enable debian12 for vm tests

Signed-off-by: Sebastian Gumprich <[email protected]>

.aar_doc.yml

@@ -1,51 +0,0 @@
-output_template: |
-  <!-- BEGIN_ANSIBLE_DOCS -->
-
-  ## Supported Operating Systems
-
-  {%- for platform in metadata.galaxy_info.platforms %}
-  - {{ platform.name }}
-    {%- if "versions" in platform %}
-    - {{ platform.versions | default([]) | join(', ') }}
-    {%- endif %}
-  {%- endfor %}
-
-  ## Role Variables
-  {% for entrypoint in argument_specs.keys() %}
-  {%- set path, options=entrypoint_options[entrypoint][0] -%}
-  {%- for name, details in options.items() |sort() %}
-  - `{{ name }}`
-    - Default: `{{ details.display_default }}`
-    - Description: {{ details.display_description }}
-    - Type: {{ details.display_type }}
-    - Required: {{ details.display_required }}
-    {%- if details.choices %}
-    - Choices:
-      {%- for choice in details.choices %}
-      - {{ choice }}
-      {%- endfor %}
-    {%- endif %}
-  {%- endfor %}
-  {%- endfor %}
-
-  ## Dependencies
-
-  {%- if ("dependencies" in metadata) and (metadata.dependencies | length > 0) %}
-  {%- for dependency in metadata.dependencies %}
-  - {{ dependency }}
-  {%- endfor %}
-  {%- else %}
-
-  None.
-  {%- endif %}
-
-  ## Example Playbook
-
-  ```
-  - hosts: all
-    become: true
-    roles:
-      - name: {{ role }}
-  ```
-
-  <!-- END_ANSIBLE_DOCS -->

.config/ansible-lint.yml

@@ -5,10 +5,9 @@
 # option will be parsed relative to the CWD of execution.
 exclude_paths:
   - .cache/ # implicit unless exclude_paths is defined in config
-  - .ansible/ # somehow someone decided that the cache directory should be renamed
-  # add all waivers individually, since exclude_files does not support globs
-  - molecule/os_hardening/waivers.yaml
-  - molecule/ssh_hardening_vm/waivers_*.yaml
+  - .yamllint
+  - ../molecule/
+  - ../.github/
 
 mock_roles:
   - geerlingguy.git
@@ -16,4 +15,3 @@ mock_roles:
 
 skip_list:
   - var-naming[no-role-prefix]
-  - meta-runtime[unsupported-version]

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -31,7 +31,7 @@ body:
     attributes:
       label: "Reproduction steps"
       render: Shell
-      description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, no need for backticks.
+      description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, so no need for backticks.
       value: |
         ...
     validations:

.github/labeler.yml

@@ -1,30 +1,22 @@
 ---
 mysql_hardening:
-  - changed-files:
-      - any-glob-to-any-file:
-          - roles/mysql_hardening/**
-          - molecule/mysql_hardening/**
-          - .github/workflows/mysql_hardening.yml
+  - 'roles/mysql_hardening/**'
+  - 'molecule/mysql_hardening/**'
+  - '.github/workflows/mysql_hardening.yml'
 
 os_hardening:
-  - changed-files:
-      - any-glob-to-any-file:
-          - roles/os_hardening/**
-          - molecule/os_hardening/**
-          - .github/workflows/os_hardening.yml
+  - 'roles/os_hardening/**'
+  - 'molecule/os_hardening/**'
+  - '.github/workflows/os_hardening.yml'
 
 ssh_hardening:
-  - changed-files:
-      - any-glob-to-any-file:
-          - roles/ssh_hardening/**
-          - molecule/ssh_hardening/**
-          - molecule/ssh_hardening_custom_tests/**
-          - .github/workflows/ssh_hardening.yml
-          - .github/workflows/ssh_hardening_custom_tests.yml
+  - 'roles/ssh_hardening/**'
+  - 'molecule/ssh_hardening/**'
+  - 'molecule/ssh_hardening_custom_tests/**'
+  - '.github/workflows/ssh_hardening.yml'
+  - '.github/workflows/ssh_hardening_custom_tests.yml'
 
 nginx_hardening:
-  - changed-files:
-      - any-glob-to-any-file:
-          - roles/nginx_hardening/**
-          - molecule/nginx_hardening/**
-          - .github/workflows/nginx_hardening.yml
+  - 'roles/nginx_hardening/**'
+  - 'molecule/nginx_hardening/**'
+  - '.github/workflows/nginx_hardening.yml'

.github/version-drafter.yml

@@ -1,3 +0,0 @@
-major-labels: ['major']
-minor-labels: ['minor', 'enhancement']
-patch-labels: ['patch', 'bug']

.github/workflows/ansible-lint.yml

@@ -7,26 +7,22 @@ on:  # yamllint disable-line rule:truthy
     branches: [master]
     paths:
       - 'roles/**'
-      - 'molecule/**'
-      - 'requirements.txt'
-      - '.github/workflows/ansible-lint.yml'
-      - '.config/ansible-lint.yml'
   pull_request:
     # The branches below must be a subset of the branches above
     branches: [master]
     paths:
       - 'roles/**'
-      - 'molecule/**'
-      - 'requirements.txt'
-      - '.github/workflows/ansible-lint.yml'
-      - '.config/ansible-lint.yml'
 
 jobs:
   ansible-lint:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      # Important: This sets up your GITHUB_WORKSPACE environment variable
+      - uses: actions/checkout@v3
 
       - name: Lint Ansible Playbook
-        uses: ansible/ansible-lint@5fac056c45595896c973fbde871f01f6cb14d74c # v26
+        # replace "master" with any valid ref
+        uses: ansible/ansible-lint-action@main
+        with:
+          path: "roles/"

.github/workflows/codespell.yml

@@ -9,6 +9,6 @@ on:  # yamllint disable-line rule:truthy
 
 jobs:
   codespell:
-    uses: "dev-sec/.github/.github/workflows/codespell.yml@2cd00282cfdb322243d879a96d9494ce64e76119" # main
+    uses: "dev-sec/.github/.github/workflows/codespell.yml@main"
     with:
-      ignore_words_list: "chage,BOOTUP"
+      ignore_words_list: "chage"

.github/workflows/enforce-labels.yml

@@ -4,16 +4,11 @@ name: "Enforce PR labels"
 on:  # yamllint disable-line rule:truthy
   pull_request_target:
     types: [labeled, unlabeled, opened, edited, synchronize]
-
-permissions:
-  contents: read # to read configuration file
-  pull-requests: write # to label PRs
-
 jobs:
   enforce-label:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+      - uses: actions/labeler@main
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/galaxy.yml

@@ -4,37 +4,37 @@ name: Publish collection to Ansible Galaxy
 on:  # yamllint disable-line rule:truthy
   release:
     types:
-      - released
+      - published
 
 jobs:
   deploy:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v3
 
       # deploy the collection first, because if it fails, we don't want
       # to update the galaxy.yml
       - name: Deploy the collection
-        uses: artis3n/ansible_galaxy_collection@ffbca2460a5a1c600b941bbf1536bd61de1c2227 # v3
+        uses: artis3n/ansible_galaxy_collection@v2
         with:
           api_key: ${{ secrets.GALAXY_API_KEY }}
           galaxy_version: ${{ github.event.release.tag_name }}
 
       # checkout master instead of the release-tag so we can push the galaxy.yml
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v3
         with:
           ref: master
 
       - name: update galaxy.yml with new version
-        uses: microsoft/variable-substitution@6287962da9e5b6e68778dc51e840caa03ca84495 # v1
+        uses: microsoft/variable-substitution@v1
         with:
           files: 'galaxy.yml'
         env:
           version: "${{ github.event.release.tag_name }}"
 
       - name: push galaxy.yml
-        uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
+        uses: github-actions-x/[email protected]
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           push-branch: 'master'

.github/workflows/mysql_hardening.yml

@@ -9,14 +9,12 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/mysql_hardening/**'
       - 'molecule/mysql_hardening/**'
       - '.github/workflows/mysql_hardening.yml'
-      - 'requirements.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/mysql_hardening/**'
       - 'molecule/mysql_hardening/**'
       - '.github/workflows/mysql_hardening.yml'
-      - 'requirements.txt'
   schedule:
     - cron: '0 6 * * 0'
 
@@ -29,7 +27,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -37,47 +35,39 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
-          - almalinux8
-          - almalinux9
-          # - almalinux10  # problem with baseline
+          - centos7
+          - centosstream8
           - centosstream9
           - rocky8
           - rocky9
-          # - rocky10 # problem with baseline
+          - ubuntu1804
+          - ubuntu2004
           - ubuntu2204
-          - ubuntu2404
-          # - ubuntu2604 # problem with test setup
+          - debian10
           - debian11
           - debian12
-          - debian13
           # - amazon  # geerlingguy.mysql does not support fedora
           # - arch  # geerlingguy.mysql does not support arch
           - opensuse_tumbleweed
           # - fedora  # geerlingguy.mysql does not support fedora
     steps:
       - name: Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v4
         with:
-          python-version: 3.13
-          cache: 'pip'
+          python-version: 3.11
 
       - name: Install dependencies
-        run: pip install -r requirements.txt
-        working-directory: ansible_collections/devsec/hardening
-
-      - name: Downgrade Ansible for Rocky 8 tests
         run: |
-            pip install "ansible-core<2.17"
-            ansible-galaxy collection install 'community.crypto:<3.0.0'
-            ansible-galaxy collection install 'community.general:<12.0.0'
+          sudo apt install git
+          python -m pip install --no-cache-dir --upgrade pip
+          pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
 
       # that was a hard one to fix. robert did it thankfully
       # https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212
@@ -89,19 +79,10 @@ jobs:
             sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld
         if: ${{ startsWith(matrix.molecule_distro, 'Debian') }}
 
-      # Molecule has problems detecting the proper location for installing roles
-      # https://github.com/ansible/molecule/issues/3806
-      # we do not set a custom role path, but the automatically determined install path used is not compatible with the location molecule expects the role
-      # see CI logs of this action "INFO     Set ANSIBLE_ROLES_PATH" should not be present, since we do not set a custom path
-      # we have to find a proper way to configure this
-      - name: Temporary fix for roles
-        run: |
-          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles \
-            /home/runner/.ansible/roles
-
       - name: Test with molecule
-        run: molecule test -s mysql_hardening
+        run: |
+          molecule --version
+          molecule test -s mysql_hardening
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
         working-directory: ansible_collections/devsec/hardening

.github/workflows/nginx_hardening.yml

@@ -8,14 +8,12 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/nginx_hardening/**'
       - 'molecule/nginx_hardening/**'
       - '.github/workflows/nginx_hardening.yml'
-      - 'requirements.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/nginx_hardening/**'
       - 'molecule/nginx_hardening/**'
       - '.github/workflows/nginx_hardening.yml'
-      - 'requirements.txt'
   schedule:
     - cron: '0 6 * * 1'
 
@@ -28,7 +26,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -36,61 +34,44 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
-          - almalinux8
-          - almalinux9
-          - almalinux10
+          - centos7
+          - centosstream8
           - centosstream9
           - rocky8
           - rocky9
-          - rocky10
+          - ubuntu1804
+          - ubuntu2004
           - ubuntu2204
-          - ubuntu2404
-          - ubuntu2604
+          - debian10
           - debian11
           - debian12
-          - debian13
           - amazon2023
           # - arch  # needs to be fixed
           # - opensuse_tumbleweed  # needs to be fixed
           # - fedora  # no support from geerlingguy role
     steps:
       - name: Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v4
         with:
-          python-version: 3.13
-          cache: 'pip'
+          python-version: 3.11
 
       - name: Install dependencies
-        run: pip install -r requirements.txt
-        working-directory: ansible_collections/devsec/hardening
-
-      - name: Downgrade Ansible for Rocky 8 tests
         run: |
-            pip install "ansible-core<2.17"
-            ansible-galaxy collection install 'community.crypto:<3.0.0'
-            ansible-galaxy collection install 'community.general:<12.0.0'
+          sudo apt install git
+          python -m pip install --no-cache-dir --upgrade pip
+          pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
-
-      # Molecule has problems detecting the proper location for installing roles
-      # https://github.com/ansible/molecule/issues/3806
-      # we do not set a custom role path, but the automatically determined install path used is not compatible with the location molecule expects the role
-      # see CI logs of this action "INFO     Set ANSIBLE_ROLES_PATH" should not be present, since we do not set a custom path
-      # we have to find a proper way to configure this
-      - name: Temporary fix for roles
-        run: |
-          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles \
-            /home/runner/.ansible/roles
 
       - name: Test with molecule
-        run: molecule test -s nginx_hardening
+        run: |
+          molecule --version
+          molecule test -s nginx_hardening
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
         working-directory: ansible_collections/devsec/hardening

.github/workflows/os_hardening.yml

@@ -8,14 +8,12 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening/**'
       - '.github/workflows/os_hardening.yml'
-      - 'requirements.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening/**'
       - '.github/workflows/os_hardening.yml'
-      - 'requirements.txt'
   schedule:
     - cron: '0 6 * * 3'
 
@@ -28,65 +26,56 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - molecule_distro: opensuse_tumbleweed
-            molecule_docker_command: "/usr/lib/systemd/systemd"
         molecule_distro:
-          - almalinux8
-          - almalinux9
-          - almalinux10
+          - centos7
+          - centosstream8
           - centosstream9
           - rocky8
           - rocky9
-          - rocky10
-          - fedora42
-          - fedora43
-          - fedora44
+          - fedora37
+          - fedora38
+          - ubuntu1804
+          - ubuntu2004
           - ubuntu2204
-          - ubuntu2404
-          - ubuntu2604
+          - debian10
           - debian11
           - debian12
-          - debian13
           - amazon2023
+          - opensuse_tumbleweed
           - arch
-        molecule_docker_command:
-          - "/lib/systemd/systemd"
     steps:
       - name: Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v4
         with:
-          python-version: 3.13
-          cache: 'pip'
+          python-version: 3.11
 
       - name: Install dependencies
-        run: pip install -r requirements.txt
-        working-directory: ansible_collections/devsec/hardening
-
-      - name: Downgrade Ansible for Rocky 8 tests
         run: |
-            pip install "ansible-core<2.17"
-            ansible-galaxy collection install 'community.crypto:<3.0.0'
-            ansible-galaxy collection install 'community.general:<12.0.0'
+          sudo apt install git
+          python -m pip install --no-cache-dir --upgrade pip
+          pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
 
       - name: Test with molecule
-        run: molecule test -s os_hardening
+        run: |
+          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
+            export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
+          fi
+          molecule --version
+          molecule test -s os_hardening
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
-          MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
         working-directory: ansible_collections/devsec/hardening

.github/workflows/os_hardening_vm.yml

@@ -8,16 +8,12 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening_vm/**'
       - '.github/workflows/os_hardening_vm.yml'
-      - 'requirements.txt'
-      - 'requirements-vm.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening_vm/**'
       - '.github/workflows/os_hardening_vm.yml'
-      - 'requirements.txt'
-      - 'requirements-vm.txt'
   schedule:
     - cron: '0 6 * * 2'
 
@@ -38,58 +34,31 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
-          - almalinux/8
-          - almalinux/9
-          # - almalinux/10  # boot loop
-          - generic/centos9s
-          - generic/rocky8
-          - generic/rocky9
-          - alvistack/fedora-42
-          # - alvistack/fedora-43 # no compatible test image
-          - generic/ubuntu2204
-          - alvistack/ubuntu-24.04
-          # - alvistack/ubuntu-26.04 # no compatible test image
-          - generic/debian11
-          - generic/debian12
-          - cloud-image/debian-13
-          - generic/opensuse15
-          - generic/arch
+          - centos7
+          - centos8s
+          - centos9s
+          - rocky8
+          - rocky9
+          - fedora37
+          - fedora38
+          - ubuntu1804
+          - ubuntu2004
+          - ubuntu2204
+          - debian10
+          - debian11
+          - debian12
+          - opensuse15
+          # - arch  # needs fix for audit
     steps:
       - name: Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Install dependencies
-        run: |
-          source ~/.venv/ansible-collection-hardening/bin/activate
-          python -m pip install --no-cache-dir --upgrade pip
-          pip install -r requirements.txt
-          pip install -r requirements-vm.txt
-        working-directory: ansible_collections/devsec/hardening
-
-      - name: Downgrade Ansible for Rocky 8 tests
-        run: |
-          source ~/.venv/ansible-collection-hardening/bin/activate
-          pip install "ansible-core<2.17"
-          ansible-galaxy collection install 'community.crypto:<3.0.0'
-          ansible-galaxy collection install 'community.general:<12.0.0'
-        working-directory: ansible_collections/devsec/hardening
-        if: >
-          matrix.molecule_distro == 'generic/rocky8' ||
-          matrix.molecule_distro == 'almalinux/8' ||
-          matrix.molecule_distro == 'generic/opensuse15'
-
-      - name: Update Vagrant Box
-        run: |
-          vagrant box update --box ${{ matrix.molecule_distro }} || true
-
       - name: Test with molecule
         run: |
-          source ~/.venv/ansible-collection-hardening/bin/activate
-          # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
-          export MOLECULE_VAGRANT_PLUGIN_DIR=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')/molecule_plugins/vagrant
+          molecule --version
           molecule test -s os_hardening_vm
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}

.github/workflows/prettier-md.yml

@@ -11,16 +11,16 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   prettier-md:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     timeout-minutes: 1
 
     steps:
       - name: Git checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v3
         with:
           ref: ${{ github.head_ref }}
 
       - name: Prettify code
-        uses: creyD/prettier_action@8c18391fdc98ed0d884c6345f03975edac71b8f0 # v4.6
+        uses: creyD/prettier_action@v4.3
         with:
           prettier_options: --write {**/*,*}.md

.github/workflows/release.yml

@@ -11,38 +11,38 @@ jobs:
   generate_changelog:
     name: create release draft
     if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v3
         with:
           fetch-depth: 0
           ref: master
 
       - name: 'Get Previous tag'
         id: previoustag
-        uses: "WyriHaximus/github-action-get-previous-tag@61819f33034117e6c686e6a31dba995a85afc9de" # master
+        uses: "WyriHaximus/github-action-get-previous-tag@master"
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
 
       - name: calculate next version
         id: version
-        uses: patrickjahns/version-drafter-action@2076fa43abb28f31d0e8b0890253fbd1d1a966fc # v1
+        uses: patrickjahns/version-drafter-action@v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Generate changelog
-        uses: charmixer/auto-changelog-action@b25e89c9410e03189f0d48b02b3a8caad6e78015 # v1
+        uses: charmixer/auto-changelog-action@v1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           future_release: ${{ steps.version.outputs.next-version }}
           # this excludes all versions prior to the collection-release
           # since they break the changelog generation with the error:
           # "No common ancestor between ... and $version"
-          exclude_tags_regex: '^[0-6]\.\d\.\d'
+          exclude_tags_regex: '[0-6]\.\d\.\d'
           issue_line_labels: mysql_hardening,os_hardening,ssh_hardening,nginx_hardening
 
       - name: push changelog
-        uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
+        uses: github-actions-x/[email protected]
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           push-branch: 'master'
@@ -58,18 +58,18 @@ jobs:
 
       - name: Read CHANGELOG.md
         id: package
-        uses: juliangruber/read-file-action@271ff311a4947af354c6abcd696a306553b9ec18 # v1
+        uses: juliangruber/read-file-action@v1
         with:
           path: ./CHANGELOGRELEASE.md
 
       - name: Delete old drafts
-        uses: hugo19941994/delete-draft-releases@3f19a25abf2ce87850c2268938f98f14e4d3d1f1 # v3.0.0
+        uses: hugo19941994/delete-draft-releases@v1.0.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Create Release draft
         id: create_release
-        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1
+        uses: actions/create-release@v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # This token is provided by Actions, you do not need to create your own token
         with:

.github/workflows/roles-readme.yml

@@ -1,56 +0,0 @@
----
-name: create roles readme
-
-on:  # yamllint disable-line rule:truthy
-  push:
-    branches: [master]
-    paths:
-      - 'roles/**/meta/argument_specs.yml'
-      - 'roles/**/meta/main.yml'
-  pull_request:
-    branches: [master]
-    paths:
-      - 'roles/**/meta/argument_specs.yml'
-      - 'roles/**/meta/main.yml'
-      - 'requirements.txt'
-
-jobs:
-  readme:
-    name: create roles readme
-    runs-on: ubuntu-22.04
-    strategy:
-      matrix:
-        roles:
-          - mysql_hardening
-          - nginx_hardening
-          - os_hardening
-          - ssh_hardening
-    steps:
-      - name: Check out code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
-        with:
-          python-version: 3.13
-          cache: 'pip'
-
-      - name: Install dependencies
-        run: pip install -r requirements.txt
-
-      - name: Run aar-doc
-        run: aar-doc roles/${{ matrix.roles }} markdown
-
-      - name: Output diff
-        run: git diff roles/${{ matrix.roles }}/README.md
-
-      - name: Push README
-        if: github.event_name != 'pull_request'
-        uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: 'update ${{ matrix.roles }} readme'
-          files: roles/${{ matrix.roles }}/README.md
-          rebase: true
-          name: dev-sec CI
-          email: [email protected]

.github/workflows/ssh_hardening.yml

@@ -8,14 +8,12 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening/**'
       - '.github/workflows/ssh_hardening.yml'
-      - 'requirements.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening/**'
       - '.github/workflows/ssh_hardening.yml'
-      - 'requirements.txt'
   schedule:
     - cron: '0 6 * * 5'
 
@@ -28,68 +26,56 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
     strategy:
       fail-fast: false
       matrix:
-        include:
-          # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
-          # - molecule_distro: opensuse_tumbleweed
-          #   molecule_docker_command: "/usr/lib/systemd/systemd"
-          - molecule_distro: alpine
-            molecule_docker_command: "/sbin/init"
         molecule_distro:
-          - almalinux8
-          - almalinux9
-          - almalinux10
+          - centos7
+          - centosstream8
           - centosstream9
           - rocky8
           - rocky9
-          - rocky10
-          - fedora42
-          - fedora43
-          - fedora44
+          - fedora37
+          - fedora38
+          - ubuntu1804
+          - ubuntu2004
           - ubuntu2204
-          - ubuntu2404
-          - ubuntu2604
+          - debian10
           - debian11
           - debian12
-          - debian13
           - amazon2023
           - arch
-        molecule_docker_command:
-          - "/lib/systemd/systemd"
+          # - opensuse_tumbleweed  # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
     steps:
       - name: Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v4
         with:
-          python-version: 3.13
-          cache: 'pip'
+          python-version: 3.11
 
       - name: Install dependencies
-        run: pip install -r requirements.txt
-        working-directory: ansible_collections/devsec/hardening
-
-      - name: Downgrade Ansible for Rocky 8 tests
         run: |
-            pip install "ansible-core<2.17"
-            ansible-galaxy collection install 'community.crypto:<3.0.0'
-            ansible-galaxy collection install 'community.general:<12.0.0'
+          sudo apt install git
+          python -m pip install --no-cache-dir --upgrade pip
+          pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
 
       - name: Test with molecule
-        run: molecule test -s ssh_hardening
+        run: |
+          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
+            export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
+          fi
+          molecule --version
+          molecule test -s ssh_hardening
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
-          MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
         working-directory: ansible_collections/devsec/hardening

.github/workflows/ssh_hardening_bsd.yml

@@ -0,0 +1,52 @@
+---
+name: "devsec.ssh_hardening BSD"
+on:  # yamllint disable-line rule:truthy
+  workflow_dispatch:
+  push:
+    branches: [master]
+    paths:
+      - 'roles/ssh_hardening/**'
+      - 'molecule/ssh_hardening_bsd/**'
+      - '.github/workflows/ssh_hardening_bsd.yml'
+  pull_request:
+    branches: [master]
+    paths:
+      - 'roles/ssh_hardening/**'
+      - 'molecule/ssh_hardening_bsd/**'
+      - '.github/workflows/ssh_hardening_bsd.yml'
+  schedule:
+    - cron: '0 6 * * 5'
+
+concurrency:
+  group: >-
+    ${{ github.workflow }}-${{
+      github.event.pull_request.number || github.sha
+    }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: self-hosted
+    env:
+      PY_COLORS: 1
+      ANSIBLE_FORCE_COLOR: 1
+    strategy:
+      fail-fast: false
+      matrix:
+        molecule_distro:
+          - openbsd7
+          - freebsd12
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+        with:
+          path: ansible_collections/devsec/hardening
+          submodules: true
+
+      - name: Test with molecule
+        run: |
+          molecule --version
+          molecule test -s ssh_hardening_bsd
+        env:
+          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
+        working-directory: ansible_collections/devsec/hardening

.github/workflows/ssh_hardening_custom_tests.yml

@@ -8,14 +8,12 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening_custom_tests/**'
       - '.github/workflows/ssh_hardening_custom_tests.yml'
-      - 'requirements.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening_custom_tests/**'
       - '.github/workflows/ssh_hardening_custom_tests.yml'
-      - 'requirements.txt'
   schedule:
     - cron: '0 6 * * 4'
 
@@ -28,68 +26,56 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
     strategy:
       fail-fast: false
       matrix:
-        include:
-          # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
-          # - molecule_distro: opensuse_tumbleweed
-          #   molecule_docker_command: "/usr/lib/systemd/systemd"
-          - molecule_distro: alpine
-            molecule_docker_command: "/sbin/init"
         molecule_distro:
-          - almalinux8
-          - almalinux9
-          - almalinux10
+          - centos7
+          - centosstream8
           - centosstream9
           - rocky8
           - rocky9
-          - rocky10
-          - fedora42
-          - fedora43
-          - fedora44
+          - fedora37
+          - fedora38
+          - ubuntu1804
+          - ubuntu2004
           - ubuntu2204
-          - ubuntu2404
-          - ubuntu2604
+          - debian10
           - debian11
           - debian12
-          - debian13
           - amazon2023
           - arch
-        molecule_docker_command:
-          - "/lib/systemd/systemd"
+          # - opensuse_tumbleweed  # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
     steps:
       - name: Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v3
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v4
         with:
-          python-version: 3.13
-          cache: 'pip'
+          python-version: 3.11
 
       - name: Install dependencies
-        run: pip install -r requirements.txt
-        working-directory: ansible_collections/devsec/hardening
-
-      - name: Downgrade Ansible for Rocky 8 tests
         run: |
-            pip install "ansible-core<2.17"
-            ansible-galaxy collection install 'community.crypto:<3.0.0'
-            ansible-galaxy collection install 'community.general:<12.0.0'
+          sudo apt install git
+          python -m pip install --no-cache-dir --upgrade pip
+          pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'
 
       - name: Test with molecule
-        run: molecule test -s ssh_hardening_custom_tests
+        run: |
+          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
+            export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
+          fi
+          molecule --version
+          molecule converge -s ssh_hardening_custom_tests
         env:
           MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
-          MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
         working-directory: ansible_collections/devsec/hardening

.github/workflows/ssh_hardening_vm.yml

@@ -1,73 +0,0 @@
----
-name: "devsec.ssh_hardening VM"
-on:  # yamllint disable-line rule:truthy
-  workflow_dispatch:
-  push:
-    branches: [master]
-    paths:
-      - 'roles/ssh_hardening/**'
-      - 'molecule/ssh_hardening_vm/**'
-      - '.github/workflows/ssh_hardening_vm.yml'
-      - 'requirements.txt'
-      - 'requirements-vm.txt'
-  pull_request:
-    branches: [master]
-    paths:
-      - 'roles/ssh_hardening/**'
-      - 'molecule/ssh_hardening_vm/**'
-      - '.github/workflows/ssh_hardening_vm.yml'
-      - 'requirements.txt'
-      - 'requirements-vm.txt'
-  schedule:
-    - cron: '0 6 * * 5'
-
-concurrency:
-  group: >-
-    ${{ github.workflow }}-${{
-      github.event.pull_request.number || github.sha
-    }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    runs-on: self-hosted
-    env:
-      PY_COLORS: 1
-      ANSIBLE_FORCE_COLOR: 1
-    strategy:
-      fail-fast: false
-      matrix:
-        molecule_distro:
-          - generic/openbsd7
-          - generic/freebsd14
-          - cloud-image/debian-13
-          - cloud-image/ubuntu-24.04
-          - cloud-image/ubuntu-26.04
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          path: ansible_collections/devsec/hardening
-          submodules: true
-
-      - name: Install dependencies
-        run: |
-          source ~/.venv/ansible-collection-hardening/bin/activate
-          python -m pip install --no-cache-dir --upgrade pip
-          pip install -r requirements.txt
-          pip install -r requirements-vm.txt
-        working-directory: ansible_collections/devsec/hardening
-
-      - name: Update Vagrant Box
-        run: |
-          vagrant box update --box ${{ matrix.molecule_distro }} || true
-
-      - name: Test with molecule
-        run: |
-          source ~/.venv/ansible-collection-hardening/bin/activate
-          # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
-          export MOLECULE_VAGRANT_PLUGIN_DIR=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')/molecule_plugins/vagrant
-          molecule test -s ssh_hardening_vm
-        env:
-          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
-        working-directory: ansible_collections/devsec/hardening

CHANGELOG.md

@@ -1,386 +1,22 @@
 # Changelog
 
-## [10.6.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.6.0) (2026-05-13)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.2...10.6.0)
-
-**Implemented enhancements:**
-
-- Update APT package cache before installing any package in case freshly installed system. [\#945](https://github.com/dev-sec/ansible-collection-hardening/issues/945)
-- Update supported OS versions to current Fedora \(42/43/44\) and Ubuntu \(22.04/24.04/26.04\) [\#946](https://github.com/dev-sec/ansible-collection-hardening/pull/946) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-
-**Merged pull requests:**
-
-- Update actions/labeler action to v6.1.0 [\#947](https://github.com/dev-sec/ansible-collection-hardening/pull/947) ([renovate[bot]](https://github.com/apps/renovate))
-- Update dev-sec/.github digest to 2cd0028 [\#943](https://github.com/dev-sec/ansible-collection-hardening/pull/943) ([renovate[bot]](https://github.com/apps/renovate))
-- Update ansible/ansible-lint digest to 5fac056 [\#942](https://github.com/dev-sec/ansible-collection-hardening/pull/942) ([renovate[bot]](https://github.com/apps/renovate))
-- Update dependency molecule to v26 [\#935](https://github.com/dev-sec/ansible-collection-hardening/pull/935) ([renovate[bot]](https://github.com/apps/renovate))
-- Update dependency ansible-core to v2.20.5 [\#910](https://github.com/dev-sec/ansible-collection-hardening/pull/910) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-
-## [10.5.2](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.2) (2026-03-28)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.1...10.5.2)
-
-**Fixed bugs:**
-
-- do not update apt cache when installing libpam-passwdqc [\#939](https://github.com/dev-sec/ansible-collection-hardening/pull/939) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([eikesauer](https://github.com/eikesauer))
-
-**Merged pull requests:**
-
-- chore\(deps\): update hugo19941994/delete-draft-releases action to v3 [\#940](https://github.com/dev-sec/ansible-collection-hardening/pull/940) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): pin dependencies [\#938](https://github.com/dev-sec/ansible-collection-hardening/pull/938) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/checkout digest to de0fac2 [\#932](https://github.com/dev-sec/ansible-collection-hardening/pull/932) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-
-## [10.5.1](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.1) (2026-03-20)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.5.0...10.5.1)
-
-**Fixed bugs:**
-
-- fix flaky failures on Ubuntu 24.04 and newer by disabling sshd socket activation first [\#931](https://github.com/dev-sec/ansible-collection-hardening/pull/931) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([kuglimon](https://github.com/kuglimon))
-
-**Closed issues:**
-
-- SSH issue after running devsec.hardening.ssh\_hardening role [\#854](https://github.com/dev-sec/ansible-collection-hardening/issues/854)
-
-**Merged pull requests:**
-
-- chore\(deps\): update juliangruber/read-file-action digest to 271ff31 [\#937](https://github.com/dev-sec/ansible-collection-hardening/pull/937) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 8ba9595 [\#934](https://github.com/dev-sec/ansible-collection-hardening/pull/934) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update artis3n/ansible\_galaxy\_collection action to v3 [\#933](https://github.com/dev-sec/ansible-collection-hardening/pull/933) ([renovate[bot]](https://github.com/apps/renovate))
-- Improve VM based testing of SSH hardening [\#878](https://github.com/dev-sec/ansible-collection-hardening/pull/878) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
-
-## [10.5.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.5.0) (2026-01-22)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.4.0...10.5.0)
-
-**Implemented enhancements:**
-
-- fix: replace deprecated community.general.yaml callback plugin [\#918](https://github.com/dev-sec/ansible-collection-hardening/pull/918) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([Normo](https://github.com/Normo))
-- Consistently access facts via the ansible\_facts.\* namespace [\#917](https://github.com/dev-sec/ansible-collection-hardening/pull/917) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([Normo](https://github.com/Normo))
-- disable systemd audit logging [\#902](https://github.com/dev-sec/ansible-collection-hardening/pull/902) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([z-bsod](https://github.com/z-bsod))
-
-**Fixed bugs:**
-
-- /etc/sysctl.conf is no longer honored in Debian 13 [\#905](https://github.com/dev-sec/ansible-collection-hardening/issues/905)
-
-**Merged pull requests:**
-
-- chore\(deps\): update dependency jmespath to v1.1.0 [\#930](https://github.com/dev-sec/ansible-collection-hardening/pull/930) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/setup-python digest to a309ff8 [\#929](https://github.com/dev-sec/ansible-collection-hardening/pull/929) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint action to v26 [\#928](https://github.com/dev-sec/ansible-collection-hardening/pull/928) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update artis3n/ansible\_galaxy\_collection digest to 415a92b - autoclosed [\#927](https://github.com/dev-sec/ansible-collection-hardening/pull/927) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to a2bc8b8 [\#924](https://github.com/dev-sec/ansible-collection-hardening/pull/924) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/setup-python digest to 83679a8 [\#920](https://github.com/dev-sec/ansible-collection-hardening/pull/920) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/checkout action to v6 [\#919](https://github.com/dev-sec/ansible-collection-hardening/pull/919) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency molecule to v25.12.0 [\#914](https://github.com/dev-sec/ansible-collection-hardening/pull/914) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 40f24c2 [\#913](https://github.com/dev-sec/ansible-collection-hardening/pull/913) ([renovate[bot]](https://github.com/apps/renovate))
-- Update test environments to current Ansible version [\#909](https://github.com/dev-sec/ansible-collection-hardening/pull/909) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([schurzi](https://github.com/schurzi))
-- chore\(deps\): update ansible/ansible-lint digest to d7cd7cf [\#903](https://github.com/dev-sec/ansible-collection-hardening/pull/903) ([renovate[bot]](https://github.com/apps/renovate))
-
-## [10.4.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.4.0) (2025-10-22)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.3.1...10.4.0)
-
-**Implemented enhancements:**
-
-- Support Debian 13 [\#891](https://github.com/dev-sec/ansible-collection-hardening/issues/891)
-- Support EL10 [\#870](https://github.com/dev-sec/ansible-collection-hardening/issues/870)
-- Add support for current versions of Debian and EL [\#893](https://github.com/dev-sec/ansible-collection-hardening/pull/893) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- Add SSH config for EL/AlmaLinux 10 [\#888](https://github.com/dev-sec/ansible-collection-hardening/pull/888) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([jonathanspw](https://github.com/jonathanspw))
-
-**Fixed bugs:**
-
-- Write sysctl config to separate file [\#907](https://github.com/dev-sec/ansible-collection-hardening/pull/907) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-
-**Closed issues:**
-
-- sysctl-34 - fs.protected\_regular not set [\#536](https://github.com/dev-sec/ansible-collection-hardening/issues/536)
-
-**Merged pull requests:**
-
-- Update ArchLinux test environment before testing [\#908](https://github.com/dev-sec/ansible-collection-hardening/pull/908) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-- chore\(deps\): update actions/setup-python action to v6 [\#901](https://github.com/dev-sec/ansible-collection-hardening/pull/901) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/labeler action to v6 [\#900](https://github.com/dev-sec/ansible-collection-hardening/pull/900) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 8861a73 [\#899](https://github.com/dev-sec/ansible-collection-hardening/pull/899) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/checkout action to v5 [\#895](https://github.com/dev-sec/ansible-collection-hardening/pull/895) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency python to 3.13 [\#892](https://github.com/dev-sec/ansible-collection-hardening/pull/892) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency aar-doc to v2.3.0 [\#890](https://github.com/dev-sec/ansible-collection-hardening/pull/890) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 9765b87 [\#889](https://github.com/dev-sec/ansible-collection-hardening/pull/889) ([renovate[bot]](https://github.com/apps/renovate))
-- Improve OS support accuracy [\#887](https://github.com/dev-sec/ansible-collection-hardening/pull/887) ([jonathanspw](https://github.com/jonathanspw))
-- chore\(deps\): update hugo19941994/delete-draft-releases action to v2 [\#885](https://github.com/dev-sec/ansible-collection-hardening/pull/885) ([renovate[bot]](https://github.com/apps/renovate))
-
-## [10.3.1](https://github.com/dev-sec/ansible-collection-hardening/tree/10.3.1) (2025-07-24)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.3.0...10.3.1)
-
-**Fixed bugs:**
-
-- Readme states Ansible \>= 2.9.10, but it uses password\_expire\_warn from  2.16 [\#871](https://github.com/dev-sec/ansible-collection-hardening/issues/871)
-
-**Merged pull requests:**
-
-- Use fixed test env for BSD VMs [\#884](https://github.com/dev-sec/ansible-collection-hardening/pull/884) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
-- Downgrade community.crypto for rocky8 [\#882](https://github.com/dev-sec/ansible-collection-hardening/pull/882) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- chore\(deps\): update dependency aar-doc to v2.2.0 [\#877](https://github.com/dev-sec/ansible-collection-hardening/pull/877) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update creyd/prettier\_action action to v4.6 [\#876](https://github.com/dev-sec/ansible-collection-hardening/pull/876) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 06f616d [\#873](https://github.com/dev-sec/ansible-collection-hardening/pull/873) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency ansible-core to v2.18.6 [\#872](https://github.com/dev-sec/ansible-collection-hardening/pull/872) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update creyd/prettier\_action action to v4.5 [\#869](https://github.com/dev-sec/ansible-collection-hardening/pull/869) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(ssh\_hardening\): ansible 2.19 compatibility [\#868](https://github.com/dev-sec/ansible-collection-hardening/pull/868) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
-- chore\(deps\): update ansible/ansible-lint digest to e98f9b3 [\#867](https://github.com/dev-sec/ansible-collection-hardening/pull/867) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/setup-python digest to a26af69 [\#866](https://github.com/dev-sec/ansible-collection-hardening/pull/866) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency ansible-core to v2.18.5 [\#865](https://github.com/dev-sec/ansible-collection-hardening/pull/865) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to c16f018 [\#863](https://github.com/dev-sec/ansible-collection-hardening/pull/863) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 6a4fcdb [\#862](https://github.com/dev-sec/ansible-collection-hardening/pull/862) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency aar-doc to v2.1.0 [\#861](https://github.com/dev-sec/ansible-collection-hardening/pull/861) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency ansible-core to v2.18.4 [\#860](https://github.com/dev-sec/ansible-collection-hardening/pull/860) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/setup-python digest to 8d9ed9a [\#859](https://github.com/dev-sec/ansible-collection-hardening/pull/859) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- Fix: ForwardAgent j2 template space  [\#856](https://github.com/dev-sec/ansible-collection-hardening/pull/856) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([cod3mas0n](https://github.com/cod3mas0n))
-- chore\(deps\): update artis3n/ansible\_galaxy\_collection digest to f6110ae [\#853](https://github.com/dev-sec/ansible-collection-hardening/pull/853) ([renovate[bot]](https://github.com/apps/renovate))
-
-## [10.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.3.0) (2025-02-25)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.2.0...10.3.0)
-
-**Implemented enhancements:**
-
-- Password expiry for users without password should not block SSH key based login [\#681](https://github.com/dev-sec/ansible-collection-hardening/issues/681)
-- Set number of warning days before password expires for existing users [\#839](https://github.com/dev-sec/ansible-collection-hardening/pull/839) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Normo](https://github.com/Normo))
-- Allow to override settings for sftponly users [\#794](https://github.com/dev-sec/ansible-collection-hardening/pull/794) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([mib1185](https://github.com/mib1185))
-
-**Closed issues:**
-
-- os\_hardening & sysctl\_overwrite with host\_vars [\#837](https://github.com/dev-sec/ansible-collection-hardening/issues/837)
-
-**Merged pull requests:**
-
-- chore\(deps\): update dependency ansible-core to v2.18.3 [\#852](https://github.com/dev-sec/ansible-collection-hardening/pull/852) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 49ded6a [\#851](https://github.com/dev-sec/ansible-collection-hardening/pull/851) ([renovate[bot]](https://github.com/apps/renovate))
-- Pin runner image to specific version to decouple from GitHub updates [\#847](https://github.com/dev-sec/ansible-collection-hardening/pull/847) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- Refactor: combine multiple set\_fact into single jinja filter [\#846](https://github.com/dev-sec/ansible-collection-hardening/pull/846) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Tinyblargon](https://github.com/Tinyblargon))
-- chore\(deps\): update actions/setup-python digest to 4237552 [\#844](https://github.com/dev-sec/ansible-collection-hardening/pull/844) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency ansible-core to v2.18.2 [\#843](https://github.com/dev-sec/ansible-collection-hardening/pull/843) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency molecule to v25 [\#841](https://github.com/dev-sec/ansible-collection-hardening/pull/841) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint action to v25 [\#840](https://github.com/dev-sec/ansible-collection-hardening/pull/840) ([renovate[bot]](https://github.com/apps/renovate))
-
-## [10.2.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.2.0) (2024-12-23)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.1.0...10.2.0)
-
-**Implemented enhancements:**
-
-- Re-enable OpenBSD tests [\#826](https://github.com/dev-sec/ansible-collection-hardening/issues/826) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
-- Allow configuring the name\_format variable in auditd config [\#796](https://github.com/dev-sec/ansible-collection-hardening/issues/796) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
-- Modify PAM to allow SSH key based logins with locked passwords [\#835](https://github.com/dev-sec/ansible-collection-hardening/pull/835) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-- adding switch for ForwardAgent in ssh\_config [\#818](https://github.com/dev-sec/ansible-collection-hardening/pull/818) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Shizzlebix](https://github.com/Shizzlebix))
-
-**Fixed bugs:**
-
-- File system loop detected; ‘/bin/X11’ is part of the same file system loop as ‘/bin’." [\#815](https://github.com/dev-sec/ansible-collection-hardening/issues/815) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)]
-- Not working ssh\_hardening on Centos 7  [\#813](https://github.com/dev-sec/ansible-collection-hardening/issues/813) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
-
-**Merged pull requests:**
-
-- chore\(deps\): update dependency molecule-plugins to v23.6.0 [\#834](https://github.com/dev-sec/ansible-collection-hardening/pull/834) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 4ce8e49 [\#832](https://github.com/dev-sec/ansible-collection-hardening/pull/832) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency molecule to v24.12.0 [\#831](https://github.com/dev-sec/ansible-collection-hardening/pull/831) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency ansible-core to v2.18.1 [\#829](https://github.com/dev-sec/ansible-collection-hardening/pull/829) ([renovate[bot]](https://github.com/apps/renovate))
-- Change installation source for OpenBSD tests [\#828](https://github.com/dev-sec/ansible-collection-hardening/pull/828) ([schurzi](https://github.com/schurzi))
-- chore\(deps\): update ansible/ansible-lint digest to 44be233 [\#825](https://github.com/dev-sec/ansible-collection-hardening/pull/825) ([renovate[bot]](https://github.com/apps/renovate))
-- Bump ansible-core from 2.17.5 to 2.17.6 [\#820](https://github.com/dev-sec/ansible-collection-hardening/pull/820) ([dependabot[bot]](https://github.com/apps/dependabot))
-- chore\(deps\): update dependency ansible-core to v2.18.0 [\#819](https://github.com/dev-sec/ansible-collection-hardening/pull/819) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency aar-doc to v2.0.1 [\#817](https://github.com/dev-sec/ansible-collection-hardening/pull/817) ([renovate[bot]](https://github.com/apps/renovate))
-- Update actions/setup-python digest to 0b93645 [\#814](https://github.com/dev-sec/ansible-collection-hardening/pull/814) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/checkout digest to 11bd719 [\#812](https://github.com/dev-sec/ansible-collection-hardening/pull/812) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-
-## [10.1.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.1.0) (2024-10-22)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.0.0...10.1.0)
-
-**Implemented enhancements:**
-
-- Ubuntu 24.04 support [\#764](https://github.com/dev-sec/ansible-collection-hardening/issues/764)
-- Add variable to set name\_format for auditd [\#810](https://github.com/dev-sec/ansible-collection-hardening/pull/810) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-- feat\(ssh\): add alpine support [\#809](https://github.com/dev-sec/ansible-collection-hardening/pull/809) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- Provide granular noop for ssh configuration [\#789](https://github.com/dev-sec/ansible-collection-hardening/pull/789) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([seven-beep](https://github.com/seven-beep))
-
-**Fixed bugs:**
-
-- molecule scenario ssh\_hardening if failing due to missing docker image [\#790](https://github.com/dev-sec/ansible-collection-hardening/issues/790)
-- getent\_shadow empty [\#787](https://github.com/dev-sec/ansible-collection-hardening/issues/787)
-- Error: Missing privilege separation directory: /run/sshd [\#752](https://github.com/dev-sec/ansible-collection-hardening/issues/752)
-- fix\(ssh\_hardening\): test setting kex to false, remove wrong default [\#808](https://github.com/dev-sec/ansible-collection-hardening/pull/808) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-
-**Merged pull requests:**
-
-- Pin python dependencies and optimize GitHub Actions [\#811](https://github.com/dev-sec/ansible-collection-hardening/pull/811) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- fix\(cicd\): test idempotence on ssh custom tests [\#807](https://github.com/dev-sec/ansible-collection-hardening/pull/807) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- Document correct quotes for ssh\_permit\_tunnel parameter [\#806](https://github.com/dev-sec/ansible-collection-hardening/pull/806) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([vmpr](https://github.com/vmpr))
-- fix\(docs\): add 'become: true' to example playbooks. fix \#787 [\#804](https://github.com/dev-sec/ansible-collection-hardening/pull/804) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- chore\(deps\): update dependency ansible-core to v2.17.5 [\#802](https://github.com/dev-sec/ansible-collection-hardening/pull/802) ([renovate[bot]](https://github.com/apps/renovate))
-- Don't run tests if the environment is not correct [\#801](https://github.com/dev-sec/ansible-collection-hardening/pull/801) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- chore\(deps\): update actions/checkout digest to eef6144 [\#800](https://github.com/dev-sec/ansible-collection-hardening/pull/800) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- feat: Corrected package name [\#799](https://github.com/dev-sec/ansible-collection-hardening/pull/799) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([PapaPeskwo](https://github.com/PapaPeskwo))
-- Use Python venv for VM tests [\#798](https://github.com/dev-sec/ansible-collection-hardening/pull/798) ([schurzi](https://github.com/schurzi))
-- Remove unused files and variables [\#797](https://github.com/dev-sec/ansible-collection-hardening/pull/797) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-- chore\(deps\): update ansible/ansible-lint digest to 3b5bee1 [\#795](https://github.com/dev-sec/ansible-collection-hardening/pull/795) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 25f783c [\#792](https://github.com/dev-sec/ansible-collection-hardening/pull/792) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency ansible-core to v2.17.4 [\#791](https://github.com/dev-sec/ansible-collection-hardening/pull/791) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/setup-python digest to f677139 [\#788](https://github.com/dev-sec/ansible-collection-hardening/pull/788) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency ansible-core to v2.17.3 [\#786](https://github.com/dev-sec/ansible-collection-hardening/pull/786) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update dependency ansible-core to v2.17.2 [\#756](https://github.com/dev-sec/ansible-collection-hardening/pull/756) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-
-## [10.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.0.0) (2024-08-06)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/9.0.1...10.0.0)
-
-**Implemented enhancements:**
-
-- option to disable regeneration of ssh private key [\#772](https://github.com/dev-sec/ansible-collection-hardening/issues/772)
-- Support systemd socket activation for sshd [\#763](https://github.com/dev-sec/ansible-collection-hardening/issues/763) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
-- Release 9.0.2 [\#758](https://github.com/dev-sec/ansible-collection-hardening/issues/758)
-- Make Publickey authentication configurable  [\#750](https://github.com/dev-sec/ansible-collection-hardening/issues/750)
-- Ansible Linting [\#747](https://github.com/dev-sec/ansible-collection-hardening/issues/747)
-- Make value of kernel.unprivileged\_userns\_clone depending on kernel version [\#727](https://github.com/dev-sec/ansible-collection-hardening/issues/727)
-- Ensure that ssh is installed \(cf \#771\) [\#774](https://github.com/dev-sec/ansible-collection-hardening/pull/774) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Byh0ki](https://github.com/Byh0ki))
-- ssh: explicitly enable or disable the service at boot [\#771](https://github.com/dev-sec/ansible-collection-hardening/pull/771) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Byh0ki](https://github.com/Byh0ki))
-- disable systemd socket activation [\#769](https://github.com/dev-sec/ansible-collection-hardening/pull/769) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- Add ssh\_pubkey\_authentication variable to ssh hardening [\#749](https://github.com/dev-sec/ansible-collection-hardening/pull/749) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([debbabi](https://github.com/debbabi))
-
-**Fixed bugs:**
-
-- ssh hardening role fails when `ssh_permit_root_login` var is set on ubuntu 24.04 [\#768](https://github.com/dev-sec/ansible-collection-hardening/issues/768)
-- os\_hardening fails when setting vm.mmap\_rnd\_bits [\#757](https://github.com/dev-sec/ansible-collection-hardening/issues/757)
-- `ssh_gateway_ports` is documented to accept 'clientspecified' string, but only accepts bools [\#755](https://github.com/dev-sec/ansible-collection-hardening/issues/755)
-- harden permissions for directory mount /var/log fails for minimized Ubuntu 22.04  [\#741](https://github.com/dev-sec/ansible-collection-hardening/issues/741)
-- Update Debian compatibility [\#784](https://github.com/dev-sec/ansible-collection-hardening/pull/784) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- do not force type of ssh\_gateway\_ports [\#765](https://github.com/dev-sec/ansible-collection-hardening/pull/765) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-
-**Merged pull requests:**
-
-- Update to current Fedora releases [\#783](https://github.com/dev-sec/ansible-collection-hardening/pull/783) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
-- Remove deprecated rebuild of initrd [\#782](https://github.com/dev-sec/ansible-collection-hardening/pull/782) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-- chore\(deps\): update patrickjahns/version-drafter-action digest to 2076fa4 [\#781](https://github.com/dev-sec/ansible-collection-hardening/pull/781) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update ansible/ansible-lint digest to 95382d3 [\#779](https://github.com/dev-sec/ansible-collection-hardening/pull/779) ([renovate[bot]](https://github.com/apps/renovate))
-- chore\(deps\): update actions/setup-python digest to 39cd149 [\#778](https://github.com/dev-sec/ansible-collection-hardening/pull/778) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- remove tests for FreeBSD12 since it's out of support [\#777](https://github.com/dev-sec/ansible-collection-hardening/pull/777) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
-- chore\(deps\): pin dependencies [\#776](https://github.com/dev-sec/ansible-collection-hardening/pull/776) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- Use best-practice preset for renovate [\#775](https://github.com/dev-sec/ansible-collection-hardening/pull/775) ([schurzi](https://github.com/schurzi))
-- Deprecate Centos Stream 8 [\#770](https://github.com/dev-sec/ansible-collection-hardening/pull/770) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- centos7 is eol, remove it [\#767](https://github.com/dev-sec/ansible-collection-hardening/pull/767) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- fix spelling [\#766](https://github.com/dev-sec/ansible-collection-hardening/pull/766) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- ci: define permissions for enforce-labels workflow  [\#760](https://github.com/dev-sec/ansible-collection-hardening/pull/760) ([fgreinacher](https://github.com/fgreinacher))
-- Update dependency ansible-core to v2.16.5 [\#754](https://github.com/dev-sec/ansible-collection-hardening/pull/754) ([renovate[bot]](https://github.com/apps/renovate))
-- Update dependency ansible-core to v2.16.4 [\#751](https://github.com/dev-sec/ansible-collection-hardening/pull/751) ([renovate[bot]](https://github.com/apps/renovate))
-- Update ansible/ansible-lint action to v24 [\#745](https://github.com/dev-sec/ansible-collection-hardening/pull/745) ([renovate[bot]](https://github.com/apps/renovate))
-- Always update Vagrant Boxes before using [\#744](https://github.com/dev-sec/ansible-collection-hardening/pull/744) ([schurzi](https://github.com/schurzi))
-- Remove Docker containers on self-hosted runner after tests [\#743](https://github.com/dev-sec/ansible-collection-hardening/pull/743) ([schurzi](https://github.com/schurzi))
-- Update dependency ansible-core to v2.16.3 [\#742](https://github.com/dev-sec/ansible-collection-hardening/pull/742) ([renovate[bot]](https://github.com/apps/renovate))
-
-## [9.0.1](https://github.com/dev-sec/ansible-collection-hardening/tree/9.0.1) (2024-01-15)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/9.0.0...9.0.1)
-
-**Implemented enhancements:**
-
-- Extend ansible-lint testing to cover our test cases [\#731](https://github.com/dev-sec/ansible-collection-hardening/issues/731)
--  Complete tests for OS hardening [\#660](https://github.com/dev-sec/ansible-collection-hardening/issues/660)
-- support restarts of audit service on Arch linux [\#722](https://github.com/dev-sec/ansible-collection-hardening/pull/722) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-
-**Fixed bugs:**
-
-- Fails to install [\#735](https://github.com/dev-sec/ansible-collection-hardening/issues/735)
-- Amazon Linux gpg check fails [\#734](https://github.com/dev-sec/ansible-collection-hardening/issues/734)
-- ssh\_hardening ipv6 [\#719](https://github.com/dev-sec/ansible-collection-hardening/issues/719)
-- boolean variable inconsistency? [\#330](https://github.com/dev-sec/ansible-collection-hardening/issues/330)
-- Restore idempotency for disabling unused filesystems with Ansible 2.16.0 [\#718](https://github.com/dev-sec/ansible-collection-hardening/pull/718) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([akikanellis](https://github.com/akikanellis))
-
-**Closed issues:**
-
-- 9.0.0 version number in galaxy.yml file is wrong [\#740](https://github.com/dev-sec/ansible-collection-hardening/issues/740)
-
-**Merged pull requests:**
-
-- restructure readme to move known limitations up top [\#739](https://github.com/dev-sec/ansible-collection-hardening/pull/739) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- release only on releases, not pre-releases [\#738](https://github.com/dev-sec/ansible-collection-hardening/pull/738) ([rndmh3ro](https://github.com/rndmh3ro))
-- Update dependency ansible-core to v2.16.2 [\#737](https://github.com/dev-sec/ansible-collection-hardening/pull/737) ([renovate[bot]](https://github.com/apps/renovate))
-- fix linting for github config [\#736](https://github.com/dev-sec/ansible-collection-hardening/pull/736) ([rndmh3ro](https://github.com/rndmh3ro))
-- Update actions/setup-python action to v5 [\#733](https://github.com/dev-sec/ansible-collection-hardening/pull/733) ([renovate[bot]](https://github.com/apps/renovate))
-- Update ansible-lint action and revise configuration to scan all Ansible code [\#732](https://github.com/dev-sec/ansible-collection-hardening/pull/732) ([schurzi](https://github.com/schurzi))
-- update labeler to new config format [\#730](https://github.com/dev-sec/ansible-collection-hardening/pull/730) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
-- Update dependency ansible-core to v2.16.1 [\#728](https://github.com/dev-sec/ansible-collection-hardening/pull/728) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- pin Ansible to always let Renovate update to the most current version in our tests [\#721](https://github.com/dev-sec/ansible-collection-hardening/pull/721) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-
-## [9.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/9.0.0) (2023-11-16)
-
-[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.8.0...9.0.0)
-
-**Breaking changes:**
-
-- make it possible to configure more then yes and no for PermitTunnel [\#715](https://github.com/dev-sec/ansible-collection-hardening/pull/715) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- add role argument spec for os, ssh, mysql [\#687](https://github.com/dev-sec/ansible-collection-hardening/pull/687) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-
-**Implemented enhancements:**
-
-- Create role documentation with Automated-Ansible-Role-Documentation [\#694](https://github.com/dev-sec/ansible-collection-hardening/issues/694)
-- Minimize access user paths should be fully configurable [\#689](https://github.com/dev-sec/ansible-collection-hardening/issues/689)
-- Add support for Debian 12 [\#672](https://github.com/dev-sec/ansible-collection-hardening/issues/672)
-- add testing and support for current versions of Fedora and FreeBSD [\#709](https://github.com/dev-sec/ansible-collection-hardening/pull/709) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
-- feat: workflow for roles readme [\#705](https://github.com/dev-sec/ansible-collection-hardening/pull/705) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
-- do not try to drop roles in mysql hardening [\#649](https://github.com/dev-sec/ansible-collection-hardening/pull/649) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-
-**Fixed bugs:**
-
-- nginx conf.d directory is missing on Rocky Linux 8 [\#707](https://github.com/dev-sec/ansible-collection-hardening/issues/707)
-- Default value of `ssh_client_alive_interval` is inconsistent with what documentation says [\#701](https://github.com/dev-sec/ansible-collection-hardening/issues/701)
-- \[devsec.hardening.os\_hardening : restart-auditd\] fails [\#698](https://github.com/dev-sec/ansible-collection-hardening/issues/698)
-- sshd\_hardening role cannot be used to build system images [\#697](https://github.com/dev-sec/ansible-collection-hardening/issues/697)
-- Error: No file was found when using first\_found on Ubuntu 20.04 [\#676](https://github.com/dev-sec/ansible-collection-hardening/issues/676)
-- PUBLIC-role breaks mysql-hardening [\#648](https://github.com/dev-sec/ansible-collection-hardening/issues/648)
-- Error deploying the playbook [\#630](https://github.com/dev-sec/ansible-collection-hardening/issues/630)
-- Gather facts when os\_hardening role is executed with tags [\#708](https://github.com/dev-sec/ansible-collection-hardening/pull/708) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-
-**Closed issues:**
-
-- Add send-to-mailinglist to github release action [\#434](https://github.com/dev-sec/ansible-collection-hardening/issues/434)
-
-**Merged pull requests:**
-
-- update status badges in README [\#714](https://github.com/dev-sec/ansible-collection-hardening/pull/714) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- fix CI test for os\_hardening [\#711](https://github.com/dev-sec/ansible-collection-hardening/pull/711) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
-- fix nginx CI tests [\#710](https://github.com/dev-sec/ansible-collection-hardening/pull/710) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- fix: roles-readme action default value [\#706](https://github.com/dev-sec/ansible-collection-hardening/pull/706) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
-- fix some wrong defaults and types in the readmes [\#703](https://github.com/dev-sec/ansible-collection-hardening/pull/703) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- update links to new Ansible Galaxy [\#702](https://github.com/dev-sec/ansible-collection-hardening/pull/702) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
-- Fix typo in login.defs.j2 [\#700](https://github.com/dev-sec/ansible-collection-hardening/pull/700) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))
-- chore\(deps\): update actions/checkout action to v4 [\#696](https://github.com/dev-sec/ansible-collection-hardening/pull/696) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
-- test debian12 on VM [\#695](https://github.com/dev-sec/ansible-collection-hardening/pull/695) ([rndmh3ro](https://github.com/rndmh3ro))
-- fix descriptions in readme [\#693](https://github.com/dev-sec/ansible-collection-hardening/pull/693) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- feat: customize user paths default [\#692](https://github.com/dev-sec/ansible-collection-hardening/pull/692) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([S0obi](https://github.com/S0obi))
-- disable PAM tests [\#691](https://github.com/dev-sec/ansible-collection-hardening/pull/691) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-
-## [8.8.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.8.0) (2023-08-04)
+## [8.8.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.8.0) (2023-06-20)
 
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.7.0...8.8.0)
 
 **Implemented enhancements:**
 
 - Add support for Fedora 38 [\#671](https://github.com/dev-sec/ansible-collection-hardening/issues/671)
-- auditd: add possibility to override config template [\#685](https://github.com/dev-sec/ansible-collection-hardening/pull/685) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Meecr0b](https://github.com/Meecr0b))
-- add debian 12 support [\#684](https://github.com/dev-sec/ansible-collection-hardening/pull/684) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - feat: explicitly support Fedora 37 and 38 [\#682](https://github.com/dev-sec/ansible-collection-hardening/pull/682) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([nejch](https://github.com/nejch))
 - Replace ssh\_keys group with root, where applicable and use less permissive file mode [\#677](https://github.com/dev-sec/ansible-collection-hardening/pull/677) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Add oddjob mkhomedir option rhel pam [\#675](https://github.com/dev-sec/ansible-collection-hardening/pull/675) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([imp1sh](https://github.com/imp1sh))
 
 **Fixed bugs:**
 
-- How does one set `sshd_authenticationmethods`  to include password authentication? [\#686](https://github.com/dev-sec/ansible-collection-hardening/issues/686)
-- FreeIPA environment mkhomedir fails [\#664](https://github.com/dev-sec/ansible-collection-hardening/issues/664)
+- Error: No file was found when using first\_found on Ubuntu 20.04 [\#676](https://github.com/dev-sec/ansible-collection-hardening/issues/676)
 
 **Closed issues:**
 
-- What is the uscase of sysctl\_overwrite over ansible.posix.sysctl? [\#683](https://github.com/dev-sec/ansible-collection-hardening/issues/683)
 -  `Ensure permissions on mysql-logfile are correct` chokes when `log_error` is set to `stderr` [\#673](https://github.com/dev-sec/ansible-collection-hardening/issues/673)
 - TASK TASK FAILED: \[devsec.hardening.os\_hardening : Set password ageing for existing regular \(non-system, non-root\) accounts\]  [\#670](https://github.com/dev-sec/ansible-collection-hardening/issues/670)
 - After os\_hardening ssh not working  [\#663](https://github.com/dev-sec/ansible-collection-hardening/issues/663)
@@ -415,6 +51,7 @@
 
 **Closed issues:**
 
+- Dependency Dashboard [\#655](https://github.com/dev-sec/ansible-collection-hardening/issues/655)
 - Invalid login.defs for RHEL6 [\#651](https://github.com/dev-sec/ansible-collection-hardening/issues/651)
 - Deprecation warnings for os\_hardening [\#638](https://github.com/dev-sec/ansible-collection-hardening/issues/638)
 - Write tests for MySQL user-deletion [\#445](https://github.com/dev-sec/ansible-collection-hardening/issues/445)
@@ -1103,6 +740,7 @@
 - Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-collection-hardening/pull/251) ([dustinmiller](https://github.com/dustinmiller))
 - Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
 - Make max\_log\_file\_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-collection-hardening/pull/246) ([jandd](https://github.com/jandd))
+- Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-collection-hardening/pull/240) ([ghost](https://github.com/ghost))
 - Fedora - Use new auto ansible\_python\_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-collection-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
 - add test support for CentOS8 [\#237](https://github.com/dev-sec/ansible-collection-hardening/pull/237) ([yeoldegrove](https://github.com/yeoldegrove))
 - Support configuring SELinux and default to enforcing [\#236](https://github.com/dev-sec/ansible-collection-hardening/pull/236) ([jaredledvina](https://github.com/jaredledvina))
@@ -1143,7 +781,7 @@
 - remove prelink package, control package-09 [\#135](https://github.com/dev-sec/ansible-collection-hardening/pull/135) ([rndmh3ro](https://github.com/rndmh3ro))
 - style update [\#134](https://github.com/dev-sec/ansible-collection-hardening/pull/134) ([rndmh3ro](https://github.com/rndmh3ro))
 - Remove deprecated include for static tasks and use instead import\_tasks fix \#131 [\#132](https://github.com/dev-sec/ansible-collection-hardening/pull/132) ([HelioCampos](https://github.com/HelioCampos))
-- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-collection-hardening/pull/130) ([FazleArefin](https://github.com/FazleArefin))
+- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-collection-hardening/pull/130) ([fazlearefin](https://github.com/fazlearefin))
 - install initramfs-tools [\#114](https://github.com/dev-sec/ansible-collection-hardening/pull/114) ([rndmh3ro](https://github.com/rndmh3ro))
 - omit empty variables [\#106](https://github.com/dev-sec/ansible-collection-hardening/pull/106) ([rndmh3ro](https://github.com/rndmh3ro))
 - Supports --check mode [\#93](https://github.com/dev-sec/ansible-collection-hardening/pull/93) ([conorsch](https://github.com/conorsch))
@@ -1210,6 +848,7 @@
 - replace module parameter fixed [\#297](https://github.com/dev-sec/ansible-collection-hardening/pull/297) ([danielkubat](https://github.com/danielkubat))
 - Addressing issue \#255 [\#258](https://github.com/dev-sec/ansible-collection-hardening/pull/258) ([ljkimmel](https://github.com/ljkimmel))
 - Fix \#247, cleanup conditions [\#248](https://github.com/dev-sec/ansible-collection-hardening/pull/248) ([fernandezcuesta](https://github.com/fernandezcuesta))
+- Fix error on applying the sysctl vars on containers [\#243](https://github.com/dev-sec/ansible-collection-hardening/pull/243) ([ghost](https://github.com/ghost))
 - Update location of NSA RHEL 5 Guide [\#235](https://github.com/dev-sec/ansible-collection-hardening/pull/235) ([jaredledvina](https://github.com/jaredledvina))
 - Fix typo [\#212](https://github.com/dev-sec/ansible-collection-hardening/pull/212) ([ruslo](https://github.com/ruslo))
 - Update modprobe to 0644 [\#211](https://github.com/dev-sec/ansible-collection-hardening/pull/211) ([joshuatalb](https://github.com/joshuatalb))

CONTRIBUTING.md

@@ -93,21 +93,6 @@ We generally include test for coding guidelines:
 
 Remember: Code is generally read much more often than written.
 
-### Local testing of roles in this collection
-
-We are using Molecule to test our roles.
-If you want to execute the tests on your machine you need Docker and Molecule.
-You will also need to set the `MOLECULE_DISTRO` environment variable to execute the tests.
-To find valid values for the variable you can take a look at our GitHub Action workflows in `.github/workflows/`.
-
-Example for executing tests locally:
-
-```bash
-pip install -r requirements.txt
-export MOLECULE_DISTRO="debian12"
-molecule test -s os_hardening
-```
-
 ### Use Markdown
 
 Wherever possible, please refrain from any other formats and stick to simple markdown.

README.md

@@ -1,26 +1,23 @@
 # Ansible Collection - devsec.hardening
 
-[![devsec.os_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml)
-[![devsec.os_hardening VM](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml)
-[![devsec.ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml)
-[![devsec.ssh_hardening VM](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_vm.yml)
-[![devsec.ssh_hardening with custom tests](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml)
-[![devsec.nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml)
-[![devsec.mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
+![devsec.os_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening/badge.svg)
+![devsec.os_hardening VM](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening%20VM/badge.svg)
+![devsec.ssh_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.ssh_hardening/badge.svg)
+![devsec.nginx_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.nginx_hardening/badge.svg)
+![devsec.mysql_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.mysql_hardening/badge.svg)
 
 ## Description
 
 This collection provides battle tested hardening for:
 
 - Linux operating systems:
-  - CentOS Stream 9
-  - AlmaLinux 8/9/10
-  - Rocky Linux 8/9/10
-  - Debian 11/12/13
-  - Ubuntu 22.04/24.04/26.04
+  - CentOS 7/8/9
+  - Rocky Linux 8/9
+  - Debian 10/11/12
+  - Ubuntu 18.04/20.04/22.04
   - Amazon Linux (some roles supported)
   - Arch Linux (some roles supported)
-  - Fedora 42/43/44 (some roles supported)
+  - Fedora 37/38 (some roles supported)
   - Suse Tumbleweed (some roles supported)
 - MySQL
   - MariaDB >= 5.5.65, >= 10.1.45, >= 10.3.17
@@ -51,7 +48,7 @@ The other roles are in separate archives repositories:
 
 ## Minimum required Ansible-version
 
-- Ansible >= 2.16
+- Ansible >= 2.9.10
 
 ## Included content
 

galaxy.yml

@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 10.5.2
+version: 8.7.0
 readme: README.md
 authors:
   - dev-sec <[email protected]>
@@ -22,9 +22,6 @@ tags:
   - nginx_hardening
   - os_hardening
   - ssh_hardening
-  - database
-  - linux
-  - security
 dependencies:
   ansible.posix: '>=1.0.0'
   community.crypto: '>=1.0.0'

molecule/mysql_hardening/converge.yml

@@ -1,29 +1,38 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-mysql-hardening"
+- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
   hosts: all
   become: true
+  collections:
+    - devsec.hardening
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
-      ansible.builtin.set_fact:
-        mysql_python_package_debian: python3-pymysql
+      set_fact:
+        mysql_python_package_debian: "python3-pymysql"
       when:
         - mysql_python_package_debian is not defined
-        - ansible_facts.distribution == "Ubuntu"
-        - ansible_facts.distribution_major_version|int > 19
+        - ansible_distribution == "Ubuntu"
+        - ansible_distribution_major_version|int > 19
+
+    - name: Determine required MySQL Python libraries.
+      set_fact:
+        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
+      when:
+        - mysql_python_package_debian is not defined
+        - ansible_distribution != "Ubuntu"
+        - ansible_distribution_major_version|int < 20
 
     - name: Use Python 3 on Suse
-      ansible.builtin.set_fact:
+      set_fact:
         ansible_python_interpreter: /usr/bin/python3
       when:
-        - ansible_facts.os_family == 'Suse'
+        - ansible_os_family == 'Suse'
 
-    - name: Include mysql_hardening role
-      ansible.builtin.include_role:
-        name: devsec.hardening.mysql_hardening
+    - include_role:
+        name: mysql_hardening
   vars:
     overwrite_global_mycnf: false
     mysql_root_password: iloverandompasswordsbutthiswilldo

molecule/mysql_hardening/molecule.yml

@@ -8,7 +8,7 @@ driver:
   name: docker
 platforms:
   - name: instance
-    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
+    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -22,9 +22,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer
-      # Currently not supported by dev-sec.mysql role
-      # inject_facts_as_vars: false
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
   name: ansible
 
@@ -35,7 +33,6 @@ scenario:
     - prepare
   check_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -51,7 +48,6 @@ scenario:
     - destroy
   test_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create

molecule/mysql_hardening/prepare.yml

@@ -1,66 +1,80 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-mysql-hardening"
+
+- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
   hosts: all
   become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: Use Python 3 on Debian 11
+      set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+      when:
+        - ansible_distribution == 'Debian'
+        - ansible_distribution_major_version|int >= 11
+
+    - name: Use Python 3 on Suse
+      set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+      when:
+        - ansible_os_family == 'Suse'
+
+    - name: Use Python 2 on Debian 10
+      set_fact:
+        ansible_python_interpreter: /usr/bin/python
+      when:
+        - ansible_distribution == 'Debian'
+        - ansible_distribution_major_version|int == 10
+
+    - name: Run the equivalent of "apt-get update && apt-get upgrade"
+      apt:
+        name: "*"
+        state: latest
+        update_cache: true
+      when: ansible_os_family == 'Debian'
+
+    - name: Install required python packages on Suse
+      ansible.builtin.shell: zypper -n install python-xml python3-rpm python3-PyMySQL
+      when: ansible_os_family == 'Suse'
+
+    - name: create missing directory
+      file:
+        path: "/etc/mysql/conf.d"
+        state: directory
+
+    - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
+      set_fact:
+        mysql_python_package_debian: "python3-pymysql"
+      when:
+        - mysql_python_package_debian is not defined
+        - ansible_distribution == "Ubuntu"
+        - ansible_distribution_major_version|int > 19
+
+    - name: Determine required MySQL Python libraries.
+      set_fact:
+        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
+      when:
+        - mysql_python_package_debian is not defined
+        - ansible_distribution != "Ubuntu"
+        - ansible_distribution_major_version|int < 20
+
+    - name: Install required MySQL Python libraries on RHEL
+      yum:
+        name: "{% if 'python3' in ansible_python_interpreter|default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
+      when:
+        - ansible_os_family == "RedHat"
+        - ansible_distribution_major_version == "7"
+          
+    - include_role:
+        name: dev-sec.mysql
+
+    - name: include MySQL user prepare tasks
+      include_tasks: prepare_tasks/mysql_users.yml
   vars:
     overwrite_global_mycnf: false
     mysql_root_password: iloverandompasswordsbutthiswilldo
     mysql_user_password: iloverandompasswordsbutthiswilldo
     mysql_config_file: /etc/mysql/mariadb.cnf
     mysql_root_password_update: true
-  tasks:
-    - name: Use Python 3 on Debian 11
-      ansible.builtin.set_fact:
-        ansible_python_interpreter: /usr/bin/python3
-      when:
-        - ansible_facts.distribution == 'Debian'
-        - ansible_facts.distribution_major_version|int >= 11
-
-    - name: Use Python 3 on Suse
-      ansible.builtin.set_fact:
-        ansible_python_interpreter: /usr/bin/python3
-      when:
-        - ansible_facts.os_family == 'Suse'
-
-    - name: Run the equivalent of "apt-get update && apt-get upgrade"
-      ansible.builtin.apt:
-        upgrade: safe
-        update_cache: true
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: Install required python packages on Suse
-      ansible.builtin.command: zypper -n install python311-rpm python311-PyMySQL
-      changed_when: false
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: Create missing directory
-      ansible.builtin.file:
-        path: /etc/mysql
-        state: directory
-        mode: "0755"
-
-    - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
-      ansible.builtin.set_fact:
-        mysql_python_package_debian: python3-pymysql
-      when:
-        - mysql_python_package_debian is not defined
-        - ansible_facts.distribution == "Ubuntu"
-        - ansible_facts.distribution_major_version|int > 19
-
-    - name: Install required MySQL Python libraries on RHEL
-      ansible.builtin.dnf:
-        name: "{% if 'python3' in ansible_python_interpreter | default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
-      when:
-        - ansible_facts.os_family == "RedHat"
-        - ansible_facts.distribution_major_version == "7"
-
-    - name: Install mysql with a generic Ansible role
-      ansible.builtin.include_role:
-        name: dev-sec.mysql
-
-    - name: Include MySQL user prepare tasks
-      ansible.builtin.include_tasks: prepare_tasks/mysql_users.yml

molecule/mysql_hardening/prepare_tasks/mysql_users.yml

@@ -1,32 +1,15 @@
 ---
-- name: Create users for test
-  ansible.mysql.mysql_query:
+- name: create users for test
+  community.mysql.mysql_query:
     query:
-      - CREATE USER 'user'@'delete';
-      - CREATE USER 'user'@'127.0.0.1';
-      - CREATE USER 'user'@'::1';
-      - CREATE USER 'user'@'%';
-      - CREATE USER 'user'@'192.168.0.%';
-      - CREATE USER 'user'@'192.168.0.1';
-      - CREATE USER    '%'@'192.168.0.1';
-      - CREATE USER 'user'@'192.168.0.2' IDENTIFIED BY 'keep';
-      - CREATE USER 'user'@'keep' IDENTIFIED BY 'keep';
-      - CREATE USER 'user'@'192.168.%' IDENTIFIED BY 'keep';
+      - "CREATE USER 'user'@'delete';"
+      - "CREATE USER 'user'@'127.0.0.1';"
+      - "CREATE USER 'user'@'::1';"
+      - "CREATE USER 'user'@'%';"
+      - "CREATE USER 'user'@'192.168.0.%';"
+      - "CREATE USER 'user'@'192.168.0.1';"
+      - "CREATE USER    '%'@'192.168.0.1';"
+      - "CREATE USER 'user'@'192.168.0.2' IDENTIFIED BY 'keep';"
+      - "CREATE USER 'user'@'keep' IDENTIFIED BY 'keep';"
+      - "CREATE USER 'user'@'192.168.%' IDENTIFIED BY 'keep';"
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
-
-- name: Detect role support on MySQL
-  ansible.mysql.mysql_query:
-    query: >
-      SELECT 1 FROM information_schema.COLUMNS
-                WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
-                AND COLUMN_NAME = 'is_role';
-    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
-  register: mysql_role_support
-
-- name: Create roles for test
-  ansible.mysql.mysql_query:
-    query:
-      - CREATE ROLE 'role_keep';
-    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
-  when:
-    - mysql_role_support.rowcount[0] > 0

molecule/mysql_hardening/requirements.yml

@@ -2,3 +2,8 @@
 roles:
   - name: dev-sec.mysql
     version: master
+
+collections:
+  - name: https://github.com/ansible-collections/community.mysql.git
+    type: git
+    version: main

molecule/mysql_hardening/verify.yml

@@ -8,23 +8,23 @@
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: Use Python 3 on Suse
-      ansible.builtin.set_fact:
+      set_fact:
         ansible_python_interpreter: /usr/bin/python3
       when:
-        - ansible_facts.os_family == 'Suse'
+        - ansible_os_family == 'Suse'
 
-    - name: Install procps for debian systems
-      ansible.builtin.apt:
+    - name: install procps for debian systems
+      apt:
         name: procps
         state: present
         update_cache: true
-      when: ansible_facts.distribution == 'Debian'
+      when: ansible_distribution == 'Debian'
 
-    - name: Include tests for the service
-      ansible.builtin.include_tasks: verify_tasks/service.yml
+    - name: include tests for the service
+      include_tasks: verify_tasks/service.yml
 
-    - name: Include tests for MySQL user
-      ansible.builtin.include_tasks: verify_tasks/mysql_users.yml
+    - name: include tests for MySQL user
+      include_tasks: verify_tasks/mysql_users.yml
 
 - name: Verify
   hosts: localhost
@@ -34,7 +34,7 @@
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: Execute cinc-auditor tests
-      ansible.builtin.command: >
+      command: >
         docker run
         --volume /run/docker.sock:/run/docker.sock
         docker.io/cincproject/auditor exec
@@ -46,10 +46,10 @@
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      ansible.builtin.debug:
+      debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      ansible.builtin.fail:
-        msg: Inspec failed to validate
+      fail:
+        msg: "Inspec failed to validate"
       when: test_results.rc != 0

molecule/mysql_hardening/verify_tasks/mysql_users.yml

@@ -1,16 +1,16 @@
 ---
 - name: Get all users from MySQL server
-  ansible.mysql.mysql_query:
+  community.mysql.mysql_query:
     query: >
       SELECT CONCAT(USER, '@', HOST) AS users FROM mysql.user;
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   register: mysql_users
 
-- name: Create list of users from mysql query
-  ansible.builtin.set_fact:
+- name: create list of users from mysql query
+  set_fact:
     mysql_users_list: "{{ mysql_users.query_result.0  | json_query('[*].users') | list }}"
 
-- name: Assert that only accounts with password remain
+- name: assert that only accounts with password remain
   ansible.builtin.assert:
     that:
       - '"user@delete" not in mysql_users_list'
@@ -23,19 +23,3 @@
       - '"[email protected]" in mysql_users_list'
       - '"user@keep" in mysql_users_list'
       - '"[email protected].%" in mysql_users_list'
-
-- name: Detect role support on MySQL
-  ansible.mysql.mysql_query:
-    query: >
-      SELECT 1 FROM information_schema.COLUMNS
-                WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
-                AND COLUMN_NAME = 'is_role';
-    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
-  register: mysql_role_support
-
-- name: Assert that roles remain
-  ansible.builtin.assert:
-    that:
-      - '"role_keep@" in mysql_users_list'
-  when:
-    - mysql_role_support.rowcount[0] > 0

molecule/mysql_hardening/verify_tasks/service.yml

@@ -10,7 +10,7 @@
   ansible.builtin.service_facts:
 
 - name: Check if MySQL is running and enabled
-  ansible.builtin.assert:
+  assert:
     that:
-      - ansible_facts.services[mysql_daemon + '.service'].state == 'running'
-      - ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'
+      - "ansible_facts.services[mysql_daemon + '.service'].state == 'running'"
+      - "ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'"

molecule/nginx_hardening/converge.yml

@@ -1,15 +1,16 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   become: true
   hosts: all
+  collections:
+    - devsec.hardening
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   vars:
-    nginx_ppa_use: true
-    nginx_ppa_version: stable
+    - nginx_ppa_use: true
+    - nginx_ppa_version: stable
   tasks:
-    - name: Include nginx_hardening role
-      ansible.builtin.include_role:
-        name: devsec.hardening.nginx_hardening
+    - include_role:
+        name: nginx_hardening

molecule/nginx_hardening/molecule.yml

@@ -7,7 +7,7 @@ driver:
   name: docker
 platforms:
   - name: instance
-    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
+    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -21,9 +21,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer
-      # Currently not supported by geerlingguy.nginx role
-      # inject_facts_as_vars: false
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
   name: ansible
 
@@ -34,7 +32,6 @@ scenario:
     - prepare
   check_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -50,7 +47,6 @@ scenario:
     - destroy
   test_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create

molecule/nginx_hardening/official-nginx-role-debian.yml

@@ -1,24 +1,24 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   hosts: localhost
   vars:
-    nginx_main_template_enable: true
-    nginx_main_template:
-      template_file: nginx.conf.j2
-      conf_file_name: nginx.conf
-      conf_file_location: /etc/nginx/
-      user: www-data
-      worker_processes: auto
-      error_level: warn
-      worker_connections: 1024
-      http_enable: true
-      http_settings:
-        keepalive_timeout: 65
-        cache: false
-        rate_limit: false
-        keyval: false
-      stream_enable: false
-      http_global_autoindex: false
+    - nginx_main_template_enable: true
+    - nginx_main_template:
+        template_file: nginx.conf.j2
+        conf_file_name: nginx.conf
+        conf_file_location: /etc/nginx/
+        user: www-data
+        worker_processes: auto
+        error_level: warn
+        worker_connections: 1024
+        http_enable: true
+        http_settings:
+          keepalive_timeout: 65
+          cache: false
+          rate_limit: false
+          keyval: false
+        stream_enable: false
+        http_global_autoindex: false
   roles:
     - nginxinc.nginx
     - nginx_hardening

molecule/nginx_hardening/official-nginx-role-redhat.yml

@@ -1,5 +1,5 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   hosts: localhost
   roles:
     - nginxinc.nginx

molecule/nginx_hardening/prepare.yml

@@ -1,5 +1,5 @@
 ---
-- name: Prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   become: true
   hosts: all
   environment:
@@ -7,17 +7,22 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: Install required packages
-      ansible.builtin.package:
-        name: python3-apt
+    - name: install required tools on SuSE
+      community.general.zypper:
+        name: "python-xml"
+        state: present
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: install required packages
+      package:
+        name: "python3-apt"
         update_cache: true
-      ignore_errors: true # noqa ignore-errors
+      ignore_errors: true  # noqa ignore-errors
 
     - name: Set correct distribution Version for Amazon Linux
-      ansible.builtin.set_fact:
+      set_fact:
         ansible_distribution_major_version: 7
-      when: ansible_facts.distribution == 'Amazon'
+      when: ansible_distribution == 'Amazon'
 
-    - name: Install nginx with a generic Ansible role
-      ansible.builtin.include_role:
+    - include_role:
         name: geerlingguy.nginx

molecule/nginx_hardening/requirements.yml

@@ -1,3 +1,3 @@
 ---
 roles:
-  - name: geerlingguy.nginx
+  - geerlingguy.nginx

molecule/nginx_hardening/verify.yml

@@ -7,12 +7,12 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: Install procps for debian systems
-      ansible.builtin.apt:
+    - name: install procps for debian systems
+      apt:
         name: procps
         state: present
         update_cache: true
-      when: ansible_facts.distribution == 'Debian'
+      when: ansible_distribution == 'Debian'
 
 - name: Verify
   hosts: localhost
@@ -22,7 +22,7 @@
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: Execute cinc-auditor tests
-      ansible.builtin.command: >
+      command: >
         docker run
         --volume /run/docker.sock:/run/docker.sock
         docker.io/cincproject/auditor exec
@@ -34,10 +34,10 @@
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      ansible.builtin.debug:
+      debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      ansible.builtin.fail:
-        msg: Inspec failed to validate
+      fail:
+        msg: "Inspec failed to validate"
       when: test_results.rc != 0

molecule/os_hardening/converge.yml

@@ -1,36 +1,38 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  collections:
+    - devsec.hardening
   tasks:
-    - name: Workaround for https://github.com/ansible/ansible/issues/66304
-      ansible.builtin.set_fact:
-        ansible_virtualization_type: docker
-    - name: Include os_hardening role
-      ansible.builtin.include_role:
-        name: devsec.hardening.os_hardening
+    - name: workaround for https://github.com/ansible/ansible/issues/66304
+      set_fact:
+        ansible_virtualization_type: "docker"
+    - include_role:
+        name: os_hardening
   vars:
     os_security_users_allow: change_user
     os_security_kernel_enable_core_dump: false
-    os_auditd_enabled: false
+    os_auditd_num_logs: 10
     os_security_suid_sgid_remove_from_unknown: true
     os_auth_pam_passwdqc_enable: false
     os_auth_lockout_time: 15
-    os_env_extra_user_paths: [/home]
+    os_desktop_enable: true
+    os_env_extra_user_paths: ['/home']
     os_auth_allow_homeless: true
-    os_security_suid_sgid_blacklist: [/bin/umount]
-    os_security_suid_sgid_whitelist: [/usr/bin/rlogin]
+    os_security_suid_sgid_blacklist: ['/bin/umount']
+    os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
     os_filesystem_whitelist: []
-    os_yum_repo_file_whitelist: [foo.repo]
-    os_users_without_password_ageing: [pw_no_ageing]
+    os_yum_repo_file_whitelist: ['foo.repo']
+    os_users_without_password_ageing: ['pw_no_ageing']
     os_auth_pw_warn_age: 7
     os_netrc_enabled: false
-    os_ignore_users: [shell_sys_acc]
-    os_ignore_home_folder_users: [user_with_777_home]
+    os_ignore_users: ["shell_sys_acc"]
+    os_ignore_home_folder_users: ["user_with_777_home"]
     sysctl_config:
       net.ipv4.ip_forward: 0
       net.ipv6.conf.all.forwarding: 0
@@ -71,6 +73,8 @@
 # - name: wrapper playbook for kitchen testing "ansible-os-hardening"
 #  hosts: all
 #  become: true
+#  collections:
+#    - devsec.hardening
 #  vars:
 #    os_auditd_enabled: false
 #  tasks:
@@ -80,9 +84,9 @@
 #      when: ansible_facts.distribution == 'Fedora'
 #
 #    - name: Run the equivalent of "apt-get update" as a separate step
-#      ansible.builtin.apt:
+#      apt:
 #        update_cache: yes
 #      when: ansible_facts.os_family == 'Debian'
 #
 #    - include_role:
-#        name: devsec.hardening.os_hardening
+#        name: os_hardening

molecule/os_hardening/molecule.yml

@@ -3,7 +3,7 @@ driver:
   name: docker
 platforms:
   - name: instance
-    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
+    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -17,8 +17,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer
-      inject_facts_as_vars: false
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
   name: ansible
 
@@ -29,7 +28,6 @@ scenario:
     - prepare
   check_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -45,7 +43,6 @@ scenario:
     - destroy
   test_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create

molecule/os_hardening/prepare.yml

@@ -1,5 +1,5 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
   environment:
@@ -7,32 +7,32 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: Set ansible_python_interpreter to "/usr/bin/python3" on fedora
-      ansible.builtin.set_fact:
-        ansible_python_interpreter: /usr/bin/python3
+    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
+      set_fact:
+        ansible_python_interpreter: "/usr/bin/python3"
       when: ansible_facts.distribution == 'Fedora'
 
     - name: Run the equivalent of "apt-get update && apt-get upgrade"
-      ansible.builtin.apt:
-        upgrade: safe
+      apt:
+        name: "*"
+        state: latest
         update_cache: true
-      when: ansible_facts.os_family == 'Debian'
+      when: ansible_os_family == 'Debian'
 
-    - name: Install required tools on SuSE
+    - name: install required tools on SuSE
       # cannot use zypper module, since it depends on python-xml
-      ansible.builtin.command: zypper -n install awk
-      changed_when: false
+      shell: "zypper -n install python-xml"
       when: ansible_facts.os_family == 'Suse'
 
-    - name: Install required tools on fedora
-      ansible.builtin.dnf:
+    - name: install required tools on fedora
+      dnf:
         name:
           - python
           - findutils
           - procps-ng
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: Install required tools on Arch
+    - name: install required tools on Arch
       community.general.pacman:
         name:
           - awk
@@ -40,8 +40,8 @@
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: Install required tools on RHEL # noqa ignore-errors
-      ansible.builtin.dnf:
+    - name: install required tools on RHEL  # noqa ignore-errors
+      yum:
         name:
           - openssh-clients
           - openssh
@@ -49,15 +49,15 @@
         update_cache: true
       ignore_errors: true
 
-    - name: Create recursing symlink to test minimize access
-      ansible.builtin.shell: rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz
+    - name: create recursing symlink to test minimize access
+      shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
       changed_when: false
 
-    - name: Include YUM prepare tasks
-      ansible.builtin.include_tasks: prepare_tasks/yum.yml
+    - name: include YUM prepare tasks
+      include_tasks: prepare_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'
 
-    - name: Include preparation tasks
+    - name: include preparation tasks
       ansible.builtin.include_tasks:
         file: "{{ item }}"
       loop:

molecule/os_hardening/prepare_tasks/ignore_home_folders.yml

@@ -1,7 +1,7 @@
 ---
 - name: Create user whose home-folder should not be touched
   ansible.builtin.user:
-    name: user_with_777_home
+    name: "user_with_777_home"
 
 - name: Change mode of home-folder for user to 777
   ansible.builtin.file:

molecule/os_hardening/prepare_tasks/netrc.yml

@@ -1,8 +1,8 @@
 ---
 - name: create '.netrc' in /root
   ansible.builtin.copy:
-    dest: /root/.netrc
-    mode: "0600"
+    dest: '/root/.netrc'
+    mode: '0600'
     content: |
       machine localhost
       login root

molecule/os_hardening/prepare_tasks/pw_ageing.yml

@@ -1,12 +1,9 @@
----
 - name: Create user those password ageing should not be changed
   user:
-    name: pw_no_ageing
-    password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
-    password_expire_max: "-1"
+    name: "pw_no_ageing"
+    password: "$6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1"
 
 - name: Create user those password ageing should be changed
   user:
-    name: pw_ageing
-    password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
-    password_expire_max: "-1"
+    name: "pw_ageing"
+    password: "$6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1"

molecule/os_hardening/prepare_tasks/sys_account_shell.yml

@@ -1,5 +1,5 @@
 ---
 - name: Create system user with shell that should keep it
   user:
-    name: shell_sys_acc
-    shell: /bin/bash
+    name: "shell_sys_acc"
+    shell: "/bin/bash"

molecule/os_hardening/prepare_tasks/yum.yml

@@ -1,5 +1,5 @@
 ---
-- name: Create 'foo' repository
+- name: create 'foo' repository
   ansible.builtin.yum_repository:
     name: foo
     description: mandatory description
@@ -7,7 +7,7 @@
     enabled: false
     gpgcheck: false
 
-- name: Create 'bar' repository
+- name: create 'bar' repository
   ansible.builtin.yum_repository:
     name: bar
     description: mandatory description

molecule/os_hardening/verify.yml

@@ -7,28 +7,25 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: Set ansible_python_interpreter to "/usr/bin/python3"
-      ansible.builtin.set_fact:
-        ansible_python_interpreter: /usr/bin/python3
-      when: ansible_facts.distribution == 'Fedora'
+    - name: set ansible_python_interpreter to "/usr/bin/python3"
+      set_fact:
+        ansible_python_interpreter: "/usr/bin/python3"
 
-    - name: Include verification tasks
+    - name: include verification tasks
       ansible.builtin.include_tasks:
         file: "{{ item }}"
-      loop:
+      loop: 
         - verify_tasks/sys_account_shell.yml
         - verify_tasks/pw_ageing.yml
         - verify_tasks/netrc.yml
         - verify_tasks/ignore_home_folders.yml
-        - verify_tasks/ssh_auth_locked.yml
 
-    # temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
-    #    - name: Include PAM tests
-    #      ansible.builtin.include_tasks: verify_tasks/pam.yml
-    #      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+    - name: include PAM tests
+      include_tasks: verify_tasks/pam.yml
+      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
 
-    - name: Include YUM tests
-      ansible.builtin.include_tasks: verify_tasks/yum.yml
+    - name: include YUM tests
+      include_tasks: verify_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'
 
 - name: Verify
@@ -39,7 +36,7 @@
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: Execute cinc-auditor tests
-      ansible.builtin.command: >
+      command: >
         docker run
         --volume /run/docker.sock:/run/docker.sock
         --volume {{ playbook_dir }}/waivers.yaml:/waivers.yaml
@@ -53,12 +50,12 @@
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      ansible.builtin.debug:
+      debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      ansible.builtin.fail:
-        msg: Inspec failed to validate
+      fail:
+        msg: "Inspec failed to validate"
       when: test_results.rc != 0
 
 - name: Verify
@@ -68,20 +65,19 @@
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  vars:
-    os_auditd_enabled: false
-    os_env_umask: "027 #override"
+  collections:
+    - devsec.hardening
   tasks:
     # test if variable can be overridden
-    - name: Workaround for https://github.com/ansible/ansible/issues/66304
-      ansible.builtin.set_fact:
-        ansible_virtualization_type: docker
+    - name: workaround for https://github.com/ansible/ansible/issues/66304
+      set_fact:
+        ansible_virtualization_type: "docker"
+        os_env_umask: "027 #override"
 
-    - name: Include os_hardening role
-      ansible.builtin.include_role:
-        name: devsec.hardening.os_hardening
+    - include_role:
+        name: os_hardening
 
-    - name: Verify os_env_umask
-      ansible.builtin.command:
+    - name: verify os_env_umask
+      shell:
         cmd: "grep '027 #override' /etc/login.defs"
       changed_when: false

molecule/os_hardening/verify_tasks/netrc.yml

@@ -1,19 +1,19 @@
 ---
-- name: Test that .netrc in root homedir exists
+- name: test that .netrc in root homedir exists
   ansible.builtin.file:
-    path: /root/.netrc
+    path: '/root/.netrc'
     state: file
   register: result_test_netrc
 
-- name: Output result if .netrc for user root exists
+- name: output result if .netrc for user root exists
   ansible.builtin.assert:
     that:
-      - result_test_netrc.state == 'file'
-    fail_msg: .netrc in /root/ not present
-    success_msg: .netrc exists in /root/
+      - "result_test_netrc.state == 'file'"
+    fail_msg: ".netrc in /root/ not present"
+    success_msg: ".netrc exists in /root/"
 
-- name: Delete '.netrc' in /root
+- name: delete '.netrc' in /root
   ansible.builtin.file:
-    path: /root/.netrc
+    path: '/root/.netrc'
     state: absent
   when: result_test_netrc.state == 'file'

molecule/os_hardening/verify_tasks/pam.yml

@@ -1,4 +1,5 @@
 ---
+
 - name: install pip
   package:
     name:
@@ -13,12 +14,12 @@
     executable: /usr/bin/pip3
 
 - name: set password for test
-  ansible.builtin.set_fact:
-    test_pw: myTest!pw
+  set_fact:
+    test_pw: "myTest!pw"
 
 - name: set locale for test
-  ansible.builtin.set_fact:
-    locale: en_US.UTF-8
+  set_fact:
+    locale: "en_US.UTF-8"
   when:
     - ansible_facts.os_family == 'RedHat'
     - ansible_facts.distribution_major_version < '8'
@@ -29,16 +30,16 @@
     password: "{{ test_pw | password_hash('sha512') }}"
 
 - name: check successful login with correct password
-  ansible.builtin.shell:
-    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
+  shell:
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
     LANG: "{{ locale | default('C.UTF-8') }}"
 
 - name: check unsuccessful login with incorrect password
-  ansible.builtin.shell:
-    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail
+  shell:
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -46,8 +47,8 @@
   with_sequence: count=6
 
 - name: check unsuccessful login, with correct password (lockout)
-  ansible.builtin.shell:
-    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail
+  shell:
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -58,8 +59,8 @@
     seconds: 20
 
 - name: check successful login
-  ansible.builtin.shell:
-    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
+  shell:
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"

molecule/os_hardening/verify_tasks/pw_ageing.yml

@@ -7,7 +7,7 @@
 - name: Check that the expiry date of pw_no_ageing is "never"
   ansible.builtin.assert:
     that:
-      - expiry_date.stdout | trim == 'never'
+      - "expiry_date.stdout | trim == 'never'"
 
 - name: Get Password Expiry date for pw_ageing
   ansible.builtin.shell: chage -l pw_ageing | grep "Password expires" | cut -d ":" -f 2
@@ -19,7 +19,7 @@
     # this uses the date from the expire_date variable and subtracts the current date.
     # it should be bigger that the password_expire_min of the user "pw_no_ageing"
     that:
-      - ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_facts.date_time.date | to_datetime('%Y-%m-%d')).days == 60
+      - "{{ ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_date_time.date | to_datetime('%Y-%m-%d')).days }} == 60"
 
 - name: Get Password Expiry warning days for pw_ageing
   ansible.builtin.shell: chage -l pw_ageing | grep "warning before password expires" | cut -d ":" -f 2
@@ -29,4 +29,4 @@
 - name: Check that number of days of warning before password expires is 7 days
   ansible.builtin.assert:
     that:
-      - expiry_warndays.stdout | trim == '7'
+      - "expiry_warndays.stdout | trim == '7'"

molecule/os_hardening/verify_tasks/ssh_auth_locked.yml

@@ -1,90 +0,0 @@
----
-- name: Install tools
-  package:
-    name: "{{ item }}"
-    state: present
-  ignore_errors: true
-  loop:
-    - sshpass
-    - openssh
-    - openssh-clients
-    - openssh-server
-
-- name: Allow password Login for sshd
-  ansible.builtin.lineinfile:
-    path: /etc/ssh/sshd_config
-    search_string: PasswordAuthentication no
-    line: PasswordAuthentication yes
-  when:
-    - ansible_facts.distribution == "Amazon"
-
-- name: Start sshd service
-  ansible.builtin.service:
-    name: "{{ item }}"
-    state: started
-  ignore_errors: true
-  loop:
-    - sshd
-    - ssh
-
-- name: Set password for test
-  ansible.builtin.set_fact:
-    test_pw: myTest!pw
-
-- name: Create locked_user
-  user:
-    name: locked_user
-    password: "{{ test_pw | password_hash('sha512') }}"
-
-- name: Create ssh-client-keypair
-  community.crypto.openssh_keypair:
-    path: /root/locked_user_id
-    type: ed25519
-    state: present
-  register: generated_key
-
-- name: Add ssh-public-key to locked_user
-  ansible.posix.authorized_key:
-    user: locked_user
-    key: "{{ generated_key.public_key }}"
-    state: present
-
-- name: Check successful login with password
-  ansible.builtin.shell:
-    cmd: sshpass -p {{ test_pw }} ssh -o StrictHostKeyChecking=no locked_user@localhost echo "success"
-
-- name: Check successful login with ssh key
-  ansible.builtin.shell:
-    cmd: ssh -i /root/locked_user_id -o StrictHostKeyChecking=no locked_user@localhost echo "success"
-
-- name: Set password change date for locked_user
-  ansible.builtin.shell:
-    cmd: chage -d 2020-01-01 locked_user
-
-- name: Check unsuccessful login with password
-  ansible.builtin.shell:
-    cmd: sshpass -p {{ test_pw }} ssh -o StrictHostKeyChecking=no locked_user@localhost echo "success"
-  register: output
-  ignore_errors: true
-
-- name: Assert check unsuccessful login
-  ansible.builtin.assert:
-    that:
-      - output.rc | int == 1
-      - "'WARNING: Your password has expired.' in output.stderr"
-      - "'success' not in output.stdout"
-  when:
-    - ansible_facts.os_family != "Suse"
-
-- name: Assert check unsuccessful login
-  ansible.builtin.assert:
-    that:
-      - output.rc | int == 5
-      - "'(password expired)' in output.stderr"
-      - output.stdout | length == 0
-  when:
-    - ansible_facts.os_family == "Suse"
-
-- name: Check successful login with ssh key
-  ansible.builtin.shell:
-    cmd: ssh -i /root/locked_user_id -o StrictHostKeyChecking=no locked_user@localhost echo "success"

molecule/os_hardening/verify_tasks/sys_account_shell.yml

@@ -1,9 +1,8 @@
----
 - name: Read local linux user database
   getent:
     database: passwd
 
 - name: Check that shell_sys_acc's shell is still bash
-  ansible.builtin.assert:
+  assert:
     that:
-      - ansible_facts.getent_passwd['shell_sys_acc'][5] == "/bin/bash"
+      - getent_passwd['shell_sys_acc'][5] == "/bin/bash"

molecule/os_hardening/verify_tasks/yum.yml

@@ -1,8 +1,8 @@
 ---
-- name: Verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
-  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
+- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
+  command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
   changed_when: false
 
-- name: Verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
-  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
+- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
+  command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
   changed_when: false

molecule/os_hardening_vm/converge.yml

@@ -1,53 +1,23 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  collections:
+    - devsec.hardening
   tasks:
-    - name: Override for arch
-      ansible.builtin.set_fact:
+    - name: override for arch
+      set_fact: 
         os_mnt_boot_enabled: false
-        os_mnt_tmp_enabled: true
-        os_mnt_tmp_src: tmpfs
-        os_mnt_tmp_filesystem: tmpfs
       when: ansible_facts.os_family == 'Archlinux'
-
-    - name: Overrides for Fedora image
-      ansible.builtin.set_fact:
-        os_mnt_tmp_enabled: true
-        os_mnt_tmp_src: tmpfs
-        os_mnt_tmp_filesystem: tmpfs
-      when: ansible_facts.distribution == 'Fedora'
-
-    - name: Overrides for Fedora 40 image
-      ansible.builtin.set_fact:
-        os_mnt_var_enabled: true
-        os_mnt_var_src: UUID=282c6d73-afc2-4113-9856-c7679ad51920
-        os_mnt_var_filesystem: btrfs
-        os_mnt_var_options: rw,nosuid,nodev,compress=zstd:1,subvol=var
-      when:
-        - ansible_facts.distribution == 'Fedora'
-        - ansible_facts.distribution_major_version|int == 40
-
-    - name: Overrides for Debian 13 image
-      ansible.builtin.set_fact:
-        os_mnt_tmp_enabled: true
-        os_mnt_tmp_src: tmpfs
-        os_mnt_tmp_filesystem: tmpfs
-      when:
-        - ansible_facts.distribution == 'Debian'
-        - ansible_facts.distribution_major_version|int == 13
-
-    - name: Include os_hardening role
-      ansible.builtin.include_role:
-        name: devsec.hardening.os_hardening
+    - include_role:
+        name: os_hardening
   vars:
     os_auth_pam_passwdqc_enable: false
     os_auth_lockout_time: 15
-    os_yum_repo_file_whitelist: [foo.repo]
+    os_yum_repo_file_whitelist: ['foo.repo']
     os_mnt_boot_enabled: true
-    os_mnt_home_enabled: true
-    os_mnt_boot_src: /dev/vda1
+    os_mnt_boot_src: "/dev/vda1"

molecule/os_hardening_vm/molecule.yml

@@ -2,7 +2,7 @@
 dependency:
   name: galaxy
   options:
-    role-file: molecule/os_hardening_vm/requirements.yml
+    role-file: molecule/os_hardening/requirements.yml
 driver:
   name: vagrant
   provider:
@@ -11,8 +11,8 @@ platforms:
   # we need to name every instance differently to start multiple VMs on the same host (parallelization)
   # since we also need to use different OS users to run the tests because of how molecule operates,
   # the VM names must be predictable by OS user (to clean up canceled runs)
-  - name: ${USER}
-    box: ${MOLECULE_DISTRO}
+  - name: "${USER}"
+    box: "generic/${MOLECULE_DISTRO}"
     memory: 1024
     cpus: 2
 provisioner:
@@ -24,10 +24,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer
-      # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
-      library: "${MOLECULE_PROJECT_DIRECTORY}/plugins/modules:/usr/share/ansible:${MOLECULE_VAGRANT_PLUGIN_DIR}"
-      inject_facts_as_vars: false
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
   name: ansible
   env:
@@ -40,7 +37,6 @@ scenario:
     - prepare
   check_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -56,7 +52,6 @@ scenario:
     - destroy
   test_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create

molecule/os_hardening_vm/prepare.yml

@@ -1,25 +1,5 @@
 ---
-- name: Prepare Archliux host
-  hosts: all
-  become: true
-  gather_facts: false
-  tasks:
-    - name: Update keyring
-      ansible.builtin.raw: pacman --noconfirm -Sy archlinux-keyring
-      changed_when: false
-      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
-
-    - name: Update OS
-      ansible.builtin.raw: pacman --noconfirm -Suy
-      changed_when: false
-      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
-
-    - name: Install python, since it's not installed by default
-      ansible.builtin.raw: pacman --noconfirm -Sy python
-      changed_when: false
-      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
-
-- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
   environment:
@@ -27,71 +7,39 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: Set ansible_python_interpreter to "/usr/bin/python3" on fedora
-      ansible.builtin.set_fact:
-        ansible_python_interpreter: /usr/bin/python3
+    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
+      set_fact:
+        ansible_python_interpreter: "/usr/bin/python3"
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: Block update of Grub, because of error
-      ansible.builtin.dpkg_selections:
-        name: grub-pc
-        selection: hold
-      when: ansible_facts.os_family == 'Debian'
-
-    # we need to free up space, since the /boot partition in some Vagrant images is
-    # pretty small and system updates might fail
-    - name: Find all initrd.img to delete them
-      ansible.builtin.find:
-        paths: /boot
-        patterns: "initrd.img*"
-      register: find_results
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: Delete all initrd.img to free space on /boot
-      ansible.builtin.file:
-        path: "{{ item['path'] }}"
-        state: absent
-      with_items: "{{ find_results['files'] }}"
-      when: ansible_facts.os_family == 'Debian'
-
     - name: Run the equivalent of "apt-get update && apt-get upgrade"
-      ansible.builtin.apt:
-        upgrade: safe
+      apt:
         update_cache: true
-      when: ansible_facts.os_family == 'Debian'
+      when: ansible_os_family == 'Debian'
 
-    - name: Install required tools on fedora
-      ansible.builtin.dnf:
+    - name: install required tools on SuSE
+      # cannot use zypper module, since it depends on python-xml
+      shell: "zypper -n install python-xml"
+      when: ansible_facts.os_family == 'Suse'
+
+    - name: install required tools on fedora
+      dnf:
         name:
           - python
           - findutils
           - procps-ng
-          - python3-libselinux
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: Install required tools on AlmaLinux
-      ansible.builtin.dnf:
-        name:
-          - initscripts
-      when: ansible_facts.distribution == 'AlmaLinux'
-
-    - name: Install required tools on Arch
+    - name: install required tools on Arch
       community.general.pacman:
         name:
           - awk
-          - archlinux-keyring
-        state: latest
+        state: present
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: Run the equivalent of "pacman -Syu"
-      community.general.pacman:
-        update_cache: true
-        upgrade: true
-      when: ansible_facts.os_family == 'Archlinux'
-
-    - name: Install required tools on RHEL # noqa ignore-errors
-      ansible.builtin.dnf:
+    - name: install required tools on RHEL  # noqa ignore-errors
+      yum:
         name:
           - openssh-clients
           - openssh
@@ -99,15 +47,10 @@
         update_cache: true
       ignore_errors: true
 
-    - name: Create recursing symlink to test minimize access
-      ansible.builtin.shell: rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz
+    - name: create recursing symlink to test minimize access
+      shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
       changed_when: false
 
-    - name: Unmount EFI partition to get rid of vfat filesystem (qemu has no firmware image that inspec can detect)
-      ansible.posix.mount:
-        path: /boot/efi
-        state: unmounted
-
-    - name: Include YUM prepare tasks
-      ansible.builtin.include_tasks: prepare_tasks/yum.yml
+    - name: include YUM prepare tasks
+      include_tasks: prepare_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'

molecule/os_hardening_vm/prepare_tasks/yum.yml

@@ -1,5 +1,5 @@
 ---
-- name: Create 'foo' repository
+- name: create 'foo' repository
   ansible.builtin.yum_repository:
     name: foo
     description: mandatory description
@@ -7,7 +7,7 @@
     enabled: false
     gpgcheck: false
 
-- name: Create 'bar' repository
+- name: create 'bar' repository
   ansible.builtin.yum_repository:
     name: bar
     description: mandatory description

molecule/os_hardening_vm/requirements.yml

@@ -1,3 +1,3 @@
 ---
 roles:
-  - name: geerlingguy.git
+  - geerlingguy.git

molecule/os_hardening_vm/verify.yml

@@ -7,13 +7,13 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    # temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
-    #    - name: Include PAM tests
-    #      ansible.builtin.include_tasks: verify_tasks/pam.yml
-    #      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
 
-    - name: Include YUM tests
-      ansible.builtin.include_tasks: verify_tasks/yum.yml
+    - name: include PAM tests
+      include_tasks: verify_tasks/pam.yml
+      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+
+    - name: include YUM tests
+      include_tasks: verify_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'
 
 - name: Verify
@@ -23,23 +23,22 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: Get ssh-config
-      ansible.builtin.command:
-        cmd: vagrant ssh-config
+    - name: get ssh-config
+      command:
+        cmd: "vagrant ssh-config"
         chdir: "{{ molecule_ephemeral_directory }}"
       register: ssh_config
       changed_when: false
 
-    - name: Create ssh-config file
-      ansible.builtin.copy:
+    - name: create ssh-config file
+      copy:
         content: "{{ ssh_config.stdout_lines | join ('\n') }}"
         dest: "{{ molecule_ephemeral_directory }}/ssh-config"
-        mode: "0400"
       changed_when: false
 
     - name: Execute cinc-auditor tests
-      ansible.builtin.command: >
-        docker run --rm
+      command: >
+        docker run
         --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
         docker.io/cincproject/auditor exec
         --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
@@ -51,10 +50,10 @@
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      ansible.builtin.debug:
+      debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      ansible.builtin.fail:
-        msg: Inspec failed to validate
+      fail:
+        msg: "Inspec failed to validate"
       when: test_results.rc != 0

molecule/os_hardening_vm/verify_tasks/pam.yml

@@ -12,12 +12,12 @@
     state: present
 
 - name: set password for test
-  ansible.builtin.set_fact:
-    test_pw: myTest!pw
+  set_fact:
+    test_pw: "myTest!pw"
 
 - name: set locale for test
-  ansible.builtin.set_fact:
-    locale: en_US.UTF-8
+  set_fact:
+    locale: "en_US.UTF-8"
   when:
     - ansible_facts.os_family == 'RedHat'
     - ansible_facts.distribution_major_version < '8'
@@ -28,16 +28,16 @@
     password: "{{ test_pw | password_hash('sha512') }}"
 
 - name: check successful login with correct password
-  ansible.builtin.shell:
-    cmd: pam-tester --user testuser --password {{ test_pw }}
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
     LANG: "{{ locale | default('C.UTF-8') }}"
 
 - name: check unsuccessful login with incorrect password
-  ansible.builtin.shell:
-    cmd: pam-tester --user testuser --password {{ test_pw }}fail --expectfail
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -45,8 +45,8 @@
   with_sequence: count=6
 
 - name: check unsuccessful login, with correct password (lockout)
-  ansible.builtin.shell:
-    cmd: pam-tester --user testuser --password {{ test_pw }} --expectfail
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -57,8 +57,8 @@
     seconds: 20
 
 - name: check successful login
-  ansible.builtin.shell:
-    cmd: pam-tester --user testuser --password {{ test_pw }}
+  shell:
+    cmd: "pam-tester --user testuser --password {{ test_pw }}"
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"

molecule/os_hardening_vm/verify_tasks/yum.yml

@@ -1,8 +1,8 @@
 ---
-- name: Verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
-  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
+- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
+  command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
   changed_when: false
 
-- name: Verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
-  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
+- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
+  command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
   changed_when: false

molecule/shared/prerequisites.yml

@@ -1,9 +0,0 @@
----
-- name: Verify prerequisites
-  hosts: localhost
-  tasks:
-    - name: Make sure environment variable for MOLECULE_DISTRO is set
-      ansible.builtin.assert:
-        that:
-          - "lookup('env','MOLECULE_DISTRO') | length > 0"
-        fail_msg: "You need to set MOLECULE_DISTRO to a supported image name. See CONTRIBUTING.md"

molecule/ssh_hardening/converge.yml

@@ -1,13 +1,14 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  collections:
+    - devsec.hardening
   tasks:
-    - name: Include ssh_hardening role
-      ansible.builtin.include_role:
-        name: devsec.hardening.ssh_hardening
+    - include_role:
+        name: ssh_hardening
   vars:
     sftp_enabled: false

molecule/ssh_hardening/molecule.yml

@@ -3,7 +3,7 @@ driver:
   name: docker
 platforms:
   - name: instance
-    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
+    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -17,8 +17,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer
-      inject_facts_as_vars: false
+      callbacks_enabled: profile_tasks, timer, yaml
   inventory:
     host_vars:
       # https://molecule.readthedocs.io/en/latest/examples.html#docker-with-non-privileged-user
@@ -35,7 +34,6 @@ scenario:
     - prepare
   check_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -51,7 +49,6 @@ scenario:
     - destroy
   test_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create

molecule/ssh_hardening/prepare.yml

@@ -1,5 +1,5 @@
 ---
-- name: Prepare the molecule container for the role
+- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
   become: true
   environment:
@@ -7,38 +7,33 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: Use python3
-      ansible.builtin.set_fact:
+    - name: use python3
+      set_fact:
         ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: Install dnf packages # noqa ignore-errors
-      ansible.builtin.dnf:
+    - name: install packages  # noqa ignore-errors
+      yum:
         name:
           - openssh-clients
           - openssh-server
-        state: present
-        update_cache: true
-      ignore_errors: true
-
-    - name: Install libselinux-python # noqa ignore-errors
-      ansible.builtin.dnf:
-        name:
           - libselinux-python
         state: present
         update_cache: true
       ignore_errors: true
 
-    - name: Install procps-ng # noqa ignore-errors
-      ansible.builtin.dnf:
+    - name: install packages  # noqa ignore-errors
+      dnf:
         name:
+          - openssh-clients
+          - openssh-server
           - procps-ng
         state: present
         update_cache: true
       ignore_errors: true
 
-    - name: Install apt packages # noqa ignore-errors
-      ansible.builtin.apt:
+    - name: install packages  # noqa ignore-errors
+      apt:
         name:
           - openssh-client
           - openssh-server
@@ -46,28 +41,19 @@
         update_cache: true
       ignore_errors: true
 
-    - name: Install required tools on SuSE
+    - name: install required tools on SuSE
       # cannot use zypper module, since it depends on python-xml
-      ansible.builtin.command: zypper -n install python-xml
-      changed_when: false
+      shell: "zypper -n install python-xml"
       when: ansible_facts.os_family == 'Suse'
 
-    - name: Install packages on SuSE
-      community.general.zypper:
+    - name: install packages
+      zypper:
         name:
-          - openssh
+          - "openssh"
       when: ansible_facts.os_family == 'Suse'
 
-    - name: Install required tools on Alpine
-      community.general.apk:
-        name:
-          - openssh
-        state: present
-        update_cache: true
-      when: ansible_facts.os_family == 'Alpine'
-
-    - name: Install required tools on Arch
-      community.general.pacman:
+    - name: install required tools on Arch
+      pacman:
         name:
           - openssh
           - awk
@@ -75,6 +61,16 @@
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: Create ssh host keys # noqa ignore-errors no-changed-when
-      ansible.builtin.command: ssh-keygen -A
+    - name: created needed directory
+      file:
+        path: "/var/run/sshd"
+        state: directory
+
+    - name: create ssh host keys  # noqa ignore-errors
+      command: "ssh-keygen -A"
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
+            ansible_facts.distribution == "Fedora" or
+            ansible_facts.distribution == "Amazon" or
+            ansible_facts.os_family == "Suse"
+      changed_when: false
       ignore_errors: true

molecule/ssh_hardening/verify.yml

@@ -7,7 +7,7 @@
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: Execute cinc-auditor tests
-      ansible.builtin.command: >
+      command: >
         docker run
         --volume /run/docker.sock:/run/docker.sock
         docker.io/cincproject/auditor exec
@@ -19,10 +19,10 @@
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      ansible.builtin.debug:
+      debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      ansible.builtin.fail:
-        msg: Inspec failed to validate
+      fail:
+        msg: "Inspec failed to validate"
       when: test_results.rc != 0

molecule/ssh_hardening_bsd/converge.yml

@@ -1,13 +1,14 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  collections:
+    - devsec.hardening
   tasks:
-    - name: Include ssh_hardening role
-      ansible.builtin.include_role:
-        name: devsec.hardening.ssh_hardening
+    - include_role:
+        name: ssh_hardening
   vars:
     sftp_enabled: false

molecule/ssh_hardening_bsd/molecule.yml

@@ -7,8 +7,8 @@ platforms:
   # we need to name every instance differently to start multiple VMs on the same host (parallelization)
   # since we also need to use different OS users to run the tests because of how molecule operates,
   # the VM names must be predictable by OS user (to clean up canceled runs)
-  - name: ${USER}
-    box: ${MOLECULE_DISTRO}
+  - name: "${USER}"
+    box: "generic/${MOLECULE_DISTRO}"
     memory: 1024
     cpus: 2
 provisioner:
@@ -20,10 +20,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer
-      # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
-      library: "${MOLECULE_PROJECT_DIRECTORY}/plugins/modules:/usr/share/ansible:${MOLECULE_VAGRANT_PLUGIN_DIR}"
-      inject_facts_as_vars: false
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
   name: ansible
   env:
@@ -36,7 +33,6 @@ scenario:
     - prepare
   check_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -52,7 +48,6 @@ scenario:
     - destroy
   test_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create

molecule/ssh_hardening_bsd/prepare.yml

@@ -0,0 +1,32 @@
+---
+- name: prepare OpenBSD host
+  hosts: all
+  become: true
+  gather_facts: false
+  tasks:
+    - name: install python
+      # BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
+      raw: "pkg_add python%3.10"
+      when: "lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'"
+
+- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+  hosts: all
+  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: created needed directory
+      file:
+        path: "/var/run/sshd"
+        state: directory
+
+    - name: create ssh host keys  # noqa ignore-errors
+      command: "ssh-keygen -A"
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
+            ansible_facts.distribution == "Fedora" or
+            ansible_facts.distribution == "Amazon" or
+            ansible_facts.os_family == "Suse"
+      changed_when: false
+      ignore_errors: true

molecule/ssh_hardening_bsd/verify.yml

@@ -3,13 +3,12 @@
   hosts: all
   become: true
   tasks:
-    - name: Use the type command instead of which to detect existing commands
-      ansible.builtin.file:
-        src: /usr/bin/which
-        dest: /usr/bin/type
+    - name: use the type command instead of which to detect existing commands
+      file:
+        src: "/usr/bin/which"
+        dest: "/usr/bin/type"
         state: hard
-        mode: "0770"
-      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
+      when: "lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'"
 
 - name: Verify
   hosts: localhost
@@ -18,25 +17,24 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: Get ssh-config
-      ansible.builtin.command:
-        cmd: vagrant ssh-config
+    - name: get ssh-config
+      command: 
+        cmd: "vagrant ssh-config"
         chdir: "{{ molecule_ephemeral_directory }}"
       register: ssh_config
       changed_when: false
 
-    - name: Create ssh-config file
-      ansible.builtin.copy:
+    - name: create ssh-config file
+      copy:
         content: "{{ ssh_config.stdout_lines | join ('\n') }}"
         dest: "{{ molecule_ephemeral_directory }}/ssh-config"
-        mode: "0400"
       changed_when: false
 
     - name: Execute cinc-auditor tests
-      ansible.builtin.command: >
-        docker run --rm
+      command: >
+        docker run
         --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
-        --volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') | regex_replace('^.*/', '') }}.yaml:/waivers.yaml
+        --volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') }}.yaml:/waivers.yaml
         docker.io/cincproject/auditor exec
         --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
         -t ssh://{{ lookup('env', 'USER') }}
@@ -48,10 +46,10 @@
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      ansible.builtin.debug:
+      debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      ansible.builtin.fail:
-        msg: Inspec failed to validate
+      fail:
+        msg: "Inspec failed to validate"
       when: test_results.rc != 0

molecule/ssh_hardening_custom_tests/converge.yml

@@ -1,43 +1,49 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
+- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
   hosts: all
   become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  collections:
+    - devsec.hardening
   tasks:
-    - name: Include ssh_hardening role
-      ansible.builtin.include_role:
-        name: devsec.hardening.ssh_hardening
+    - include_role:
+        name: ssh_hardening
   vars:
-    ssh_trusted_user_ca_keys_file: /etc/ssh/ca.pub
+    ssh_trusted_user_ca_keys_file: '/etc/ssh/ca.pub'
     ssh_trusted_user_ca_keys:
-      - "# ssh-rsa ..."
-    ssh_authorized_principals_file: /etc/ssh/auth_principals/%u
+      - '# ssh-rsa ...'
+    ssh_authorized_principals_file: '/etc/ssh/auth_principals/%u'
     ssh_authorized_principals:
-      - path: /etc/ssh/auth_principals/root
+      - path: "/etc/ssh/auth_principals/root"
         principals:
-          - root
+          - "root"
+        owner: "{{ ssh_owner }}"
+        group: "{{ ssh_group }}"
+        directoryowner: "{{ ssh_owner }}"
+        directorygroup: "{{ ssh_group }}"
+        directorymode: "0700"
     network_ipv6_enable: true
-    ssh_allow_tcp_forwarding: "yes"
-    ssh_gateway_ports: "clientspecified"
+    ssh_allow_tcp_forwarding: 'yes'
+    ssh_gateway_ports: true
     ssh_allow_agent_forwarding: true
-    ssh_server_permit_environment_vars: "yes"
-    ssh_server_accept_env_vars: PWD HTTP_PROXY
+    ssh_server_permit_environment_vars: 'yes'
+    ssh_server_accept_env_vars: 'PWD HTTP_PROXY'
     ssh_client_alive_interval: 100
     ssh_client_alive_count: 10
     ssh_client_password_login: true
     ssh_challengeresponseauthentication: true
     ssh_compression: true
-    ssh_allow_users: root kitchen vagrant
-    ssh_allow_groups: root kitchen vagrant
-    ssh_deny_users: foo bar
-    ssh_deny_groups: foo bar
-    ssh_authorized_keys_file: /etc/ssh/authorized_keys/%u
+    ssh_allow_users: 'root kitchen vagrant'
+    ssh_allow_groups: 'root kitchen vagrant'
+    ssh_deny_users: 'foo bar'
+    ssh_deny_groups: 'foo bar'
+    ssh_authorized_keys_file: '/etc/ssh/authorized_keys/%u'
     ssh_max_auth_retries: 10
-    ssh_permit_root_login: without-password
-    ssh_permit_tunnel: "yes"
+    ssh_permit_root_login: "without-password"
+    ssh_permit_tunnel: true
     ssh_print_motd: true
     ssh_print_last_log: true
     ssh_banner: true
@@ -48,33 +54,33 @@
       - 22
       - 222
     ssh_server_match_address:
-      - address: 192.168.1.0/24
+      - address: '192.168.1.0/24'
         rules:
-          - AllowTcpForwarding yes
-          - AllowAgentForwarding no
+          - 'AllowTcpForwarding yes'
+          - 'AllowAgentForwarding no'
     ssh_server_match_group:
-      - group: root
+      - group: 'root'
         rules:
-          - AllowTcpForwarding yes
-          - AllowAgentForwarding no
+          - 'AllowTcpForwarding yes'
+          - 'AllowAgentForwarding no'
     ssh_server_match_user:
-      - user: root
+      - user: 'root'
         rules:
-          - AllowTcpForwarding yes
-          - AllowAgentForwarding no
+          - 'AllowTcpForwarding yes'
+          - 'AllowAgentForwarding no'
     ssh_server_match_local_port:
       - port: 222
         rules:
-          - AllowTcpForwarding yes
-          - AllowAgentForwarding no
+          - 'AllowTcpForwarding yes'
+          - 'AllowAgentForwarding no'
     ssh_remote_hosts:
-      - names: [example.com, example2.com]
-        options: [Port 2222, ForwardAgent yes]
-      - names: [example3.com]
-        options: [StrictHostKeyChecking no]
+      - names: ['example.com', 'example2.com']
+        options: ['Port 2222', 'ForwardAgent yes']
+      - names: ['example3.com']
+        options: ['StrictHostKeyChecking no']
     ssh_use_dns: true
     ssh_use_pam: true
-    ssh_max_startups: 10:30:60
+    ssh_max_startups: '10:30:60'
     ssh_host_key_algorithms:
       - ssh-ed25519
       - rsa-sha2-512
@@ -88,9 +94,10 @@
       - aes192-ctr
       - aes128-ctr
       - aes256-cbc
-    # these should not be set in the final sshd_config
-    ssh_kex: false
+    ssh_kex:
+      - diffie-hellman-group-exchange-sha256
+      - diffie-hellman-group-exchange-sha1
     ssh_custom_options:
-      - Include /etc/ssh/ssh_config.d/*
+      - "Include /etc/ssh/ssh_config.d/*"
     sshd_custom_options:
-      - AcceptEnv LANG
+      - "AcceptEnv LANG"

molecule/ssh_hardening_custom_tests/molecule.yml

@@ -3,7 +3,7 @@ driver:
   name: docker
 platforms:
   - name: instance
-    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
+    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -17,8 +17,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer
-      inject_facts_as_vars: false
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
   name: ansible
 
@@ -29,7 +28,6 @@ scenario:
     - prepare
   check_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - create
     - prepare
@@ -45,7 +43,6 @@ scenario:
     - destroy
   test_sequence:
     - dependency
-    - verify ../shared/prerequisites.yml
     - destroy
     - syntax
     - create
@@ -53,4 +50,5 @@ scenario:
     - check
     - converge
     - idempotence
+    - verify
     - destroy

molecule/ssh_hardening_custom_tests/prepare.yml

@@ -1,5 +1,5 @@
 ---
-- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
   become: true
   environment:
@@ -7,38 +7,33 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: Use python3
-      ansible.builtin.set_fact:
+    - name: use python3
+      set_fact:
         ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: Install dnf packages # noqa ignore-errors
-      ansible.builtin.dnf:
+    - name: install packages  # noqa ignore-errors
+      yum:
         name:
           - openssh-clients
           - openssh-server
-        state: present
-        update_cache: true
-      ignore_errors: true
-
-    - name: Install libselinux-python # noqa ignore-errors
-      ansible.builtin.dnf:
-        name:
           - libselinux-python
         state: present
         update_cache: true
       ignore_errors: true
 
-    - name: Install procps-ng # noqa ignore-errors
-      ansible.builtin.dnf:
+    - name: install packages  # noqa ignore-errors
+      dnf:
         name:
+          - openssh-clients
+          - openssh-server
           - procps-ng
         state: present
         update_cache: true
       ignore_errors: true
 
-    - name: Install apt packages # noqa ignore-errors
-      ansible.builtin.apt:
+    - name: install packages  # noqa ignore-errors
+      apt:
         name:
           - openssh-client
           - openssh-server
@@ -46,20 +41,19 @@
         update_cache: true
       ignore_errors: true
 
-    - name: Install required tools on SuSE
+    - name: install required tools on SuSE
       # cannot use zypper module, since it depends on python-xml
-      ansible.builtin.command: zypper -n install python-xml
-      changed_when: false
+      shell: "zypper -n install python-xml"
       when: ansible_facts.os_family == 'Suse'
 
-    - name: Install packages on SuSE
-      community.general.zypper:
+    - name: install packages
+      zypper:
         name:
-          - openssh
+          - "openssh"
       when: ansible_facts.os_family == 'Suse'
 
-    - name: Install required tools on Arch
-      community.general.pacman:
+    - name: install required tools on Arch
+      pacman:
         name:
           - openssh
           - awk
@@ -67,14 +61,16 @@
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: Install required tools on Alpine
-      community.general.apk:
-        name:
-          - openssh
-        state: present
-        update_cache: true
-      when: ansible_facts.os_family == 'Alpine'
+    - name: created needed directory
+      file:
+        path: "/var/run/sshd"
+        state: directory
 
-    - name: Create ssh host keys # noqa ignore-errors no-changed-when
-      ansible.builtin.command: ssh-keygen -A
+    - name: create ssh host keys  # noqa ignore-errors
+      command: "ssh-keygen -A"
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
+            ansible_facts.distribution == "Fedora" or
+            ansible_facts.distribution == "Amazon" or
+            ansible_facts.os_family == "Suse"
+      changed_when: false
       ignore_errors: true

molecule/ssh_hardening_vm/prepare.yml

@@ -1,34 +0,0 @@
----
-- name: Prepare OpenBSD host
-  hosts: all
-  become: true
-  gather_facts: false
-  tasks:
-    - name: Change installation source
-      # temporary fix for https://github.com/lavabit/robox/issues/305
-      ansible.builtin.raw: echo "https://ftp.eu.openbsd.org/pub/OpenBSD" > /etc/installurl
-      changed_when: false
-      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
-
-    - name: Install python
-      # BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
-      ansible.builtin.raw: pkg_add -I python%3.11
-      changed_when: false
-      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/openbsd7'
-
-- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
-  hosts: all
-  become: true
-  environment:
-    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
-    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
-    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  tasks:
-    - name: Create ssh host keys # noqa ignore-errors
-      ansible.builtin.command: ssh-keygen -A
-      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
-        or ansible_facts.distribution == "Fedora"
-        or ansible_facts.distribution == "Amazon"
-        or ansible_facts.os_family == "Suse"
-      changed_when: false
-      ignore_errors: true

molecule/ssh_hardening_vm/waivers_almalinux-10.yaml

@@ -1,3 +0,0 @@
-unrelated:
-  run: false
-  justification: "cinc-auditor needs at least one waived control"

molecule/ssh_hardening_vm/waivers_debian-13.yaml

@@ -1,3 +0,0 @@
-unrelated:
-  run: false
-  justification: "cinc-auditor needs at least one waived control"

molecule/ssh_hardening_vm/waivers_ubuntu-24.04.yaml

@@ -1,3 +0,0 @@
-unrelated:
-  run: false
-  justification: "cinc-auditor needs at least one waived control"

molecule/ssh_hardening_vm/waivers_ubuntu-26.04.yaml

@@ -1,3 +0,0 @@
-unrelated:
-  run: false
-  justification: "cinc-auditor needs at least one waived control"

renovate.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:best-practices",
+    "config:base",
     ":gitSignOff"
   ],
   "dependencyDashboard": true,

requirements-vm.txt

@@ -1 +0,0 @@
-molecule-plugins[vagrant]==25.8.12

requirements.txt

@@ -1,7 +1,8 @@
-molecule==26.4.0
-molecule-plugins[docker]==25.8.12
-ansible-core==2.20.5
-docker==7.1.0
-jmespath==1.1.0
-aar-doc==2.3.0
-passlib==1.7.4
+molecule
+molecule-plugins[docker]
+yamllint
+ansible
+ansible-lint
+docker
+flake8
+jmespath

roles/mysql_hardening/README.md

@@ -1,6 +1,6 @@
 # devsec.mysql_hardening
 
-[![devsec.mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
+![devsec.mysql_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.mysql_hardening/badge.svg)
 
 ## Description
 
@@ -12,131 +12,74 @@ It configures:
 - Removes anonymous users, users without a password or authentication_string and test databases
 - various hardening options inside MySQL
 
-Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.
-
-Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
-
 ## Requirements
 
-- An existing installation of MySQL or MariaDB.
+- Ansible 2.9.0
+- An existing MySQL installation
 - python-jmespath on the ansible host
 
-<!-- BEGIN_ANSIBLE_DOCS -->
+### Example playbook
 
-## Supported Operating Systems
-- EL
-  - 8, 9, 10
-- Ubuntu
-  - jammy, noble
-- Debian
-  - trixie, bookworm, bullseye
-- Amazon
-- opensuse
+```yml
+- hosts: localhost
+  collections:
+    - devsec.hardening
+  roles:
+    - mysql_hardening
+```
+
+This role expects an existing installation of MySQL or MariaDB. Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.  
+Please ensure that the following variables are set accordingly:
+
+- `mysql_hardening_enabled: yes` role is enabled by default and can be disabled without removing it from a playbook. You can use conditional variable, for example: `mysql_hardening_enabled: "{{ true if mysql_enabled else false }}"`
+- `mysql_hardening_user: 'mysql'` The user that mysql runs as.
+- `mysql_hardening_mysql_hardening_conf_file: '/etc/mysql/conf.d/hardening.cnf'` The path to the configuration file where the hardening will be performed
+- _deprecated: `mysql_datadir: '/var/lib/mysql'` The MySQL data directory_
+  - `mysql_datadir` is no longer necessary, as MySQL data directory is automatically taken from `mysql_info`. But it can still be defined and will also be checked for correct permissions.
 
 ## Role Variables
 
-- `mysql_daemon_enabled`
-  - Default: `True`
-  - Description: Whether to enable the MySQL-service so it starts on boot
-  - Type: bool
-  - Required: no
 - `mysql_hardening_chroot`
-  - Default: ``
+  - Default: ""
   - Description: [chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)
-  - Type: str
-  - Required: no
-- `mysql_hardening_chroot.automatic-sp-privileges`
-  - Default: `0`
-  - Description: [automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)
-  - Type: int
-  - Required: no
-- `mysql_hardening_enabled`
-  - Default: `True`
-  - Description: Whether to run the hardening
-  - Type: bool
-  - Required: no
-- `mysql_hardening_options.allow-suspicious-udfs`
-  - Default: `0`
-  - Description: [allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)
-  - Type: int
-  - Required: no
-- `mysql_hardening_options.local-infile`
-  - Default: `0`
-  - Description: [local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)
-  - Type: int
-  - Required: no
 - `mysql_hardening_options.safe-user-create`
-  - Default: `1`
+  - Default: 1
   - Description: [safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)
-  - Type: int
-  - Required: no
 - `mysql_hardening_options.secure-auth`
-  - Default: `1`
+  - Default: 1
   - Description: [secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)
-  - Type: int
-  - Required: no
-- `mysql_hardening_options.secure-file-priv`
-  - Default: `/tmp`
-  - Description: [secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)
-  - Type: str
-  - Required: no
 - `mysql_hardening_options.skip-symbolic-links`
-  - Default: `1`
+  - Default: 1
   - Description: [skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)
-  - Type: int
-  - Required: no
-- `mysql_hardening_restart_mysql`
-  - Default: `True`
-  - Description: Restart mysql after running this role
-  - Type: bool
-  - Required: no
 - `mysql_hardening_skip_grant_tables:`
-  - Default: `False`
+  - Default: false
   - Description: [skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)
-  - Type: bool
-  - Required: no
 - `mysql_hardening_skip_show_database`
-  - Default: `1`
+  - Default: 1
   - Description: [skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)
-  - Type: int
-  - Required: no
+- `mysql_hardening_options.local-infile`
+  - Default: 0
+  - Description: [local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)
+- `mysql_hardening_options.allow-suspicious-udfs`
+  - Default: 0
+  - Description: [allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)
+- `mysql_hardening_chroot.automatic-sp-privileges`
+  - Default: 0
+  - Description: [automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)
+- `mysql_hardening_options.secure-file-priv`
+  - Default: /tmp
+  - Description: [secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)
+- `mysql_allow_remote_root`
+  - Default: false
+  - Description: delete remote root users
 - `mysql_remove_anonymous_users`
-  - Default: `True`
-  - Description: Set to `false` to keep users without authentication
-  - Type: bool
-  - Required: no
-- `mysql_remove_remote_root`
-  - Default: `True`
-  - Description: If `true`, root can only connect from localhost. Set to `false` to not remove remote root users.
-  - Type: bool
-  - Required: no
+  - Default: true
+  - Description: remove users without authentication
 - `mysql_remove_test_database`
-  - Default: `True`
-  - Description: Set to `false` to keep the test database
-  - Type: bool
-  - Required: no
-- `mysql_root_password`
-  - Default: `-----====>SetR00tPa$$wordH3r3!!!<====-----`
-  - Description: The default password. Please change or overwrite it
-  - Type: str
-  - Required: no
-- `mysql_user_home`
-  - Default: `{{ ansible_env.HOME }}`
-  - Description: The path where the `.my.cnf` will be stored
-  - Type: str
-  - Required: no
+  - Default: true
+  - Description: remove test database
+- `mysql_hardening_restart_mysql`
+  - Default: true
+  - Description: Restart mysql after running this role
 
-## Dependencies
-
-None.
-
-## Example Playbook
-
-```
-- hosts: all
-  become: true
-  roles:
-    - name: devsec.hardening.mysql_hardening
-```
-
-<!-- END_ANSIBLE_DOCS -->
+Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)

roles/mysql_hardening/defaults/main.yml

@@ -6,6 +6,8 @@ mysql_daemon_enabled: true
 
 mysql_hardening_restart_mysql: true
 
+# general configuration
+mysql_hardening_mysql_hardening_conf_file: "{{ mysql_hardening_mysql_confd_dir }}/hardening.cnf"
 # You have to change this to your own strong enough mysql root password
 mysql_root_password: "-----====>SetR00tPa$$wordH3r3!!!<====-----"
 # There .my.cnf with mysql root credentials will be installed

roles/mysql_hardening/meta/argument_specs.yml

@@ -1,79 +0,0 @@
----
-argument_specs:
-  main:
-    short_description: The main entry point for the mysql hardening role.
-    version_added: 8.8.0
-    options:
-      mysql_hardening_chroot:
-        default: ''
-        type: str
-        description: '[chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)'
-      mysql_hardening_options.safe-user-create:
-        default: 1
-        type: int
-        description: '[safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)'
-      mysql_hardening_options.secure-auth:
-        default: 1
-        type: int
-        description: '[secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)'
-      mysql_hardening_options.skip-symbolic-links:
-        default: 1
-        type: int
-        description: '[skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)'
-      'mysql_hardening_skip_grant_tables:':
-        default: false
-        type: bool
-        description: '[skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)'
-      mysql_hardening_skip_show_database:
-        default: 1
-        type: int
-        description: '[skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)'
-      mysql_hardening_options.local-infile:
-        default: 0
-        type: int
-        description: '[local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)'
-      mysql_hardening_options.allow-suspicious-udfs:
-        default: 0
-        type: int
-        description: '[allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)'
-      mysql_hardening_chroot.automatic-sp-privileges:
-        default: 0
-        type: int
-        description: '[automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)'
-      mysql_hardening_options.secure-file-priv:
-        default: /tmp
-        type: str
-        description: '[secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)'
-      mysql_remove_anonymous_users:
-        default: true
-        type: bool
-        description: Set to `false` to keep users without authentication
-      mysql_remove_test_database:
-        default: true
-        type: bool
-        description: Set to `false` to keep the test database
-      mysql_hardening_restart_mysql:
-        default: true
-        type: bool
-        description: Restart mysql after running this role
-      mysql_hardening_enabled:
-        default: true
-        type: bool
-        description: Whether to run the hardening
-      mysql_daemon_enabled:
-        default: true
-        type: bool
-        description: Whether to enable the MySQL-service so it starts on boot
-      mysql_root_password:
-        default: '-----====>SetR00tPa$$wordH3r3!!!<====-----'
-        type: str
-        description: The default password. Please change or overwrite it
-      mysql_user_home:
-        default: '{{ ansible_env.HOME }}'
-        type: str
-        description: The path where the `.my.cnf` will be stored
-      mysql_remove_remote_root:
-        default: true
-        type: bool
-        description: If `true`, root can only connect from localhost. Set to `false`
-          to not remove remote root users.

roles/mysql_hardening/meta/main.yml

@@ -8,18 +8,18 @@ galaxy_info:
   platforms:
     - name: EL
       versions:
+        - "7"
         - "8"
         - "9"
-        - "10"
     - name: Ubuntu
       versions:
+        - bionic
+        - focal
         - jammy
-        - noble
     - name: Debian
       versions:
-        - trixie
-        - bookworm
         - bullseye
+        - buster
     - name: Amazon
     - name: opensuse
   galaxy_tags:

roles/mysql_hardening/tasks/configure.yml

@@ -14,7 +14,7 @@
     state: directory
     owner: "{{ mysql_hardening_user }}"
     group: "{{ mysql_hardening_user }}"
-    mode: '{{ mysql_hardening_datadir_permissions | default("0750") }}'
+    mode: "0750"
   when: item is defined and item != ""
   loop:
     - "{{ mysql_settings.settings.datadir }}"
@@ -56,7 +56,7 @@
 - name: Apply hardening configuration
   ansible.builtin.template:
     src: hardening.cnf.j2
-    dest: "{{ mysql_hardening_mysql_confd_dir + '/hardening.cnf' }}"
+    dest: "{{ mysql_hardening_mysql_hardening_conf_file }}"
     owner: "{{ mysql_cnf_owner }}"
     group: "{{ mysql_cnf_group }}"
     mode: "0640"

roles/mysql_hardening/tasks/main.yml

@@ -39,13 +39,13 @@
   when: not mysql_distribution is defined
 
 - name: Check which MySQL/MariaDB version is used
-  ansible.mysql.mysql_info:
+  community.mysql.mysql_info:
     filter: version
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   register: mysql_version
 
 - name: Check MySQL/MariaDB settings
-  ansible.mysql.mysql_info:
+  community.mysql.mysql_info:
     filter: settings
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   register: mysql_settings

roles/mysql_hardening/tasks/mysql_secure_installation.yml

@@ -5,7 +5,7 @@
   when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'
 
 - name: Ensure that the root password is present
-  ansible.mysql.mysql_user:
+  community.mysql.mysql_user:
     name: root
     host_all: true
     password: "{{ mysql_root_password | mandatory }}"
@@ -20,14 +20,14 @@
   tags: my_cnf
 
 - name: Ensure that the test database is absent
-  ansible.mysql.mysql_db:
+  community.mysql.mysql_db:
     name: test
     state: absent
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   when: mysql_remove_test_database
 
 - name: Ensure that anonymous users are absent
-  ansible.mysql.mysql_user:
+  community.mysql.mysql_user:
     name: ""
     state: absent
     host_all: true
@@ -35,7 +35,7 @@
   when: mysql_remove_anonymous_users
 
 - name: Ensure that root can only login from localhost
-  ansible.mysql.mysql_query:
+  community.mysql.mysql_query:
     query: >
       DELETE
       FROM mysql.user
@@ -46,18 +46,8 @@
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   when: mysql_remove_remote_root
 
-- name: Detect role support on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
-  ansible.mysql.mysql_query:
-    query: >
-      SELECT 1 FROM information_schema.COLUMNS
-                WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
-                AND COLUMN_NAME = 'is_role';
-    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
-  register: mysql_role_support
-  check_mode: false
-
 - name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
-  ansible.mysql.mysql_query:
+  community.mysql.mysql_query:
     query: >
       SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
       FROM mysql.user
@@ -65,8 +55,7 @@
              OR authentication_string="")
         AND USER NOT IN ('mysql.sys',
                          'mysqlxsys',
-                         'mariadb.sys')
-        {{ 'AND CONVERT(is_role USING utf8) = "N"' if mysql_role_support.rowcount[0] > 0 }};
+                         'mariadb.sys');
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   register: mysql_users_wo_passwords_or_auth_string
   check_mode: false
@@ -76,7 +65,7 @@
     is version('10.4.0', '>='))
 
 - name: Get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
-  ansible.mysql.mysql_query:
+  community.mysql.mysql_query:
     query: >
       SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
       FROM mysql.user
@@ -86,8 +75,7 @@
              OR authentication_string="")
         AND USER NOT IN ('mysql.sys',
                          'mysqlxsys',
-                         'mariadb.sys')
-        {{ 'AND is_role = "N"' if mysql_role_support.rowcount[0] > 0 }};
+                         'mariadb.sys');
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   register: mysql_users_wo_passwords
   check_mode: false
@@ -97,7 +85,7 @@
     version('10.4.0', '<'))
 
 - name: Ensure that there are no users without password or authentication_string
-  ansible.mysql.mysql_query:
+  community.mysql.mysql_query:
     query:
       - DROP USER {{ item.user }}
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"

roles/mysql_hardening/vars/Suse.yml

@@ -6,7 +6,5 @@ mysql_hardening_mysql_confd_dir: '/etc/my.cnf.d'
 mysql_cnf_owner: 'root'  # owner of /etc/my.cnf.d/*.cnf files
 mysql_cnf_group: 'mysql'  # owner of /etc/my.cnf.d/*.cnf files
 
-mysql_hardening_datadir_permissions: "0700"
-
 mysql_hardening_group: 'mysql'
 login_unix_socket: '/run/mysql/mysql.sock'

roles/nginx_hardening/README.md

@@ -1,6 +1,6 @@
 # devsec.nginx_hardening
 
-[![devsec.nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml)
+![devsec.nginx_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.nginx_hardening/badge.svg)
 
 ## Description
 
@@ -8,142 +8,110 @@ This role provides secure nginx configuration. It is intended to be compliant wi
 
 It works with the following nginx-roles, including, but not limited to:
 
-- [nginxinc.nginx](https://galaxy.ansible.com/ui/standalone/roles/nginxinc/nginx/)
-- [geerlinggux.nginx](https://galaxy.ansible.com/ui/standalone/roles/geerlingguy/nginx/)
-- [jdauphant.nginx](https://galaxy.ansible.com/ui/standalone/roles/jdauphant/nginx/)
+- [geerlingguy.nginx](https://galaxy.ansible.com/geerlingguy/nginx/)
+- [nginxinc.nginx](https://galaxy.ansible.com/nginxinc/nginx)
+- [jdauphant.nginx](https://galaxy.ansible.com/jdauphant/nginx/)
+- [franklinkim.nginx](https://galaxy.ansible.com/franklinkim/nginx/)
 
 **NOTE: This role does not work with nginx 1.0.15 or older! Please use the latest version from the official nginx repositories!**
 
-<!-- BEGIN_ANSIBLE_DOCS -->
+## Requirements
 
-## Supported Operating Systems
-- EL
-  - 8, 9, 10
-- Ubuntu
-  - jammy, noble, resolute
-- Debian
-  - trixie, bookworm, bullseye
-- Amazon
+- Ansible >= 2.9
 
 ## Role Variables
 
-- `nginx_add_header`
-  - Default: `['X-Frame-Options SAMEORIGIN', 'X-Content-Type-Options nosniff', 'X-XSS-Protection "1; mode=block"', 'Content-Security-Policy \\"script-src \'self\'; object-src \'self\'\\"']`
-  - Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See [nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
-  - Type: list of ''
-  - Required: no
-- `nginx_client_body_buffer_size`
+- [nginx_client_body_buffer_size][]
   - Default: `1k`
-  - Description: Sets buffer size for reading client request body. In case the request body is larger than the buffer, the whole body or only its part is written to a temporary file. See [nginx_client_body_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size)
-  - Type: str
-  - Required: no
-- `nginx_client_body_timeout`
-  - Default: `10`
-  - Description: Defines a timeout for reading client request body. See [nginx_client_body_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout)
-  - Type: int
-  - Required: no
-- `nginx_client_header_buffer_size`
-  - Default: `1k`
-  - Description: Sets buffer size for reading client request header. For most requests, a buffer of 1K bytes is enough. See [nginx_client_header_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client
-  - Type: str
-  - Required: no
-- `nginx_client_header_timeout`
-  - Default: `10`
-  - Description: Defines a timeout for reading client request header. See [nginx_client_header_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout)
-  - Type: int
-  - Required: no
-- `nginx_client_max_body_size`
-  - Default: `1k`
-  - Description: Sets the maximum allowed size of the client request body, specified in the "Content-Length" request header field. If the size in a request exceeds the configured value, the 413 (Request Entity Too Large) error is returned to the client. See [nginx_client_max_body_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size)
-  - Type: str
-  - Required: no
-- `nginx_configuration_dir`
-  - Default: `/etc/nginx`
-  - Description: The main location for all nginx configuration files
-  - Type: str
-  - Required: no
-- `nginx_configuration_hardening_dir`
-  - Default: `/etc/nginx`
-  - Description: The location for the nginx hardening configuration file (Could be different e.g. when used in jails)
-  - Type: str
-  - Required: no
-- `nginx_dh_size`
-  - Default: `2048`
-  - Description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam)
-  - Type: int
-  - Required: no
-- `nginx_keepalive_timeout`
-  - Default: `5 5`
-  - Description: The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The optional second parameter sets a value in the "Keep-Alive timeout=time" response header field. See [nginx_keepalive_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout)
-  - Type: str
-  - Required: no
-- `nginx_large_client_header_buffers`
-  - Default: `2 1k`
-  - Description: Sets the maximum number and size of buffers used for reading large client request header. See [nginx_large_client_header_buffers](http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers)
-  - Type: str
-  - Required: no
-- `nginx_limit_conn`
-  - Default: `default 5`
-  - Description: Sets the shared memory zone and the maximum allowed number of connections for a given key value. See [nginx_limit_conn](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn)
-  - Type: str
-  - Required: no
-- `nginx_limit_conn_zone`
-  - Default: `$binary_remote_addr zone=default:10m`
-  - Description: Sets parameters for a shared memory zone that will keep states for various keys. See [nginx_limit_conn_zone](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone)
-  - Type: str
-  - Required: no
-- `nginx_owner_group`
-  - Default: `root`
-  - Description: The owner group of the nginx configuration files
-  - Type: str
-  - Required: no
-- `nginx_owner_user`
-  - Default: `root`
-  - Description: The owner user of the nginx configuration files
-  - Type: str
-  - Required: no
-- `nginx_remove_default_site`
-  - Default: `True`
+  - Description: Sets buffer size for reading client request body. In case the request body is larger than the buffer, the whole body or only its part is written to a temporary file.
+- nginx_remove_default_site
+  - Default: `true`
   - Description: Disables the default site. Set to false to enable the default site in nginx.
-  - Type: bool
-  - Required: no
-- `nginx_send_timeout`
-  - Default: `10`
-  - Description: Sets a timeout for transmitting a response to the client. See [nginx_send_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout)
-  - Type: int
-  - Required: no
-- `nginx_server_tokens`
+- [nginx_client_max_body_size][]
+  - Default: `1k`
+  - Description: Sets the maximum allowed size of the client request body, specified in the “Content-Length” request header field. If the size in a request exceeds the configured value, the 41
+    3 (Request Entity Too Large) error is returned to the client.
+- [nginx_keepalive_timeout][]
+  - Default: `5 5`
+  - Description: The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The op
+    tional second parameter sets a value in the “Keep-Alive: timeout=time” response header field.
+- [nginx_server_tokens][]
   - Default: `off`
-  - Description: Disables emitting nginx version in error messages and in the "Server" response header field. Set to on to enable the nginx version in error messages and "Server" response header. See [nginx_server_tokens](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens)
-  - Type: str
-  - Required: no
-- `nginx_ssl_ciphers`
-  - Default: `ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256`
-  - Description: Specifies the TLS ciphers which should be used. See [nginx_ssl_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers)
-  - Type: str
-  - Required: no
-- `nginx_ssl_prefer_server_ciphers`
-  - Default: `on`
-  - Description: Specifies that server ciphers should be preferred over client ciphers when using the TLS protocols. Set to false to disable it. See [nginx_ssl_prefer_server_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers)
-  - Type: str
-  - Required: no
-- `nginx_ssl_protocols`
+  - Description: Disables emitting nginx version in error messages and in the "Server" response header field. Set to on to enable the nginx version in error messages and "Server" response head
+    er.
+- [nginx_client_header_buffer_size][]
+  - Default: `1k`
+  - Description: Sets buffer size for reading client request header. For most requests, a buffer of 1K bytes is enough.
+- [nginx_large_client_header_buffers][]
+  - Default: `2 1k`
+  - Description: Sets the maximum number and size of buffers used for reading large client request header.
+- [nginx_client_body_timeout][]
+  - Default: `10`
+  - Description: Defines a timeout for reading client request body.
+- [nginx_client_header_timeout][]
+  - Default: `10`
+  - Description: Defines a timeout for reading client request header.
+- [nginx_send_timeout][]
+  - Default: `10`
+  - Description: Sets a timeout for transmitting a response to the client.
+- [nginx_limit_conn_zone][]
+  - Default: `$binary_remote_addr zone=default:10m`
+  - Description: Sets parameters for a shared memory zone that will keep states for various keys.
+- [nginx_limit_conn][]
+  - Default: `default 5`
+  - Description: Sets the shared memory zone and the maximum allowed number of connections for a given key value.
+- [nginx_add_header][]
+  - Default: `[ "X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"", Content-Security-Policy \"script-src 'self'; object-src 'self'\" ]`
+  - Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307.
+- [nginx_ssl_protocols][]
   - Default: `TLSv1.2`
-  - Description: Specifies the SSL protocol which should be used. See [nginx_ssl_protocols](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols)
-  - Type: str
-  - Required: no
-
-## Dependencies
-
-None.
+  - Description: Specifies the SSL protocol which should be used.
+- [nginx_ssl_ciphers][]
+  - Default: _see defaults.yml_
+  - Description: Specifies the TLS ciphers which should be used.
+- [nginx_ssl_prefer_server_ciphers][]
+  - Default: `on`
+  - Description: Specifies that server ciphers should be preferred over client ciphers when using the TLS protocols. Set to false to disable it.
+- [nginx_dh_size][]
+  - Default: `2048`
+  - Description: Specifies the length of DH parameters for EDH ciphers.
+- [nginx_configuration_dir][]
+  - default: "/etc/nginx"
+  - Description: The main location for all nginx configuration files
+- [nginx_configuration_hardening_dir][]
+  - default: "/etc/nginx"
+  - Description: The location for the nginx hardening configuration file (Could be different e.g. when used in jails)
+- [nginx_owner_user][]
+  - default: "root"
+  - Description: The owner user of the nginx configuration files
+- [nginx_owner_group][]
+  - default: "root"
+  - Description: The owner group of the nginx configuration files
 
 ## Example Playbook
 
 ```
-- hosts: all
-  become: true
+- hosts: localhost
+  collections:
+    - devsec.hardening
   roles:
-    - name: devsec.hardening.nginx_hardening
+    - nginx_hardening
 ```
 
-<!-- END_ANSIBLE_DOCS -->
+[nginx_client_body_buffer_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size
+[nginx_client_max_body_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
+[nginx_keepalive_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout
+[nginx_server_tokens]: http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens
+[nginx_more_clear_headers]: http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header
+[nginx_client_header_buffer_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_buffer_size
+[nginx_large_client_header_buffers]: http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers
+[nginx_client_body_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout
+[nginx_client_header_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout
+[nginx_send_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout
+[nginx_limit_conn_zone]: http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone
+[nginx_limit_conn]: http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn
+[nginx_add_header]: http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header
+[nginx_ssl_protocols]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols
+[nginx_ssl_ciphers]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers
+[nginx_ssl_prefer_server_ciphers]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers
+[nginx_dh_size]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam

roles/nginx_hardening/defaults/main.yml

@@ -25,6 +25,7 @@ nginx_add_header:
   - Strict-Transport-Security max-age=15768000
   - Content-Security-Policy "script-src 'self'; object-src 'self'"
 
+nginx_set_cookie_flag: "* HttpOnly secure"
 nginx_ssl_prefer_server_ciphers: "on"
 nginx_ssl_protocols: TLSv1.2 TLSv1.3
 # yamllint disable-line rule:line-length

roles/nginx_hardening/meta/argument_specs.yml

@@ -1,112 +0,0 @@
----
-argument_specs:
-  main:
-    short_description: The main entry point for the nginx hardening role.
-    version_added: 8.8.0
-    options:
-      nginx_client_body_buffer_size:
-        default: 1k
-        type: str
-        description: Sets buffer size for reading client request body. In case the
-          request body is larger than the buffer, the whole body or only its part
-          is written to a temporary file. See [nginx_client_body_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size)
-      nginx_remove_default_site:
-        default: true
-        type: bool
-        description: Disables the default site. Set to false to enable the default
-          site in nginx.
-      nginx_client_max_body_size:
-        default: 1k
-        type: str
-        description: Sets the maximum allowed size of the client request body, specified
-          in the "Content-Length" request header field. If the size in a request exceeds
-          the configured value, the 413 (Request Entity Too Large) error is returned
-          to the client. See [nginx_client_max_body_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size)
-      nginx_keepalive_timeout:
-        default: 5 5
-        type: str
-        description: The first parameter sets a timeout during which a keep-alive
-          client connection will stay open on the server side. The zero value disables
-          keep-alive client connections. The optional second parameter sets a value
-          in the "Keep-Alive timeout=time" response header field. See [nginx_keepalive_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout)  # noqa yaml[line-length]
-      nginx_server_tokens:
-        default: 'off'
-        type: str
-        description: Disables emitting nginx version in error messages and in the
-          "Server" response header field. Set to on to enable the nginx version in
-          error messages and "Server" response header. See [nginx_server_tokens](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens)
-      nginx_client_header_buffer_size:
-        default: 1k
-        type: str
-        description: Sets buffer size for reading client request header. For most
-          requests, a buffer of 1K bytes is enough. See [nginx_client_header_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client
-      nginx_large_client_header_buffers:
-        default: 2 1k
-        type: str
-        description: Sets the maximum number and size of buffers used for reading
-          large client request header. See [nginx_large_client_header_buffers](http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers)  # noqa yaml[line-length]
-      nginx_client_body_timeout:
-        default: 10
-        type: int
-        description: Defines a timeout for reading client request body. See [nginx_client_body_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout)  # noqa yaml[line-length]
-      nginx_client_header_timeout:
-        default: 10
-        type: int
-        description: Defines a timeout for reading client request header. See [nginx_client_header_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout)  # noqa yaml[line-length]
-      nginx_send_timeout:
-        default: 10
-        type: int
-        description: Sets a timeout for transmitting a response to the client. See
-          [nginx_send_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout)
-      nginx_limit_conn_zone:
-        default: $binary_remote_addr zone=default:10m
-        type: str
-        description: Sets parameters for a shared memory zone that will keep states
-          for various keys. See [nginx_limit_conn_zone](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone)
-      nginx_limit_conn:
-        default: default 5
-        type: str
-        description: Sets the shared memory zone and the maximum allowed number of
-          connections for a given key value. See [nginx_limit_conn](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn)
-      nginx_add_header:
-        default: [X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff, X-XSS-Protection
-              "1; mode=block", Content-Security-Policy \"script-src 'self'; object-src
-              'self'\"]
-        type: list
-        description: Adds the specified field to a response header provided that the
-          response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See
-          [nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
-      nginx_ssl_protocols:
-        default: TLSv1.2
-        type: str
-        description: Specifies the SSL protocol which should be used. See [nginx_ssl_protocols](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols)  # noqa yaml[line-length]
-      nginx_ssl_ciphers:
-        default: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256  # noqa yaml[line-length]
-        type: str
-        description: Specifies the TLS ciphers which should be used. See [nginx_ssl_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers)
-      nginx_ssl_prefer_server_ciphers:
-        default: 'on'
-        type: str
-        description: Specifies that server ciphers should be preferred over client
-          ciphers when using the TLS protocols. Set to false to disable it. See [nginx_ssl_prefer_server_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers)  # noqa yaml[line-length]
-      nginx_dh_size:
-        default: 2048
-        type: int
-        description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam)  # noqa yaml[line-length]
-      nginx_configuration_dir:
-        default: /etc/nginx
-        type: str
-        description: The main location for all nginx configuration files
-      nginx_configuration_hardening_dir:
-        default: /etc/nginx
-        type: str
-        description: The location for the nginx hardening configuration file (Could
-          be different e.g. when used in jails)
-      nginx_owner_user:
-        default: root
-        type: str
-        description: The owner user of the nginx configuration files
-      nginx_owner_group:
-        default: root
-        type: str
-        description: The owner group of the nginx configuration files

roles/nginx_hardening/meta/main.yml

@@ -8,18 +8,17 @@ galaxy_info:
   platforms:
     - name: EL
       versions:
+        - "7"
         - "8"
         - "9"
-        - "10"
     - name: Ubuntu
       versions:
+        - bionic
+        - focal
         - jammy
-        - noble
-        - resolute
     - name: Debian
       versions:
-        - trixie
-        - bookworm
+        - buster
         - bullseye
     - name: Amazon
   galaxy_tags:

roles/os_hardening/defaults/main.yml

@@ -1,5 +1,5 @@
 ---
-os_env_user_paths: [/usr/local/sbin, /usr/local/bin, /usr/sbin, /usr/bin, /sbin, /bin]
+os_desktop_enable: false
 os_env_extra_user_paths: []
 os_auth_pw_max_age: 60
 os_auth_pw_min_age: 7 # Discourage password cycling
@@ -39,6 +39,7 @@ os_users_without_password_ageing: []
 
 # Specify system accounts whose login should not be disabled and password not changed
 os_ignore_users: [vagrant, kitchen]
+os_security_kernel_enable_module_loading: true
 os_security_kernel_enable_core_dump: false
 os_security_suid_sgid_enforce: true
 # User-defined blacklist and whitelist
@@ -146,7 +147,7 @@ sysctl_config:
   # The PTRACE system is used for debugging.  With it, a single user process
   # can attach to any other dumpable process owned by the same user.  In the
   # case of malicious software, it is possible to use PTRACE to access
-  # credentials that exist in memory (reusing existing SSH connections,
+  # credentials that exist in memory (re-using existing SSH connections,
   # extracting GPG agent information, etc).
   #
   # A PTRACE scope of "0" is the more permissive mode.  A scope of "1" limits
@@ -305,7 +306,7 @@ sysctl_config:
 
 # Do not delete the following line or otherwise the playbook will fail
 # at task 'create a combined sysctl-dict if overwrites are defined'
-sysctl_overwrite: {}
+sysctl_overwrite:
 # Disable unused filesystems
 os_unused_filesystems:
   - cramfs
@@ -331,13 +332,9 @@ os_hardening_enabled: true
 
 # Set to false to disable installing and configuring auditd.
 os_auditd_enabled: true
-os_auditd_template: etc/audit/auditd.conf.j2
 os_auditd_flush: INCREMENTAL
-os_auditd_freq: 20
 os_auditd_max_log_file: 6
 os_auditd_max_log_file_action: keep_logs
-os_auditd_write_logs: true
-os_auditd_log_file: /var/log/audit/audit.log
 os_auditd_log_format: RAW
 os_auditd_admin_space_left: 50
 os_auditd_space_left: 75
@@ -348,7 +345,6 @@ os_auditd_disk_error_action: SUSPEND
 os_auditd_action_mail_acct: root
 os_auditd_log_group: root
 os_auditd_num_logs: 5
-os_auditd_name_format: NONE
 
 # Set the SELinux state, which can be either disabled, permissive, or enforcing.
 os_selinux_state: enforcing
@@ -356,7 +352,7 @@ os_selinux_state: enforcing
 os_selinux_policy: targeted
 
 # Mount options for proc in /etc/fstab.
-proc_mnt_options: rw,nosuid,nodev,noexec,relatime
+proc_mnt_options: rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}
 
 # Set to false to disable installing and configuring cron.
 os_cron_enabled: true

roles/os_hardening/handlers/main.yml

@@ -2,33 +2,17 @@
 - name: Update-initramfs # noqa no-changed-when
   ansible.builtin.command: update-initramfs -u
 
+- name: Restart auditd # noqa command-instead-of-module no-changed-when
+  ansible.builtin.command:
+    cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
+  when: molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
+
 - name: Reload systemd
   ansible.builtin.systemd:
     daemon_reload: true
 
-- name: Restart auditd via systemd
-  ansible.builtin.systemd:
-    name: auditd.service
-    state: restarted
-  ignore_errors: "{{ ansible_check_mode }}"
-  when:
-    - molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
-    - not ansible_facts.os_family == 'RedHat'
-
-- name: Restart auditd via service # noqa command-instead-of-module no-changed-when
-  ansible.builtin.command:
-    cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
-  when:
-    - molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
-    - ansible_facts.os_family == 'RedHat'
-
 - name: Remount filesystems
   ansible.posix.mount:
     path: "{{ item }}"
     state: remounted
   loop: "{{ mountpoints_changed }}"
-
-- name: Restart journald
-  ansible.builtin.systemd:
-    name: systemd-journald.service
-    state: restarted