste verbatim command output between quotes -->
-
-```paste below
-
-```
-
-**Example Playbook**
-
-<!--- Paste an example playbook that can be used to reproduce the problem between quotes -->
-
-```paste below
-
-```
-
-**OS / Environment**
-
-<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
-
-**Ansible Version**
-
-<!--- Paste verbatim output from "ansible --version" between quotes -->
-
-```paste below
-
-```
-
-**Role Version**
-
-<!--- Paste version of the role between quotes -->
-
-```paste below
-
-```
-
-**Additional context**
-Add any other context about the problem here.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,97 @@
+---
+# reference: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests
+name: "Bug report"
+description: "Create a report to help us improve."
+labels: [
+  "bug"
+]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Reporting Bugs ld follow some simple rules:
+
+        - **Check**, if you can find similar bugs
+        - **Describe** what is happening and what should happen
+        - **Explain** how to reproduce the problem
+        - **Add** more details and attachments
+        - **Follow up**, if somebody is having questions or needs more details
+
+  - type: textarea
+    id: description
+    attributes:
+      label: "Description"
+      description: Describe the bug
+      placeholder: A clear and concise description of what the bug is.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reprod
+    attributes:
+      label: "Reproduction steps"
+      render: Shell
+      description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, so no need for backticks.
+      value: |
+        ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: currentbehavior
+    attributes:
+      label: "Current Behavior"
+      description: Please describe the results you received
+      value: |
+        ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expectedbehavior
+    attributes:
+      label: "Expected Behavior"
+      description: Please describe the results you expect
+      value: |
+        ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: os
+    attributes:
+      label: "OS / Environment"
+      value: |
+        Provide all relevant information below, e.g. target OS versions, network device firmware, etc.
+    validations:
+      required: true
+
+  - type: textarea
+    id: ansible
+    attributes:
+      label: "Ansible Version"
+      render: Shell
+      value: |
+        Paste verbatim output from "ansible --version" between quotes. This will be automatically formatted into code, so no need for backticks.
+    validations:
+      required: true
+
+  - type: textarea
+    id: collection
+    attributes:
+      label: "Collection Version"
+      render: Shell
+      value: |
+        Paste version of the collection. This will be automatically formatted into code, so no need for backticks.
+    validations:
+      required: true
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: "Additional information"
+      description: Please add information like the used software versions, outputs of logs, OS information, screenshots, etc. to enhance the report
+      value: |
+        ...
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,16 +0,0 @@
----
-name: Feature request
-about: Suggest an idea for this project
----
-
-**Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
-
-**Describe the solution you'd like**
-A clear and concise description of what you want to happen.
-
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
-
-**Additional context**
-Add any other context or screenshots about the feature request here.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,55 @@
+---
+# reference: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests
+name: "Feature request"
+description: "Suggest an idea for this project."
+labels: [
+  "enhancement"
+]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Requesting a new feature or enhancement is following some simple rules:
+
+        - **Check**, if the feature is already requested
+        - **Describe** what your feature will bring to the community
+        - **Explain** the criteria to fulfill the request
+        - **Add** more details like mock ups, attachments, lists, screenshots
+        - **Follow Up** in the discussion to the feature
+
+  - type: textarea
+    id: description
+    attributes:
+      label: "Description"
+      description: Is your feature request related to a problem? Please describe.
+      placeholder: A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: "Solution"
+      description: Describe the solution you'd like
+      placeholder: A clear and concise description of what you want to happen.
+    validations:
+      required: false
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: "Alternatives"
+      description: Describe alternatives you've considered
+      placeholder: A clear and concise description of any alternative solutions or features you've considered.
+    validations:
+      required: false
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: "Additional information"
+      description: Add any other context or screenshots about the feature request here.
+      value: |
+        ...
+    validations:
+      required: false

.github/dependabot.yml

@@ -10,3 +10,8 @@ updates:
     directory: "/"  # Location of package manifests
     schedule:
       interval: "daily"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"

.github/workflows/ansible-lint.yml

@@ -1,11 +1,16 @@
 ---
 name: Ansible Lint  # feel free to pick your own name
 
-on: [push, pull_request]   # yamllint disable-line rule:truthy
+on:  # yamllint disable-line rule:truthy
+  # Run CI against all pushes (direct commits, also merged PRs), Pull Requests
+  push:
+    branches: [master]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master]
 
 jobs:
   ansible-lint:
-
     runs-on: ubuntu-latest
 
     steps:
@@ -16,43 +21,4 @@ jobs:
         # replace "master" with any valid ref
         uses: ansible/ansible-lint-action@main
         with:
-          # [required]
-          # Paths to ansible files (i.e., playbooks, tasks, handlers etc..)
-          # or valid Ansible directories according to the Ansible role
-          # directory structure.
-          # If you want to lint multiple ansible files, use the following syntax
-          # targets: |
-          #   playbook_1.yml
-          #   playbook_2.yml
-          targets: "roles/"
-          # [optional]
-          # Arguments to override a package and its version to be set explicitly.
-          # Must follow the example syntax.
-          # override-deps: |
-          #   ansible==2.9
-          #   ansible-lint==4.2.0
-          override-deps: |
-            rich>=9.5.1,<11.0.0
-          # [optional]
-          # Arguments to be passed to the ansible-lint
-
-          # Options:
-          #   -q                    quieter, although not silent output
-          #   -p                    parseable output in the format of pep8
-          #   --parseable-severity  parseable output including severity of rule
-          #   -r RULESDIR           specify one or more rules directories using one or
-          #                         more -r arguments. Any -r flags override the default
-          #                         rules in ansiblelint/rules, unless -R is also used.
-          #   -R                    Use default rules in ansiblelint/rules in addition to
-          #                         any extra
-          #                         rules directories specified with -r. There is no need
-          #                         to specify this if no -r flags are used
-          #   -t TAGS               only check rules whose id/tags match these values
-          #   -x SKIP_LIST          only check rules whose id/tags do not match these
-          #                         values
-          #   --nocolor             disable colored output
-          #   --exclude=EXCLUDE_PATHS
-          #                         path to directories or files to skip. This option is
-          #                         repeatable.
-          #   -c C                  Specify configuration file to use. Defaults to ".ansible-lint"
-          args: ""
+          path: "roles/"

.github/workflows/enforce-labels.yml

@@ -6,6 +6,7 @@ on:  # yamllint disable-line rule:truthy
     types: [labeled, unlabeled, opened, edited, synchronize]
 jobs:
   enforce-label:
+    if: github.repository == 'dev-sec/ansible-collection-hardening'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/labeler@main

.github/workflows/galaxy.yml

@@ -8,6 +8,7 @@ on:  # yamllint disable-line rule:truthy
 
 jobs:
   deploy:
+    if: github.repository == 'dev-sec/ansible-collection-hardening'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3

.github/workflows/mysql_hardening.yml

@@ -1,13 +1,16 @@
 ---
 name: "devsec.mysql_hardening"
+
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
+    branches: [master]
     paths:
       - 'roles/mysql_hardening/**'
       - 'molecule/mysql_hardening/**'
       - '.github/workflows/mysql_hardening.yml'
   pull_request:
+    branches: [master]
     paths:
       - 'roles/mysql_hardening/**'
       - 'molecule/mysql_hardening/**'
@@ -23,14 +26,18 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
+          - centosstream8
+          - centosstream9
           - rocky8
+          - rocky9
           - ubuntu1804
           - ubuntu2004
-          - debian9
+          - ubuntu2204
           - debian10
+          - debian11
           # - amazon  # geerlingguy.mysql does not support fedora
           # - arch  # needs to be fixed
-          # - opensuse_tumbleweed  # needs to be fixed
+          - opensuse_tumbleweed  # needs to be fixed
           # - fedora  # geerlingguy.mysql does not support fedora
     steps:
       - name: Checkout repo
@@ -40,7 +47,7 @@ jobs:
           submodules: true
 
       - name: Set up Python 3.7
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
         with:
           python-version: 3.7
 

.github/workflows/nginx_hardening.yml

@@ -3,11 +3,13 @@ name: "devsec.nginx_hardening"
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
+    branches: [master]
     paths:
       - 'roles/nginx_hardening/**'
       - 'molecule/nginx_hardening/**'
       - '.github/workflows/nginx_hardening.yml'
   pull_request:
+    branches: [master]
     paths:
       - 'roles/nginx_hardening/**'
       - 'molecule/nginx_hardening/**'
@@ -23,11 +25,15 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
+          - centosstream8
+          - centosstream9
           - rocky8
+          - rocky9
           - ubuntu1804
           - ubuntu2004
-          - debian9
+          - ubuntu2204
           - debian10
+          - debian11
           - amazon
           # - arch  # needs to be fixed
           # - opensuse_tumbleweed  # needs to be fixed
@@ -40,7 +46,7 @@ jobs:
           submodules: true
 
       - name: Set up Python 3.7
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
         with:
           python-version: 3.7
 

.github/workflows/os_hardening.yml

@@ -3,11 +3,13 @@ name: "devsec.os_hardening"
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
+    branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening/**'
       - '.github/workflows/os_hardening.yml'
   pull_request:
+    branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening/**'
@@ -23,11 +25,15 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
+          - centosstream8
+          - centosstream9
           - rocky8
+          - rocky9
           - ubuntu1804
           - ubuntu2004
-          - debian9
+          - ubuntu2204
           - debian10
+          - debian11
           - amazon
           - opensuse_tumbleweed
           # - arch  # needs to be fixed
@@ -39,7 +45,7 @@ jobs:
           submodules: true
 
       - name: Set up Python 3.7
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
         with:
           python-version: 3.7
 

.github/workflows/os_hardening_vm.yml

@@ -3,11 +3,13 @@ name: "devsec.os_hardening VM"
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
+    branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening_vm/**'
       - '.github/workflows/os_hardening_vm.yml'
   pull_request:
+    branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening_vm/**'
@@ -23,13 +25,17 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
+          - centos8s
+          # - centos9s  # problems with vagrant
           - rocky8
+          # - rocky9  # problems with vagrant
           - ubuntu1804
           - ubuntu2004
-          - debian9
+          - ubuntu2204
           - debian10
+          - debian11
           # - opensuse42  # opensuse currently cannot get an ip address
-          # - arch  - arch is currently not supported by cinc-auditor
+          # - arch  # arch is currently not supported by cinc-auditor
     steps:
       - name: Checkout repo
         uses: actions/checkout@v3

.github/workflows/prettier-md.yml

@@ -4,11 +4,13 @@ name: Prettier markdown files
 
 on:  # yamllint disable-line rule:truthy
   push:
+    branches: [master]
     paths:
       - '**.md'
 
 jobs:
   prettier-md:
+    if: github.repository == 'dev-sec/ansible-collection-hardening'
     runs-on: ubuntu-latest
     timeout-minutes: 1
 
@@ -19,6 +21,6 @@ jobs:
           ref: ${{ github.head_ref }}
 
       - name: Prettify code
-        uses: creyD/prettier_action@v3.1
+        uses: creyD/prettier_action@v4.2
         with:
           prettier_options: --write {**/*,*}.md

.github/workflows/release.yml

@@ -9,8 +9,9 @@ on:  # yamllint disable-line rule:truthy
 
 jobs:
   generate_changelog:
-    runs-on: ubuntu-latest
     name: create release draft
+    if: github.repository == 'dev-sec/ansible-collection-hardening'
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
         with:

.github/workflows/ssh_hardening.yml

@@ -3,11 +3,13 @@ name: "devsec.ssh_hardening"
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
+    branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening/**'
       - '.github/workflows/ssh_hardening.yml'
   pull_request:
+    branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening/**'
@@ -23,12 +25,16 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
+          - centosstream8
+          - centosstream9
           - rocky8
+          - rocky9
           - fedora
           - ubuntu1804
           - ubuntu2004
-          - debian9
+          - ubuntu2204
           - debian10
+          - debian11
           - amazon
           # - arch  # needs to be fixed
           # - opensuse_tumbleweed  # baseline is not compatible with suse
@@ -40,7 +46,7 @@ jobs:
           submodules: true
 
       - name: Set up Python 3.7
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
         with:
           python-version: 3.7
 

.github/workflows/ssh_hardening_custom_tests.yml

@@ -3,11 +3,13 @@ name: "devsec.ssh_hardening with custom tests"
 on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   push:
+    branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening_custom_tests/**'
       - '.github/workflows/ssh_hardening_custom_tests.yml'
   pull_request:
+    branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening_custom_tests/**'
@@ -23,12 +25,16 @@ jobs:
       matrix:
         molecule_distro:
           - centos7
+          - centosstream8
+          - centosstream9
           - rocky8
+          - rocky9
           - fedora
           - ubuntu1804
           - ubuntu2004
-          - debian9
+          - ubuntu2204
           - debian10
+          - debian11
           - amazon
           # - arch  # needs to be fixed
           # - opensuse_tumbleweed  # baseline is not compatible with suse
@@ -40,7 +46,7 @@ jobs:
           submodules: true
 
       - name: Set up Python 3.7
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
         with:
           python-version: 3.7
 

.gitignore

@@ -1,3 +1,4 @@
 .kitchen
 hosts
 Gemfile.lock
+.venv

CHANGELOG.md

@@ -1,5 +1,154 @@
 # Changelog
 
+## [9.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/9.0.0) (2023-01-19)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.4.0...9.0.0)
+
+**Implemented enhancements:**
+
+- Add support for /etc/auditd.conf num\_logs to go with max\_log\_file\_action [\#616](https://github.com/dev-sec/ansible-collection-hardening/issues/616)
+- Add support for /etc/auditd.conf num\_logs to go with max\_log\_file\_action [\#617](https://github.com/dev-sec/ansible-collection-hardening/pull/617) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([richardlock](https://github.com/richardlock))
+- Parametrize more auditd.conf options [\#535](https://github.com/dev-sec/ansible-collection-hardening/pull/535) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([kravietz](https://github.com/kravietz))
+
+**Merged pull requests:**
+
+- Bump actions/setup-python from 1 to 4 [\#611](https://github.com/dev-sec/ansible-collection-hardening/pull/611) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([dependabot[bot]](https://github.com/apps/dependabot))
+- Bump creyD/prettier\_action from 3.1 to 4.2 [\#610](https://github.com/dev-sec/ansible-collection-hardening/pull/610) ([dependabot[bot]](https://github.com/apps/dependabot))
+
+## [8.4.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.4.0) (2022-12-17)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.3.0...8.4.0)
+
+**Implemented enhancements:**
+
+- Implement Test for MySQL systemd service [\#606](https://github.com/dev-sec/ansible-collection-hardening/issues/606)
+- Extended net hardening [\#607](https://github.com/dev-sec/ansible-collection-hardening/pull/607) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
+- Add OpenSUSE support  [\#605](https://github.com/dev-sec/ansible-collection-hardening/pull/605) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Allow ssh\_allow\_tcp\_forwarding to be a boolean [\#600](https://github.com/dev-sec/ansible-collection-hardening/pull/600) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([crisbal](https://github.com/crisbal))
+- OpenBSD does not support GSSAPI Authentication [\#598](https://github.com/dev-sec/ansible-collection-hardening/pull/598) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([dennisse](https://github.com/dennisse))
+- add Ansible specific templates for issues [\#596](https://github.com/dev-sec/ansible-collection-hardening/pull/596) ([schurzi](https://github.com/schurzi))
+- use github templates for new issues [\#595](https://github.com/dev-sec/ansible-collection-hardening/pull/595) ([schurzi](https://github.com/schurzi))
+
+**Fixed bugs:**
+
+- os\_auth\_retries variable causes a comparison type error on pam tasks [\#593](https://github.com/dev-sec/ansible-collection-hardening/issues/593)
+- ssh\_hardening: Install selinux dependencies fails on Oracle Linux \(RHEL\) 9 [\#585](https://github.com/dev-sec/ansible-collection-hardening/issues/585)
+- OpenBSD does not set distributiuon\_major\_version [\#597](https://github.com/dev-sec/ansible-collection-hardening/pull/597) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([dennisse](https://github.com/dennisse))
+
+**Merged pull requests:**
+
+- Check for github action updates daily [\#609](https://github.com/dev-sec/ansible-collection-hardening/pull/609) ([jlosito](https://github.com/jlosito))
+- add verify-task to check if mysql is running and enabled [\#608](https://github.com/dev-sec/ansible-collection-hardening/pull/608) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Updates handlers for new ansible syntax and deprecated options for legacy commands [\#602](https://github.com/dev-sec/ansible-collection-hardening/pull/602) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([jsievertde](https://github.com/jsievertde))
+- add notice to sign-off work to contributor guideline [\#601](https://github.com/dev-sec/ansible-collection-hardening/pull/601) ([schurzi](https://github.com/schurzi))
+
+## [8.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.3.0) (2022-10-27)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.2.0...8.3.0)
+
+**Implemented enhancements:**
+
+- add hardening of root user account\(s\) [\#579](https://github.com/dev-sec/ansible-collection-hardening/pull/579) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
+
+**Fixed bugs:**
+
+- cast expected int types in pam tasks [\#594](https://github.com/dev-sec/ansible-collection-hardening/pull/594) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([dlouzan](https://github.com/dlouzan))
+- do not manage trusted user ca keys if none exist [\#580](https://github.com/dev-sec/ansible-collection-hardening/pull/580) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([hollow](https://github.com/hollow))
+
+**Closed issues:**
+
+- Trying to run the os\_hardening on Debian 11, but fails on privilege escalation [\#587](https://github.com/dev-sec/ansible-collection-hardening/issues/587)
+- auditd increasing logfiles [\#586](https://github.com/dev-sec/ansible-collection-hardening/issues/586)
+- Path to nginx.conf should be configurable in a variable  [\#577](https://github.com/dev-sec/ansible-collection-hardening/issues/577)
+
+**Merged pull requests:**
+
+- adopt all current suggestions from ansible-lint [\#592](https://github.com/dev-sec/ansible-collection-hardening/pull/592) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Support more os [\#588](https://github.com/dev-sec/ansible-collection-hardening/pull/588) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- run tests only on pushes to master or to PRs [\#581](https://github.com/dev-sec/ansible-collection-hardening/pull/581) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [8.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.2.0) (2022-09-08)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.1.0...8.2.0)
+
+**Implemented enhancements:**
+
+- Add nginx variables for config-path and owner/group [\#578](https://github.com/dev-sec/ansible-collection-hardening/pull/578) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([hagenbauer](https://github.com/hagenbauer))
+- add centos \>8 Support [\#573](https://github.com/dev-sec/ansible-collection-hardening/pull/573) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([sbaerlocher](https://github.com/sbaerlocher))
+- add always-tag to include so other tags can be used [\#569](https://github.com/dev-sec/ansible-collection-hardening/pull/569) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Closed issues:**
+
+- Bug using os\_hardening "tags" [\#567](https://github.com/dev-sec/ansible-collection-hardening/issues/567)
+
+## [8.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.1.0) (2022-08-26)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.0.0...8.1.0)
+
+**Closed issues:**
+
+- dev-sec CI bot should not update CHANGELOG.md in fork repository [\#566](https://github.com/dev-sec/ansible-collection-hardening/issues/566)
+
+**Merged pull requests:**
+
+- update supported OS in meta and fix linting [\#572](https://github.com/dev-sec/ansible-collection-hardening/pull/572) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- fix misleading comment [\#571](https://github.com/dev-sec/ansible-collection-hardening/pull/571) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
+- only run release actions on upstream-repo [\#568](https://github.com/dev-sec/ansible-collection-hardening/pull/568) ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [8.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.0.0) (2022-08-22)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.16.0...8.0.0)
+
+**Breaking changes:**
+
+- change default to allow SFTP [\#564](https://github.com/dev-sec/ansible-collection-hardening/pull/564) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+
+**Implemented enhancements:**
+
+- add possibility to keep .netrc files in users homedir [\#563](https://github.com/dev-sec/ansible-collection-hardening/pull/563) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([PhilippFunk](https://github.com/PhilippFunk))
+- rework filesystem hardening [\#555](https://github.com/dev-sec/ansible-collection-hardening/pull/555) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([divialth](https://github.com/divialth))
+
+**Closed issues:**
+
+- Error in Task 'Create sshd\_config and set permissions to root/600' [\#565](https://github.com/dev-sec/ansible-collection-hardening/issues/565) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
+- \[ssh\_hardening\] Debian 11 - Ansible cannot transfer files [\#557](https://github.com/dev-sec/ansible-collection-hardening/issues/557)
+- Add the old SFTP-Reminder to the stable ssh\_hardening role for ansible [\#521](https://github.com/dev-sec/ansible-collection-hardening/issues/521)
+
+## [7.16.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.16.0) (2022-08-16)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.15.1...7.16.0)
+
+**Implemented enhancements:**
+
+- revert debian 9 change, only one tls variable now [\#562](https://github.com/dev-sec/ansible-collection-hardening/pull/562) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add posibility to run ssh\_hardening as unprivileged user [\#561](https://github.com/dev-sec/ansible-collection-hardening/pull/561) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- add basic support for ubuntu22.04 [\#554](https://github.com/dev-sec/ansible-collection-hardening/pull/554) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Add full support for Debian 11 [\#538](https://github.com/dev-sec/ansible-collection-hardening/pull/538) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([addianto](https://github.com/addianto))
+
+**Fixed bugs:**
+
+- Replace default 2048 bits RSA keypair fails on Ubuntu 20.04 [\#459](https://github.com/dev-sec/ansible-collection-hardening/issues/459)
+
+**Closed issues:**
+
+- os-hardening: yum gpg-check fails if gpg-check already set [\#556](https://github.com/dev-sec/ansible-collection-hardening/issues/556)
+- Ubuntu 22.04 LTS [\#553](https://github.com/dev-sec/ansible-collection-hardening/issues/553)
+- Revert nginx ssl-protocol after deprecation of debian9 [\#528](https://github.com/dev-sec/ansible-collection-hardening/issues/528)
+- Support for Debian 11 [\#527](https://github.com/dev-sec/ansible-collection-hardening/issues/527)
+- Support baseline-control os-14 [\#507](https://github.com/dev-sec/ansible-collection-hardening/issues/507)
+
+## [7.15.1](https://github.com/dev-sec/ansible-collection-hardening/tree/7.15.1) (2022-07-26)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.15.0...7.15.1)
+
+**Fixed bugs:**
+
+- Fix broken mode for /var/log/audit [\#552](https://github.com/dev-sec/ansible-collection-hardening/pull/552) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([hollow](https://github.com/hollow))
+
+**Merged pull requests:**
+
+- Only run hardening if /var/log/audit exists [\#550](https://github.com/dev-sec/ansible-collection-hardening/pull/550) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([mego22](https://github.com/mego22))
+
 ## [7.15.0](https://github.com/dev-sec/ansible-collection-hardening/tree/7.15.0) (2022-07-11)
 
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/7.14.3...7.15.0)

CONTRIBUTING.md

@@ -15,7 +15,7 @@ In order to contribute code please:
 1. Fork the project on GitHub
 2. Clone the project
 3. Add changes (and tests)
-4. Commit and push
+4. Commit, sign off and push your changes
 5. Create a merge-request
 
 To have your code merged, see the expectations listed below.
@@ -28,6 +28,24 @@ Some great guidelines can be found [here](https://wiki.openstack.org/wiki/GitCom
 
 ## Expectations
 
+## Sign off Your Work
+
+The Developer Certificate of Origin (DCO) is a lightweight way for contributors to certify that they wrote or otherwise have the right to submit the code they are contributing to the project.
+[Here is the full text of the DCO](http://developercertificate.org/).
+Contributors must sign-off that they adhere to these requirements by adding a `Signed-off-by` line to commit messages.
+
+```text
+This is my commit message
+
+Signed-off-by: Random J Developer <[email protected]>
+```
+
+Git even has a -s command line option to append this automatically to your commit message:
+
+```text
+git commit -s -m 'This is my commit message'
+```
+
 ### Don't reinvent the wheel
 
 This hardening project doesn't intend to reinvent the configuration stack for services. Aim to use official configuration projects first and provide hardening as a layer on top. The goal is remove the need for a user to configure all aspects of services and maintain security configuration. This way, the user can still configure a service using the interface provided by the official project.

README.md

@@ -11,10 +11,10 @@
 This collection provides battle tested hardening for:
 
 - Linux operating systems:
-  - CentOS 7/8
+  - CentOS 7
   - Rocky Linux 8
-  - Debian 9/10
-  - Ubuntu 16.04/18.04/20.04
+  - Debian 10/11
+  - Ubuntu 18.04/20.04/22.04
   - Amazon Linux (some roles supported)
   - Arch Linux (some roles supported)
   - Fedora (some roles supported)
@@ -38,7 +38,7 @@ The roles are now part of the hardening-collection.
 We have kept the old releases of the `os-hardening` role in this repository, so you can find the them by exploring older tags.
 The last release of the standalone role was [6.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/6.2.0).
 
-The other roles are in separate archives repositories
+The other roles are in separate archives repositories:
 
 - [apache_hardening](https://github.com/dev-sec/ansible-apache-hardening)
 - [mysql_hardening](https://github.com/dev-sec/ansible-mysql-hardening)
@@ -86,8 +86,8 @@ See the [changelog](https://github.com/dev-sec/ansible-os-hardening/tree/master/
 
 Todos:
 
-- Work on [apache_hardening](roles/apache_hardening/) and [windows_hardening](roles/windows_hardening/).
-- Add support for more operating systems,
+- Work on [apache_hardening](roles/apache_hardening/) and [windows_hardening](roles/windows_hardening/)
+- Add support for more operating systems
 
 ## More information
 

galaxy.yml

@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 7.15.0
+version: 8.4.0
 readme: README.md
 authors:
   - dev-sec <[email protected]>

molecule/mysql_hardening/converge.yml

@@ -2,6 +2,8 @@
 - name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
   hosts: all
   become: true
+  collections:
+    - devsec.hardening
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
@@ -22,6 +24,13 @@
         - mysql_python_package_debian is not defined
         - ansible_distribution != "Ubuntu"
         - ansible_distribution_major_version|int < 20
+
+    - name: Use Python 3 on Suse
+      set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+      when:
+        - ansible_os_family == 'Suse'
+
     - include_role:
         name: mysql_hardening
   vars:

molecule/mysql_hardening/molecule.yml

@@ -25,6 +25,8 @@ platforms:
       container: docker
 provisioner:
   name: ansible
+  options:
+    diff: true
   config_options:
     defaults:
       interpreter_python: auto_silent

molecule/mysql_hardening/prepare.yml

@@ -8,6 +8,26 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
+    - name: Use Python 3 on Debian 11
+      set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+      when:
+        - ansible_distribution == 'Debian'
+        - ansible_distribution_major_version|int >= 11
+
+    - name: Use Python 3 on Suse
+      set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+      when:
+        - ansible_os_family == 'Suse'
+
+    - name: Use Python 2 on Debian 10
+      set_fact:
+        ansible_python_interpreter: /usr/bin/python
+      when:
+        - ansible_distribution == 'Debian'
+        - ansible_distribution_major_version|int == 10
+
     - name: Run the equivalent of "apt-get update && apt-get upgrade"
       apt:
         name: "*"
@@ -15,11 +35,9 @@
         update_cache: true
       when: ansible_os_family == 'Debian'
 
-    - name: install required tools on SuSE
-      community.general.zypper:
-        name: "python-xml"
-        state: present
-      when: ansible_facts.os_family == 'Suse'
+    - name: Install required python packages on Suse
+      ansible.builtin.shell: zypper -n install python-xml python3-rpm python3-PyMySQL
+      when: ansible_os_family == 'Suse'
 
     - name: create missing directory
       file:

molecule/mysql_hardening/verify.yml

@@ -34,6 +34,9 @@
         update_cache: true
       when: ansible_distribution == 'Debian'
 
+    - name: include tests for the service
+      include_tasks: verify_tasks/service.yml
+
     - name: download cinc-auditor
       get_url:
         url: https://omnitruck.cinc.sh/install.sh

molecule/mysql_hardening/verify_tasks/service.yml

@@ -0,0 +1,16 @@
+---
+- name: Load variables from role to use the "mysql_daemon" variable
+  ansible.builtin.include_role:
+    name: devsec.hardening.mysql_hardening
+    apply:
+      tags:
+        - never
+
+- name: Populate service facts
+  ansible.builtin.service_facts:
+
+- name: Check if MySQL is running and enabled
+  assert:
+    that:
+      - "ansible_facts.services[mysql_daemon + '.service'].state == 'running'"
+      - "ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'"

molecule/nginx_hardening/molecule.yml

@@ -25,6 +25,8 @@ platforms:
       container: docker
 provisioner:
   name: ansible
+  options:
+    diff: true
   config_options:
     defaults:
       interpreter_python: auto_silent

molecule/os_hardening/converge.yml

@@ -17,6 +17,7 @@
   vars:
     os_security_users_allow: change_user
     os_security_kernel_enable_core_dump: false
+    os_auditd_num_logs: 10
     os_security_suid_sgid_remove_from_unknown: true
     os_auth_pam_passwdqc_enable: false
     os_auth_lockout_time: 15
@@ -27,6 +28,7 @@
     os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
     os_filesystem_whitelist: []
     os_yum_repo_file_whitelist: ['foo.repo']
+    os_netrc_enabled: false
     sysctl_config:
       net.ipv4.ip_forward: 0
       net.ipv6.conf.all.forwarding: 0

molecule/os_hardening/molecule.yml

@@ -25,6 +25,8 @@ platforms:
       container: docker
 provisioner:
   name: ansible
+  options:
+    diff: true
   config_options:
     defaults:
       interpreter_python: auto_silent

molecule/os_hardening/prepare.yml

@@ -58,3 +58,7 @@
     - name: include YUM prepare tasks
       include_tasks: prepare_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'
+
+    - name: include YUM prepare tasks
+      include_tasks: prepare_tasks/netrc.yml
+

molecule/os_hardening/prepare_tasks/netrc.yml

@@ -0,0 +1,9 @@
+---
+- name: create '.netrc' in /root
+  ansible.builtin.copy:
+    dest: '/root/.netrc'
+    mode: '0600'
+    content: |
+      machine localhost
+      login root
+      password ipsum

molecule/os_hardening/verify.yml

@@ -37,6 +37,9 @@
         name: procps
       when: ansible_facts.os_family == 'Debian'
 
+    - name: include netrc tests
+      include_tasks: verify_tasks/netrc.yml
+
     - name: include PAM tests
       include_tasks: verify_tasks/pam.yml
       when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'

molecule/os_hardening/verify_tasks/netrc.yml

@@ -0,0 +1,19 @@
+---
+- name: test that .netrc in root homedir exists
+  ansible.builtin.file:
+    path: '/root/.netrc'
+    state: file
+  register: result_test_netrc
+
+- name: output result if .netrc for user root exists
+  ansible.builtin.assert:
+    that:
+      - "result_test_netrc.state == 'file'"
+    fail_msg: ".netrc in /root/ not present"
+    success_msg: ".netrc exists in /root/"
+
+- name: delete '.netrc' in /root
+  ansible.builtin.file:
+    path: '/root/.netrc'
+    state: absent
+  when: result_test_netrc.state == 'file'

molecule/os_hardening_vm/molecule.yml

@@ -14,6 +14,8 @@ platforms:
     cpus: 2
 provisioner:
   name: ansible
+  options:
+    diff: true
   env:
     ANSIBLE_PIPELINING: "True"
   config_options:

molecule/os_hardening_vm/prepare.yml

@@ -16,8 +16,6 @@
 
     - name: Run the equivalent of "apt-get update && apt-get upgrade"
       apt:
-        name: "*"
-        state: latest
         update_cache: true
       when: ansible_os_family == 'Debian'
 

molecule/ssh_hardening/converge.yml

@@ -1,7 +1,6 @@
 ---
 - name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
-  become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
@@ -11,3 +10,5 @@
   tasks:
     - include_role:
         name: ssh_hardening
+  vars:
+    sftp_enabled: false

molecule/ssh_hardening/molecule.yml

@@ -25,10 +25,18 @@ platforms:
       container: docker
 provisioner:
   name: ansible
+  options:
+    diff: true
   config_options:
     defaults:
       interpreter_python: auto_silent
       callback_whitelist: profile_tasks, timer, yaml
+  inventory:
+    host_vars:
+      # https://molecule.readthedocs.io/en/latest/examples.html#docker-with-non-privileged-user
+      # setting for the platform instance named 'instance'
+      instance:
+        ansible_user: ansible
 verifier:
   name: ansible
 

molecule/ssh_hardening_custom_tests/converge.yml

@@ -48,7 +48,6 @@
     ssh_print_last_log: true
     ssh_banner: true
     ssh_server_password_login: true
-    sftp_enabled: true
     sftp_chroot: true
     # ssh_server_enabled: false
     ssh_server_ports:

molecule/ssh_hardening_custom_tests/molecule.yml

@@ -25,6 +25,8 @@ platforms:
       container: docker
 provisioner:
   name: ansible
+  options:
+    diff: true
   config_options:
     defaults:
       interpreter_python: auto_silent

roles/mysql_hardening/README.md

@@ -16,6 +16,7 @@ It configures:
 
 - Ansible 2.9.0
 - An existing MySQL installation
+- python-jmespath on the ansible host
 
 ### Example playbook
 

roles/mysql_hardening/meta/main.yml

@@ -8,15 +8,17 @@ galaxy_info:
   platforms:
     - name: EL
       versions:
-        - 6
-        - 7
+        - "7"
+        - "8"
     - name: Ubuntu
       versions:
-        - xenial
         - bionic
+        - focal
+        - jammy
     - name: Debian
       versions:
-        - jessie
+        - bullseye
+        - buster
     - name: Amazon
     - name: Fedora
   galaxy_tags:

roles/mysql_hardening/tasks/main.yml

@@ -59,12 +59,14 @@
     - mysql_version.version.full is version('8.0.3', '>=')
     - mysql_distribution == "mysql"
 
-- include: configure.yml
+- name: Include tasks for configuration
+  import_tasks: configure.yml
   when: mysql_hardening_enabled | bool
   tags:
     - mysql_hardening
 
-- include: mysql_secure_installation.yml
+- name: Include tasks to secure mysql installation
+  import_tasks: mysql_secure_installation.yml
   when: mysql_hardening_enabled | bool
   tags:
     - mysql_hardening

roles/mysql_hardening/tasks/mysql_secure_installation.yml

@@ -4,7 +4,7 @@
     msg: 'ERROR - you have to change default mysql_root_password'
   when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'
 
-- name: ensure that the root password is present
+- name: Ensure that the root password is present
   community.mysql.mysql_user:
     name: 'root'
     host_all: true
@@ -19,14 +19,14 @@
     mode: '0400'
   tags: my_cnf
 
-- name: ensure that the test database is absent
+- name: Ensure that the test database is absent
   community.mysql.mysql_db:
     name: test
     state: absent
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   when: mysql_remove_test_database
 
-- name: ensure that anonymous users are absent
+- name: Ensure that anonymous users are absent
   community.mysql.mysql_user:
     name: ''
     state: absent
@@ -34,7 +34,7 @@
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   when: mysql_remove_anonymous_users
 
-- name: ensure that root can only login from localhost
+- name: Ensure that root can only login from localhost
   community.mysql.mysql_query:
     query:
       - DELETE
@@ -46,7 +46,7 @@
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   when: mysql_remove_remote_root
 
-- name: get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
+- name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
   community.mysql.mysql_query:
     query:
       - SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
@@ -62,7 +62,7 @@
     - (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '>=')) or
       (mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '>='))
 
-- name: get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
+- name: Get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
   community.mysql.mysql_query:
     query:
       - SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
@@ -80,21 +80,21 @@
     - (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '<')) or
       (mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '<'))
 
-- name: create a fact for users without password or authentication_string
+- name: Create a fact for users without password or authentication_string
   set_fact:
     users_wo_auth: "{{ mysql_users_wo_passwords_or_auth_string.query_result.0.0 | community.general.json_query('users') }}"
   when:
     - mysql_users_wo_passwords_or_auth_string.query_result is defined
     - mysql_users_wo_passwords_or_auth_string.query_result != ""  # noqa empty-string-compare
 
-- name: create a fact for users without password
+- name: Create a fact for users without password
   set_fact:
     users_wo_auth: "{{ mysql_users_wo_passwords.query_result.0.0 | community.general.json_query('users') }}"
   when:
     - mysql_users_wo_passwords.query_result is defined
     - mysql_users_wo_passwords.query_result != ""  # noqa empty-string-compare
 
-- name: ensure that there are no users without password or authentication_string
+- name: Ensure that there are no users without password or authentication_string
   community.mysql.mysql_query:
     query:
       - "DROP USER {{ users_wo_auth }}"

roles/mysql_hardening/vars/Debian.yml

@@ -1,5 +1,5 @@
 ---
-mysql_daemon: mysql
+mysql_daemon: mariadb
 
 mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
 mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'

roles/mysql_hardening/vars/RedHat_8.yml

@@ -1,9 +0,0 @@
----
-mysql_daemon: mariadb
-mysql_hardening_mysql_conf_file: '/etc/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'mysql'

roles/mysql_hardening/vars/Rocky_8.yml

@@ -1,9 +0,0 @@
----
-mysql_daemon: mariadb
-mysql_hardening_mysql_conf_file: '/etc/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'mysql'

roles/mysql_hardening/vars/Suse.yml

@@ -0,0 +1,10 @@
+---
+mysql_daemon: mariadb
+mysql_hardening_mysql_conf_file: '/etc/my.cnf'
+mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
+
+mysql_cnf_owner: 'root'  # owner of /etc/my.cnf.d/*.cnf files
+mysql_cnf_group: 'mysql'  # owner of /etc/my.cnf.d/*.cnf files
+
+mysql_hardening_group: 'mysql'
+login_unix_socket: '/run/mysql/mysql.sock'

roles/mysql_hardening/vars/Ubuntu_18.yml

@@ -1,10 +0,0 @@
----
-mysql_daemon: mysql
-
-mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'adm'

roles/mysql_hardening/vars/Ubuntu_20.yml

@@ -1,10 +0,0 @@
----
-mysql_daemon: mysql
-
-mysql_hardening_mysql_conf_file: '/etc/mysql/my.cnf'
-mysql_hardening_mysql_confd_dir: '/etc/mysql/conf.d'
-
-mysql_cnf_owner: 'root'  # owner of /etc/mysql/*.cnf files
-mysql_cnf_group: 'mysql'  # owner of /etc/mysql/*.cnf files
-
-mysql_hardening_group: 'adm'

roles/nginx_hardening/README.md

@@ -75,6 +75,18 @@ It works with the following nginx-roles, including, but not limited to:
 - [nginx_dh_size][]
   - Default: `2048`
   - Description: Specifies the length of DH parameters for EDH ciphers.
+- [nginx_configuration_dir][]
+  - default: "/etc/nginx"
+  - Description: The main location for all nginx configuration files
+- [nginx_configuration_hardening_dir][]
+  - default: "/etc/nginx"
+  - Description: The location for the nginx hardening configuration file (Could be different e.g. when used in jails)
+- [nginx_owner_user][]
+  - default: "root"
+  - Description: The owner user of the nginx configuration files
+- [nginx_owner_group][]
+  - default: "root"
+  - Description: The owner group of the nginx configuration files
 
 ## Example Playbook
 

roles/nginx_hardening/defaults/main.yml

@@ -11,6 +11,10 @@ nginx_client_header_timeout: "10"
 nginx_send_timeout: "10"
 nginx_limit_conn_zone: "$binary_remote_addr zone=default:10m"
 nginx_limit_conn: "default 5"
+nginx_configuration_dir: "/etc/nginx"
+nginx_configuration_hardening_dir: "/etc/nginx"
+nginx_owner_user: "root"
+nginx_owner_group: "root"
 nginx_add_header:
   # avoid clickjacking
   - X-Frame-Options SAMEORIGIN
@@ -23,6 +27,7 @@ nginx_add_header:
 
 nginx_set_cookie_flag: "* HttpOnly secure"
 nginx_ssl_prefer_server_ciphers: "on"
+nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
 nginx_ssl_ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
 nginx_ssl_session_tickets: "off"
 nginx_dh_size: "4096"

roles/nginx_hardening/meta/main.yml

@@ -8,16 +8,17 @@ galaxy_info:
   platforms:
     - name: EL
       versions:
-        - 6
-        - 7
+        - "7"
+        - "8"
     - name: Ubuntu
       versions:
-        - xenial
         - bionic
+        - focal
+        - jammy
     - name: Debian
       versions:
-        - stretch
         - buster
+        - bullseye
   galaxy_tags:
     - system
     - security

roles/nginx_hardening/tasks/main.yml

@@ -1,100 +1,77 @@
 ---
-- name: Fetch OS dependent variables
-  include_vars:
-    file: '{{ item }}'
-    name: 'os_vars'
-  with_first_found:
-    - files:
-        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
-        - '{{ ansible_facts.distribution }}.yml'
-        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
-        - '{{ ansible_facts.os_family }}.yml'
-      skip: true
-  tags: always
-
-# we only override variables with our default, if they have not been specified already
-# by default the lookup functions finds all varnames containing the string, therefore
-# we add ^ and $ to denote start and end of string, so this returns only exact matches
-- name: Set OS dependent variables, if not already defined by user  # noqa var-naming
-  set_fact:
-    '{{ item.key }}': '{{ item.value }}'
-  when: "not lookup('varnames', '^' + item.key + '$')"
-  with_dict: '{{ os_vars }}'
-  tags: always
-
 - name: Create additional configuration
   template:
     src: "hardening.conf.j2"
-    dest: "/etc/nginx/conf.d/90.hardening.conf"
+    dest: "{{ nginx_configuration_dir }}/conf.d/90.hardening.conf"
     mode: '0600'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
   notify: Restart nginx
 
 - name: Change configuration in main nginx.conf
   lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
     regexp: '^\s*server_tokens'
     line: "    server_tokens {{ nginx_server_tokens }};"
     insertafter: "http {"
     mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
   notify: Restart nginx
 
 - name: Change ssl_protocols in main nginx.conf
   lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
     regexp: '^\s*ssl_protocols'
     line: "    ssl_protocols {{ nginx_ssl_protocols }};"
     insertafter: "http {"
     mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
   notify: Restart nginx
 
 - name: Change ssl_prefer_server_ciphers in main nginx.conf
   lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
     regexp: '^\s*ssl_prefer_server_ciphers'
     line: "    ssl_prefer_server_ciphers {{ nginx_ssl_prefer_server_ciphers }};"
     insertafter: "http {"
     mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
   notify: Restart nginx
 
 - name: Change client_max_body_size in main nginx.conf
   lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
     regexp: '^\s*client_max_body_size'
     line: "    client_max_body_size {{ nginx_client_max_body_size }};"
     insertafter: "http {"
     mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
   notify: Restart nginx
 
 - name: Change client_body_buffer_size in main nginx.conf
   lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
     regexp: '^\s*client_body_buffer_size'
     line: "    client_body_buffer_size {{ nginx_client_body_buffer_size }};"
     insertafter: "http {"
     mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
   notify: Restart nginx
 
 - name: Change keepalive_timeout in main nginx.conf
   lineinfile:
-    dest: "/etc/nginx/nginx.conf"
+    dest: "{{ nginx_configuration_dir }}/nginx.conf"
     regexp: '^\s*keepalive_timeout'
     line: "    keepalive_timeout {{ nginx_keepalive_timeout }};"
     insertafter: "http {"
     mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
   notify: Restart nginx
 
 - name: Remove default.conf
@@ -104,14 +81,14 @@
   when: nginx_remove_default_site
   notify: Restart nginx
   loop:
-    - "/etc/nginx/conf.d/default.conf"
-    - "/etc/nginx/sites-enabled/default"
+    - "{{ nginx_configuration_dir }}/conf.d/default.conf"
+    - "{{ nginx_configuration_dir }}/sites-enabled/default"
 
 - name: Generate dh group
   openssl_dhparam:
-    path: "/etc/nginx/dh{{ nginx_dh_size }}.pem"
+    path: "{{ nginx_configuration_dir }}/dh{{ nginx_dh_size }}.pem"
     size: "{{ nginx_dh_size }}"
     mode: '0640'
-    owner: "root"
-    group: "root"
+    owner: "{{ nginx_owner_user }}"
+    group: "{{ nginx_owner_group }}"
   notify: Restart nginx

roles/nginx_hardening/templates/hardening.conf.j2

@@ -11,7 +11,7 @@ limit_conn_zone             {{ nginx_limit_conn_zone }};
 limit_conn                  {{ nginx_limit_conn }};
 ssl_ciphers                 '{{ nginx_ssl_ciphers }}';
 ssl_session_tickets         {{ nginx_ssl_session_tickets }};
-ssl_dhparam                 /etc/nginx/dh{{ nginx_dh_size }}.pem;
+ssl_dhparam                 {{ nginx_configuration_hardening_dir }}/dh{{ nginx_dh_size }}.pem;
 {% for header in nginx_add_header %}
 add_header                  {{ header }};
 {% endfor %}

roles/nginx_hardening/vars/Amazon.yml

@@ -1,2 +0,0 @@
----
-nginx_ssl_protocols: "TLSv1.2 TLSv1.3"

roles/nginx_hardening/vars/Archlinux.yml

@@ -1,2 +0,0 @@
----
-nginx_ssl_protocols: "TLSv1.2 TLSv1.3"

roles/nginx_hardening/vars/Debian.yml

@@ -1,2 +0,0 @@
----
-nginx_ssl_protocols: "TLSv1.2 TLSv1.3"

roles/nginx_hardening/vars/Debian_9.yml

@@ -1,2 +0,0 @@
----
-nginx_ssl_protocols: "TLSv1.2"

roles/nginx_hardening/vars/Fedora.yml

@@ -1,2 +0,0 @@
----
-nginx_ssl_protocols: "TLSv1.2 TLSv1.3"

roles/nginx_hardening/vars/RedHat.yml

@@ -1,2 +0,0 @@
----
-nginx_ssl_protocols: "TLSv1.2 TLSv1.3"

roles/nginx_hardening/vars/Suse.yml

@@ -1,2 +0,0 @@
----
-nginx_ssl_protocols: "TLSv1.2 TLSv1.3"

roles/os_hardening/README.md

@@ -218,6 +218,9 @@ We know that this is the case on Raspberry Pi.
 - `os_auditd_max_log_file`
   - Default: `6`
   - Description: This keyword specifies the maximum file size in megabytes. When this limit is reached, it will trigger a configurable action. The value given must be numeric.
+- `os_auditd_num_logs`
+  - Default: `5`
+  - Description: This keyword specifies the number of log files to keep if `rotate` is given as the max_log_file_action. The value given must be numeric.
 - `hidepid_option`
   - Default: `2` (on RHEL/CentOS7 `0`, see known limitations)
   - Description: `0`: This is the default setting and gives you the default behaviour. `1`: With this option an normal user would not see other processes but their own about ps, top etc, but he is still able to see process IDs in /proc. `2`: Users are only able too see their own processes (like with hidepid=1), but also the other process IDs are hidden for them in /proc.
@@ -230,6 +233,15 @@ We know that this is the case on Raspberry Pi.
 - `os_ignore_home_folder_users`
   - Default: `lost+found`
   - Description: specify user home folders in `/home` that shouldn't be chmodded to 700
+- `os_chmod_rootuser_home_folder`
+  - Default: `true`
+  - Description: Set to `false` to disable "chmod 700" of root's home folder
+- `os_rootuser_pw_ageing`
+  - Default: `false`
+  - Description: Set to true to enforce password age settings for root user(s)
+- `os_remove_additional_root_users`
+  - Default: `false`
+  - Description: When enabled and there are multiple users with UID=0, only "root" will be kept. Others will be deleted.
 - `os_cron_enabled`
   - Default: `true`
   - Description: Set to false to disable installing and configuring cron.
@@ -241,7 +253,7 @@ We know that this is the case on Raspberry Pi.
   - Description: Set to false to disable installing and configuring limits.
 - `os_login_defs_enabled`
   - Default: `true`
-  - Description: Set to false to disable installing and configuring login_defs.
+  - Description: Set to false to disable installing and configuring login_defs for newly created users.
 - `os_minimize_access_enabled`
   - Default: `true`
   - Description: Set to false to disable installing and configuring minimize_access.
@@ -287,6 +299,30 @@ We know that this is the case on Raspberry Pi.
 - `os_sha_crypt_max_rounds`
   - Default: `640000`
   - Description: Define the number of maximum SHA rounds. With a lot of rounds brute forcing the password is more difficult. But note also that it more CPU resources will be needed to authenticate users. The values must be inside the 1000-999999999 range.
+- `os_auditd_enabled`
+  - Default: `true`
+  - Description: Set to false to disable installing and configuring `auditd`.
+- `os_auditd_flush`
+  - Default: `INCREMENTAL`
+  - Description: Valid values are none, incremental, incremental_async, data, and sync.
+- `os_auditd_max_log_file`
+  - Default: 6
+  - Description: This keyword specifies the maximum file size in megabytes. When this limit is reached, it will trigger a configurable action.
+- `os_auditd_max_log_file_action`
+  - Default: `keep_logs`
+  - Description: This parameter tells the system what action to take when the system has detected that the max file size limit has been reached. Valid values are ignore, syslog, suspend, rotate and keep_logs.
+- `os_auditd_admin_space_left`
+  - Default: 50
+  - Description: This is a numeric value in megabytes that tells the audit daemon when to perform a configurable action because the system is running low on disk space.
+- `os_auditd_space_left`
+  - Default: 75
+  - Description: If the free space in the filesystem containing log_file drops below this value, the audit daemon takes the action specified by space_left_action.
+- `os_auditd_space_left_action`
+  - Default: SYSLOG
+  - Description: This parameter tells the system what action to take when the system has detected that it is starting to get low on disk space.
+- `os_auditd_log_format`
+  - Default: `RAW`
+  - Description: The log format describes how the information should be stored on disk. There are 2 options: raw and enriched. If set to `RAW`, the audit records will be stored in a format exactly as the kernel sends it. The `ENRICHED` option will resolve all uid, gid, syscall, architecture, and socket address information before writing the event to disk. This aids in making sense of events created on one system but reported/analyzed on another system.
 - `os_mnt_boot_dir_mode`
   - Default: `0700`
   - Description: Set default perimissions for /boot
@@ -300,8 +336,14 @@ We know that this is the case on Raspberry Pi.
   - Default: `rw,nosuid,nodev,noexec`
   - Description: Configure mount options for /boot
 - `os_mnt_boot_filesystem`
-  - Default: `ext4`
-  - Description: Configure file system for fstab entry /boot
+  - Default: `""`
+  - Description: Configure file system for fstab entry /boot. If empty, the current file system type will be used.
+- `os_mnt_boot_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_boot_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_dev_dir_mode`
   - Default: `0755`
   - Description: Set default perimissions for /dev
@@ -315,8 +357,14 @@ We know that this is the case on Raspberry Pi.
   - Default: `'rw,nosuid,noexec'`
   - Description: Configure mount options for /dev
 - `os_mnt_dev_filesystem`
-  - Default: `ext4`
+  - Default: `devtmpfs`
   - Description: Configure file system for fstab entry /dev
+- `os_mnt_dev_dump`
+  - Default: `0`
+  - Description: Configure dump for fstab entry /var/tmp.
+- `os_mnt_dev_passno`
+  - Default: `0`
+  - Description: Configure passno for fstab entry /var/tmp.
 - `os_mnt_dev_shm_dir_mode`
   - Default: `1777`
   - Description: Set default perimissions for /dev/shm
@@ -330,8 +378,14 @@ We know that this is the case on Raspberry Pi.
   - Default: `rw,nosuid,nodev,noexec`
   - Description: Configure mount options for /dev/shm
 - `os_mnt_dev_shm_filesystem`
-  - Default: `ext4`
+  - Default: `tmpfs`
   - Description: Configure file system for fstab entry /dev/shm
+- `os_mnt_dev_shm_dump`
+  - Default: `0`
+  - Description: Configure dump for fstab entry /var/tmp.
+- `os_mnt_dev_shm_passno`
+  - Default: `0`
+  - Description: Configure passno for fstab entry /var/tmp.
 - `os_mnt_home_dir_mode`
   - Default: `0755`
   - Description: Set default perimissions for /home
@@ -340,13 +394,19 @@ We know that this is the case on Raspberry Pi.
   - Description: Set to true to configure /home mountpoint
 - `os_mnt_home_src`
   - Default: `""`
-  - Description: Set mount source for /home
+  - Description: Set mount source for /home. If empty, the current file system source device will be used.
 - `os_mnt_home_options`
   - Default: `rw,nosuid,nodev`
   - Description: Configure mount options for /home
 - `os_mnt_home_filesystem`
-  - Default: `ext4`
-  - Description: Configure file system for fstab entry /home
+  - Default: `""`
+  - Description: Configure file system for fstab entry /home. If empty, the current file system type will be used.
+- `os_mnt_home_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_home_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_run_dir_mode`
   - Default: `0755`
   - Description: Set default perimissions for /run
@@ -360,8 +420,35 @@ We know that this is the case on Raspberry Pi.
   - Default: `rw,nosuid,nodev`
   - Description: Configure mount options for /run
 - `os_mnt_run_filesystem`
-  - Default: `ext4`
+  - Default: `tmpfs`
   - Description: Configure file system for fstab entry /run
+- `os_mnt_run_dump`
+  - Default: `0`
+  - Description: Configure dump for fstab entry /var/tmp.
+- `os_mnt_run_passno`
+  - Default: `0`
+  - Description: Configure passno for fstab entry /var/tmp.
+- `os_mnt_tmp_dir_mode`
+  - Default: `1777`
+  - Description: Set default perimissions for /tmp
+- `os_mnt_tmp_enabled`
+  - Default: `false`
+  - Description: Set to true to configure /tmp mountpoint
+- `os_mnt_tmp_src`
+  - Default: `""`
+  - Description: Set mount source for /tmp. If empty, the current file system source device will be used.
+- `os_mnt_tmp_options`
+  - Default: `rw,nosuid,nodev,noexec`
+  - Description: Configure mount options for /tmp
+- `os_mnt_tmp_filesystem`
+  - Default: `""`
+  - Description: Configure file system for fstab entry /tmp. If empty, the current file system type will be used.
+- `os_mnt_tmp_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_tmp_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_var_dir_mode`
   - Default: `0755`
   - Description: Set default perimissions for /var
@@ -370,13 +457,19 @@ We know that this is the case on Raspberry Pi.
   - Description: Set to true to configure /var mountpoint
 - `os_mnt_var_src`
   - Default: `""`
-  - Description: Set mount source for /var
+  - Description: Set mount source for /var. If empty, the current file system source device will be used.
 - `os_mnt_var_options`
   - Default: `rw,nosuid,nodev`
   - Description: Configure mount options for /var
 - `os_mnt_var_filesystem`
-  - Default: `ext4`
-  - Description: Configure file system for fstab entry /var
+  - Default: `""`
+  - Description: Configure file system for fstab entry /var. If empty, the current file system type will be used.
+- `os_mnt_var_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_var_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_var_log_dir_mode`
   - Default: `0755`
   - Description: Set default perimissions for /var/log
@@ -385,13 +478,19 @@ We know that this is the case on Raspberry Pi.
   - Description: Set to true to configure /var/log mountpoint
 - `os_mnt_var_log_src`
   - Default: `""`
-  - Description: Set mount source for /var/log
+  - Description: Set mount source for /var/log. If empty, the current file system source device will be used.
 - `os_mnt_var_log_options`
   - Default: `rw,nosuid,nodev,noexec`
   - Description: Configure mount options for /var/log
 - `os_mnt_var_log_filesystem`
-  - Default: `ext4`
-  - Description: Configure file system for fstab entry /var/log
+  - Default: `""`
+  - Description: Configure file system for fstab entry /var/log. If empty, the current file system type will be used.
+- `os_mnt_var_log_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_var_log_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_var_log_audit_dir_mode`
   - Default: `0640`
   - Description: Set default perimissions for /var/log/audit
@@ -400,13 +499,19 @@ We know that this is the case on Raspberry Pi.
   - Description: Set to true to configure /var/log/audit mountpoint
 - `os_mnt_var_log_audit_src`
   - Default: `""`
-  - Description: Set mount source for /var/log/audit
+  - Description: Set mount source for /var/log/audit. If empty, the current file system source device will be used.
 - `os_mnt_var_log_audit_options`
   - Default: `rw,nosuid,nodev,noexec`
   - Description: Configure mount options for /var/log/audit
 - `os_mnt_var_log_audit_filesystem`
-  - Default: `ext4`
-  - Description: Configure file system for fstab entry /var/log/audit
+  - Default: `""`
+  - Description: Configure file system for fstab entry /var/log/audit. If empty, the current file system type will be used.
+- `os_mnt_var_log_audit_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_var_log_audit_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
 - `os_mnt_var_tmp_dir_mode`
   - Default: `1777`
   - Description: Set default perimissions for /var/tmp
@@ -415,13 +520,25 @@ We know that this is the case on Raspberry Pi.
   - Description: Set to true to configure /var/tmp mountpoint
 - `os_mnt_var_tmp_src`
   - Default: `""`
-  - Description: Set mount source for /var/tmp
+  - Description: Set mount source for /var/tmp. If empty, the current file system source device will be used.
 - `os_mnt_var_tmp_options`
   - Default: `rw,nosuid,nodev,noexec`
   - Description: Configure mount options for /var/tmp
 - `os_mnt_var_tmp_filesystem`
-  - Default: `ext4`
-  - Description: Configure file system for fstab entry /var/tmp
+  - Default: `""`
+  - Description: Configure file system for fstab entry /var/tmp. If empty, the current file system type will be used.
+- `os_mnt_var_tmp_dump`
+  - Default: ext3 + ext4 `1` / other `0`
+  - Description: Configure dump for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_mnt_var_tmp_passno`
+  - Default: ext3 + ext4 `2` / other `0`
+  - Description: Configure passno for fstab entry /var/tmp. If empty, the default depends on fstype.
+- `os_netrc_enabled`
+  - Default: `True`
+  - Description: Configure filesystem for existence of .netrc file in homedir
+- `os_netrc_whitelist_user`
+  - Default: ``
+  - Description: Add list of user to allow creation of .netrc in users homedir
 
 ## Packages
 

roles/os_hardening/defaults/main.yml

@@ -9,19 +9,27 @@ os_auth_lockout_time: 600  # Seconds (600 = 10min)
 os_auth_timeout: 60
 os_auth_allow_homeless: false
 os_auth_pam_passwdqc_enable: true
-os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8'  # Used in RHEL6
+os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8'  # Used in Debian
 os_auth_pam_pwquality_options: 'try_first_pass retry=3 authtok_type='  # Used in RHEL7 and RHEL8
 os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]
 
 os_chfn_restrict: ''
 
-# Set to false to disable chmod /home folders to 700
+# Set to false to disable chmod userhome folders to 700
+os_chmod_rootuser_home_folder: true
 os_chmod_home_folders: true
 
 # May contain: change_user
 os_security_users_allow: []
 # Specify user home folders in /home that shouldn't be chmodded to 700
 os_ignore_home_folder_users: ['lost+found']
+
+# Set to false to disable password age enforcement on existing users
+os_rootuser_pw_ageing: false
+
+# When enabled and there are multiple users with UID=0, only "root" will be kept. Others will be deleted.
+os_remove_additional_root_users: false
+
 # Specify system accounts whose login should not be disabled and password not changed
 os_ignore_users: ['vagrant', 'kitchen']
 os_security_kernel_enable_module_loading: true
@@ -253,6 +261,7 @@ sysctl_config:
 
   # Disable acceptance of IPv6 router solicitations messages | sysctl-21
   net.ipv6.conf.default.router_solicitations: 0
+  net.ipv6.conf.all.router_solicitations: 0
 
   # Disable Accept Router Preference from router advertisement | sysctl-22
   net.ipv6.conf.default.accept_ra_rtr_pref: 0
@@ -265,6 +274,7 @@ sysctl_config:
 
   # Disable IPv6 autoconfiguration | sysctl-26
   net.ipv6.conf.default.autoconf: 0
+  net.ipv6.conf.all.autoconf: 0
 
   # Disable neighbor solicitations to send out per address | sysctl-27
   net.ipv6.conf.default.dad_transmits: 0
@@ -318,8 +328,18 @@ os_hardening_enabled: true
 
 # Set to false to disable installing and configuring auditd.
 os_auditd_enabled: true
+os_auditd_flush: INCREMENTAL
 os_auditd_max_log_file: 6
 os_auditd_max_log_file_action: keep_logs
+os_auditd_log_format: RAW
+os_auditd_admin_space_left: 50
+os_auditd_space_left: 75
+os_auditd_space_left_action: SYSLOG
+os_auditd_admin_space_left_action: SUSPEND
+os_auditd_disk_full_action: SUSPEND
+os_auditd_disk_error_action: SUSPEND
+os_auditd_log_group: root
+os_auditd_num_logs: 5
 
 # Set the SELinux state, which can be either disabled, permissive, or enforcing.
 os_selinux_state: enforcing
@@ -338,7 +358,7 @@ os_ctrlaltdel_disabled: false
 # Set to false to disable installing and configuring limits.
 os_limits_enabled: true
 
-# Set to false to disable installing and configuring login_defs.
+# Set to false to disable installing and configuring login_defs for newly created users.
 os_login_defs_enabled: true
 
 # Set to false to disable installing and configuring minimize_access.
@@ -390,52 +410,84 @@ os_mnt_boot_dir_mode: '0700'
 os_mnt_boot_enabled: false
 os_mnt_boot_src: ""
 os_mnt_boot_options: 'rw,nosuid,nodev,noexec'
-os_mnt_boot_filesystem: 'ext4'
+os_mnt_boot_filesystem: ""
+os_mnt_boot_dump: ""
+os_mnt_boot_passno: ""
 
 os_mnt_dev_dir_mode: '0755'
 os_mnt_dev_enabled: true
 os_mnt_dev_src: "devtmpfs"
 os_mnt_dev_options: 'rw,nosuid,noexec'
 os_mnt_dev_filesystem: "devtmpfs"
+os_mnt_dev_dump: ""
+os_mnt_dev_passno: ""
 
 os_mnt_dev_shm_dir_mode: '1777'
 os_mnt_dev_shm_enabled: true
 os_mnt_dev_shm_src: "tmpfs"
 os_mnt_dev_shm_options: 'rw,nosuid,nodev,noexec'
 os_mnt_dev_shm_filesystem: "tmpfs"
+os_mnt_dev_shm_dump: ""
+os_mnt_dev_shm_passno: ""
 
 os_mnt_home_dir_mode: '0755'
 os_mnt_home_enabled: false
 os_mnt_home_src: ""
 os_mnt_home_options: 'rw,nosuid,nodev'
-os_mnt_home_filesystem: "ext4"
+os_mnt_home_filesystem: ""
+os_mnt_home_dump: ""
+os_mnt_home_passno: ""
 
 os_mnt_run_dir_mode: '0755'
 os_mnt_run_enabled: true
 os_mnt_run_src: "tmpfs"
 os_mnt_run_options: 'rw,nosuid,nodev'
 os_mnt_run_filesystem: "tmpfs"
+os_mnt_run_dump: ""
+os_mnt_run_passno: ""
+
+os_mnt_tmp_dir_mode: '1777'
+os_mnt_tmp_enabled: false
+os_mnt_tmp_src: ""
+os_mnt_tmp_options: 'rw,nosuid,nodev,noexec'
+os_mnt_tmp_filesystem: ""
+os_mnt_tmp_dump: ""
+os_mnt_tmp_passno: ""
 
 os_mnt_var_dir_mode: '0755'
 os_mnt_var_enabled: false
 os_mnt_var_src: ""
 os_mnt_var_options: 'rw,nosuid,nodev'
-os_mnt_var_filesystem: "ext4"
+os_mnt_var_filesystem: ""
+os_mnt_var_dump: ""
+os_mnt_var_passno: ""
 
 os_mnt_var_log_dir_mode: '0755'
 os_mnt_var_log_enabled: false
 os_mnt_var_log_src: ""
 os_mnt_var_log_options: 'rw,nosuid,nodev,noexec'
-os_mnt_var_log_filesystem: "ext4"
+os_mnt_var_log_filesystem: ""
+os_mnt_var_log_dump: ""
+os_mnt_var_log_passno: ""
 
-os_mnt_var_log_audit_dir_mode: '0640'
+os_mnt_var_log_audit_dir_mode: '0700'
 os_mnt_var_log_audit_enabled: false
 os_mnt_var_log_audit_src: ""
 os_mnt_var_log_audit_options: 'rw,nosuid,nodev,noexec'
-os_mnt_var_log_audit_filesystem: "ext4"
+os_mnt_var_log_audit_filesystem: ""
+os_mnt_var_log_audit_dump: ""
+os_mnt_var_log_audit_passno: ""
 
 os_mnt_var_tmp_dir_mode: '1777'
 os_mnt_var_tmp_enabled: false
 os_mnt_var_tmp_src: ""
 os_mnt_var_tmp_options: 'rw,nosuid,nodev,noexec'
-os_mnt_var_tmp_filesystem: "ext4"
+os_mnt_var_tmp_filesystem: ""
+os_mnt_var_tmp_dump: ""
+os_mnt_var_tmp_passno: ""
+
+#
+# .netrc User whitelist
+# keep .netrc file for users in whitelist
+os_netrc_enabled: true
+os_netrc_whitelist_user: []

roles/os_hardening/handlers/main.yml

@@ -1,13 +1,18 @@
 ---
 - name: Update-initramfs
-  command: 'update-initramfs -u'
+  ansible.builtin.command: 'update-initramfs -u'
 
-- name: restart-auditd
-  command:
+- name: Restart auditd
+  ansible.builtin.command:
     cmd: 'service auditd restart'  # rhel: see: https://access.redhat.com/solutions/2664811
-    warn: false  # sadly 'service' module fails in that case also by using 'use: service'
   when: molecule_yml is not defined  # restarting auditd in a container does not work
 
 - name: Reload systemd
-  systemd:
+  ansible.builtin.systemd:
     daemon_reload: true
+
+- name: Remount filesystems
+  ansible.posix.mount:
+    path: "{{ item }}"
+    state: remounted
+  loop: "{{ mountpoints_changed }}"

roles/os_hardening/meta/main.yml

@@ -8,21 +8,22 @@ galaxy_info:
   platforms:
     - name: EL
       versions:
-        - 7
-        - 8
+        - "7"
+        - "8"
     - name: Ubuntu
       versions:
-        - xenial
         - bionic
+        - focal
+        - jammy
     - name: Debian
       versions:
-        - stretch
         - buster
+        - bullseye
     - name: Amazon
     - name: Fedora
-    - name: Archlinux
+    - name: ArchLinux
     - name: SmartOS
-    - name: openSUSE
+    - name: opensuse
   galaxy_tags:
     - system
     - security

roles/os_hardening/tasks/auditd.yml

@@ -12,5 +12,5 @@
     owner: 'root'
     group: 'root'
     mode: '0640'
-  notify: 'restart-auditd'
+  notify: Restart auditd
   tags: auditd

roles/os_hardening/tasks/hardening.yml

@@ -22,75 +22,97 @@
   with_dict: '{{ os_vars }}'
   tags: always
 
-- import_tasks: auditd.yml
+- name: Import tasks for auditd
+  import_tasks: auditd.yml
   tags: auditd
   when: os_auditd_enabled | bool
 
-- import_tasks: cron.yml
+- name: Import tasks for cron
+  import_tasks: cron.yml
   tags: cron
   when: os_cron_enabled | bool
 
-- import_tasks: ctrlaltdel.yml
+- name: Import tasks to configure ctrl+alt+del
+  import_tasks: ctrlaltdel.yml
   tags: ctrlaltdel
   when: os_ctrlaltdel_disabled | bool
 
-- import_tasks: limits.yml
+- name: Import tasks to configure limits
+  import_tasks: limits.yml
   tags: limits
   when: os_limits_enabled | bool
 
-- import_tasks: login_defs.yml
+- name: Import tasks to configure login_defs
+  import_tasks: login_defs.yml
   tags: login_defs
   when: os_login_defs_enabled | bool
 
-- import_tasks: minimize_access.yml
+- name: Import tasks to minimize access permissions
+  import_tasks: minimize_access.yml
   tags: minimize_access
   when: os_minimize_access_enabled | bool
 
-- import_tasks: pam.yml
+- name: Import tasks to configure PAM
+  import_tasks: pam.yml
   tags: pam
   when: os_pam_enabled | bool
 
-- import_tasks: modprobe.yml
+- name: Import tasks to configure modules
+  import_tasks: modprobe.yml
   tags: modprobe
   when: os_modprobe_enabled | bool
 
-- import_tasks: profile.yml
+- name: Import tasks to configure profile
+  import_tasks: profile.yml
   tags: profile
   when: os_profile_enabled | bool
 
-- import_tasks: securetty.yml
+- name: Import tasks to configure securetty
+  import_tasks: securetty.yml
   tags: securetty
   when: os_securetty_enabled | bool
 
-- import_tasks: suid_sgid.yml
+- name: Import tasks to set suid and sgid
+  import_tasks: suid_sgid.yml
   when: os_security_suid_sgid_enforce  | bool
   tags: suid_sgid
 
-- import_tasks: sysctl.yml
+- name: Import tasks to configure sysctl
+  import_tasks: sysctl.yml
   tags: sysctl
   when: os_sysctl_enabled | bool
 
-- import_tasks: user_accounts.yml
+- name: Import tasks to harden user accounts
+  import_tasks: user_accounts.yml
   tags: user_accounts
   when: os_user_accounts_enabled | bool
 
-- import_tasks: rhosts.yml
+- name: Import tasks to configure rhosts
+  import_tasks: rhosts.yml
   tags: rhosts
   when: os_rhosts_enabled | bool
 
-- import_tasks: yum.yml
+- name: Import tasks to configure netrc
+  import_tasks: netrc.yml
+  tags: netrc
+  when: os_netrc_enabled | bool
+
+- name: Import tasks to configure yum
+  import_tasks: yum.yml
   tags: yum
   when:
     - ansible_facts.os_family == 'RedHat'
     - os_yum_enabled | bool
 
-- import_tasks: apt.yml
+- name: Import tasks to configure apt
+  import_tasks: apt.yml
   tags: apt
   when:
     - ansible_facts.os_family == 'Debian'
     - os_apt_enabled | bool
 
-- import_tasks: selinux.yml
+- name: Import tasks to configure selinux
+  import_tasks: selinux.yml
   tags: selinux
   when:
     - ansible_facts.selinux.status == 'enabled'

roles/os_hardening/tasks/limits.yml

@@ -1,5 +1,6 @@
 ---
-- name: disable coredumps
+- name: Disable coredumps
+  when: not os_security_kernel_enable_core_dump | bool
   block:
   - name: Create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
     file:
@@ -28,7 +29,7 @@
       modification_time: preserve
       access_time: preserve
 
-  - name: create coredump.conf.d-directory if it does not exist
+  - name: Create coredump.conf.d-directory if it does not exist
     file:
       path: '/etc/systemd/coredump.conf.d'
       owner: root
@@ -37,7 +38,7 @@
       state: directory
     when: ansible_service_mgr == "systemd"
 
-  - name: create custom.conf for disabling coredumps
+  - name: Create custom.conf for disabling coredumps
     template:
       src: 'etc/systemd/coredump.conf.d/coredumps.conf.j2'
       dest: '/etc/systemd/coredump.conf.d/custom.conf'
@@ -47,9 +48,8 @@
     when: ansible_service_mgr == "systemd"
     notify: Reload systemd
 
-  when: not os_security_kernel_enable_core_dump | bool
-
-- name: enable coredumps
+- name: Enable coredumps
+  when: os_security_kernel_enable_core_dump | bool
   block:
     - name: Remove coredump.conf.d directory with files
       file:
@@ -62,4 +62,3 @@
       file:
         path: /etc/security/limits.d/10.hardcore.conf
         state: absent
-  when: os_security_kernel_enable_core_dump | bool

roles/os_hardening/tasks/main.yml

@@ -1,3 +1,6 @@
 ---
-- include_tasks: hardening.yml
+- name: Include hardening tasks
+  include_tasks: hardening.yml
   when: os_hardening_enabled | bool
+  tags:
+    - always

roles/os_hardening/tasks/minimize_access.yml

@@ -6,7 +6,7 @@
 # also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
 - name: Find files with write-permissions for group
   shell: "find -L {{ item }} -perm /go+w -type f"  # noqa command-instead-of-shell
-  with_flattened:
+  with_community.general.flattened:
     - '/usr/local/sbin'
     - '/usr/local/bin'
     - '/usr/sbin'
@@ -81,182 +81,26 @@
     opts: '{{ proc_mnt_options }}'
     state: mounted
 
-- name: Check if boot exists
-  stat:
-    path: /boot
-  register: boot_exists
+- name: Generate list of current available mounted filesystems on the system
+  set_fact:
+    mountpoints_list: "{{ ansible_mounts | map(attribute='mount') | list }}"
 
-- name: Mount /boot with hardened options
-  mount:
-    path: /boot
-    src: '{{ os_mnt_boot_src }}'
-    fstype: '{{ os_mnt_boot_filesystem }}'
-    opts: '{{ os_mnt_boot_options }}'
-    state: present
-  register: bootmount
-  when:
-    - os_mnt_boot_enabled | bool
-    - boot_exists.stat.exists | bool
+- name: Append special devices list to valid mountpoint list
+  set_fact:
+    mountpoints_list: "{{ mountpoints_list + ['/dev', '/dev/shm', '/run'] }}"
 
-- name: Harden permissions for /boot directory
-  file:
-    dest: /boot
-    owner: 'root'
-    group: 'root'
-    mode: '{{ os_mnt_boot_dir_mode }}'
-  when:  boot_exists.stat.exists | bool
-
-- name: Mount /dev with hardened options
-  mount:
-    path: /dev
-    src: '{{ os_mnt_dev_src }}'
-    fstype: '{{ os_mnt_dev_filesystem }}'
-    opts: '{{ os_mnt_dev_options }}'
-    state: present
-  register: devmount
-  when: os_mnt_dev_enabled | bool
-
-- name: Harden permissions for /dev directory
-  file:
-    dest: /dev
-    owner: 'root'
-    group: 'root'
-    mode: '{{ os_mnt_dev_dir_mode }}'
-
-- name: Mount /dev/shm with hardened options
-  mount:
-    path: /dev/shm
-    src: '{{ os_mnt_dev_shm_src }}'
-    fstype: '{{ os_mnt_dev_shm_filesystem }}'
-    opts: '{{ os_mnt_dev_shm_options }}'
-    state: present
-  register: devshmmount
-  when: os_mnt_dev_shm_enabled | bool
-
-- name: Harden permissions for /dev/shm directory
-  file:
-    dest: /dev/shm
-    owner: 'root'
-    group: 'root'
-    mode: '{{ os_mnt_dev_shm_dir_mode }}'
-
-- name: Mount /home with hardened options
-  mount:
-    path: /home
-    src: '{{ os_mnt_home_src }}'
-    fstype: '{{ os_mnt_home_filesystem }}'
-    opts: '{{ os_mnt_home_options }}'
-    state: present
-  register: homemount
-  when: os_mnt_home_enabled | bool
-
-- name: Harden permissions for /home directory
-  file:
-    dest: /home
-    owner: 'root'
-    group: 'root'
-    mode: '{{ os_mnt_home_dir_mode }}'
-
-- name: Mount /run with hardened options
-  mount:
-    path: /run
-    src: '{{ os_mnt_run_src }}'
-    fstype: '{{ os_mnt_run_filesystem }}'
-    opts: '{{ os_mnt_run_options }}'
-    state: present
-  register: runmount
-  when: os_mnt_run_enabled | bool
-
-- name: Harden permissions for /run directory
-  file:
-    dest: /run
-    owner: 'root'
-    group: 'root'
-    mode: '{{ os_mnt_run_dir_mode }}'
-
-- name: Mount /var with hardened options
-  mount:
-    path: /var
-    src: '{{ os_mnt_var_src }}'
-    fstype: '{{ os_mnt_var_filesystem }}'
-    opts: '{{ os_mnt_var_options }}'
-    state: present
-  register: varmount
-  when: os_mnt_var_enabled | bool
-
-- name: Harden permissions for /var directory
-  file:
-    dest: /var
-    owner: 'root'
-    group: 'root'
-    mode: '{{ os_mnt_var_dir_mode }}'
-
-- name: Mount /var/log with hardened options
-  mount:
-    path: /var/log
-    src: '{{ os_mnt_var_log_src }}'
-    fstype: '{{ os_mnt_var_log_filesystem }}'
-    opts: '{{ os_mnt_var_log_options }}'
-    state: present
-  register: varlogmount
-  when: os_mnt_var_log_enabled | bool
-
-- name: Harden permissions for /var/log directory
-  file:
-    dest: /var/log
-    owner: 'root'
-    group: 'root'
-    mode: '{{ os_mnt_var_log_dir_mode }}'
-
-- name: Mount /var/log/audit with hardened options
-  mount:
-    path: /var/log/audit
-    src: '{{ os_mnt_var_log_audit_src }}'
-    fstype: '{{ os_mnt_var_log_audit_filesystem }}'
-    opts: '{{ os_mnt_var_log_audit_options }}'
-    state: present
-  register: varlogauditmount
-  when: os_mnt_var_log_audit_enabled | bool
-
-- name: Harden permissions for /var/log/audit directory
-  file:
-    dest: /var/log/audit
-    owner: 'root'
-    group: 'root'
-    mode: '{{ os_mnt_var_log_audit_dir_mode }}'
-
-- name: Mount /var/tmp with hardened options
-  mount:
-    path: /var/tmp
-    src: '{{ os_mnt_var_tmp_src }}'
-    fstype: '{{ os_mnt_var_tmp_filesystem }}'
-    opts: '{{ os_mnt_var_tmp_options }}'
-    state: present
-  register: vartmpmount
-  when: os_mnt_var_tmp_enabled | bool
-
-- name: Harden permissions for /var/tmp directory
-  file:
-    dest: /var/tmp
-    owner: 'root'
-    group: 'root'
-    mode: '{{ os_mnt_var_tmp_dir_mode }}'
-
-- name: remount all changed mountpoints
-  mount:
-    path: "{{ item.path }}"
-    src: "{{ item.src }}"
-    fstype: "{{ item.fstype }}"
-    opts: "{{ item.opts }}"
-    state: remounted
-  when: item.when | bool
+- name: Minimize access for filesystems
+  include_tasks: minimize_access_fs.yml
   loop:
-    - { path: '/boot', src: '{{ os_mnt_boot_src }}', fstype: '{{ os_mnt_boot_filesystem }}', opts: '{{ os_mnt_boot_options }}', when: "{{ bootmount.changed }}" }
-    - { path: '/dev', src: '{{ os_mnt_dev_src }}', fstype: '{{ os_mnt_dev_filesystem }}', opts: '{{ os_mnt_dev_options }}', when: "{{ devmount.changed }}" }
-    - { path: '/dev/shm', src: '{{ os_mnt_dev_shm_src }}', fstype: '{{ os_mnt_dev_shm_filesystem }}', opts: '{{ os_mnt_dev_shm_options }}', when: "{{ devshmmount.changed }}" }
-    - { path: '/home', src: '{{ os_mnt_home_src }}', fstype: '{{ os_mnt_home_filesystem }}', opts: '{{ os_mnt_home_options }}', when: "{{ homemount.changed }}" }
-    - { path: '/run', src: '{{ os_mnt_run_src }}', fstype: '{{ os_mnt_run_filesystem }}', opts: '{{ os_mnt_run_options }}', when: "{{ runmount.changed }}" }
-    - { path: '/var', src: '{{ os_mnt_var_src }}', fstype: '{{ os_mnt_var_filesystem }}', opts: '{{ os_mnt_var_options }}', when: "{{ varmount.changed }}" }
-    - { path: '/var/log', src: '{{ os_mnt_var_log_src }}', fstype: '{{ os_mnt_var_log_filesystem }}', opts: '{{ os_mnt_var_log_options }}', when: "{{ varlogmount.changed }}" }
-    - { path: '/var/log/audit', src: '{{ os_mnt_var_log_audit_src }}', fstype: '{{ os_mnt_var_log_audit_filesystem }}', opts: '{{ os_mnt_var_log_audit_options }}', when: "{{ varlogauditmount.changed }}" }
-    - { path: '/var/tmp', src: '{{ os_mnt_var_tmp_src }}', fstype: '{{ os_mnt_var_tmp_filesystem }}', opts: '{{ os_mnt_var_tmp_options }}', when: "{{ vartmpmount.changed }}" }
+    - { path: '/boot', src: '{{ os_mnt_boot_src }}', fstype: '{{ os_mnt_boot_filesystem }}', opts: '{{ os_mnt_boot_options }}', enabled: "{{ os_mnt_boot_enabled }}", mode: "{{ os_mnt_boot_dir_mode }}", dump: "{{ os_mnt_boot_dump }}", passno: "{{ os_mnt_boot_passno }}" }
+    - { path: '/dev', src: '{{ os_mnt_dev_src }}', fstype: '{{ os_mnt_dev_filesystem }}', opts: '{{ os_mnt_dev_options }}', enabled: "{{ os_mnt_dev_enabled }}", mode: "{{ os_mnt_dev_dir_mode }}", dump: "{{ os_mnt_dev_dump }}", passno: "{{ os_mnt_dev_passno }}" }
+    - { path: '/dev/shm', src: '{{ os_mnt_dev_shm_src }}', fstype: '{{ os_mnt_dev_shm_filesystem }}', opts: '{{ os_mnt_dev_shm_options }}', enabled: "{{ os_mnt_dev_shm_enabled }}", mode: "{{ os_mnt_dev_shm_dir_mode }}", dump: "{{ os_mnt_dev_shm_dump }}", passno: "{{ os_mnt_dev_shm_passno }}" }
+    - { path: '/home', src: '{{ os_mnt_home_src }}', fstype: '{{ os_mnt_home_filesystem }}', opts: '{{ os_mnt_home_options }}', enabled: "{{ os_mnt_home_enabled }}", mode: "{{ os_mnt_home_dir_mode }}", dump: "{{ os_mnt_home_dump }}", passno: "{{ os_mnt_home_passno }}" }
+    - { path: '/run', src: '{{ os_mnt_run_src }}', fstype: '{{ os_mnt_run_filesystem }}', opts: '{{ os_mnt_run_options }}', enabled: "{{ os_mnt_run_enabled }}", mode: "{{ os_mnt_run_dir_mode }}", dump: "{{ os_mnt_run_dump }}", passno: "{{ os_mnt_run_passno }}" }
+    - { path: '/tmp', src: '{{ os_mnt_tmp_src }}', fstype: '{{ os_mnt_tmp_filesystem }}', opts: '{{ os_mnt_tmp_options }}', enabled: "{{ os_mnt_tmp_enabled }}", mode: "{{ os_mnt_tmp_dir_mode }}", dump: "{{ os_mnt_tmp_dump }}", passno: "{{ os_mnt_tmp_passno }}" }
+    - { path: '/var', src: '{{ os_mnt_var_src }}', fstype: '{{ os_mnt_var_filesystem }}', opts: '{{ os_mnt_var_options }}', enabled: "{{ os_mnt_var_enabled }}", mode: "{{ os_mnt_var_dir_mode }}", dump: "{{ os_mnt_var_dump }}", passno: "{{ os_mnt_var_passno }}" }
+    - { path: '/var/log', src: '{{ os_mnt_var_log_src }}', fstype: '{{ os_mnt_var_log_filesystem }}', opts: '{{ os_mnt_var_log_options }}', enabled: "{{ os_mnt_var_log_enabled }}", mode: "{{ os_mnt_var_log_dir_mode }}", dump: "{{ os_mnt_var_log_dump }}", passno: "{{ os_mnt_var_log_passno }}" }
+    - { path: '/var/log/audit', src: '{{ os_mnt_var_log_audit_src }}', fstype: '{{ os_mnt_var_log_audit_filesystem }}', opts: '{{ os_mnt_var_log_audit_options }}', enabled: "{{ os_mnt_var_log_audit_enabled }}", mode: "{{ os_mnt_var_log_audit_dir_mode }}", dump: "{{ os_mnt_var_log_audit_dump }}", passno: "{{ os_mnt_var_log_audit_passno }}" }
+    - { path: '/var/tmp', src: '{{ os_mnt_var_tmp_src }}', fstype: '{{ os_mnt_var_tmp_filesystem }}', opts: '{{ os_mnt_var_tmp_options }}', enabled: "{{ os_mnt_var_tmp_enabled }}", mode: "{{ os_mnt_var_tmp_dir_mode }}", dump: "{{ os_mnt_var_tmp_dump }}", passno: "{{ os_mnt_var_tmp_passno }}" }
+  loop_control:
+    loop_var: mount

roles/os_hardening/tasks/minimize_access_fs.yml

@@ -0,0 +1,36 @@
+---
+- name: "Configure mount {{ mount.path }} with hardened options"
+  mount:
+    path: "{{ mount.path }}"
+    src: "{{ mount.src | default(mountinfo.device, true) }}"
+    fstype: "{{ mount.fstype | default(mountinfo.fstype, true) }}"
+    opts: "{{ mount.opts }}"
+    dump: "{{ mount.dump | default('1' if mount.fstype | default(mountinfo.fstype, true) in ['ext3', 'ext4'] else '0', true) }}"
+    passno: "{{ mount.passno | default('2' if mount.fstype | default(mountinfo.fstype, true) in ['ext3', 'ext4'] else '0', true) }}"
+    state: present
+  register: mountpoint
+  when:
+    - mount.enabled | bool
+    - mount.path in mountpoints_list
+  vars:
+    mountinfo: "{{ ansible_mounts | selectattr('mount', 'equalto', mount.path) | list | first | default(None) }}"
+  notify: Remount filesystems
+
+- name: "Check if {{ mount.path }} exists"
+  stat:
+    path: "{{ mount.path }}"
+  register: mountpoint_exists
+
+- name: "Harden permissions for {{ mount.path }} directory"
+  file:
+    dest: "{{ mount.path }}"
+    owner: 'root'
+    group: 'root'
+    mode: "{{ mount.mode }}"
+  when:
+    - mountpoint_exists.stat.exists | bool
+
+- name: "Register changed mountpoints"
+  set_fact:
+    mountpoints_changed: "{{ mountpoints_changed | default([]) + [mount.path] }}"
+  when: mountpoint.changed  # noqa no-handler

roles/os_hardening/tasks/netrc.yml

@@ -0,0 +1,13 @@
+---
+- name: Get user accounts | os-09
+  command: "awk -F: '{print $1}' /etc/passwd"
+  changed_when: false
+  check_mode: false
+  register: users_accounts
+
+- name: Delete .netrc-files from system | os-09
+  file:
+    dest: '~{{ item }}/.netrc'
+    state: 'absent'
+  loop: '{{ users_accounts.stdout_lines | flatten | default([]) }}'
+  when: item not in os_netrc_whitelist_user

roles/os_hardening/tasks/pam.yml

@@ -17,11 +17,13 @@
   when:
     - ansible_facts.os_family != 'Archlinux'
 
-- import_tasks: pam_debian.yml
+- name: Import tasks for Debian PAM
+  import_tasks: pam_debian.yml
   when:
     - ansible_facts.os_family == 'Debian'
 
-- import_tasks: pam_rhel.yml
+- name: Import tasks for RedHat PAM
+  import_tasks: pam_rhel.yml
   when:
     - ansible_facts.os_family == 'RedHat'
 

roles/os_hardening/tasks/pam_debian.yml

@@ -22,9 +22,12 @@
     name: 'libpam-modules'
     state: 'present'
   when:
-    - os_auth_retries > 0
+    - os_auth_retries|int > 0
 
 - name: Manage tally on Debian stable
+  when:
+    - "'libpam-modules' in ansible_facts.packages"
+    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '<')"
   block:
     - name: Configure tally2
       template:
@@ -34,26 +37,26 @@
         owner: 'root'
         group: 'root'
       when:
-        - os_auth_retries > 0
+        - os_auth_retries|int > 0
 
     - name: Delete tally2 when retries is 0
       file:
         path: '{{ tally2_path }}'
         state: 'absent'
       when:
-        - os_auth_retries == 0
-  when:
-    - "'libpam-modules' in ansible_facts.packages"
-    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '<')"
+        - os_auth_retries|int == 0
 
 - name: Manage tally/faillock on Debian unstable
+  when:
+    - "'libpam-modules' in ansible_facts.packages"
+    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '>=')"
   block:
     - name: Delete tally2
       file:
         path: '{{ tally2_path }}'
         state: 'absent'
 
-    - name:  create tally directory
+    - name: Create tally directory
       file:
         path: '/var/run/faillock'
         state: 'directory'
@@ -77,7 +80,7 @@
         owner: 'root'
         group: 'root'
       when:
-        - os_auth_retries > 0
+        - os_auth_retries|int > 0
 
     - name: Configure faillock pam authfail
       template:
@@ -87,24 +90,21 @@
         owner: 'root'
         group: 'root'
       when:
-        - os_auth_retries > 0
+        - os_auth_retries|int > 0
 
     - name: Delete faillock when retries is 0
       file:
         path: '/usr/share/pam-configs/faillock'
         state: 'absent'
       when:
-        - os_auth_retries == 0
+        - os_auth_retries|int == 0
 
     - name: Delete faillock authfail when retries is 0
       file:
         path: '/usr/share/pam-configs/faillock_authfail'
         state: 'absent'
       when:
-        - os_auth_retries == 0
-  when:
-    - "'libpam-modules' in ansible_facts.packages"
-    - "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '>=')"
+        - os_auth_retries|int == 0
 
 - name: Update pam on Debian systems
   command: 'pam-auth-update --package'

roles/os_hardening/tasks/rhosts.yml

@@ -9,15 +9,9 @@
   file:
     dest: '~{{ item }}/.rhosts'
     state: 'absent'
-  with_flattened: '{{ users_accounts.stdout_lines | default([]) }}'
+  loop: '{{ users_accounts.stdout_lines | flatten | default([]) }}'
 
 - name: Delete hosts.equiv from system | os-01
   file:
     dest: '/etc/hosts.equiv'
     state: 'absent'
-
-- name: Delete .netrc-files from system | os-09
-  file:
-    dest: '~{{ item }}/.netrc'
-    state: 'absent'
-  with_flattened: '{{ users_accounts.stdout_lines | default([]) }}'

roles/os_hardening/tasks/suid_sgid.yml

@@ -6,7 +6,7 @@
     state: 'file'
     follow: 'yes'
   failed_when: false
-  with_flattened:
+  with_community.general.flattened:
     - '{{ os_security_suid_sgid_system_blacklist }}'
     - '{{ os_security_suid_sgid_blacklist }}'
 
@@ -27,6 +27,6 @@
     mode: 'a-s'
     state: 'file'
     follow: 'yes'
-  with_flattened:
+  with_community.general.flattened:
     - '{{ suid | default([]) | difference(os_security_suid_sgid_whitelist) }}'
   when: os_security_suid_sgid_remove_from_unknown | bool

roles/os_hardening/tasks/sysctl.yml

@@ -42,6 +42,7 @@
   register: initramfs
 
 - name: Change sysctls
+  when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']
   block:
     - name: Create a combined sysctl-dict if os-dependent sysctls are defined
       set_fact:
@@ -69,7 +70,6 @@
         ignoreerrors: true
       with_dict: '{{ sysctl_config }}'
       when: item.key not in sysctl_unsupported_entries | default()
-  when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']
 
 - name: Apply ufw defaults
   template:

roles/os_hardening/tasks/user_accounts.yml

@@ -1,4 +1,45 @@
 ---
+- name: Read local linux user database
+  getent:
+    database: passwd
+    # creates a dict for each user containing UID/HOMEDIR etc...
+  when: getent_passwd is undefined  # skip this task if "getent" has run before
+
+- name: Extract root account(s) from local user database
+  loop: "{{ getent_passwd.keys() | list }}"
+  when:
+    - getent_passwd[item][1]|int == 0
+  set_fact:
+    root_users: "{{ root_users | default([]) + [item] }}"
+
+- name: Set ownership of root user home directory(s) to 0700
+  file:
+    mode: 0700
+    owner: "{{ item }}"
+    path: "{{ getent_passwd[item][4] }}"
+    state: directory
+  loop: "{{ root_users }}"
+  when:
+    - os_chmod_rootuser_home_folder | bool
+
+- name: Set password ageing for root user(s)
+  user:
+    name: "{{ item }}"
+    password_expire_min: "{{ os_auth_pw_min_age }}"
+    password_expire_max: "{{ os_auth_pw_max_age }}"
+  loop: "{{ root_users }}"
+  when: os_rootuser_pw_ageing|bool
+
+- name: Remove additional users with UID=0 ("root" user is not touched)
+  user:
+    name: "{{ item }}"
+    state: absent
+  loop: "{{ root_users }}"
+  when:
+    - os_remove_additional_root_users|bool
+    - root_users|length > 1
+    - item != "root"
+
 - name: Get UID_MIN from login.defs
   shell: awk '/^\s*UID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs
   args:
@@ -25,7 +66,7 @@
   when: uid_max is not defined
 
 - name: Get all system accounts
-  command: awk -F'':'' '{ if ( $3 <= {{ uid_max|quote }} ) print $1}' /etc/passwd
+  command: awk -F'':'' '{ if ( $3 <= {{ uid_max | quote }} ) print $1}' /etc/passwd
   args:
     removes: /etc/passwd
   changed_when: false
@@ -43,10 +84,10 @@
     shell: '{{ os_nologin_shell_path }}'
     password: '*'
     createhome: false
-  with_flattened:
+  with_community.general.flattened:
     - '{{ sys_accs_cond | default([]) | difference(os_ignore_users) | list }}'
 
-- name: get all home directories in /home, but skip ignored users
+- name: Get all home directories in /home, but skip ignored users
   find:
     paths: /home/
     recurse: false
@@ -55,7 +96,7 @@
   register: home_directories
   when: os_chmod_home_folders | bool
 
-- name: set ownership of /home directories to 0700
+- name: Set ownership of /home directories to 0700
   file:
     mode: 0700
     path: "{{ item.path }}"

roles/os_hardening/templates/etc/audit/auditd.conf.j2

@@ -2,30 +2,26 @@
 # Generated by Ansible role {{ ansible_role_name }}
 
 log_file = /var/log/audit/audit.log
-log_format = RAW
-log_group = root
+log_format = {{ os_auditd_log_format }}
+log_group = {{ os_auditd_log_group }}
 priority_boost = 4
-flush = INCREMENTAL
+flush = {{ os_auditd_flush }}
 freq = 20
-num_logs = 5
+num_logs = {{ os_auditd_num_logs }}
 disp_qos = lossy
 dispatcher = /sbin/audispd
 name_format = NONE
-##name = mydomain
 max_log_file = {{ os_auditd_max_log_file }}
 max_log_file_action = {{ os_auditd_max_log_file_action }}
-space_left = 75
-space_left_action = SYSLOG
+space_left = {{ os_auditd_space_left }}
+space_left_action = {{ os_auditd_space_left_action }}
 action_mail_acct = root
-admin_space_left = 50
-admin_space_left_action = SUSPEND
-disk_full_action = SUSPEND
-disk_error_action = SUSPEND
-##tcp_listen_port =
+admin_space_left = {{ os_auditd_admin_space_left }}
+admin_space_left_action = {{ os_auditd_admin_space_left_action }}
+disk_full_action = {{ os_auditd_disk_full_action }}
+disk_error_action = {{ os_auditd_disk_error_action }}
 tcp_listen_queue = 5
 tcp_max_per_addr = 1
-##tcp_client_ports = 1024-65535
 tcp_client_max_idle = 0
 enable_krb5 = no
 krb5_principal = auditd
-##krb5_key_file = /etc/audit/audit.key

roles/os_hardening/templates/etc/pam.d/rhel_auth.j2

@@ -4,7 +4,7 @@
 #%PAM-1.0
 auth        required      pam_env.so
 auth        required      pam_faildelay.so delay=2000000
-{% if os_auth_retries > 0 %}
+{% if os_auth_retries|int > 0 %}
 auth        required      pam_faillock.so preauth silent audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
 {% endif %}
 {% if (os_auth_pam_sssd_enable | bool) %}
@@ -16,12 +16,12 @@ auth        sufficient    pam_unix.so nullok try_first_pass
 auth        [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
 auth        sufficient    pam_sss.so forward_pass
 {% endif %}
-{% if os_auth_retries > 0 %}
+{% if os_auth_retries|int > 0 %}
 auth        required      pam_faillock.so authfail audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
 {% endif %}
 auth        required      pam_deny.so
 
-{% if os_auth_retries > 0 %}
+{% if os_auth_retries|int > 0 %}
 account     required      pam_faillock.so
 {% endif %}
 account     required      pam_unix.so

roles/os_hardening/vars/RedHat.yml

@@ -33,7 +33,7 @@ os_auth_sub_gid_min: 100000
 os_auth_sub_gid_max: 600100000
 os_auth_sub_gid_count: 65536
 
-os_auth_pam_sssd_enable: false
+os_auth_pam_sssd_enable: true
 
 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail

roles/os_hardening/vars/RedHat_8.yml

@@ -1,45 +0,0 @@
----
-
-os_packages_pam_ccreds: 'pam_ccreds'
-os_nologin_shell_path: '/sbin/nologin'
-
-# Different distros use different standards for /etc/shadow perms, e.g.
-# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
-# You must provide key/value pairs for owner, group, and mode if overriding.
-os_shadow_perms:
-  owner: root
-  group: root
-  mode: '0000'
-
-os_passwd_perms:
-  owner: root
-  group: root
-  mode: '0644'
-
-os_env_umask: '077'
-
-os_auth_uid_min: 1000
-os_auth_uid_max: 60000
-os_auth_gid_min: 1000
-os_auth_gid_max: 60000
-os_auth_sys_uid_min: 201
-os_auth_sys_uid_max: 999
-os_auth_sys_gid_min: 201
-os_auth_sys_gid_max: 999
-os_auth_sub_uid_min: 100000
-os_auth_sub_uid_max: 600100000
-os_auth_sub_uid_count: 65536
-os_auth_sub_gid_min: 100000
-os_auth_sub_gid_max: 600100000
-os_auth_sub_gid_count: 65536
-
-os_auth_pam_sssd_enable: true
-
-# defaults for useradd
-os_useradd_mail_dir: /var/spool/mail
-os_useradd_create_home: true
-
-modprobe_package: 'module-init-tools'
-auditd_package: 'audit'
-
-hidepid_option: '2'  # allowed values: 0, 1, 2

roles/os_hardening/vars/Rocky_8.yml

@@ -1,45 +0,0 @@
----
-
-os_packages_pam_ccreds: 'pam_ccreds'
-os_nologin_shell_path: '/sbin/nologin'
-
-# Different distros use different standards for /etc/shadow perms, e.g.
-# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640.
-# You must provide key/value pairs for owner, group, and mode if overriding.
-os_shadow_perms:
-  owner: root
-  group: root
-  mode: '0000'
-
-os_passwd_perms:
-  owner: root
-  group: root
-  mode: '0644'
-
-os_env_umask: '077'
-
-os_auth_uid_min: 1000
-os_auth_uid_max: 60000
-os_auth_gid_min: 1000
-os_auth_gid_max: 60000
-os_auth_sys_uid_min: 201
-os_auth_sys_uid_max: 999
-os_auth_sys_gid_min: 201
-os_auth_sys_gid_max: 999
-os_auth_sub_uid_min: 100000
-os_auth_sub_uid_max: 600100000
-os_auth_sub_uid_count: 65536
-os_auth_sub_gid_min: 100000
-os_auth_sub_gid_max: 600100000
-os_auth_sub_gid_count: 65536
-
-os_auth_pam_sssd_enable: true
-
-# defaults for useradd
-os_useradd_mail_dir: /var/spool/mail
-os_useradd_create_home: true
-
-modprobe_package: 'module-init-tools'
-auditd_package: 'audit'
-
-hidepid_option: '2'  # allowed values: 0, 1, 2

roles/ssh_hardening/README.md

@@ -11,6 +11,9 @@ Warning: This role disables root-login on the target server! Please make sure yo
 ## Requirements
 
 - Ansible >= 2.9
+- root-privileges on the target system
+
+As this role requires root-privileges, we added `become: true` to all tasks. So please make sure you run the role as root or as a user with become-privileges.
 
 ## Role Variables
 
@@ -61,7 +64,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
   - Description: Disable root-login. Set to `'without-password'` or `'yes'` to enable root-login - The quotes are required!
 - `ssh_allow_tcp_forwarding`
   - Default: `no`
-  - Description: `'no'` to disable TCP Forwarding. Set to `'yes'` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all'`, `'local'`or`'remote'`. <br> _Note_: values passed to this variable must be strings, thus values `'yes'`and`'no'` should be passed with quotes.
+  - Description: `'no'` or `False` to disable TCP Forwarding. Set to `'yes'` or `True` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all'`, `'local'`or`'remote'`.
 - `ssh_gateway_ports`
   - Default: `false`
   - Description: `false` to disable binding forwarded ports to non-loopback addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified` to allow the client to specify which address to bind to.
@@ -123,8 +126,8 @@ Warning: This role disables root-login on the target server! Please make sure yo
   - Default: `false`
   - Description: false to disable display of last login information.
 - `sftp_enabled`
-  - Default: `false`
-  - Description: true to enable sftp configuration.
+  - Default: `true`
+  - Description: false to disable sftp configuration.
 - `sftp_umask`
   - Default: `'0027'`
   - Description: Specifies the umask for sftp.
@@ -269,6 +272,10 @@ Example playbook:
       - "AcceptEnv LANG"
 ```
 
+## After using the role Ansibles template/copy/file module does not work anymore
+
+If you use this role to disable SFTP (`sftp_enabled: false`) you will get errors. Ansible uses by default SFTP to transfer files to the remote hosts. You have to set `scp_if_ssh = True` in your ansible.cfg. This way Ansible uses SCP to copy files. If your control node uses OpenSSH version 9.0 or above, you also need to set `scp_extra_args = "-O"`, since starting with that version the `scp` utility also defaults to using SFTP.
+
 ## Changing the default port and idempotency
 
 This role uses the default port 22 or the port configured in the inventory to connect to the server. If the default `ssh` port is changed via `ssh_server_ports`, once the ssh server is restarted, it will still try to connect using the previous port. In order to run this role again on the same server the inventory will have to be updated to use the new ssh port.

roles/ssh_hardening/defaults/main.yml

@@ -158,8 +158,8 @@ ssh_banner_path: '/etc/ssh/banner.txt'
 # false to disable distribution version leakage during initial protocol handshake
 ssh_print_debian_banner: false      # sshd (Debian OS family only)
 
-# true to enable sftp configuration
-sftp_enabled: false
+# false to disable sftp configuration
+sftp_enabled: true
 
 # false to disable sftp chroot
 sftp_chroot: true

roles/ssh_hardening/meta/main.yml

@@ -8,21 +8,22 @@ galaxy_info:
   platforms:
     - name: EL
       versions:
-        - 7
-        - 8
+        - "7"
+        - "8"
     - name: Ubuntu
       versions:
-        - xenial
         - bionic
+        - focal
+        - jammy
     - name: Debian
       versions:
-        - stretch
         - buster
+        - bullseye
     - name: Amazon
     - name: Fedora
-    - name: Archlinux
+    - name: ArchLinux
     - name: SmartOS
-    - name: openSUSE
+    - name: opensuse
   galaxy_tags:
     - system
     - security

roles/ssh_hardening/tasks/hardening.yml

@@ -5,9 +5,9 @@
     name: 'os_vars'
   with_first_found:
     - files:
-        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version | default() }}.yml'
         - '{{ ansible_facts.distribution }}.yml'
-        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml'
+        - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version | default() }}.yml'
         - '{{ ansible_facts.os_family }}.yml'
       skip: true
   tags: always
@@ -110,7 +110,9 @@
 
 - name: Include tasks to setup ca keys and principals
   include_tasks: ca_keys_and_principals.yml
-  when: ssh_trusted_user_ca_keys_file | length > 0
+  when:
+    - ssh_trusted_user_ca_keys_file | length > 0
+    - ssh_trusted_user_ca_keys | length > 0
 
 - name: Include selinux specific tasks
   include_tasks: selinux.yml

roles/ssh_hardening/tasks/main.yml

@@ -1,3 +1,7 @@
 ---
-- include_tasks: hardening.yml
+- name: Include hardening tasks
+  include_tasks: hardening.yml
+  args:
+    apply:
+      become: true
   when: ssh_hardening_enabled | bool

roles/ssh_hardening/tasks/selinux.yml

@@ -24,7 +24,7 @@
 # The following tasks only get executed when selinux is in state enforcing,
 # UsePam is 'no' and the ssh_password module is not installed. See this issue for
 # more info: https://github.com/hardening-io/ansible-ssh-hardening/issues/23
-- name: run selinux tasks
+- name: Run selinux tasks
   when:
     - not (ssh_use_pam | bool)
     - ('ssh_password' not in ssh_password_module.stdout)

roles/ssh_hardening/templates/openssh.conf.j2

@@ -106,10 +106,13 @@ RSAAuthentication yes
 # Disable password-based authentication, it can allow for potentially easier brute-force attacks.
 PasswordAuthentication {{ 'yes' if ssh_client_password_login else 'no' }}
 
+{# OpenBSD does not support GSSAPIAuthentication, so leave this out if on OpenBSD #}
+{% if ansible_facts.os_family != 'OpenBSD' %}
 # Only use GSSAPIAuthentication if implemented on the network.
 GSSAPIAuthentication {{ 'yes' if (ssh_gssapi_support|bool) else 'no' }}
 GSSAPIDelegateCredentials {{ 'yes' if (ssh_gssapi_delegation|bool) else 'no' }}
 
+{% endif %}
 # Disable tunneling
 Tunnel no
 

roles/ssh_hardening/templates/opensshd.conf.j2

@@ -143,10 +143,13 @@ KerberosTicketCleanup yes
 #KerberosGetAFSToken no
 {% endif %}
 
+{# OpenBSD does not support GSSAPIAuthentication, so leave this out if on OpenBSD #}
+{% if ansible_facts.os_family != 'OpenBSD' -%}
 # Only enable GSSAPI authentication if it is configured.
 GSSAPIAuthentication {{ 'yes' if ssh_gssapi_support else 'no' }}
 GSSAPICleanupCredentials yes
 
+{% endif %}
 {% if ssh_deny_users %}
 # In case you don't use PAM (`UsePAM no`), you can alternatively restrict users and groups here.
 # For key-based authentication this is not necessary, since all keys must be explicitely enabled.
@@ -194,9 +197,9 @@ PermitTunnel {{ 'yes' if (ssh_permit_tunnel|bool) else 'no' }}
 # Disable forwarding tcp connections.
 # no real advantage without denied shell access
 {% if sshd_version is version('6.2', '>=') %}
-AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no', 'local', 'all', 'remote')) else 'no' }}
+AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no', 'local', 'all', 'remote')) else ('yes' if (ssh_allow_tcp_forwarding|bool) else 'no') }}
 {% else %}
-AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no')) else 'no' }}
+AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no')) else ('yes' if (ssh_allow_tcp_forwarding|bool) else 'no') }}
 {% endif %}
 
 # Disable agent forwarding, since local agent could be accessed through forwarded connection.

roles/ssh_hardening/vars/RedHat.yml

@@ -7,7 +7,7 @@ ssh_group: root
 ssh_host_keys_owner: 'root'
 ssh_host_keys_group: 'ssh_keys'
 ssh_selinux_packages:
-  - policycoreutils-python
+  - policycoreutils-python-utils
   - checkpolicy
 
 # true if SSH support Kerberos

roles/ssh_hardening/vars/RedHat_7.yml

@@ -7,7 +7,7 @@ ssh_group: root
 ssh_host_keys_owner: 'root'
 ssh_host_keys_group: 'ssh_keys'
 ssh_selinux_packages:
-  - python3-policycoreutils
+  - policycoreutils-python
   - checkpolicy
 
 # true if SSH support Kerberos

roles/ssh_hardening/vars/RedHat_8.yml

@@ -1,23 +0,0 @@
----
-sshd_path: /usr/sbin/sshd
-ssh_host_keys_dir: '/etc/ssh'
-sshd_service_name: sshd
-ssh_owner: root
-ssh_group: root
-ssh_host_keys_owner: 'root'
-ssh_host_keys_group: 'ssh_keys'
-ssh_selinux_packages:
-  - python3-policycoreutils
-  - checkpolicy
-
-# true if SSH support Kerberos
-ssh_kerberos_support: true
-
-# true if SSH has PAM support
-ssh_pam_support: true
-
-sshd_moduli_file: '/etc/ssh/moduli'
-
-# disable CRYPTO_POLICY to take settings from sshd configuration
-# see: https://access.redhat.com/solutions/4410591
-sshd_disable_crypto_policy: true