Update Debian compatibility (#784)

* Update Ubuntu compatability

Signed-off-by: Martin Schurz <[email protected]>

* reload systemd when disabling ssh socket

Signed-off-by: Martin Schurz <[email protected]>

* manage systemd files

Signed-off-by: Martin Schurz <[email protected]>

* Create privsep directory for Debian

Signed-off-by: Martin Schurz <[email protected]>

* Use working Ubuntu 24.04 image for vm tests

Signed-off-by: Martin Schurz <[email protected]>

* Remove deprecated Debian 10

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>

.aar_doc.yml

@@ -0,0 +1,50 @@
+output_template: |
+  <!-- BEGIN_ANSIBLE_DOCS -->
+
+  ## Supported Operating Systems
+
+  {%- for platform in metadata.galaxy_info.platforms %}
+  - {{ platform.name }}
+    {%- if "versions" in platform %}
+    - {{ platform.versions | default([]) | join(', ') }}
+    {%- endif %}
+  {%- endfor %}
+
+  ## Role Variables
+  {% for entrypoint in argument_specs.keys() %}
+  {%- set path, options=entrypoint_options[entrypoint][0] -%}
+  {%- for name, details in options.items() |sort() %}
+  - `{{ name }}`
+    - Default: `{{ details.display_default }}`
+    - Description: {{ details.display_description }}
+    - Type: {{ details.display_type }}
+    - Required: {{ details.display_required }}
+    {%- if details.choices %}
+    - Choices:
+      {%- for choice in details.choices %}
+      - {{ choice }}
+      {%- endfor %}
+    {%- endif %}
+  {%- endfor %}
+  {%- endfor %}
+
+  ## Dependencies
+
+  {%- if ("dependencies" in metadata) and (metadata.dependencies | length > 0) %}
+  {%- for dependency in metadata.dependencies %}
+  - {{ dependency }}
+  {%- endfor %}
+  {%- else %}
+
+  None.
+  {%- endif %}
+
+  ## Example Playbook
+
+  ```
+  - hosts: all
+    roles:
+      - name: {{ role }}
+  ```
+
+  <!-- END_ANSIBLE_DOCS -->

.config/ansible-lint.yml

@@ -5,10 +5,16 @@
 # option will be parsed relative to the CWD of execution.
 exclude_paths:
   - .cache/ # implicit unless exclude_paths is defined in config
-  - .yamllint
+  # add all waivers individually, since exclude_files does not support globs
-  - ../molecule/
+  - molecule/os_hardening/waivers.yaml
-  - ../.github/
+  - molecule/ssh_hardening_bsd/waivers_freebsd13.yaml
+  - molecule/ssh_hardening_bsd/waivers_freebsd14.yaml
+  - molecule/ssh_hardening_bsd/waivers_openbsd7.yaml
 
 mock_roles:
   - geerlingguy.git
   - nginxinc.nginx
+
+skip_list:
+  - var-naming[no-role-prefix]
+  - meta-runtime[unsupported-version]

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -31,7 +31,7 @@ body:
     attributes:
       label: "Reproduction steps"
       render: Shell
-      description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, so no need for backticks.
+      description: Paste an example playbook that can be used to reproduce the problem. This will be automatically formatted into code, no need for backticks.
       value: |
         ...
     validations:

.github/dependabot.yml

@@ -1,25 +0,0 @@
----
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
-version: 2
-updates:
-  - package-ecosystem: "pip"  # See documentation for possible values
-    directory: "/"  # Location of package manifests
-    schedule:
-      interval: "daily"
-    # by default Dependabot creates labels like "major" or "minor" for version updates of our deps.
-    # however this interferes with the github changelog generator which uses these labels to define
-    # a new version for the collection
-    labels: [ ]
-
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    # by default Dependabot creates labels like "major" or "minor" for version updates of our deps.
-    # however this interferes with the github changelog generator which uses these labels to define
-    # a new version for the collection
-    labels: [ ]

.github/labeler.yml

@@ -1,22 +1,30 @@
 ---
 mysql_hardening:
-  - 'roles/mysql_hardening/**'
+  - changed-files:
-  - 'molecule/mysql_hardening/**'
+      - any-glob-to-any-file:
-  - '.github/workflows/mysql_hardening.yml'
+          - roles/mysql_hardening/**
+          - molecule/mysql_hardening/**
+          - .github/workflows/mysql_hardening.yml
 
 os_hardening:
-  - 'roles/os_hardening/**'
+  - changed-files:
-  - 'molecule/os_hardening/**'
+      - any-glob-to-any-file:
-  - '.github/workflows/os_hardening.yml'
+          - roles/os_hardening/**
+          - molecule/os_hardening/**
+          - .github/workflows/os_hardening.yml
 
 ssh_hardening:
-  - 'roles/ssh_hardening/**'
+  - changed-files:
-  - 'molecule/ssh_hardening/**'
+      - any-glob-to-any-file:
-  - 'molecule/ssh_hardening_custom_tests/**'
+          - roles/ssh_hardening/**
-  - '.github/workflows/ssh_hardening.yml'
+          - molecule/ssh_hardening/**
-  - '.github/workflows/ssh_hardening_custom_tests.yml'
+          - molecule/ssh_hardening_custom_tests/**
+          - .github/workflows/ssh_hardening.yml
+          - .github/workflows/ssh_hardening_custom_tests.yml
 
 nginx_hardening:
-  - 'roles/nginx_hardening/**'
+  - changed-files:
-  - 'molecule/nginx_hardening/**'
+      - any-glob-to-any-file:
-  - '.github/workflows/nginx_hardening.yml'
+          - roles/nginx_hardening/**
+          - molecule/nginx_hardening/**
+          - .github/workflows/nginx_hardening.yml

.github/version-drafter.yml

@@ -0,0 +1,3 @@
+major-labels: ['major']
+minor-labels: ['minor', 'enhancement']
+patch-labels: ['patch', 'bug']

.github/workflows/ansible-lint.yml

@@ -7,22 +7,26 @@ on:  # yamllint disable-line rule:truthy
     branches: [master]
     paths:
       - 'roles/**'
+      - 'molecule/**'
+      - 'requirements.txt'
+      - '.github/workflows/ansible-lint.yml'
+      - '.config/ansible-lint.yml'
   pull_request:
     # The branches below must be a subset of the branches above
     branches: [master]
     paths:
       - 'roles/**'
+      - 'molecule/**'
+      - 'requirements.txt'
+      - '.github/workflows/ansible-lint.yml'
+      - '.config/ansible-lint.yml'
 
 jobs:
   ansible-lint:
     runs-on: ubuntu-latest
 
     steps:
-      # Important: This sets up your GITHUB_WORKSPACE environment variable
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
-      - uses: actions/checkout@v3
 
       - name: Lint Ansible Playbook
-        # replace "master" with any valid ref
+        uses: ansible/ansible-lint@95382d398ea1744bf6bfa47b030f14c38b3f6957 # v24
-        uses: ansible/ansible-lint-action@main
-        with:
-          path: "roles/"

.github/workflows/codespell.yml

@@ -0,0 +1,14 @@
+---
+name: Codespell - Spellcheck
+
+on:  # yamllint disable-line rule:truthy
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  codespell:
+    uses: "dev-sec/.github/.github/workflows/codespell.yml@main"
+    with:
+      ignore_words_list: "chage,BOOTUP"

.github/workflows/enforce-labels.yml

@@ -4,11 +4,16 @@ name: "Enforce PR labels"
 on:  # yamllint disable-line rule:truthy
   pull_request_target:
     types: [labeled, unlabeled, opened, edited, synchronize]
+
+permissions:
+  contents: read # to read configuration file
+  pull-requests: write # to label PRs
+
 jobs:
   enforce-label:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@main
+      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/galaxy-publish.yml

@@ -4,37 +4,37 @@ name: Publish collection to Ansible Galaxy
 on:  # yamllint disable-line rule:truthy
   release:
     types:
-      - published
+      - released
 
 jobs:
   deploy:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
 
       # deploy the collection first, because if it fails, we don't want
       # to update the galaxy.yml
       - name: Deploy the collection
-        uses: artis3n/ansible_galaxy_collection@v2
+        uses: artis3n/ansible_galaxy_collection@3368f56529a2ef47ef0ac1ecfcda039f90d0174a # v2
         with:
           api_key: ${{ secrets.GALAXY_API_KEY }}
           galaxy_version: ${{ github.event.release.tag_name }}
 
       # checkout master instead of the release-tag so we can push the galaxy.yml
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         with:
           ref: master
 
       - name: update galaxy.yml with new version
-        uses: microsoft/variable-substitution@v1
+        uses: microsoft/variable-substitution@6287962da9e5b6e68778dc51e840caa03ca84495 # v1
         with:
           files: 'galaxy.yml'
         env:
           version: "${{ github.event.release.tag_name }}"
 
       - name: push galaxy.yml
-        uses: github-actions-x/[email protected]
+        uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           push-branch: 'master'

.github/workflows/mysql_hardening.yml

@@ -9,12 +9,14 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/mysql_hardening/**'
       - 'molecule/mysql_hardening/**'
       - '.github/workflows/mysql_hardening.yml'
+      - 'requirements.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/mysql_hardening/**'
       - 'molecule/mysql_hardening/**'
       - '.github/workflows/mysql_hardening.yml'
+      - 'requirements.txt'
   schedule:
     - cron: '0 6 * * 0'
 
@@ -27,7 +29,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -35,31 +37,29 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
-          - centos7
-          - centosstream8
           - centosstream9
           - rocky8
           - rocky9
-          - ubuntu1804
           - ubuntu2004
           - ubuntu2204
-          - debian10
+          - ubuntu2404
           - debian11
+          - debian12
           # - amazon  # geerlingguy.mysql does not support fedora
-          # - arch  # needs to be fixed
+          # - arch  # geerlingguy.mysql does not support arch
-          - opensuse_tumbleweed  # needs to be fixed
+          - opensuse_tumbleweed
           # - fedora  # geerlingguy.mysql does not support fedora
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python 3.7
+      - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5
         with:
-          python-version: 3.7
+          python-version: 3.12
 
       - name: Install dependencies
         run: |
@@ -68,11 +68,6 @@ jobs:
           pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
-      - name: Create default collection path symlink
-        run: |
-          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
-
       # that was a hard one to fix. robert did it thankfully
       # https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212
       - name: disable apparmor on debian systems
@@ -83,6 +78,17 @@ jobs:
             sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld
         if: ${{ startsWith(matrix.molecule_distro, 'Debian') }}
 
+      # Molecule has problems detecting the proper location for installing roles
+      # https://github.com/ansible/molecule/issues/3806
+      # we do not set a custom role path, but the automatically determined install path used is not compatible with the location molecule expects the role
+      # see CI logs of this action "INFO     Set ANSIBLE_ROLES_PATH" should not be present, since we do not set a custom path
+      # we have to find a proper way to configure this
+      - name: Temporary fix for roles
+        run: |
+          mkdir -p /home/runner/.ansible
+          ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles \
+            /home/runner/.ansible/roles
+
       - name: Test with molecule
         run: |
           molecule --version

.github/workflows/nginx_hardening.yml

@@ -8,12 +8,14 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/nginx_hardening/**'
       - 'molecule/nginx_hardening/**'
       - '.github/workflows/nginx_hardening.yml'
+      - 'requirements.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/nginx_hardening/**'
       - 'molecule/nginx_hardening/**'
       - '.github/workflows/nginx_hardening.yml'
+      - 'requirements.txt'
   schedule:
     - cron: '0 6 * * 1'
 
@@ -26,7 +28,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -34,31 +36,29 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
-          - centos7
-          - centosstream8
           - centosstream9
           - rocky8
           - rocky9
-          - ubuntu1804
           - ubuntu2004
           - ubuntu2204
-          - debian10
+          - ubuntu2404
           - debian11
-          - amazon
+          - debian12
+          - amazon2023
           # - arch  # needs to be fixed
           # - opensuse_tumbleweed  # needs to be fixed
           # - fedora  # no support from geerlingguy role
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python 3.7
+      - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5
         with:
-          python-version: 3.7
+          python-version: 3.12
 
       - name: Install dependencies
         run: |
@@ -67,10 +67,16 @@ jobs:
           pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
-      - name: Create default collection path symlink
+      # Molecule has problems detecting the proper location for installing roles
+      # https://github.com/ansible/molecule/issues/3806
+      # we do not set a custom role path, but the automatically determined install path used is not compatible with the location molecule expects the role
+      # see CI logs of this action "INFO     Set ANSIBLE_ROLES_PATH" should not be present, since we do not set a custom path
+      # we have to find a proper way to configure this
+      - name: Temporary fix for roles
         run: |
           mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
+          ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles \
+            /home/runner/.ansible/roles
 
       - name: Test with molecule
         run: |

.github/workflows/os_hardening.yml

@@ -8,12 +8,14 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening/**'
       - '.github/workflows/os_hardening.yml'
+      - 'requirements.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening/**'
       - '.github/workflows/os_hardening.yml'
+      - 'requirements.txt'
   schedule:
     - cron: '0 6 * * 3'
 
@@ -26,7 +28,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -34,30 +36,30 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
-          - centos7
-          - centosstream8
           - centosstream9
           - rocky8
           - rocky9
-          - ubuntu1804
+          - fedora39
+          - fedora40
           - ubuntu2004
           - ubuntu2204
-          - debian10
+          - ubuntu2404
           - debian11
-          - amazon
+          - debian12
+          - amazon2023
           - opensuse_tumbleweed
-          # - arch  # needs to be fixed
+          - arch
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python 3.7
+      - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5
         with:
-          python-version: 3.7
+          python-version: 3.12
 
       - name: Install dependencies
         run: |
@@ -66,11 +68,6 @@ jobs:
           pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
-      - name: Create default collection path symlink
-        run: |
-          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
-
       - name: Test with molecule
         run: |
           if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then

.github/workflows/os_hardening_vm.yml

@@ -8,12 +8,14 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening_vm/**'
       - '.github/workflows/os_hardening_vm.yml'
+      - 'requirements.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/os_hardening/**'
       - 'molecule/os_hardening_vm/**'
       - '.github/workflows/os_hardening_vm.yml'
+      - 'requirements.txt'
   schedule:
     - cron: '0 6 * * 2'
 
@@ -34,25 +36,29 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
-          - centos7
+          - generic/centos9s
-          - centos8s
+          - generic/rocky8
-          - centos9s
+          - generic/rocky9
-          - rocky8
+          - fedora/39-cloud-base
-          - rocky9
+          - fedora/40-cloud-base
-          - ubuntu1804
+          - generic/ubuntu2004
-          - ubuntu2004
+          - generic/ubuntu2204
-          - ubuntu2204
+          - alvistack/ubuntu-24.04
-          - debian10
+          - generic/debian11
-          - debian11
+          - generic/debian12
-          - opensuse15
+          - generic/opensuse15
-          # - arch  # arch is currently not supported by cinc-auditor
+          - generic/arch
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
+      - name: Update Vagrant Box
+        run: |
+          vagrant box update --box ${{ matrix.molecule_distro }} || true
+
       - name: Test with molecule
         run: |
           molecule --version

.github/workflows/prettier-md.yml

@@ -16,11 +16,11 @@ jobs:
 
     steps:
       - name: Git checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         with:
           ref: ${{ github.head_ref }}
 
       - name: Prettify code
-        uses: creyD/prettier_action@v4.2
+        uses: creyD/prettier_action@31355f8eef017f8aeba2e0bc09d8502b13dbbad1 # v4.3
         with:
           prettier_options: --write {**/*,*}.md

.github/workflows/release.yml

@@ -13,7 +13,7 @@ jobs:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         with:
           fetch-depth: 0
           ref: master
@@ -26,12 +26,12 @@ jobs:
 
       - name: calculate next version
         id: version
-        uses: patrickjahns/version-drafter-action@v1
+        uses: patrickjahns/version-drafter-action@2076fa43abb28f31d0e8b0890253fbd1d1a966fc # v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Generate changelog
-        uses: charmixer/auto-changelog-action@v1
+        uses: charmixer/auto-changelog-action@b25e89c9410e03189f0d48b02b3a8caad6e78015 # v1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           future_release: ${{ steps.version.outputs.next-version }}
@@ -42,7 +42,7 @@ jobs:
           issue_line_labels: mysql_hardening,os_hardening,ssh_hardening,nginx_hardening
 
       - name: push changelog
-        uses: github-actions-x/[email protected]
+        uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           push-branch: 'master'
@@ -58,18 +58,18 @@ jobs:
 
       - name: Read CHANGELOG.md
         id: package
-        uses: juliangruber/read-file-action@v1
+        uses: juliangruber/read-file-action@b549046febe0fe86f8cb4f93c24e284433f9ab58 # v1
         with:
           path: ./CHANGELOGRELEASE.md
 
       - name: Delete old drafts
-        uses: hugo19941994/[email protected]
+        uses: hugo19941994/delete-draft-releases@1bdca1ea7ffb25ae7f468a7bdb40056dae98175e # v1.0.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Create Release draft
         id: create_release
-        uses: actions/create-release@v1
+        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # This token is provided by Actions, you do not need to create your own token
         with:

.github/workflows/roles-readme.yml

@@ -0,0 +1,54 @@
+---
+name: create roles readme
+
+on:  # yamllint disable-line rule:truthy
+  push:
+    branches: [master]
+    paths:
+      - 'roles/**/meta/argument_specs.yml'
+      - 'roles/**/meta/main.yml'
+  pull_request:
+    branches: [master]
+    paths:
+      - 'roles/**/meta/argument_specs.yml'
+      - 'roles/**/meta/main.yml'
+
+jobs:
+  readme:
+    name: create roles readme
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        roles:
+          - mysql_hardening
+          - nginx_hardening
+          - os_hardening
+          - ssh_hardening
+    steps:
+      - name: Check out code
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - name: Set up Python
+        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5
+        with:
+          python-version: 3.12
+
+      - name: Install aar_doc
+        run: pip3 install aar_doc
+
+      - name: Run aar_doc
+        run: aar_doc roles/${{ matrix.roles }} markdown
+
+      - name: Output diff
+        run: git diff roles/${{ matrix.roles }}/README.md
+
+      - name: Push README
+        if: github.event_name != 'pull_request'
+        uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: 'update ${{ matrix.roles }} readme'
+          files: roles/${{ matrix.roles }}/README.md
+          rebase: true
+          name: dev-sec CI
+          email: [email protected]

.github/workflows/ssh_hardening.yml

@@ -8,12 +8,14 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening/**'
       - '.github/workflows/ssh_hardening.yml'
+      - 'requirements.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening/**'
       - '.github/workflows/ssh_hardening.yml'
+      - 'requirements.txt'
   schedule:
     - cron: '0 6 * * 5'
 
@@ -26,7 +28,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -34,31 +36,30 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
-          - centos7
-          - centosstream8
           - centosstream9
           - rocky8
           - rocky9
-          - fedora
+          - fedora39
-          - ubuntu1804
+          - fedora40
           - ubuntu2004
           - ubuntu2204
-          - debian10
+          - ubuntu2404
           - debian11
-          - amazon
+          - debian12
-          # - arch  # needs to be fixed
+          - amazon2023
-          # - opensuse_tumbleweed  # baseline is not compatible with suse
+          - arch
+          # - opensuse_tumbleweed  # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python 3.7
+      - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5
         with:
-          python-version: 3.7
+          python-version: 3.12
 
       - name: Install dependencies
         run: |
@@ -67,11 +68,6 @@ jobs:
           pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
-      - name: Create default collection path symlink
-        run: |
-          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
-
       - name: Test with molecule
         run: |
           if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then

.github/workflows/ssh_hardening_bsd.yml

@@ -0,0 +1,59 @@
+---
+name: "devsec.ssh_hardening BSD"
+on:  # yamllint disable-line rule:truthy
+  workflow_dispatch:
+  push:
+    branches: [master]
+    paths:
+      - 'roles/ssh_hardening/**'
+      - 'molecule/ssh_hardening_bsd/**'
+      - '.github/workflows/ssh_hardening_bsd.yml'
+      - 'requirements.txt'
+  pull_request:
+    branches: [master]
+    paths:
+      - 'roles/ssh_hardening/**'
+      - 'molecule/ssh_hardening_bsd/**'
+      - '.github/workflows/ssh_hardening_bsd.yml'
+      - 'requirements.txt'
+  schedule:
+    - cron: '0 6 * * 5'
+
+concurrency:
+  group: >-
+    ${{ github.workflow }}-${{
+      github.event.pull_request.number || github.sha
+    }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: self-hosted
+    env:
+      PY_COLORS: 1
+      ANSIBLE_FORCE_COLOR: 1
+    strategy:
+      fail-fast: false
+      matrix:
+        molecule_distro:
+          - openbsd7
+          - freebsd13
+          - freebsd14
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        with:
+          path: ansible_collections/devsec/hardening
+          submodules: true
+
+      - name: Update Vagrant Box
+        run: |
+          vagrant box update --box generic/${{ matrix.molecule_distro }} || true
+
+      - name: Test with molecule
+        run: |
+          molecule --version
+          molecule test -s ssh_hardening_bsd
+        env:
+          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
+        working-directory: ansible_collections/devsec/hardening

.github/workflows/ssh_hardening_custom_tests.yml

@@ -8,12 +8,14 @@ on:  # yamllint disable-line rule:truthy
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening_custom_tests/**'
       - '.github/workflows/ssh_hardening_custom_tests.yml'
+      - 'requirements.txt'
   pull_request:
     branches: [master]
     paths:
       - 'roles/ssh_hardening/**'
       - 'molecule/ssh_hardening_custom_tests/**'
       - '.github/workflows/ssh_hardening_custom_tests.yml'
+      - 'requirements.txt'
   schedule:
     - cron: '0 6 * * 4'
 
@@ -26,7 +28,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -34,31 +36,30 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
-          - centos7
-          - centosstream8
           - centosstream9
           - rocky8
           - rocky9
-          - fedora
+          - fedora39
-          - ubuntu1804
+          - fedora40
           - ubuntu2004
           - ubuntu2204
-          - debian10
+          - ubuntu2404
           - debian11
-          - amazon
+          - debian12
-          # - arch  # needs to be fixed
+          - amazon2023
-          # - opensuse_tumbleweed  # baseline is not compatible with suse
+          - arch
+          # - opensuse_tumbleweed  # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         with:
           path: ansible_collections/devsec/hardening
           submodules: true
 
-      - name: Set up Python 3.7
+      - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5
         with:
-          python-version: 3.7
+          python-version: 3.12
 
       - name: Install dependencies
         run: |
@@ -67,11 +68,6 @@ jobs:
           pip install -r requirements.txt
         working-directory: ansible_collections/devsec/hardening
 
-      - name: Create default collection path symlink
-        run: |
-          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
-
       - name: Test with molecule
         run: |
           if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then

CHANGELOG.md

@@ -1,18 +1,204 @@
 # Changelog
 
-## [8.7.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.7.0) (2023-02-07)
+## [10.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.0.0) (2024-07-30)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/9.0.1...10.0.0)
+
+**Implemented enhancements:**
+
+- option to disable regeneration of ssh private key [\#772](https://github.com/dev-sec/ansible-collection-hardening/issues/772)
+- Support systemd socket activation for sshd [\#763](https://github.com/dev-sec/ansible-collection-hardening/issues/763) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)]
+- Release 9.0.2 [\#758](https://github.com/dev-sec/ansible-collection-hardening/issues/758)
+- Make Publickey authentication configurable  [\#750](https://github.com/dev-sec/ansible-collection-hardening/issues/750)
+- Ansible Linting [\#747](https://github.com/dev-sec/ansible-collection-hardening/issues/747)
+- Make value of kernel.unprivileged\_userns\_clone depending on kernel version [\#727](https://github.com/dev-sec/ansible-collection-hardening/issues/727)
+- Ensure that ssh is installed \(cf \#771\) [\#774](https://github.com/dev-sec/ansible-collection-hardening/pull/774) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Byh0ki](https://github.com/Byh0ki))
+- ssh: explicitly enable or disable the service at boot [\#771](https://github.com/dev-sec/ansible-collection-hardening/pull/771) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Byh0ki](https://github.com/Byh0ki))
+- Add ssh\_pubkey\_authentication variable to ssh hardening [\#749](https://github.com/dev-sec/ansible-collection-hardening/pull/749) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([debbabi](https://github.com/debbabi))
+
+**Fixed bugs:**
+
+- ssh hardening role fails when `ssh_permit_root_login` var is set on ubuntu 24.04 [\#768](https://github.com/dev-sec/ansible-collection-hardening/issues/768)
+- os\_hardening fails when setting vm.mmap\_rnd\_bits [\#757](https://github.com/dev-sec/ansible-collection-hardening/issues/757)
+- `ssh_gateway_ports` is documented to accept 'clientspecified' string, but only accepts bools [\#755](https://github.com/dev-sec/ansible-collection-hardening/issues/755)
+- harden permissions for directory mount /var/log fails for minimized Ubuntu 22.04  [\#741](https://github.com/dev-sec/ansible-collection-hardening/issues/741)
+
+**Merged pull requests:**
+
+- Update to current Fedora releases [\#783](https://github.com/dev-sec/ansible-collection-hardening/pull/783) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Remove deprecated rebuild of initrd [\#782](https://github.com/dev-sec/ansible-collection-hardening/pull/782) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- chore\(deps\): update patrickjahns/version-drafter-action digest to 2076fa4 [\#781](https://github.com/dev-sec/ansible-collection-hardening/pull/781) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 95382d3 [\#779](https://github.com/dev-sec/ansible-collection-hardening/pull/779) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/setup-python digest to 39cd149 [\#778](https://github.com/dev-sec/ansible-collection-hardening/pull/778) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- remove tests for FreeBSD12 since it's out of support [\#777](https://github.com/dev-sec/ansible-collection-hardening/pull/777) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- chore\(deps\): pin dependencies [\#776](https://github.com/dev-sec/ansible-collection-hardening/pull/776) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- Use best-practice preset for renovate [\#775](https://github.com/dev-sec/ansible-collection-hardening/pull/775) ([schurzi](https://github.com/schurzi))
+- Deprecate Centos Stream 8 [\#770](https://github.com/dev-sec/ansible-collection-hardening/pull/770) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- disable systemd socket activation [\#769](https://github.com/dev-sec/ansible-collection-hardening/pull/769) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- centos7 is eol, remove it [\#767](https://github.com/dev-sec/ansible-collection-hardening/pull/767) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- fix spelling [\#766](https://github.com/dev-sec/ansible-collection-hardening/pull/766) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- do not force type of ssh\_gateway\_ports [\#765](https://github.com/dev-sec/ansible-collection-hardening/pull/765) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- ci: define permissions for enforce-labels workflow  [\#760](https://github.com/dev-sec/ansible-collection-hardening/pull/760) ([fgreinacher](https://github.com/fgreinacher))
+- Update dependency ansible-core to v2.16.5 [\#754](https://github.com/dev-sec/ansible-collection-hardening/pull/754) ([renovate[bot]](https://github.com/apps/renovate))
+- Update dependency ansible-core to v2.16.4 [\#751](https://github.com/dev-sec/ansible-collection-hardening/pull/751) ([renovate[bot]](https://github.com/apps/renovate))
+- Update ansible/ansible-lint action to v24 [\#745](https://github.com/dev-sec/ansible-collection-hardening/pull/745) ([renovate[bot]](https://github.com/apps/renovate))
+- Always update Vagrant Boxes before using [\#744](https://github.com/dev-sec/ansible-collection-hardening/pull/744) ([schurzi](https://github.com/schurzi))
+- Remove Docker containers on self-hosted runner after tests [\#743](https://github.com/dev-sec/ansible-collection-hardening/pull/743) ([schurzi](https://github.com/schurzi))
+- Update dependency ansible-core to v2.16.3 [\#742](https://github.com/dev-sec/ansible-collection-hardening/pull/742) ([renovate[bot]](https://github.com/apps/renovate))
+
+## [9.0.1](https://github.com/dev-sec/ansible-collection-hardening/tree/9.0.1) (2024-01-15)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/9.0.0...9.0.1)
+
+**Implemented enhancements:**
+
+- Extend ansible-lint testing to cover our test cases [\#731](https://github.com/dev-sec/ansible-collection-hardening/issues/731)
+-  Complete tests for OS hardening [\#660](https://github.com/dev-sec/ansible-collection-hardening/issues/660)
+- support restarts of audit service on Arch linux [\#722](https://github.com/dev-sec/ansible-collection-hardening/pull/722) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+
+**Fixed bugs:**
+
+- Fails to install [\#735](https://github.com/dev-sec/ansible-collection-hardening/issues/735)
+- Amazon Linux gpg check fails [\#734](https://github.com/dev-sec/ansible-collection-hardening/issues/734)
+- ssh\_hardening ipv6 [\#719](https://github.com/dev-sec/ansible-collection-hardening/issues/719)
+- boolean variable inconsistency? [\#330](https://github.com/dev-sec/ansible-collection-hardening/issues/330)
+- Restore idempotency for disabling unused filesystems with Ansible 2.16.0 [\#718](https://github.com/dev-sec/ansible-collection-hardening/pull/718) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([akikanellis](https://github.com/akikanellis))
+
+**Closed issues:**
+
+- 9.0.0 version number in galaxy.yml file is wrong [\#740](https://github.com/dev-sec/ansible-collection-hardening/issues/740)
+
+**Merged pull requests:**
+
+- restructure readme to move known limitations up top [\#739](https://github.com/dev-sec/ansible-collection-hardening/pull/739) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- release only on releases, not pre-releases [\#738](https://github.com/dev-sec/ansible-collection-hardening/pull/738) ([rndmh3ro](https://github.com/rndmh3ro))
+- Update dependency ansible-core to v2.16.2 [\#737](https://github.com/dev-sec/ansible-collection-hardening/pull/737) ([renovate[bot]](https://github.com/apps/renovate))
+- fix linting for github config [\#736](https://github.com/dev-sec/ansible-collection-hardening/pull/736) ([rndmh3ro](https://github.com/rndmh3ro))
+- Update actions/setup-python action to v5 [\#733](https://github.com/dev-sec/ansible-collection-hardening/pull/733) ([renovate[bot]](https://github.com/apps/renovate))
+- Update ansible-lint action and revise configuration to scan all Ansible code [\#732](https://github.com/dev-sec/ansible-collection-hardening/pull/732) ([schurzi](https://github.com/schurzi))
+- update labeler to new config format [\#730](https://github.com/dev-sec/ansible-collection-hardening/pull/730) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Update dependency ansible-core to v2.16.1 [\#728](https://github.com/dev-sec/ansible-collection-hardening/pull/728) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- pin Ansible to always let Renovate update to the most current version in our tests [\#721](https://github.com/dev-sec/ansible-collection-hardening/pull/721) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+
+## [9.0.0](https://github.com/dev-sec/ansible-collection-hardening/tree/9.0.0) (2023-11-16)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.8.0...9.0.0)
+
+**Breaking changes:**
+
+- make it possible to configure more then yes and no for PermitTunnel [\#715](https://github.com/dev-sec/ansible-collection-hardening/pull/715) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add role argument spec for os, ssh, mysql [\#687](https://github.com/dev-sec/ansible-collection-hardening/pull/687) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Implemented enhancements:**
+
+- Create role documentation with Automated-Ansible-Role-Documentation [\#694](https://github.com/dev-sec/ansible-collection-hardening/issues/694)
+- Minimize access user paths should be fully configurable [\#689](https://github.com/dev-sec/ansible-collection-hardening/issues/689)
+- Add support for Debian 12 [\#672](https://github.com/dev-sec/ansible-collection-hardening/issues/672)
+- add testing and support for current versions of Fedora and FreeBSD [\#709](https://github.com/dev-sec/ansible-collection-hardening/pull/709) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- feat: workflow for roles readme [\#705](https://github.com/dev-sec/ansible-collection-hardening/pull/705) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
+- do not try to drop roles in mysql hardening [\#649](https://github.com/dev-sec/ansible-collection-hardening/pull/649) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+**Fixed bugs:**
+
+- nginx conf.d directory is missing on Rocky Linux 8 [\#707](https://github.com/dev-sec/ansible-collection-hardening/issues/707)
+- Default value of `ssh_client_alive_interval` is inconsistent with what documentation says [\#701](https://github.com/dev-sec/ansible-collection-hardening/issues/701)
+- \[devsec.hardening.os\_hardening : restart-auditd\] fails [\#698](https://github.com/dev-sec/ansible-collection-hardening/issues/698)
+- sshd\_hardening role cannot be used to build system images [\#697](https://github.com/dev-sec/ansible-collection-hardening/issues/697)
+- Error: No file was found when using first\_found on Ubuntu 20.04 [\#676](https://github.com/dev-sec/ansible-collection-hardening/issues/676)
+- PUBLIC-role breaks mysql-hardening [\#648](https://github.com/dev-sec/ansible-collection-hardening/issues/648)
+- Error deploying the playbook [\#630](https://github.com/dev-sec/ansible-collection-hardening/issues/630)
+- Gather facts when os\_hardening role is executed with tags [\#708](https://github.com/dev-sec/ansible-collection-hardening/pull/708) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+
+**Closed issues:**
+
+- Add send-to-mailinglist to github release action [\#434](https://github.com/dev-sec/ansible-collection-hardening/issues/434)
+
+**Merged pull requests:**
+
+- update status badges in README [\#714](https://github.com/dev-sec/ansible-collection-hardening/pull/714) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- fix CI test for os\_hardening [\#711](https://github.com/dev-sec/ansible-collection-hardening/pull/711) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- fix nginx CI tests [\#710](https://github.com/dev-sec/ansible-collection-hardening/pull/710) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- fix: roles-readme action default value [\#706](https://github.com/dev-sec/ansible-collection-hardening/pull/706) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
+- fix some wrong defaults and types in the readmes [\#703](https://github.com/dev-sec/ansible-collection-hardening/pull/703) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- update links to new Ansible Galaxy [\#702](https://github.com/dev-sec/ansible-collection-hardening/pull/702) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Fix typo in login.defs.j2 [\#700](https://github.com/dev-sec/ansible-collection-hardening/pull/700) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))
+- chore\(deps\): update actions/checkout action to v4 [\#696](https://github.com/dev-sec/ansible-collection-hardening/pull/696) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- test debian12 on VM [\#695](https://github.com/dev-sec/ansible-collection-hardening/pull/695) ([rndmh3ro](https://github.com/rndmh3ro))
+- fix descriptions in readme [\#693](https://github.com/dev-sec/ansible-collection-hardening/pull/693) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- feat: customize user paths default [\#692](https://github.com/dev-sec/ansible-collection-hardening/pull/692) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([S0obi](https://github.com/S0obi))
+- disable PAM tests [\#691](https://github.com/dev-sec/ansible-collection-hardening/pull/691) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [8.8.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.8.0) (2023-08-04)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.7.0...8.8.0)
+
+**Implemented enhancements:**
+
+- Add support for Fedora 38 [\#671](https://github.com/dev-sec/ansible-collection-hardening/issues/671)
+- auditd: add possibility to override config template [\#685](https://github.com/dev-sec/ansible-collection-hardening/pull/685) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Meecr0b](https://github.com/Meecr0b))
+- add debian 12 support [\#684](https://github.com/dev-sec/ansible-collection-hardening/pull/684) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- feat: explicitly support Fedora 37 and 38 [\#682](https://github.com/dev-sec/ansible-collection-hardening/pull/682) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([nejch](https://github.com/nejch))
+- Replace ssh\_keys group with root, where applicable and use less permissive file mode [\#677](https://github.com/dev-sec/ansible-collection-hardening/pull/677) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Add oddjob mkhomedir option rhel pam [\#675](https://github.com/dev-sec/ansible-collection-hardening/pull/675) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([imp1sh](https://github.com/imp1sh))
+
+**Fixed bugs:**
+
+- How does one set `sshd_authenticationmethods`  to include password authentication? [\#686](https://github.com/dev-sec/ansible-collection-hardening/issues/686)
+- FreeIPA environment mkhomedir fails [\#664](https://github.com/dev-sec/ansible-collection-hardening/issues/664)
+
+**Closed issues:**
+
+- What is the uscase of sysctl\_overwrite over ansible.posix.sysctl? [\#683](https://github.com/dev-sec/ansible-collection-hardening/issues/683)
+-  `Ensure permissions on mysql-logfile are correct` chokes when `log_error` is set to `stderr` [\#673](https://github.com/dev-sec/ansible-collection-hardening/issues/673)
+- TASK TASK FAILED: \[devsec.hardening.os\_hardening : Set password ageing for existing regular \(non-system, non-root\) accounts\]  [\#670](https://github.com/dev-sec/ansible-collection-hardening/issues/670)
+- After os\_hardening ssh not working  [\#663](https://github.com/dev-sec/ansible-collection-hardening/issues/663)
+- Unsupported parameters for \(ansible.builtin.user\) module [\#650](https://github.com/dev-sec/ansible-collection-hardening/issues/650)
+
+**Merged pull requests:**
+
+- setting gets ignored [\#680](https://github.com/dev-sec/ansible-collection-hardening/pull/680) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add var-naming\[no-role-prefix\] to skip-list [\#679](https://github.com/dev-sec/ansible-collection-hardening/pull/679) ([rndmh3ro](https://github.com/rndmh3ro))
+- expand on check conditions for non-file locations of logs [\#674](https://github.com/dev-sec/ansible-collection-hardening/pull/674) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([whysthatso](https://github.com/whysthatso))
+- use new molecule-plugins [\#667](https://github.com/dev-sec/ansible-collection-hardening/pull/667) ([schurzi](https://github.com/schurzi))
+- add spellchecking with codespell [\#662](https://github.com/dev-sec/ansible-collection-hardening/pull/662) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+
+## [8.7.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.7.0) (2023-04-12)
 
 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.6.0...8.7.0)
 
 **Implemented enhancements:**
 
+- Support BSD and other operating systems CI with VM based tests [\#599](https://github.com/dev-sec/ansible-collection-hardening/issues/599)
+- add check mode to molecule tests [\#644](https://github.com/dev-sec/ansible-collection-hardening/pull/644) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- add testing for OpenBSD and FreeBSD [\#642](https://github.com/dev-sec/ansible-collection-hardening/pull/642) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Only skip audit restart handler in docker [\#637](https://github.com/dev-sec/ansible-collection-hardening/pull/637) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))
 - Make action\_mail\_acct configurable in auditd [\#631](https://github.com/dev-sec/ansible-collection-hardening/pull/631) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))
 
+**Fixed bugs:**
+
+- getent task is skipped if user previously ran it with a key parameter [\#646](https://github.com/dev-sec/ansible-collection-hardening/issues/646)
+- Error running devsec.hardening.os\_hardening role [\#645](https://github.com/dev-sec/ansible-collection-hardening/issues/645)
+- devsec.hardening.mysql\_hardening - Get all users that have no authentication\_string - Hello world [\#640](https://github.com/dev-sec/ansible-collection-hardening/issues/640)
+- fixes \#646 - add another condition to getent task [\#647](https://github.com/dev-sec/ansible-collection-hardening/pull/647) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([gbolo](https://github.com/gbolo))
+
+**Closed issues:**
+
+- Invalid login.defs for RHEL6 [\#651](https://github.com/dev-sec/ansible-collection-hardening/issues/651)
+- Deprecation warnings for os\_hardening [\#638](https://github.com/dev-sec/ansible-collection-hardening/issues/638)
+- Write tests for MySQL user-deletion [\#445](https://github.com/dev-sec/ansible-collection-hardening/issues/445)
+
 **Merged pull requests:**
 
+- Update minimum required Ansible version for os\_hardening [\#657](https://github.com/dev-sec/ansible-collection-hardening/pull/657) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Update test environment [\#656](https://github.com/dev-sec/ansible-collection-hardening/pull/656) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Update dependency geerlingguy.git to v3.0.1 [\#654](https://github.com/dev-sec/ansible-collection-hardening/pull/654) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- Configure Renovate [\#653](https://github.com/dev-sec/ansible-collection-hardening/pull/653) ([renovate[bot]](https://github.com/apps/renovate))
+- simplify MySQL queries for user deletion [\#641](https://github.com/dev-sec/ansible-collection-hardening/pull/641) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([schurzi](https://github.com/schurzi))
+- Bump creyD/prettier\_action from 4.2 to 4.3 [\#639](https://github.com/dev-sec/ansible-collection-hardening/pull/639) ([dependabot[bot]](https://github.com/apps/dependabot))
+- Fix molecule tests for EL7 [\#636](https://github.com/dev-sec/ansible-collection-hardening/pull/636) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - run our CI tests periodically [\#634](https://github.com/dev-sec/ansible-collection-hardening/pull/634) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
 - try to fix molecule local tests [\#632](https://github.com/dev-sec/ansible-collection-hardening/pull/632) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- remove unneccessary tasks for VM based test [\#629](https://github.com/dev-sec/ansible-collection-hardening/pull/629) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- remove unnecessary tasks for VM based test [\#629](https://github.com/dev-sec/ansible-collection-hardening/pull/629) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
 
 ## [8.6.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.6.0) (2023-02-04)
 
@@ -38,7 +224,7 @@
 - Add support for /etc/auditd.conf num\_logs to go with max\_log\_file\_action [\#617](https://github.com/dev-sec/ansible-collection-hardening/pull/617) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([richardlock](https://github.com/richardlock))
 - Preserve default ownership and dir mode for /var/log on Ubuntu [\#615](https://github.com/dev-sec/ansible-collection-hardening/pull/615) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([stdtom](https://github.com/stdtom))
 - rewrite user home dir hardening [\#584](https://github.com/dev-sec/ansible-collection-hardening/pull/584) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
-- apply password age settings to exisiting regular users [\#582](https://github.com/dev-sec/ansible-collection-hardening/pull/582) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
+- apply password age settings to existing regular users [\#582](https://github.com/dev-sec/ansible-collection-hardening/pull/582) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 - Parametrize more auditd.conf options [\#535](https://github.com/dev-sec/ansible-collection-hardening/pull/535) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([kravietz](https://github.com/kravietz))
 
 **Fixed bugs:**
@@ -173,7 +359,7 @@
 **Implemented enhancements:**
 
 - revert debian 9 change, only one tls variable now [\#562](https://github.com/dev-sec/ansible-collection-hardening/pull/562) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
-- add posibility to run ssh\_hardening as unprivileged user [\#561](https://github.com/dev-sec/ansible-collection-hardening/pull/561) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- add possibility to run ssh\_hardening as unprivileged user [\#561](https://github.com/dev-sec/ansible-collection-hardening/pull/561) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
 - add basic support for ubuntu22.04 [\#554](https://github.com/dev-sec/ansible-collection-hardening/pull/554) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
 - Add full support for Debian 11 [\#538](https://github.com/dev-sec/ansible-collection-hardening/pull/538) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([addianto](https://github.com/addianto))
 
@@ -244,7 +430,7 @@
 
 **Closed issues:**
 
-- No such file directory error triggered by the  kernel.unpriviliged\_userns\_clone configuration. [\#514](https://github.com/dev-sec/ansible-collection-hardening/issues/514)
+- No such file directory error triggered by the  kernel.unprivileged\_userns\_clone configuration. [\#514](https://github.com/dev-sec/ansible-collection-hardening/issues/514)
 
 **Merged pull requests:**
 
@@ -683,7 +869,7 @@
 - Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-collection-hardening/pull/259) ([jaredledvina](https://github.com/jaredledvina))
 - Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-collection-hardening/pull/254) ([kravietz](https://github.com/kravietz))
 - Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-collection-hardening/pull/251) ([dustinmiller](https://github.com/dustinmiller))
-- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
+- Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
 - Make max\_log\_file\_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-collection-hardening/pull/246) ([jandd](https://github.com/jandd))
 - Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-collection-hardening/pull/240) ([ghost](https://github.com/ghost))
 - Fedora - Use new auto ansible\_python\_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-collection-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
@@ -734,7 +920,7 @@
 - Docker [\#90](https://github.com/dev-sec/ansible-collection-hardening/pull/90) ([rndmh3ro](https://github.com/rndmh3ro))
 - debian 8 support [\#88](https://github.com/dev-sec/ansible-collection-hardening/pull/88) ([rndmh3ro](https://github.com/rndmh3ro))
 - Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-collection-hardening/pull/85) ([fitz123](https://github.com/fitz123))
-- replace ignore\_errors to failed\_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-collection-hardening/pull/81) ([fitz123](https://github.com/fitz123))
+- replace ignore\_errors to failed\_when to suppress ugly error warnings [\#81](https://github.com/dev-sec/ansible-collection-hardening/pull/81) ([fitz123](https://github.com/fitz123))
 - fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-collection-hardening/pull/79) ([fitz123](https://github.com/fitz123))
 - update platforms in meta-file [\#69](https://github.com/dev-sec/ansible-collection-hardening/pull/69) ([rndmh3ro](https://github.com/rndmh3ro))
 - add webhook for ansible galaxy [\#68](https://github.com/dev-sec/ansible-collection-hardening/pull/68) ([rndmh3ro](https://github.com/rndmh3ro))
@@ -760,7 +946,7 @@
 - \[lots of\] deprecation warnings in Ansible 2.8 [\#221](https://github.com/dev-sec/ansible-collection-hardening/issues/221)
 - `squash_actions` deprecation warning [\#218](https://github.com/dev-sec/ansible-collection-hardening/issues/218)
 - login.defs.j2 template: ENV\_PATH is missing ':' before variable substitution [\#202](https://github.com/dev-sec/ansible-collection-hardening/issues/202)
-- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-collection-hardening/issues/191)
+- auditd causing v5.0 to fail on unprivileged LXC's [\#191](https://github.com/dev-sec/ansible-collection-hardening/issues/191)
 - Setting os\_security\_users\_allow has no effect [\#175](https://github.com/dev-sec/ansible-collection-hardening/issues/175)
 - minimize\_access: maximum recursion depth exceeded on Ansible 2.5 [\#171](https://github.com/dev-sec/ansible-collection-hardening/issues/171)
 - wrong permissions passwdqc [\#170](https://github.com/dev-sec/ansible-collection-hardening/issues/170)
@@ -848,7 +1034,7 @@
 - adjust permissions on shadow file on suse [\#311](https://github.com/dev-sec/ansible-collection-hardening/pull/311) ([rndmh3ro](https://github.com/rndmh3ro))
 - fix fedora build [\#296](https://github.com/dev-sec/ansible-collection-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
 - do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-collection-hardening/pull/289) ([schurzi](https://github.com/schurzi))
-- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-collection-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
+- move hidepid vars into defaults so they're overwritable [\#285](https://github.com/dev-sec/ansible-collection-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
 - install procps in debian so sysctl.conf exists [\#282](https://github.com/dev-sec/ansible-collection-hardening/pull/282) ([rndmh3ro](https://github.com/rndmh3ro))
 - move defaults to os-specific vars [\#157](https://github.com/dev-sec/ansible-collection-hardening/pull/157) ([rndmh3ro](https://github.com/rndmh3ro))
 - Converts set to JSON-serializable list [\#126](https://github.com/dev-sec/ansible-collection-hardening/pull/126) ([pestaa](https://github.com/pestaa))
@@ -900,7 +1086,7 @@
 - Repair debian install script [\#8](https://github.com/dev-sec/ansible-collection-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
 - Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-collection-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
 - Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-collection-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
-- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-collection-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accommodate test-repo [\#4](https://github.com/dev-sec/ansible-collection-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
 - treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-collection-hardening/pull/3) ([arlimus](https://github.com/arlimus))
 - Add Securetty-support [\#2](https://github.com/dev-sec/ansible-collection-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
 - Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-collection-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))

OS_HARDENING_CHANGELOG.md

@@ -26,7 +26,7 @@
 
 - fix fedora build [\#296](https://github.com/dev-sec/ansible-os-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
 - do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-os-hardening/pull/289) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([schurzi](https://github.com/schurzi))
-- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))
+- move hidepid vars into defaults so they're overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))
 
 ## [6.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/6.1.0) (2020-07-21)
 
@@ -90,7 +90,7 @@
 - Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-os-hardening/pull/259) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jaredledvina](https://github.com/jaredledvina))
 - Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-os-hardening/pull/254) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([kravietz](https://github.com/kravietz))
 - Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-os-hardening/pull/251) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
-- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
+- Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
 - Make max_log_file_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-os-hardening/pull/246) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jandd](https://github.com/jandd))
 - Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-os-hardening/pull/240) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([ghost](https://github.com/ghost))
 - Fedora - Use new auto ansible_python_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-os-hardening/pull/239) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jaredledvina](https://github.com/jaredledvina))
@@ -165,7 +165,7 @@
 
 **Fixed bugs:**
 
-- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- auditd causing v5.0 to fail on unprivileged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
 - Setting os_security_users_allow has no effect [\#175](https://github.com/dev-sec/ansible-os-hardening/issues/175) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
 - add /usr/bin/su to suid_guid whitelist [\#199](https://github.com/dev-sec/ansible-os-hardening/pull/199) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([ccolic](https://github.com/ccolic))
 - ensure that permissions to su-binary are not restricted to root user and group only, if os_security_users_allow contains the value change_user [\#197](https://github.com/dev-sec/ansible-os-hardening/pull/197) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([szEvEz](https://github.com/szEvEz))
@@ -346,7 +346,7 @@
 - Docker [\#90](https://github.com/dev-sec/ansible-os-hardening/pull/90) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
 - debian 8 support [\#88](https://github.com/dev-sec/ansible-os-hardening/pull/88) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-os-hardening/pull/85) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
-- replace ignore_errors to failed_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
+- replace ignore_errors to failed_when to suppress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
 - fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-os-hardening/pull/79) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
 
 **Fixed bugs:**
@@ -459,7 +459,7 @@
 - Repair debian install script [\#8](https://github.com/dev-sec/ansible-os-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
 - Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-os-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
 - Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-os-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
-- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accommodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
 - treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-os-hardening/pull/3) ([arlimus](https://github.com/arlimus))
 - Add Securetty-support [\#2](https://github.com/dev-sec/ansible-os-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
 - Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-os-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))

README.md

@@ -1,23 +1,25 @@
 # Ansible Collection - devsec.hardening
 
-![devsec.os_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening/badge.svg)
+[![devsec.os_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening.yml)
-![devsec.os_hardening VM](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.os_hardening%20VM/badge.svg)
+[![devsec.os_hardening VM](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/os_hardening_vm.yml)
-![devsec.ssh_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.ssh_hardening/badge.svg)
+[![devsec.ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening.yml)
-![devsec.nginx_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.nginx_hardening/badge.svg)
+[![devsec.ssh_hardening BSD](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_bsd.yml)
-![devsec.mysql_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.mysql_hardening/badge.svg)
+[![devsec.ssh_hardening with custom tests](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/ssh_hardening_custom_tests.yml)
+[![devsec.nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml)
+[![devsec.mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
 
 ## Description
 
 This collection provides battle tested hardening for:
 
 - Linux operating systems:
-  - CentOS 7
+  - CentOS 9
-  - Rocky Linux 8
+  - Rocky Linux 8/9
-  - Debian 10/11
+  - Debian 11/12
-  - Ubuntu 18.04/20.04/22.04
+  - Ubuntu 20.04/22.04/24.04
   - Amazon Linux (some roles supported)
   - Arch Linux (some roles supported)
-  - Fedora (some roles supported)
+  - Fedora 39/40 (some roles supported)
   - Suse Tumbleweed (some roles supported)
 - MySQL
   - MariaDB >= 5.5.65, >= 10.1.45, >= 10.3.17

galaxy.yml

@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 8.6.0
+version: 9.0.1
 readme: README.md
 authors:
   - dev-sec <[email protected]>
@@ -22,6 +22,9 @@ tags:
   - nginx_hardening
   - os_hardening
   - ssh_hardening
+  - database
+  - linux
+  - security
 dependencies:
   ansible.posix: '>=1.0.0'
   community.crypto: '>=1.0.0'
@@ -42,3 +45,4 @@ build_ignore:
   - .tox
   - tox.ini
   - .yamllint
+  - renovate.json

molecule/mysql_hardening/converge.yml

@@ -1,38 +1,37 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
+- name: Wrapper playbook for kitchen testing "ansible-mysql-hardening"
   hosts: all
   become: true
-  collections:
-    - devsec.hardening
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
     - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
-      set_fact:
+      ansible.builtin.set_fact:
-        mysql_python_package_debian: "python3-pymysql"
+        mysql_python_package_debian: python3-pymysql
       when:
         - mysql_python_package_debian is not defined
         - ansible_distribution == "Ubuntu"
         - ansible_distribution_major_version|int > 19
 
     - name: Determine required MySQL Python libraries.
-      set_fact:
+      ansible.builtin.set_fact:
-        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
+        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
       when:
         - mysql_python_package_debian is not defined
         - ansible_distribution != "Ubuntu"
         - ansible_distribution_major_version|int < 20
 
     - name: Use Python 3 on Suse
-      set_fact:
+      ansible.builtin.set_fact:
         ansible_python_interpreter: /usr/bin/python3
       when:
         - ansible_os_family == 'Suse'
 
-    - include_role:
+    - name: Include mysql_hardening role
-        name: mysql_hardening
+      ansible.builtin.include_role:
+        name: devsec.hardening.mysql_hardening
   vars:
     overwrite_global_mycnf: false
     mysql_root_password: iloverandompasswordsbutthiswilldo

molecule/mysql_hardening/molecule.yml

@@ -8,7 +8,7 @@ driver:
   name: docker
 platforms:
   - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -22,7 +22,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
   name: ansible
 
@@ -52,7 +52,8 @@ scenario:
     - syntax
     - create
     - prepare
+    - check
     - converge
-    # - idempotence  # not idempotent
+    - idempotence
     - verify
     - destroy

molecule/mysql_hardening/prepare.yml

@@ -1,76 +1,74 @@
 ---
-
+- name: Wrapper playbook for kitchen testing "ansible-mysql-hardening"
-- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
   hosts: all
   become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  tasks:
-    - name: Use Python 3 on Debian 11
-      set_fact:
-        ansible_python_interpreter: /usr/bin/python3
-      when:
-        - ansible_distribution == 'Debian'
-        - ansible_distribution_major_version|int >= 11
-
-    - name: Use Python 3 on Suse
-      set_fact:
-        ansible_python_interpreter: /usr/bin/python3
-      when:
-        - ansible_os_family == 'Suse'
-
-    - name: Use Python 2 on Debian 10
-      set_fact:
-        ansible_python_interpreter: /usr/bin/python
-      when:
-        - ansible_distribution == 'Debian'
-        - ansible_distribution_major_version|int == 10
-
-    - name: Run the equivalent of "apt-get update && apt-get upgrade"
-      apt:
-        name: "*"
-        state: latest
-        update_cache: true
-      when: ansible_os_family == 'Debian'
-
-    - name: Install required python packages on Suse
-      ansible.builtin.shell: zypper -n install python-xml python3-rpm python3-PyMySQL
-      when: ansible_os_family == 'Suse'
-
-    - name: create missing directory
-      file:
-        path: "/etc/mysql/conf.d"
-        state: directory
-
-    - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
-      set_fact:
-        mysql_python_package_debian: "python3-pymysql"
-      when:
-        - mysql_python_package_debian is not defined
-        - ansible_distribution == "Ubuntu"
-        - ansible_distribution_major_version|int > 19
-
-    - name: Determine required MySQL Python libraries.
-      set_fact:
-        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter|default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
-      when:
-        - mysql_python_package_debian is not defined
-        - ansible_distribution != "Ubuntu"
-        - ansible_distribution_major_version|int < 20
-
-    - include_role:
-        name: geerlingguy.mysql
-
-    - name: create a user with an empty password
-      community.mysql.mysql_query:
-        query:
-          - "CREATE USER foo@bar;"
-        login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   vars:
     overwrite_global_mycnf: false
     mysql_root_password: iloverandompasswordsbutthiswilldo
     mysql_user_password: iloverandompasswordsbutthiswilldo
     mysql_config_file: /etc/mysql/mariadb.cnf
     mysql_root_password_update: true
+  tasks:
+    - name: Use Python 3 on Debian 11
+      ansible.builtin.set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+      when:
+        - ansible_distribution == 'Debian'
+        - ansible_distribution_major_version|int >= 11
+
+    - name: Use Python 3 on Suse
+      ansible.builtin.set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+      when:
+        - ansible_os_family == 'Suse'
+
+    - name: Run the equivalent of "apt-get update && apt-get upgrade"
+      ansible.builtin.apt:
+        upgrade: safe
+        update_cache: true
+      when: ansible_os_family == 'Debian'
+
+    - name: Install required python packages on Suse
+      ansible.builtin.command: zypper -n install python-xml python3-rpm python3-PyMySQL
+      changed_when: false
+      when: ansible_os_family == 'Suse'
+
+    - name: Create missing directory
+      ansible.builtin.file:
+        path: /etc/mysql
+        state: directory
+        mode: "0755"
+
+    - name: Determine required MySQL Python libraries (Ubuntu Focal Fossa ++)
+      ansible.builtin.set_fact:
+        mysql_python_package_debian: python3-pymysql
+      when:
+        - mysql_python_package_debian is not defined
+        - ansible_distribution == "Ubuntu"
+        - ansible_distribution_major_version|int > 19
+
+    - name: Determine required MySQL Python libraries.
+      ansible.builtin.set_fact:
+        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
+      when:
+        - mysql_python_package_debian is not defined
+        - ansible_distribution != "Ubuntu"
+        - ansible_distribution_major_version|int < 20
+
+    - name: Install required MySQL Python libraries on RHEL
+      ansible.builtin.dnf:
+        name: "{% if 'python3' in ansible_python_interpreter | default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
+      when:
+        - ansible_os_family == "RedHat"
+        - ansible_distribution_major_version == "7"
+
+    - name: Install mysql with a generic Ansible role
+      ansible.builtin.include_role:
+        name: dev-sec.mysql
+
+    - name: Include MySQL user prepare tasks
+      ansible.builtin.include_tasks: prepare_tasks/mysql_users.yml

molecule/mysql_hardening/prepare_tasks/mysql_users.yml

@@ -0,0 +1,32 @@
+---
+- name: Create users for test
+  community.mysql.mysql_query:
+    query:
+      - CREATE USER 'user'@'delete';
+      - CREATE USER 'user'@'127.0.0.1';
+      - CREATE USER 'user'@'::1';
+      - CREATE USER 'user'@'%';
+      - CREATE USER 'user'@'192.168.0.%';
+      - CREATE USER 'user'@'192.168.0.1';
+      - CREATE USER    '%'@'192.168.0.1';
+      - CREATE USER 'user'@'192.168.0.2' IDENTIFIED BY 'keep';
+      - CREATE USER 'user'@'keep' IDENTIFIED BY 'keep';
+      - CREATE USER 'user'@'192.168.%' IDENTIFIED BY 'keep';
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+
+- name: Detect role support on MySQL
+  community.mysql.mysql_query:
+    query: >
+      SELECT 1 FROM information_schema.COLUMNS
+                WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
+                AND COLUMN_NAME = 'is_role';
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_role_support
+
+- name: Create roles for test
+  community.mysql.mysql_query:
+    query:
+      - CREATE ROLE 'role_keep';
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  when:
+    - mysql_role_support.rowcount[0] > 0

molecule/mysql_hardening/requirements.yml

@@ -1,8 +1,6 @@
 ---
 roles:
-  - name: geerlingguy.git
+  - name: dev-sec.mysql
-    version: 3.0.0
-  - name: geerlingguy.mysql
     version: master
 
 collections:

molecule/mysql_hardening/verify.yml

@@ -6,57 +6,50 @@
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  roles:
-    - geerlingguy.git
   tasks:
-    - name: install fake SuSE-release for cinc compatibility
+    - name: Use Python 3 on Suse
-      copy:
+      ansible.builtin.set_fact:
-        content: |
+        ansible_python_interpreter: /usr/bin/python3
-          openSUSE Faked Enterprise 2020 (x86_64)
+      when:
-          VERSION = 2020
+        - ansible_os_family == 'Suse'
-          CODENAME = Faked Feature
-        dest: /etc/SuSE-release
-        owner: root
-        group: root
-        mode: '0444'
-      when: ansible_facts.os_family == 'Suse'
 
-    - name: install git for SuSE since geerlinguy.git does not support it
+    - name: Install procps for debian systems
-      zypper:
+      ansible.builtin.apt:
-        name: git
-        state: present
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: install procps for debian systems
-      apt:
         name: procps
         state: present
         update_cache: true
       when: ansible_distribution == 'Debian'
 
-    - name: include tests for the service
+    - name: Include tests for the service
-      include_tasks: verify_tasks/service.yml
+      ansible.builtin.include_tasks: verify_tasks/service.yml
 
-    - name: download cinc-auditor
+    - name: Include tests for MySQL user
-      get_url:
+      ansible.builtin.include_tasks: verify_tasks/mysql_users.yml
-        url: https://omnitruck.cinc.sh/install.sh
-        dest: /tmp/install.sh
-        mode: '0775'
-
-    - name: install cinc-auditor
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
 
+- name: Verify
+  hosts: localhost
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
     - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/mysql-baseline/archive/refs/heads/master.zip"
+      ansible.builtin.command: >
+        docker run
+        --volume /run/docker.sock:/run/docker.sock
+        docker.io/cincproject/auditor exec
+        -t docker://instance
+        --no-show-progress --no-color
+        --no-distinct-exit https://github.com/dev-sec/mysql-baseline/archive/refs/heads/master.zip
       register: test_results
       changed_when: false
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      fail:
+      ansible.builtin.fail:
-        msg: "Inspec failed to validate"
+        msg: Inspec failed to validate
       when: test_results.rc != 0

molecule/mysql_hardening/verify_tasks/mysql_users.yml

@@ -0,0 +1,41 @@
+---
+- name: Get all users from MySQL server
+  community.mysql.mysql_query:
+    query: >
+      SELECT CONCAT(USER, '@', HOST) AS users FROM mysql.user;
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_users
+
+- name: Create list of users from mysql query
+  ansible.builtin.set_fact:
+    mysql_users_list: "{{ mysql_users.query_result.0  | json_query('[*].users') | list }}"
+
+- name: Assert that only accounts with password remain
+  ansible.builtin.assert:
+    that:
+      - '"user@delete" not in mysql_users_list'
+      - '"[email protected]" not in mysql_users_list'
+      - '"user@::1" not in mysql_users_list'
+      - '"user@%" not in mysql_users_list'
+      - '"[email protected].%" not in mysql_users_list'
+      - '"[email protected]" not in mysql_users_list'
+      - '"%@192.168.0.1" not in mysql_users_list'
+      - '"[email protected]" in mysql_users_list'
+      - '"user@keep" in mysql_users_list'
+      - '"[email protected].%" in mysql_users_list'
+
+- name: Detect role support on MySQL
+  community.mysql.mysql_query:
+    query: >
+      SELECT 1 FROM information_schema.COLUMNS
+                WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
+                AND COLUMN_NAME = 'is_role';
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_role_support
+
+- name: Assert that roles remain
+  ansible.builtin.assert:
+    that:
+      - '"role_keep@" in mysql_users_list'
+  when:
+    - mysql_role_support.rowcount[0] > 0

molecule/mysql_hardening/verify_tasks/service.yml

@@ -10,7 +10,7 @@
   ansible.builtin.service_facts:
 
 - name: Check if MySQL is running and enabled
-  assert:
+  ansible.builtin.assert:
     that:
-      - "ansible_facts.services[mysql_daemon + '.service'].state == 'running'"
+      - ansible_facts.services[mysql_daemon + '.service'].state == 'running'
-      - "ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'"
+      - ansible_facts.services[mysql_daemon + '.service'].status == 'enabled'

molecule/nginx_hardening/converge.yml

@@ -1,5 +1,5 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   become: true
   hosts: all
   environment:
@@ -7,8 +7,9 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   vars:
-    - nginx_ppa_use: true
+    nginx_ppa_use: true
-    - nginx_ppa_version: stable
+    nginx_ppa_version: stable
   tasks:
-    - include_role:
+    - name: Include nginx_hardening role
-        name: nginx_hardening
+      ansible.builtin.include_role:
+        name: devsec.hardening.nginx_hardening

molecule/nginx_hardening/molecule.yml

@@ -7,7 +7,7 @@ driver:
   name: docker
 platforms:
   - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -21,7 +21,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
   name: ansible
 
@@ -51,6 +51,7 @@ scenario:
     - syntax
     - create
     - prepare
+    - check
     - converge
     - idempotence
     - verify

molecule/nginx_hardening/official-nginx-role-debian.yml

@@ -1,9 +1,9 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   hosts: localhost
   vars:
-    - nginx_main_template_enable: true
+    nginx_main_template_enable: true
-    - nginx_main_template:
+    nginx_main_template:
       template_file: nginx.conf.j2
       conf_file_name: nginx.conf
       conf_file_location: /etc/nginx/

molecule/nginx_hardening/official-nginx-role-redhat.yml

@@ -1,5 +1,5 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: Wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   hosts: localhost
   roles:
     - nginxinc.nginx

molecule/nginx_hardening/prepare.yml

@@ -1,5 +1,5 @@
 ---
-- name: prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
+- name: Prepare playbook for kitchen testing "ansible-nginx-hardening" with custom settings
   become: true
   hosts: all
   environment:
@@ -7,22 +7,23 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: install required tools on SuSE
+    - name: Install required tools on SuSE
       community.general.zypper:
-        name: "python-xml"
+        name: python-xml
         state: present
       when: ansible_facts.os_family == 'Suse'
 
-    - name: install required packages
+    - name: Install required packages
-      package:
+      ansible.builtin.package:
-        name: "python3-apt"
+        name: python3-apt
         update_cache: true
       ignore_errors: true # noqa ignore-errors
 
     - name: Set correct distribution Version for Amazon Linux
-      set_fact:
+      ansible.builtin.set_fact:
         ansible_distribution_major_version: 7
       when: ansible_distribution == 'Amazon'
 
-    - include_role:
+    - name: Install nginx with a generic Ansible role
+      ansible.builtin.include_role:
         name: geerlingguy.nginx

molecule/nginx_hardening/requirements.yml

@@ -1,4 +1,3 @@
 ---
 roles:
-  - geerlingguy.git
+  - name: geerlingguy.nginx
-  - geerlingguy.nginx

molecule/nginx_hardening/verify.yml

@@ -6,57 +6,38 @@
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  roles:
-    - geerlingguy.git
   tasks:
-    - name: install fake SuSE-release for cinc compatibility
+    - name: Install procps for debian systems
-      copy:
+      ansible.builtin.apt:
-        content: |
-          openSUSE Faked Enterprise 2020 (x86_64)
-          VERSION = 2020
-          CODENAME = Faked Feature
-        dest: /etc/SuSE-release
-        owner: root
-        group: root
-        mode: '0444'
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: install git for SuSE since geerlinguy.git does not support it
-      zypper:
-        name: git
-        state: present
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: Run the equivalent of "apt-get update" as a separate step
-      apt:
-        update_cache: true
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: install required tools on debian
-      apt:
         name: procps
-      when: ansible_facts.os_family == 'Debian'
+        state: present
-
+        update_cache: true
-    - name: download cinc-auditor
+      when: ansible_distribution == 'Debian'
-      get_url:
-        url: https://omnitruck.cinc.sh/install.sh
-        dest: /tmp/install.sh
-        mode: '0775'
-
-    - name: install cinc-auditor
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
 
+- name: Verify
+  hosts: localhost
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
     - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/nginx-baseline/archive/refs/heads/master.zip"
+      ansible.builtin.command: >
+        docker run
+        --volume /run/docker.sock:/run/docker.sock
+        docker.io/cincproject/auditor exec
+        -t docker://instance
+        --no-show-progress --no-color
+        --no-distinct-exit https://github.com/dev-sec/nginx-baseline/archive/refs/heads/master.zip
       register: test_results
       changed_when: false
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      fail:
+      ansible.builtin.fail:
-        msg: "Inspec failed to validate"
+        msg: Inspec failed to validate
       when: test_results.rc != 0

molecule/os_hardening/converge.yml

@@ -1,19 +1,18 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  collections:
-    - devsec.hardening
   tasks:
-    - name: workaround for https://github.com/ansible/ansible/issues/66304
+    - name: Workaround for https://github.com/ansible/ansible/issues/66304
-      set_fact:
+      ansible.builtin.set_fact:
-        ansible_virtualization_type: "docker"
+        ansible_virtualization_type: docker
-    - include_role:
+    - name: Include os_hardening role
-        name: os_hardening
+      ansible.builtin.include_role:
+        name: devsec.hardening.os_hardening
   vars:
     os_security_users_allow: change_user
     os_security_kernel_enable_core_dump: false
@@ -22,17 +21,17 @@
     os_auth_pam_passwdqc_enable: false
     os_auth_lockout_time: 15
     os_desktop_enable: true
-    os_env_extra_user_paths: ['/home']
+    os_env_extra_user_paths: [/home]
     os_auth_allow_homeless: true
-    os_security_suid_sgid_blacklist: ['/bin/umount']
+    os_security_suid_sgid_blacklist: [/bin/umount]
-    os_security_suid_sgid_whitelist: ['/usr/bin/rlogin']
+    os_security_suid_sgid_whitelist: [/usr/bin/rlogin]
     os_filesystem_whitelist: []
-    os_yum_repo_file_whitelist: ['foo.repo']
+    os_yum_repo_file_whitelist: [foo.repo]
-    os_users_without_password_ageing: ['pw_no_ageing']
+    os_users_without_password_ageing: [pw_no_ageing]
     os_auth_pw_warn_age: 7
     os_netrc_enabled: false
-    os_ignore_users: ["shell_sys_acc"]
+    os_ignore_users: [shell_sys_acc]
-    os_ignore_home_folder_users: ["user_with_777_home"]
+    os_ignore_home_folder_users: [user_with_777_home]
     sysctl_config:
       net.ipv4.ip_forward: 0
       net.ipv6.conf.all.forwarding: 0
@@ -73,8 +72,6 @@
 # - name: wrapper playbook for kitchen testing "ansible-os-hardening"
 #  hosts: all
 #  become: true
-#  collections:
-#    - devsec.hardening
 #  vars:
 #    os_auditd_enabled: false
 #  tasks:
@@ -84,9 +81,9 @@
 #      when: ansible_facts.distribution == 'Fedora'
 #
 #    - name: Run the equivalent of "apt-get update" as a separate step
-#      apt:
+#      ansible.builtin.apt:
 #        update_cache: yes
 #      when: ansible_facts.os_family == 'Debian'
 #
 #    - include_role:
-#        name: os_hardening
+#        name: devsec.hardening.os_hardening

molecule/os_hardening/molecule.yml

@@ -1,13 +1,9 @@
 ---
-dependency:
-  name: galaxy
-  options:
-    role-file: molecule/os_hardening/requirements.yml
 driver:
   name: docker
 platforms:
   - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -21,7 +17,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
   name: ansible
 
@@ -51,6 +47,7 @@ scenario:
     - syntax
     - create
     - prepare
+    - check
     - converge
     - idempotence
     - verify

molecule/os_hardening/prepare.yml

@@ -1,40 +1,38 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
-  collections:
-    - devsec.hardening
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
+    - name: Set ansible_python_interpreter to "/usr/bin/python3" on fedora
-      set_fact:
+      ansible.builtin.set_fact:
-        ansible_python_interpreter: "/usr/bin/python3"
+        ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
     - name: Run the equivalent of "apt-get update && apt-get upgrade"
-      apt:
+      ansible.builtin.apt:
-        name: "*"
+        upgrade: safe
-        state: latest
         update_cache: true
       when: ansible_os_family == 'Debian'
 
-    - name: install required tools on SuSE
+    - name: Install required tools on SuSE
       # cannot use zypper module, since it depends on python-xml
-      shell: "zypper -n install python-xml"
+      ansible.builtin.command: zypper -n install python-xml awk
+      changed_when: false
       when: ansible_facts.os_family == 'Suse'
 
-    - name: install required tools on fedora
+    - name: Install required tools on fedora
-      dnf:
+      ansible.builtin.dnf:
         name:
           - python
           - findutils
           - procps-ng
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: install required tools on Arch
+    - name: Install required tools on Arch
       community.general.pacman:
         name:
           - awk
@@ -42,8 +40,8 @@
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: install required tools on RHEL  # noqa ignore-errors
+    - name: Install required tools on RHEL # noqa ignore-errors
-      yum:
+      ansible.builtin.dnf:
         name:
           - openssh-clients
           - openssh
@@ -51,15 +49,15 @@
         update_cache: true
       ignore_errors: true
 
-    - name: create recursing symlink to test minimize access
+    - name: Create recursing symlink to test minimize access
-      shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
+      ansible.builtin.shell: rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz
       changed_when: false
 
-    - name: include YUM prepare tasks
+    - name: Include YUM prepare tasks
-      include_tasks: prepare_tasks/yum.yml
+      ansible.builtin.include_tasks: prepare_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'
 
-    - name: include preparation tasks
+    - name: Include preparation tasks
       ansible.builtin.include_tasks:
         file: "{{ item }}"
       loop:

molecule/os_hardening/prepare_tasks/ignore_home_folders.yml

@@ -1,7 +1,7 @@
 ---
 - name: Create user whose home-folder should not be touched
   ansible.builtin.user:
-    name: "user_with_777_home"
+    name: user_with_777_home
 
 - name: Change mode of home-folder for user to 777
   ansible.builtin.file:

molecule/os_hardening/prepare_tasks/netrc.yml

@@ -1,8 +1,8 @@
 ---
 - name: create '.netrc' in /root
   ansible.builtin.copy:
-    dest: '/root/.netrc'
+    dest: /root/.netrc
-    mode: '0600'
+    mode: "0600"
     content: |
       machine localhost
       login root

molecule/os_hardening/prepare_tasks/pw_ageing.yml

@@ -1,9 +1,10 @@
+---
 - name: Create user those password ageing should not be changed
   user:
-    name: "pw_no_ageing"
+    name: pw_no_ageing
-    password: "$6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1"
+    password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1
 
 - name: Create user those password ageing should be changed
   user:
-    name: "pw_ageing"
+    name: pw_ageing
-    password: "$6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1"
+    password: $6$mysecretsalt$qJbapG68nyRab3gxvKWPUcs2g3t0oMHSHMnSKecYNpSi3CuZm.GbBqXO8BE6EI6P1JUefhA0qvD7b5LSh./PU1

molecule/os_hardening/prepare_tasks/sys_account_shell.yml

@@ -1,5 +1,5 @@
 ---
 - name: Create system user with shell that should keep it
   user:
-    name: "shell_sys_acc"
+    name: shell_sys_acc
-    shell: "/bin/bash"
+    shell: /bin/bash

molecule/os_hardening/prepare_tasks/yum.yml

@@ -1,5 +1,5 @@
 ---
-- name: create 'foo' repository
+- name: Create 'foo' repository
   ansible.builtin.yum_repository:
     name: foo
     description: mandatory description
@@ -7,7 +7,7 @@
     enabled: false
     gpgcheck: false
 
-- name: create 'bar' repository
+- name: Create 'bar' repository
   ansible.builtin.yum_repository:
     name: bar
     description: mandatory description

molecule/os_hardening/requirements.yml

@@ -1,3 +0,0 @@
----
-roles:
-  - geerlingguy.git

molecule/os_hardening/verify.yml

@@ -6,38 +6,13 @@
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  roles:
-    - geerlingguy.git
   tasks:
-    - name: install fake SuSE-release for cinc compatibility
+    - name: Set ansible_python_interpreter to "/usr/bin/python3"
-      copy:
+      ansible.builtin.set_fact:
-        content: |
+        ansible_python_interpreter: /usr/bin/python3
-          openSUSE Faked Enterprise 2020 (x86_64)
+      when: ansible_facts.distribution == 'Fedora'
-          VERSION = 2020
-          CODENAME = Faked Feature
-        dest: /etc/SuSE-release
-        owner: root
-        group: root
-        mode: '0444'
-      when: ansible_facts.os_family == 'Suse'
 
-    - name: install git for SuSE since geerlinguy.git does not support it
+    - name: Include verification tasks
-      zypper:
-        name: git
-        state: present
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: Run the equivalent of "apt-get update" as a separate step
-      apt:
-        update_cache: true
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: install required tools on debian
-      apt:
-        name: procps
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: include verification tasks
       ansible.builtin.include_tasks:
         file: "{{ item }}"
       loop:
@@ -46,48 +21,64 @@
         - verify_tasks/netrc.yml
         - verify_tasks/ignore_home_folders.yml
 
-    - name: include PAM tests
+    # temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
-      include_tasks: verify_tasks/pam.yml
+    #    - name: Include PAM tests
-      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+    #      ansible.builtin.include_tasks: verify_tasks/pam.yml
+    #      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
 
-    - name: include YUM tests
+    - name: Include YUM tests
-      include_tasks: verify_tasks/yum.yml
+      ansible.builtin.include_tasks: verify_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'
 
-    - name: download cinc-auditor
+- name: Verify
-      get_url:
+  hosts: localhost
-        url: https://omnitruck.cinc.sh/install.sh
+  environment:
-        dest: /tmp/install.sh
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
-        mode: '0775'
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
-
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-    - name: install cinc-auditor
+  tasks:
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
+    - name: Execute cinc-auditor tests
-
+      ansible.builtin.command: >
-    - name: Execute cinc-auditor tests  # noqa ignore-errors
+        docker run
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit --waiver-file waivers.yaml https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
+        --volume /run/docker.sock:/run/docker.sock
+        --volume {{ playbook_dir }}/waivers.yaml:/waivers.yaml
+        docker.io/cincproject/auditor exec
+        -t docker://instance
+        --no-show-progress --no-color
+        --waiver-file /waivers.yaml
+        --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip
       register: test_results
       changed_when: false
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      fail:
+      ansible.builtin.fail:
-        msg: "Inspec failed to validate"
+        msg: Inspec failed to validate
       when: test_results.rc != 0
 
+- name: Verify
+  hosts: all
+  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
     # test if variable can be overridden
-    - name: workaround for https://github.com/ansible/ansible/issues/66304
+    - name: Workaround for https://github.com/ansible/ansible/issues/66304
-      set_fact:
+      ansible.builtin.set_fact:
-        ansible_virtualization_type: "docker"
+        ansible_virtualization_type: docker
         os_env_umask: "027 #override"
 
-    - include_role:
+    - name: Include os_hardening role
-        name: os_hardening
+      ansible.builtin.include_role:
+        name: devsec.hardening.os_hardening
 
-    - name: verify os_env_umask
+    - name: Verify os_env_umask
-      shell:
+      ansible.builtin.command:
         cmd: "grep '027 #override' /etc/login.defs"
       changed_when: false

molecule/os_hardening/verify_tasks/netrc.yml

@@ -1,19 +1,19 @@
 ---
-- name: test that .netrc in root homedir exists
+- name: Test that .netrc in root homedir exists
   ansible.builtin.file:
-    path: '/root/.netrc'
+    path: /root/.netrc
     state: file
   register: result_test_netrc
 
-- name: output result if .netrc for user root exists
+- name: Output result if .netrc for user root exists
   ansible.builtin.assert:
     that:
-      - "result_test_netrc.state == 'file'"
+      - result_test_netrc.state == 'file'
-    fail_msg: ".netrc in /root/ not present"
+    fail_msg: .netrc in /root/ not present
-    success_msg: ".netrc exists in /root/"
+    success_msg: .netrc exists in /root/
 
-- name: delete '.netrc' in /root
+- name: Delete '.netrc' in /root
   ansible.builtin.file:
-    path: '/root/.netrc'
+    path: /root/.netrc
     state: absent
   when: result_test_netrc.state == 'file'

molecule/os_hardening/verify_tasks/pam.yml

@@ -1,17 +1,24 @@
 ---
-- name: download pam-tester
+- name: install pip
-  get_url:
+  package:
-    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
+    name:
-    dest: /bin/pam-tester
+      - python3-pip
-    mode: 0555
+      - python3-setuptools
+    state: present
+
+- name: install pam-tester
+  ansible.builtin.pip:
+    name: pam-tester
+    state: present
+    executable: /usr/bin/pip3
 
 - name: set password for test
-  set_fact:
+  ansible.builtin.set_fact:
-    test_pw: "myTest!pw"
+    test_pw: myTest!pw
 
 - name: set locale for test
-  set_fact:
+  ansible.builtin.set_fact:
-    locale: "en_US.UTF-8"
+    locale: en_US.UTF-8
   when:
     - ansible_facts.os_family == 'RedHat'
     - ansible_facts.distribution_major_version < '8'
@@ -21,26 +28,26 @@
     name: testuser
     password: "{{ test_pw | password_hash('sha512') }}"
 
-- name: check successfull login with correct password
+- name: check successful login with correct password
-  shell:
+  ansible.builtin.shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
     LANG: "{{ locale | default('C.UTF-8') }}"
 
-- name: check unsuccessfull login with incorrect password
+- name: check unsuccessful login with incorrect password
-  shell:
+  ansible.builtin.shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
     LANG: "{{ locale | default('C.UTF-8') }}"
   with_sequence: count=6
 
-- name: check unsuccessfull login, with correct password (lockout)
+- name: check unsuccessful login, with correct password (lockout)
-  shell:
+  ansible.builtin.shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
+    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -50,9 +57,9 @@
   pause:
     seconds: 20
 
-- name: check successfull login
+- name: check successful login
-  shell:
+  ansible.builtin.shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"

molecule/os_hardening/verify_tasks/pw_ageing.yml

@@ -7,7 +7,7 @@
 - name: Check that the expiry date of pw_no_ageing is "never"
   ansible.builtin.assert:
     that:
-      - "expiry_date.stdout | trim == 'never'"
+      - expiry_date.stdout | trim == 'never'
 
 - name: Get Password Expiry date for pw_ageing
   ansible.builtin.shell: chage -l pw_ageing | grep "Password expires" | cut -d ":" -f 2
@@ -19,7 +19,7 @@
     # this uses the date from the expire_date variable and subtracts the current date.
     # it should be bigger that the password_expire_min of the user "pw_no_ageing"
     that:
-      - "{{ ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_date_time.date | to_datetime('%Y-%m-%d')).days }} == 60"
+      - ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_date_time.date | to_datetime('%Y-%m-%d')).days == 60
 
 - name: Get Password Expiry warning days for pw_ageing
   ansible.builtin.shell: chage -l pw_ageing | grep "warning before password expires" | cut -d ":" -f 2
@@ -29,4 +29,4 @@
 - name: Check that number of days of warning before password expires is 7 days
   ansible.builtin.assert:
     that:
-      - "expiry_warndays.stdout | trim == '7'"
+      - expiry_warndays.stdout | trim == '7'

molecule/os_hardening/verify_tasks/sys_account_shell.yml

@@ -1,8 +1,9 @@
+---
 - name: Read local linux user database
   getent:
     database: passwd
 
 - name: Check that shell_sys_acc's shell is still bash
-  assert:
+  ansible.builtin.assert:
     that:
       - getent_passwd['shell_sys_acc'][5] == "/bin/bash"

molecule/os_hardening/verify_tasks/yum.yml

@@ -1,8 +1,8 @@
 ---
-- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
+- name: Verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
-  command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
+  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
   changed_when: false
 
-- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
+- name: Verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
-  command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
+  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
   changed_when: false

molecule/os_hardening_vm/converge.yml

@@ -1,23 +1,44 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  collections:
-    - devsec.hardening
   tasks:
-    - name: override for arch
+    - name: Override for arch
-      set_fact: 
+      ansible.builtin.set_fact:
         os_mnt_boot_enabled: false
+        os_mnt_tmp_enabled: true
+        os_mnt_tmp_src: tmpfs
+        os_mnt_tmp_filesystem: tmpfs
       when: ansible_facts.os_family == 'Archlinux'
-    - include_role:
+
-        name: os_hardening
+    - name: Overrides for Fedora image
+      ansible.builtin.set_fact:
+        os_mnt_tmp_enabled: true
+        os_mnt_tmp_src: tmpfs
+        os_mnt_tmp_filesystem: tmpfs
+      when: ansible_facts.distribution == 'Fedora'
+
+    - name: Overrides for Fedora 40 image
+      ansible.builtin.set_fact:
+        os_mnt_var_enabled: true
+        os_mnt_var_src: UUID=282c6d73-afc2-4113-9856-c7679ad51920
+        os_mnt_var_filesystem: btrfs
+        os_mnt_var_options: rw,nosuid,nodev,compress=zstd:1,subvol=var
+      when:
+        - ansible_facts.distribution == 'Fedora'
+        - ansible_distribution_major_version|int == 40
+
+    - name: Include os_hardening role
+      ansible.builtin.include_role:
+        name: devsec.hardening.os_hardening
   vars:
     os_auth_pam_passwdqc_enable: false
     os_auth_lockout_time: 15
-    os_yum_repo_file_whitelist: ['foo.repo']
+    os_yum_repo_file_whitelist: [foo.repo]
     os_mnt_boot_enabled: true
-    os_mnt_boot_src: "/dev/vda1"
+    os_mnt_home_enabled: true
+    os_mnt_boot_src: /dev/vda1

molecule/os_hardening_vm/molecule.yml

@@ -2,17 +2,17 @@
 dependency:
   name: galaxy
   options:
-    role-file: molecule/os_hardening/requirements.yml
+    role-file: molecule/os_hardening_vm/requirements.yml
 driver:
   name: vagrant
   provider:
     name: libvirt
 platforms:
-  # we need to name every instance differntly to start multiple VMs on the same host (parallelization)
+  # we need to name every instance differently to start multiple VMs on the same host (parallelization)
   # since we also need to use different OS users to run the tests because of how molecule operates,
   # the VM names must be predictable by OS user (to clean up canceled runs)
-  - name: "${USER}"
+  - name: ${USER}
-    box: "generic/${MOLECULE_DISTRO}"
+    box: ${MOLECULE_DISTRO}
     memory: 1024
     cpus: 2
 provisioner:
@@ -24,7 +24,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
   name: ansible
   env:
@@ -56,6 +56,7 @@ scenario:
     - syntax
     - create
     - prepare
+    - check
     - converge
     - idempotence
     - verify

molecule/os_hardening_vm/prepare.yml

@@ -1,38 +1,71 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: Prepare Archliux host
+  hosts: all
+  become: true
+  gather_facts: false
+  tasks:
+    - name: Install python, since it's not installed by default
+      ansible.builtin.raw: pacman --noconfirm -Sy python
+      changed_when: false
+      when: lookup('env', 'MOLECULE_DISTRO') == 'generic/arch'
+
+- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
   hosts: all
   become: true
-  collections:
-    - devsec.hardening
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
+    - name: Set ansible_python_interpreter to "/usr/bin/python3" on fedora
-      set_fact:
+      ansible.builtin.set_fact:
-        ansible_python_interpreter: "/usr/bin/python3"
+        ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
+    - name: Block update of Grub, because of error
+      ansible.builtin.dpkg_selections:
+        name: grub-pc
+        selection: hold
+      when: ansible_os_family == 'Debian'
+
+    # we need to free up space, since the /boot partition in some Vagrant images is
+    # pretty small and system updates might fail
+    - name: Find all initrd.img to delete them
+      ansible.builtin.find:
+        paths: /boot
+        patterns: "initrd.img*"
+      register: find_results
+      when: ansible_os_family == 'Debian'
+
+    - name: Delete all initrd.img to free space on /boot
+      ansible.builtin.file:
+        path: "{{ item['path'] }}"
+        state: absent
+      with_items: "{{ find_results['files'] }}"
+      when: ansible_os_family == 'Debian'
+
     - name: Run the equivalent of "apt-get update && apt-get upgrade"
-      apt:
+      ansible.builtin.apt:
+        upgrade: safe
         update_cache: true
       when: ansible_os_family == 'Debian'
 
-    - name: install required tools on SuSE
+    - name: Install required tools on SuSE
       # cannot use zypper module, since it depends on python-xml
-      shell: "zypper -n install python-xml"
+      ansible.builtin.command: zypper -n install python-xml
+      changed_when: false
       when: ansible_facts.os_family == 'Suse'
 
-    - name: install required tools on fedora
+    - name: Install required tools on fedora
-      dnf:
+      ansible.builtin.dnf:
         name:
           - python
           - findutils
           - procps-ng
+          - python3-libselinux
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: install required tools on Arch
+    - name: Install required tools on Arch
       community.general.pacman:
         name:
           - awk
@@ -40,8 +73,8 @@
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: install required tools on RHEL  # noqa ignore-errors
+    - name: Install required tools on RHEL # noqa ignore-errors
-      yum:
+      ansible.builtin.dnf:
         name:
           - openssh-clients
           - openssh
@@ -49,10 +82,16 @@
         update_cache: true
       ignore_errors: true
 
-    - name: create recursing symlink to test minimize access
+    - name: Create recursing symlink to test minimize access
-      shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
+      ansible.builtin.shell: rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz
       changed_when: false
 
-    - name: include YUM prepare tasks
+    - name: Unmount EFI partition to get rid of vfat filesystem (qemu has no firmware image that inspec can detect)
-      include_tasks: prepare_tasks/yum.yml
+      ansible.posix.mount:
+        path: /boot/efi
+        state: unmounted
+      when: ansible_facts.distribution == 'Fedora'
+
+    - name: Include YUM prepare tasks
+      ansible.builtin.include_tasks: prepare_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'

molecule/os_hardening_vm/prepare_tasks/yum.yml

@@ -1,5 +1,5 @@
 ---
-- name: create 'foo' repository
+- name: Create 'foo' repository
   ansible.builtin.yum_repository:
     name: foo
     description: mandatory description
@@ -7,7 +7,7 @@
     enabled: false
     gpgcheck: false
 
-- name: create 'bar' repository
+- name: Create 'bar' repository
   ansible.builtin.yum_repository:
     name: bar
     description: mandatory description

molecule/os_hardening_vm/requirements.yml

@@ -1,3 +1,3 @@
 ---
 roles:
-  - geerlingguy.git
+  - name: geerlingguy.git

molecule/os_hardening_vm/verify.yml

@@ -6,65 +6,55 @@
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  roles:
-    - geerlingguy.git
   tasks:
-    - name: install fake SuSE-release for cinc compatibility
+    # temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
-      copy:
+    #    - name: Include PAM tests
-        content: |
+    #      ansible.builtin.include_tasks: verify_tasks/pam.yml
-          openSUSE Faked Enterprise 2020 (x86_64)
+    #      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
-          VERSION = 2020
-          CODENAME = Faked Feature
-        dest: /etc/SuSE-release
-        owner: root
-        group: root
-        mode: '0444'
-      when: ansible_facts.os_family == 'Suse'
 
-    - name: install git for SuSE since geerlinguy.git does not support it
+    - name: Include YUM tests
-      zypper:
+      ansible.builtin.include_tasks: verify_tasks/yum.yml
-        name: git
-        state: present
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: Run the equivalent of "apt-get update" as a separate step
-      apt:
-        update_cache: true
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: install required tools on debian
-      apt:
-        name: procps
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: include PAM tests
-      include_tasks: verify_tasks/pam.yml
-      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
-
-    - name: include YUM tests
-      include_tasks: verify_tasks/yum.yml
       when: ansible_facts.os_family == 'RedHat'
 
-    - name: download cinc-auditor
+- name: Verify
-      get_url:
+  hosts: localhost
-        url: https://omnitruck.cinc.sh/install.sh
+  environment:
-        dest: /tmp/install.sh
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
-        mode: '0775'
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: Get ssh-config
+      ansible.builtin.command:
+        cmd: vagrant ssh-config
+        chdir: "{{ molecule_ephemeral_directory }}"
+      register: ssh_config
+      changed_when: false
 
-    - name: install cinc-auditor
+    - name: Create ssh-config file
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
+      ansible.builtin.copy:
+        content: "{{ ssh_config.stdout_lines | join ('\n') }}"
+        dest: "{{ molecule_ephemeral_directory }}/ssh-config"
+        mode: "0400"
+      changed_when: false
 
-    - name: Execute cinc-auditor tests  # noqa ignore-errors
+    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
+      ansible.builtin.command: >
+        docker run --rm
+        --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
+        docker.io/cincproject/auditor exec
+        --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
+        -t ssh://{{ lookup('env', 'USER') }}
+        --sudo --no-show-progress --no-color
+        --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip
       register: test_results
       changed_when: false
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      fail:
+      ansible.builtin.fail:
-        msg: "Inspec failed to validate"
+        msg: Inspec failed to validate
       when: test_results.rc != 0

molecule/os_hardening_vm/verify_tasks/pam.yml

@@ -1,17 +1,23 @@
 ---
-- name: download pam-tester
+- name: install pip
-  get_url:
+  package:
-    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
+    name:
-    dest: /bin/pam-tester
+      - python3-pip
-    mode: 0555
+      - python3-setuptools
+    state: present
+
+- name: install pam-tester
+  ansible.builtin.pip:
+    name: pam-tester
+    state: present
 
 - name: set password for test
-  set_fact:
+  ansible.builtin.set_fact:
-    test_pw: "myTest!pw"
+    test_pw: myTest!pw
 
 - name: set locale for test
-  set_fact:
+  ansible.builtin.set_fact:
-    locale: "en_US.UTF-8"
+    locale: en_US.UTF-8
   when:
     - ansible_facts.os_family == 'RedHat'
     - ansible_facts.distribution_major_version < '8'
@@ -21,26 +27,26 @@
     name: testuser
     password: "{{ test_pw | password_hash('sha512') }}"
 
-- name: check successfull login with correct password
+- name: check successful login with correct password
-  shell:
+  ansible.builtin.shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+    cmd: pam-tester --user testuser --password {{ test_pw }}
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
     LANG: "{{ locale | default('C.UTF-8') }}"
 
-- name: check unsuccessfull login with incorrect password
+- name: check unsuccessful login with incorrect password
-  shell:
+  ansible.builtin.shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+    cmd: pam-tester --user testuser --password {{ test_pw }}fail --expectfail
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
     LANG: "{{ locale | default('C.UTF-8') }}"
   with_sequence: count=6
 
-- name: check unsuccessfull login, with correct password (lockout)
+- name: check unsuccessful login, with correct password (lockout)
-  shell:
+  ansible.builtin.shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
+    cmd: pam-tester --user testuser --password {{ test_pw }} --expectfail
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -50,9 +56,9 @@
   pause:
     seconds: 20
 
-- name: check successfull login
+- name: check successful login
-  shell:
+  ansible.builtin.shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+    cmd: pam-tester --user testuser --password {{ test_pw }}
   environment:
     TMPDIR: /var/tmp
     LC_ALL: "{{ locale | default('C.UTF-8') }}"

molecule/os_hardening_vm/verify_tasks/yum.yml

@@ -1,8 +1,8 @@
 ---
-- name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
+- name: Verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
-  command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
+  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
   changed_when: false
 
-- name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
+- name: Verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
-  command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
+  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
   changed_when: false

molecule/ssh_hardening/converge.yml

@@ -1,14 +1,13 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  collections:
-    - devsec.hardening
   tasks:
-    - include_role:
+    - name: Include ssh_hardening role
-        name: ssh_hardening
+      ansible.builtin.include_role:
+        name: devsec.hardening.ssh_hardening
   vars:
     sftp_enabled: false

molecule/ssh_hardening/molecule.yml

@@ -1,13 +1,9 @@
 ---
-dependency:
-  name: galaxy
-  options:
-    role-file: molecule/ssh_hardening/requirements.yml
 driver:
   name: docker
 platforms:
   - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -21,7 +17,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
   inventory:
     host_vars:
       # https://molecule.readthedocs.io/en/latest/examples.html#docker-with-non-privileged-user
@@ -57,6 +53,7 @@ scenario:
     - syntax
     - create
     - prepare
+    - check
     - converge
     - idempotence
     - verify

molecule/ssh_hardening/prepare.yml

@@ -1,5 +1,5 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
   become: true
   environment:
@@ -7,13 +7,13 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: use python3
+    - name: Use python3
-      set_fact:
+      ansible.builtin.set_fact:
         ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: install packages  # noqa ignore-errors
+    - name: Install packages # noqa ignore-errors
-      yum:
+      ansible.builtin.dnf:
         name:
           - openssh-clients
           - openssh-server
@@ -22,8 +22,8 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install packages  # noqa ignore-errors
+    - name: Install packages # noqa ignore-errors
-      dnf:
+      ansible.builtin.dnf:
         name:
           - openssh-clients
           - openssh-server
@@ -32,8 +32,8 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install packages  # noqa ignore-errors
+    - name: Install packages # noqa ignore-errors
-      apt:
+      ansible.builtin.apt:
         name:
           - openssh-client
           - openssh-server
@@ -41,19 +41,20 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install required tools on SuSE
+    - name: Install required tools on SuSE
       # cannot use zypper module, since it depends on python-xml
-      shell: "zypper -n install python-xml"
+      ansible.builtin.command: zypper -n install python-xml
+      changed_when: false
       when: ansible_facts.os_family == 'Suse'
 
-    - name: install packages
+    - name: Install packages
-      zypper:
+      community.general.zypper:
         name:
-          - "openssh"
+          - openssh
       when: ansible_facts.os_family == 'Suse'
 
-    - name: install required tools on Arch
+    - name: Install required tools on Arch
-      pacman:
+      community.general.pacman:
         name:
           - openssh
           - awk
@@ -61,16 +62,11 @@
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: created needed directory
+    - name: Create ssh host keys # noqa ignore-errors
-      file:
+      ansible.builtin.command: ssh-keygen -A
-        path: "/var/run/sshd"
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
-        state: directory
+        or ansible_facts.distribution == "Fedora"
-
+        or ansible_facts.distribution == "Amazon"
-    - name: create ssh host keys  # noqa ignore-errors
+        or ansible_facts.os_family == "Suse"
-      command: "ssh-keygen -A"
-      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
-            ansible_facts.distribution == "Fedora" or
-            ansible_facts.distribution == "Amazon" or
-            ansible_facts.os_family == "Suse"
       changed_when: false
       ignore_errors: true

molecule/ssh_hardening/requirements.yml

@@ -1,3 +0,0 @@
----
-roles:
-  - geerlingguy.git

molecule/ssh_hardening/verify.yml

@@ -1,57 +1,28 @@
 ---
 - name: Verify
-  hosts: all
+  hosts: localhost
-  become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  roles:
-    - geerlingguy.git
   tasks:
-    - name: install fake SuSE-release for cinc compatibility
-      copy:
-        content: |
-          openSUSE Faked Enterprise 2020 (x86_64)
-          VERSION = 2020
-          CODENAME = Faked Feature
-        dest: /etc/SuSE-release
-        owner: root
-        group: root
-        mode: '0444'
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: install git for SuSE since geerlinguy.git does not support it
-      zypper:
-        name: git
-        state: present
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: install crypto compat modules on fedora
-      dnf:
-        name: libxcrypt-compat
-      when: ansible_facts.distribution == 'Fedora'
-
-    - name: download cinc-auditor
-      get_url:
-        url: https://omnitruck.cinc.sh/install.sh
-        dest: /tmp/install.sh
-        mode: '0775'
-
-    - name: install cinc-auditor
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
-
     - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip"
+      ansible.builtin.command: >
+        docker run
+        --volume /run/docker.sock:/run/docker.sock
+        docker.io/cincproject/auditor exec
+        -t docker://instance
+        --no-show-progress --no-color
+        --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip
       register: test_results
       changed_when: false
       ignore_errors: true
 
     - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
         msg: "{{ test_results.stdout_lines }}"
 
     - name: Fail when tests fail
-      fail:
+      ansible.builtin.fail:
-        msg: "Inspec failed to validate"
+        msg: Inspec failed to validate
       when: test_results.rc != 0

molecule/ssh_hardening_bsd/INSTALL.rst

@@ -0,0 +1,22 @@
+*******
+Docker driver installation guide
+*******
+
+Requirements
+============
+
+* Docker Engine
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ python3 -m pip install 'molecule[docker]'

molecule/ssh_hardening_bsd/converge.yml

@@ -0,0 +1,13 @@
+---
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+  hosts: all
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: Include ssh_hardening role
+      ansible.builtin.include_role:
+        name: devsec.hardening.ssh_hardening
+  vars:
+    sftp_enabled: false

molecule/ssh_hardening_bsd/molecule.yml

@@ -0,0 +1,58 @@
+---
+driver:
+  name: vagrant
+  provider:
+    name: libvirt
+platforms:
+  # we need to name every instance differently to start multiple VMs on the same host (parallelization)
+  # since we also need to use different OS users to run the tests because of how molecule operates,
+  # the VM names must be predictable by OS user (to clean up canceled runs)
+  - name: ${USER}
+    box: generic/${MOLECULE_DISTRO}
+    memory: 1024
+    cpus: 2
+provisioner:
+  name: ansible
+  options:
+    diff: true
+  env:
+    ANSIBLE_PIPELINING: "True"
+  config_options:
+    defaults:
+      interpreter_python: auto_silent
+      callbacks_enabled: profile_tasks, timer, yaml
+verifier:
+  name: ansible
+  env:
+    ANSIBLE_PIPELINING: "True"
+
+scenario:
+  create_sequence:
+    - dependency
+    - create
+    - prepare
+  check_sequence:
+    - dependency
+    - destroy
+    - create
+    - prepare
+    - converge
+    - check
+    - destroy
+  converge_sequence:
+    - dependency
+    - create
+    - prepare
+    - converge
+  destroy_sequence:
+    - destroy
+  test_sequence:
+    - dependency
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - verify
+    - destroy

molecule/ssh_hardening_bsd/prepare.yml

@@ -0,0 +1,28 @@
+---
+- name: Prepare OpenBSD host
+  hosts: all
+  become: true
+  gather_facts: false
+  tasks:
+    - name: Install python
+      # BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
+      ansible.builtin.raw: pkg_add python%3.10
+      changed_when: false
+      when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
+
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+  hosts: all
+  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: Create ssh host keys # noqa ignore-errors
+      ansible.builtin.command: ssh-keygen -A
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
+        or ansible_facts.distribution == "Fedora"
+        or ansible_facts.distribution == "Amazon"
+        or ansible_facts.os_family == "Suse"
+      changed_when: false
+      ignore_errors: true

molecule/ssh_hardening_bsd/verify.yml

@@ -0,0 +1,57 @@
+---
+- name: OpenBSD workaround - inspec detects OpenSBD as unix and not linux compatible
+  hosts: all
+  become: true
+  tasks:
+    - name: Use the type command instead of which to detect existing commands
+      ansible.builtin.file:
+        src: /usr/bin/which
+        dest: /usr/bin/type
+        state: hard
+        mode: "0770"
+      when: lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'
+
+- name: Verify
+  hosts: localhost
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: Get ssh-config
+      ansible.builtin.command:
+        cmd: vagrant ssh-config
+        chdir: "{{ molecule_ephemeral_directory }}"
+      register: ssh_config
+      changed_when: false
+
+    - name: Create ssh-config file
+      ansible.builtin.copy:
+        content: "{{ ssh_config.stdout_lines | join ('\n') }}"
+        dest: "{{ molecule_ephemeral_directory }}/ssh-config"
+        mode: "0400"
+      changed_when: false
+
+    - name: Execute cinc-auditor tests
+      ansible.builtin.command: >
+        docker run --rm
+        --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
+        --volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') }}.yaml:/waivers.yaml
+        docker.io/cincproject/auditor exec
+        --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
+        -t ssh://{{ lookup('env', 'USER') }}
+        --sudo --no-show-progress --no-color
+        --waiver-file /waivers.yaml
+        --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip
+      register: test_results
+      changed_when: false
+      ignore_errors: true
+
+    - name: Display details about the cinc-auditor results
+      ansible.builtin.debug:
+        msg: "{{ test_results.stdout_lines }}"
+
+    - name: Fail when tests fail
+      ansible.builtin.fail:
+        msg: Inspec failed to validate
+      when: test_results.rc != 0

molecule/ssh_hardening_bsd/waivers_freebsd13.yaml

@@ -0,0 +1,3 @@
+sshd-45:
+  run: false
+  justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"

molecule/ssh_hardening_bsd/waivers_freebsd14.yaml

@@ -0,0 +1,3 @@
+sshd-45:
+  run: false
+  justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"

molecule/ssh_hardening_bsd/waivers_openbsd7.yaml

@@ -0,0 +1,21 @@
+ssh-17:
+  run: false
+  justification: "GSSAPIAuthentication is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
+ssh-18:
+  run: false
+  justification: "GSSAPIDelegateCredentials is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
+sshd-30:
+  run: false
+  justification: "KerberosAuthentication is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
+sshd-31:
+  run: false
+  justification: "KerberosOrLocalPasswd is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
+sshd-32:
+  run: false
+  justification: "KerberosTicketCleanup is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
+sshd-33:
+  run: false
+  justification: "GSSAPIAuthentication is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
+sshd-34:
+  run: false
+  justification: "GSSAPICleanupCredentials is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"

molecule/ssh_hardening_custom_tests/converge.yml

@@ -1,49 +1,43 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
   hosts: all
   become: true
   environment:
     http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  collections:
-    - devsec.hardening
   tasks:
-    - include_role:
+    - name: Include ssh_hardening role
-        name: ssh_hardening
+      ansible.builtin.include_role:
+        name: devsec.hardening.ssh_hardening
   vars:
-    ssh_trusted_user_ca_keys_file: '/etc/ssh/ca.pub'
+    ssh_trusted_user_ca_keys_file: /etc/ssh/ca.pub
     ssh_trusted_user_ca_keys:
-      - '# ssh-rsa ...'
+      - "# ssh-rsa ..."
-    ssh_authorized_principals_file: '/etc/ssh/auth_principals/%u'
+    ssh_authorized_principals_file: /etc/ssh/auth_principals/%u
     ssh_authorized_principals:
-      - path: "/etc/ssh/auth_principals/root"
+      - path: /etc/ssh/auth_principals/root
         principals:
-          - "root"
+          - root
-        owner: "{{ ssh_owner }}"
-        group: "{{ ssh_group }}"
-        directoryowner: "{{ ssh_owner }}"
-        directorygroup: "{{ ssh_group }}"
-        directorymode: "0700"
     network_ipv6_enable: true
-    ssh_allow_tcp_forwarding: 'yes'
+    ssh_allow_tcp_forwarding: "yes"
-    ssh_gateway_ports: true
+    ssh_gateway_ports: "clientspecified"
     ssh_allow_agent_forwarding: true
-    ssh_server_permit_environment_vars: 'yes'
+    ssh_server_permit_environment_vars: "yes"
-    ssh_server_accept_env_vars: 'PWD HTTP_PROXY'
+    ssh_server_accept_env_vars: PWD HTTP_PROXY
     ssh_client_alive_interval: 100
     ssh_client_alive_count: 10
     ssh_client_password_login: true
     ssh_challengeresponseauthentication: true
     ssh_compression: true
-    ssh_allow_users: 'root kitchen vagrant'
+    ssh_allow_users: root kitchen vagrant
-    ssh_allow_groups: 'root kitchen vagrant'
+    ssh_allow_groups: root kitchen vagrant
-    ssh_deny_users: 'foo bar'
+    ssh_deny_users: foo bar
-    ssh_deny_groups: 'foo bar'
+    ssh_deny_groups: foo bar
-    ssh_authorized_keys_file: '/etc/ssh/authorized_keys/%u'
+    ssh_authorized_keys_file: /etc/ssh/authorized_keys/%u
     ssh_max_auth_retries: 10
-    ssh_permit_root_login: "without-password"
+    ssh_permit_root_login: without-password
-    ssh_permit_tunnel: true
+    ssh_permit_tunnel: "yes"
     ssh_print_motd: true
     ssh_print_last_log: true
     ssh_banner: true
@@ -54,33 +48,33 @@
       - 22
       - 222
     ssh_server_match_address:
-      - address: '192.168.1.0/24'
+      - address: 192.168.1.0/24
         rules:
-          - 'AllowTcpForwarding yes'
+          - AllowTcpForwarding yes
-          - 'AllowAgentForwarding no'
+          - AllowAgentForwarding no
     ssh_server_match_group:
-      - group: 'root'
+      - group: root
         rules:
-          - 'AllowTcpForwarding yes'
+          - AllowTcpForwarding yes
-          - 'AllowAgentForwarding no'
+          - AllowAgentForwarding no
     ssh_server_match_user:
-      - user: 'root'
+      - user: root
         rules:
-          - 'AllowTcpForwarding yes'
+          - AllowTcpForwarding yes
-          - 'AllowAgentForwarding no'
+          - AllowAgentForwarding no
     ssh_server_match_local_port:
       - port: 222
         rules:
-          - 'AllowTcpForwarding yes'
+          - AllowTcpForwarding yes
-          - 'AllowAgentForwarding no'
+          - AllowAgentForwarding no
     ssh_remote_hosts:
-      - names: ['example.com', 'example2.com']
+      - names: [example.com, example2.com]
-        options: ['Port 2222', 'ForwardAgent yes']
+        options: [Port 2222, ForwardAgent yes]
-      - names: ['example3.com']
+      - names: [example3.com]
-        options: ['StrictHostKeyChecking no']
+        options: [StrictHostKeyChecking no]
     ssh_use_dns: true
     ssh_use_pam: true
-    ssh_max_startups: '10:30:60'
+    ssh_max_startups: 10:30:60
     ssh_host_key_algorithms:
       - ssh-ed25519
       - rsa-sha2-512
@@ -98,6 +92,6 @@
       - diffie-hellman-group-exchange-sha256
       - diffie-hellman-group-exchange-sha1
     ssh_custom_options:
-      - "Include /etc/ssh/ssh_config.d/*"
+      - Include /etc/ssh/ssh_config.d/*
     sshd_custom_options:
-      - "AcceptEnv LANG"
+      - AcceptEnv LANG

molecule/ssh_hardening_custom_tests/molecule.yml

@@ -1,13 +1,9 @@
 ---
-dependency:
-  name: galaxy
-  options:
-    role-file: molecule/ssh_hardening/requirements.yml
 driver:
   name: docker
 platforms:
   - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest
     command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -21,7 +17,7 @@ provisioner:
   config_options:
     defaults:
       interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
   name: ansible
 
@@ -51,6 +47,7 @@ scenario:
     - syntax
     - create
     - prepare
+    - check
     - converge
     - idempotence
     - verify

molecule/ssh_hardening_custom_tests/prepare.yml

@@ -1,5 +1,5 @@
 ---
-- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
   hosts: all
   become: true
   environment:
@@ -7,13 +7,13 @@
     https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
     no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
   tasks:
-    - name: use python3
+    - name: Use python3
-      set_fact:
+      ansible.builtin.set_fact:
         ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: install packages  # noqa ignore-errors
+    - name: Install packages # noqa ignore-errors
-      yum:
+      ansible.builtin.dnf:
         name:
           - openssh-clients
           - openssh-server
@@ -22,8 +22,8 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install packages  # noqa ignore-errors
+    - name: Install packages # noqa ignore-errors
-      dnf:
+      ansible.builtin.dnf:
         name:
           - openssh-clients
           - openssh-server
@@ -32,8 +32,8 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install packages  # noqa ignore-errors
+    - name: Install packages # noqa ignore-errors
-      apt:
+      ansible.builtin.apt:
         name:
           - openssh-client
           - openssh-server
@@ -41,19 +41,20 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install required tools on SuSE
+    - name: Install required tools on SuSE
       # cannot use zypper module, since it depends on python-xml
-      shell: "zypper -n install python-xml"
+      ansible.builtin.command: zypper -n install python-xml
+      changed_when: false
       when: ansible_facts.os_family == 'Suse'
 
-    - name: install packages
+    - name: Install packages
-      zypper:
+      community.general.zypper:
         name:
-          - "openssh"
+          - openssh
       when: ansible_facts.os_family == 'Suse'
 
-    - name: install required tools on Arch
+    - name: Install required tools on Arch
-      pacman:
+      community.general.pacman:
         name:
           - openssh
           - awk
@@ -61,16 +62,11 @@
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: created needed directory
+    - name: Create ssh host keys # noqa ignore-errors
-      file:
+      ansible.builtin.command: ssh-keygen -A
-        path: "/var/run/sshd"
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
-        state: directory
+        or ansible_facts.distribution == "Fedora"
-
+        or ansible_facts.distribution == "Amazon"
-    - name: create ssh host keys  # noqa ignore-errors
+        or ansible_facts.os_family == "Suse"
-      command: "ssh-keygen -A"
-      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
-            ansible_facts.distribution == "Fedora" or
-            ansible_facts.distribution == "Amazon" or
-            ansible_facts.os_family == "Suse"
       changed_when: false
       ignore_errors: true

molecule/ssh_hardening_custom_tests/requirements.yml

@@ -1,3 +0,0 @@
----
-roles:
-  - geerlingguy.git

renovate.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:best-practices",
+    ":gitSignOff"
+  ],
+  "dependencyDashboard": true,
+  "dependencyDashboardAutoclose": true,
+  "packageRules": [
+    {
+      "matchUpdateTypes": ["patch", "minor"],
+      "automerge": true
+    }
+  ]
+}

requirements.txt

@@ -1,6 +1,7 @@
-molecule[docker]
+molecule
+molecule-plugins[docker]
 yamllint
-ansible
+ansible-core==2.16.5
 ansible-lint
 docker
 flake8

roles/mysql_hardening/CHANGELOG.md

@@ -91,7 +91,7 @@
 
 **Implemented enhancements:**
 
-- add follow=yes to my.cnf protect task, incase its a symlink. fixes \#20 [\#21](https://github.com/dev-sec/ansible-mysql-hardening/pull/21) ([rndmh3ro](https://github.com/rndmh3ro))
+- add follow=yes to my.cnf protect task, in case its a symlink. fixes \#20 [\#21](https://github.com/dev-sec/ansible-mysql-hardening/pull/21) ([rndmh3ro](https://github.com/rndmh3ro))
 - add changelog generator [\#7](https://github.com/dev-sec/ansible-mysql-hardening/pull/7) ([chris-rock](https://github.com/chris-rock))
 
 **Closed issues:**

roles/mysql_hardening/README.md

@@ -1,6 +1,6 @@
 # devsec.mysql_hardening
 
-![devsec.mysql_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.mysql_hardening/badge.svg)
+[![devsec.mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/mysql_hardening.yml)
 
 ## Description
 
@@ -12,74 +12,131 @@ It configures:
 - Removes anonymous users, users without a password or authentication_string and test databases
 - various hardening options inside MySQL
 
+Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.
+
+Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
+
 ## Requirements
 
-- Ansible 2.9.0
+- An existing installation of MySQL or MariaDB.
-- An existing MySQL installation
 - python-jmespath on the ansible host
 
-### Example playbook
+<!-- BEGIN_ANSIBLE_DOCS -->
 
-```yml
+## Supported Operating Systems
-- hosts: localhost
-  collections:
-    - devsec.hardening
-  roles:
-    - mysql_hardening
-```
 
-This role expects an existing installation of MySQL or MariaDB. Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.  
+- EL
-Please ensure that the following variables are set accordingly:
+  - 8, 9
-
+- Ubuntu
-- `mysql_hardening_enabled: yes` role is enabled by default and can be disabled without removing it from a playbook. You can use conditional variable, for example: `mysql_hardening_enabled: "{{ true if mysql_enabled else false }}"`
+  - bionic, focal, jammy
-- `mysql_hardening_user: 'mysql'` The user that mysql runs as.
+- Debian
-- `mysql_hardening_mysql_hardening_conf_file: '/etc/mysql/conf.d/hardening.cnf'` The path to the configuration file where the hardening will be performed
+  - bullseye, buster
-- _deprecated: `mysql_datadir: '/var/lib/mysql'` The MySQL data directory_
+- Amazon
-  - `mysql_datadir` is no longer necessary, as MySQL data directory is automatically taken from `mysql_info`. But it can still be defined and will also be checked for correct permissions.
+- opensuse
 
 ## Role Variables
 
+- `mysql_daemon_enabled`
+  - Default: `true`
+  - Description: Whether to enable the MySQL-service so it starts on boot
+  - Type: bool
+  - Required: no
 - `mysql_hardening_chroot`
-  - Default: ""
+  - Default: ``
   - Description: [chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)
-- `mysql_hardening_options.safe-user-create`
+  - Type: str
-  - Default: 1
+  - Required: no
-  - Description: [safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)
-- `mysql_hardening_options.secure-auth`
-  - Default: 1
-  - Description: [secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)
-- `mysql_hardening_options.skip-symbolic-links`
-  - Default: 1
-  - Description: [skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)
-- `mysql_hardening_skip_grant_tables:`
-  - Default: false
-  - Description: [skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)
-- `mysql_hardening_skip_show_database`
-  - Default: 1
-  - Description: [skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)
-- `mysql_hardening_options.local-infile`
-  - Default: 0
-  - Description: [local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)
-- `mysql_hardening_options.allow-suspicious-udfs`
-  - Default: 0
-  - Description: [allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)
 - `mysql_hardening_chroot.automatic-sp-privileges`
-  - Default: 0
+  - Default: `0`
   - Description: [automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)
+  - Type: int
+  - Required: no
+- `mysql_hardening_enabled`
+  - Default: `true`
+  - Description: Whether to run the hardening
+  - Type: bool
+  - Required: no
+- `mysql_hardening_options.allow-suspicious-udfs`
+  - Default: `0`
+  - Description: [allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)
+  - Type: int
+  - Required: no
+- `mysql_hardening_options.local-infile`
+  - Default: `0`
+  - Description: [local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)
+  - Type: int
+  - Required: no
+- `mysql_hardening_options.safe-user-create`
+  - Default: `1`
+  - Description: [safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)
+  - Type: int
+  - Required: no
+- `mysql_hardening_options.secure-auth`
+  - Default: `1`
+  - Description: [secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)
+  - Type: int
+  - Required: no
 - `mysql_hardening_options.secure-file-priv`
-  - Default: /tmp
+  - Default: `/tmp`
   - Description: [secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)
-- `mysql_allow_remote_root`
+  - Type: str
-  - Default: false
+  - Required: no
-  - Description: delete remote root users
+- `mysql_hardening_options.skip-symbolic-links`
-- `mysql_remove_anonymous_users`
+  - Default: `1`
-  - Default: true
+  - Description: [skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)
-  - Description: remove users without authentication
+  - Type: int
-- `mysql_remove_test_database`
+  - Required: no
-  - Default: true
-  - Description: remove test database
 - `mysql_hardening_restart_mysql`
-  - Default: true
+  - Default: `true`
   - Description: Restart mysql after running this role
+  - Type: bool
+  - Required: no
+- `mysql_hardening_skip_grant_tables:`
+  - Default: `false`
+  - Description: [skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)
+  - Type: bool
+  - Required: no
+- `mysql_hardening_skip_show_database`
+  - Default: `1`
+  - Description: [skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)
+  - Type: int
+  - Required: no
+- `mysql_remove_anonymous_users`
+  - Default: `true`
+  - Description: Set to `false` to keep users without authentication
+  - Type: bool
+  - Required: no
+- `mysql_remove_remote_root`
+  - Default: `true`
+  - Description: If `true`, root can only connect from localhost. Set to `false` to not remove remote root users.
+  - Type: bool
+  - Required: no
+- `mysql_remove_test_database`
+  - Default: `true`
+  - Description: Set to `false` to keep the test database
+  - Type: bool
+  - Required: no
+- `mysql_root_password`
+  - Default: `-----====>SetR00tPa$$wordH3r3!!!<====-----`
+  - Description: The default password. Please change or overwrite it
+  - Type: str
+  - Required: no
+- `mysql_user_home`
+  - Default: `{{ ansible_env.HOME }}`
+  - Description: The path where the `.my.cnf` will be stored
+  - Type: str
+  - Required: no
 
-Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
+## Dependencies
+
+None.
+
+## Example Playbook
+
+```
+- hosts: all
+  roles:
+    - name: devsec.hardening.mysql_hardening
+```
+
+<!-- END_ANSIBLE_DOCS -->

roles/mysql_hardening/defaults/main.yml

@@ -6,8 +6,6 @@ mysql_daemon_enabled: true
 
 mysql_hardening_restart_mysql: true
 
-# general configuration
-mysql_hardening_mysql_hardening_conf_file: "{{ mysql_hardening_mysql_confd_dir }}/hardening.cnf"
 # You have to change this to your own strong enough mysql root password
 mysql_root_password: "-----====>SetR00tPa$$wordH3r3!!!<====-----"
 # There .my.cnf with mysql root credentials will be installed

roles/mysql_hardening/meta/argument_specs.yml

@@ -0,0 +1,79 @@
+---
+argument_specs:
+  main:
+    short_description: The main entry point for the mysql hardening role.
+    version_added: 8.8.0
+    options:
+      mysql_hardening_chroot:
+        default: ''
+        type: str
+        description: '[chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)'
+      mysql_hardening_options.safe-user-create:
+        default: 1
+        type: int
+        description: '[safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)'
+      mysql_hardening_options.secure-auth:
+        default: 1
+        type: int
+        description: '[secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)'
+      mysql_hardening_options.skip-symbolic-links:
+        default: 1
+        type: int
+        description: '[skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)'
+      'mysql_hardening_skip_grant_tables:':
+        default: false
+        type: bool
+        description: '[skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)'
+      mysql_hardening_skip_show_database:
+        default: 1
+        type: int
+        description: '[skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)'
+      mysql_hardening_options.local-infile:
+        default: 0
+        type: int
+        description: '[local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)'
+      mysql_hardening_options.allow-suspicious-udfs:
+        default: 0
+        type: int
+        description: '[allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)'
+      mysql_hardening_chroot.automatic-sp-privileges:
+        default: 0
+        type: int
+        description: '[automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)'
+      mysql_hardening_options.secure-file-priv:
+        default: /tmp
+        type: str
+        description: '[secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)'
+      mysql_remove_anonymous_users:
+        default: true
+        type: bool
+        description: Set to `false` to keep users without authentication
+      mysql_remove_test_database:
+        default: true
+        type: bool
+        description: Set to `false` to keep the test database
+      mysql_hardening_restart_mysql:
+        default: true
+        type: bool
+        description: Restart mysql after running this role
+      mysql_hardening_enabled:
+        default: true
+        type: bool
+        description: Whether to run the hardening
+      mysql_daemon_enabled:
+        default: true
+        type: bool
+        description: Whether to enable the MySQL-service so it starts on boot
+      mysql_root_password:
+        default: '-----====>SetR00tPa$$wordH3r3!!!<====-----'
+        type: str
+        description: The default password. Please change or overwrite it
+      mysql_user_home:
+        default: '{{ ansible_env.HOME }}'
+        type: str
+        description: The path where the `.my.cnf` will be stored
+      mysql_remove_remote_root:
+        default: true
+        type: bool
+        description: If `true`, root can only connect from localhost. Set to `false`
+          to not remove remote root users.

roles/mysql_hardening/meta/main.yml

@@ -8,19 +8,19 @@ galaxy_info:
   platforms:
     - name: EL
       versions:
-        - "7"
         - "8"
+        - "9"
     - name: Ubuntu
       versions:
-        - bionic
         - focal
         - jammy
+        - noble
     - name: Debian
       versions:
         - bullseye
-        - buster
+        - bookworm
     - name: Amazon
-    - name: Fedora
+    - name: opensuse
   galaxy_tags:
     - system
     - security

roles/mysql_hardening/tasks/configure.yml

@@ -27,7 +27,11 @@
     owner: "{{ mysql_hardening_user }}"
     group: "{{ mysql_hardening_group }}"
     mode: "0640"
-  when: item is defined and item != ""
+  when:
+    - item is defined
+    - item != ""
+    - item != "stderr"
+    - item != "stdout"
   loop:
     - "{{ mysql_settings.settings.log_error }}"
     - '{{ mysql_hardening_log_file | default("") }}'
@@ -52,7 +56,7 @@
 - name: Apply hardening configuration
   ansible.builtin.template:
     src: hardening.cnf.j2
-    dest: "{{ mysql_hardening_mysql_hardening_conf_file }}"
+    dest: "{{ mysql_hardening_mysql_confd_dir + '/hardening.cnf' }}"
     owner: "{{ mysql_cnf_owner }}"
     group: "{{ mysql_cnf_group }}"
     mode: "0640"

roles/mysql_hardening/tasks/main.yml

@@ -14,7 +14,7 @@
 
 # we only override variables with our default if they have not been specified already.
 # by default the lookup functions finds all varnames containing the string, therefore
-# we add ^ and $ to denote start and end of string, so this returns only exact maches.
+# we add ^ and $ to denote start and end of string, so this returns only exact matches.
 - name: Set OS dependent variables, if not already defined by user # noqa var-naming
   ansible.builtin.set_fact:
     "{{ item.key }}": "{{ item.value }}"

roles/mysql_hardening/tasks/mysql_secure_installation.yml

@@ -46,19 +46,30 @@
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   when: mysql_remove_remote_root
 
+- name: Detect role support on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
+  community.mysql.mysql_query:
+    query: >
+      SELECT 1 FROM information_schema.COLUMNS
+                WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
+                AND COLUMN_NAME = 'is_role';
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_role_support
+  check_mode: false
+
 - name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
   community.mysql.mysql_query:
     query: >
-      SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
+      SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
       FROM mysql.user
       WHERE (length(authentication_string)=0
              OR authentication_string="")
         AND USER NOT IN ('mysql.sys',
                          'mysqlxsys',
-                         'mariadb.sys');
+                         'mariadb.sys')
-
+        {{ 'AND CONVERT(is_role USING utf8) = "N"' if mysql_role_support.rowcount[0] > 0 }};
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   register: mysql_users_wo_passwords_or_auth_string
+  check_mode: false
   when: >
     (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '>=')) or
     (mysql_distribution == "mariadb" and mysql_version.version.full
@@ -67,7 +78,7 @@
 - name: Get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
   community.mysql.mysql_query:
     query: >
-      SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
+      SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
       FROM mysql.user
       WHERE (length(password)=0
              OR password="")
@@ -75,33 +86,21 @@
              OR authentication_string="")
         AND USER NOT IN ('mysql.sys',
                          'mysqlxsys',
-                         'mariadb.sys');
+                         'mariadb.sys')
+        {{ 'AND is_role = "N"' if mysql_role_support.rowcount[0] > 0 }};
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   register: mysql_users_wo_passwords
+  check_mode: false
   when: >
     (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '<')) or
     (mysql_distribution == "mariadb" and mysql_version.version.full is
     version('10.4.0', '<'))
 
-- name: Create a fact for users without password or authentication_string
-  ansible.builtin.set_fact:
-    users_wo_auth: "{{ mysql_users_wo_passwords_or_auth_string.query_result.0.0 | community.general.json_query('users') }}"
-  when:
-    - mysql_users_wo_passwords_or_auth_string.query_result is defined
-    - mysql_users_wo_passwords_or_auth_string.query_result != "" # noqa empty-string-compare
-
-- name: Create a fact for users without password
-  ansible.builtin.set_fact:
-    users_wo_auth: "{{ mysql_users_wo_passwords.query_result.0.0 | community.general.json_query('users') }}"
-  when:
-    - mysql_users_wo_passwords.query_result is defined
-    - mysql_users_wo_passwords.query_result != "" # noqa empty-string-compare
-
 - name: Ensure that there are no users without password or authentication_string
   community.mysql.mysql_query:
     query:
-      - DROP USER {{ users_wo_auth }}
+      - DROP USER {{ item.user }}
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
-  when:
+  with_community.general.flattened:
-    - users_wo_auth is defined
+    - "{{ mysql_users_wo_passwords.query_result | default([]) }}"
-    - users_wo_auth != "" # noqa empty-string-compare
+    - "{{ mysql_users_wo_passwords_or_auth_string.query_result | default([]) }}"

roles/nginx_hardening/README.md

@@ -1,6 +1,6 @@
 # devsec.nginx_hardening
 
-![devsec.nginx_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.nginx_hardening/badge.svg)
+[![devsec.nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/nginx_hardening.yml)
 
 ## Description
 
@@ -8,110 +8,142 @@ This role provides secure nginx configuration. It is intended to be compliant wi
 
 It works with the following nginx-roles, including, but not limited to:
 
-- [geerlingguy.nginx](https://galaxy.ansible.com/geerlingguy/nginx/)
+- [nginxinc.nginx](https://galaxy.ansible.com/ui/standalone/roles/nginxinc/nginx/)
-- [nginxinc.nginx](https://galaxy.ansible.com/nginxinc/nginx)
+- [geerlinggux.nginx](https://galaxy.ansible.com/ui/standalone/roles/geerlingguy/nginx/)
-- [jdauphant.nginx](https://galaxy.ansible.com/jdauphant/nginx/)
+- [jdauphant.nginx](https://galaxy.ansible.com/ui/standalone/roles/jdauphant/nginx/)
-- [franklinkim.nginx](https://galaxy.ansible.com/franklinkim/nginx/)
 
 **NOTE: This role does not work with nginx 1.0.15 or older! Please use the latest version from the official nginx repositories!**
 
-## Requirements
+<!-- BEGIN_ANSIBLE_DOCS -->
 
-- Ansible >= 2.9
+## Supported Operating Systems
+
+- EL
+  - 8, 9
+- Ubuntu
+  - bionic, focal, jammy
+- Debian
+  - buster, bullseye
+- Amazon
 
 ## Role Variables
 
-- [nginx_client_body_buffer_size][]
+- `nginx_add_header`
+  - Default: `["X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"", "Content-Security-Policy \\\"script-src 'self'; object-src 'self'\\\""]`
+  - Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See [nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
+  - Type: list
+  - Required: no
+- `nginx_client_body_buffer_size`
   - Default: `1k`
-  - Description: Sets buffer size for reading client request body. In case the request body is larger than the buffer, the whole body or only its part is written to a temporary file.
+  - Description: Sets buffer size for reading client request body. In case the request body is larger than the buffer, the whole body or only its part is written to a temporary file. See [nginx_client_body_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size)
-- nginx_remove_default_site
+  - Type: str
+  - Required: no
+- `nginx_client_body_timeout`
+  - Default: `10`
+  - Description: Defines a timeout for reading client request body. See [nginx_client_body_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout)
+  - Type: int
+  - Required: no
+- `nginx_client_header_buffer_size`
+  - Default: `1k`
+  - Description: Sets buffer size for reading client request header. For most requests, a buffer of 1K bytes is enough. See [nginx_client_header_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client
+  - Type: str
+  - Required: no
+- `nginx_client_header_timeout`
+  - Default: `10`
+  - Description: Defines a timeout for reading client request header. See [nginx_client_header_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout)
+  - Type: int
+  - Required: no
+- `nginx_client_max_body_size`
+  - Default: `1k`
+  - Description: Sets the maximum allowed size of the client request body, specified in the "Content-Length" request header field. If the size in a request exceeds the configured value, the 413 (Request Entity Too Large) error is returned to the client. See [nginx_client_max_body_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size)
+  - Type: str
+  - Required: no
+- `nginx_configuration_dir`
+  - Default: `/etc/nginx`
+  - Description: The main location for all nginx configuration files
+  - Type: str
+  - Required: no
+- `nginx_configuration_hardening_dir`
+  - Default: `/etc/nginx`
+  - Description: The location for the nginx hardening configuration file (Could be different e.g. when used in jails)
+  - Type: str
+  - Required: no
+- `nginx_dh_size`
+  - Default: `2048`
+  - Description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam)
+  - Type: int
+  - Required: no
+- `nginx_keepalive_timeout`
+  - Default: `5 5`
+  - Description: The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The optional second parameter sets a value in the "Keep-Alive timeout=time" response header field. See [nginx_keepalive_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout)
+  - Type: str
+  - Required: no
+- `nginx_large_client_header_buffers`
+  - Default: `2 1k`
+  - Description: Sets the maximum number and size of buffers used for reading large client request header. See [nginx_large_client_header_buffers](http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers)
+  - Type: str
+  - Required: no
+- `nginx_limit_conn`
+  - Default: `default 5`
+  - Description: Sets the shared memory zone and the maximum allowed number of connections for a given key value. See [nginx_limit_conn](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn)
+  - Type: str
+  - Required: no
+- `nginx_limit_conn_zone`
+  - Default: `$binary_remote_addr zone=default:10m`
+  - Description: Sets parameters for a shared memory zone that will keep states for various keys. See [nginx_limit_conn_zone](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone)
+  - Type: str
+  - Required: no
+- `nginx_owner_group`
+  - Default: `root`
+  - Description: The owner group of the nginx configuration files
+  - Type: str
+  - Required: no
+- `nginx_owner_user`
+  - Default: `root`
+  - Description: The owner user of the nginx configuration files
+  - Type: str
+  - Required: no
+- `nginx_remove_default_site`
   - Default: `true`
   - Description: Disables the default site. Set to false to enable the default site in nginx.
-- [nginx_client_max_body_size][]
+  - Type: bool
-  - Default: `1k`
+  - Required: no
-  - Description: Sets the maximum allowed size of the client request body, specified in the “Content-Length” request header field. If the size in a request exceeds the configured value, the 41
+- `nginx_send_timeout`
-    3 (Request Entity Too Large) error is returned to the client.
+  - Default: `10`
-- [nginx_keepalive_timeout][]
+  - Description: Sets a timeout for transmitting a response to the client. See [nginx_send_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout)
-  - Default: `5 5`
+  - Type: int
-  - Description: The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The op
+  - Required: no
-    tional second parameter sets a value in the “Keep-Alive: timeout=time” response header field.
+- `nginx_server_tokens`
-- [nginx_server_tokens][]
   - Default: `off`
-  - Description: Disables emitting nginx version in error messages and in the "Server" response header field. Set to on to enable the nginx version in error messages and "Server" response head
+  - Description: Disables emitting nginx version in error messages and in the "Server" response header field. Set to on to enable the nginx version in error messages and "Server" response header. See [nginx_server_tokens](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens)
-    er.
+  - Type: str
-- [nginx_client_header_buffer_size][]
+  - Required: no
-  - Default: `1k`
+- `nginx_ssl_ciphers`
-  - Description: Sets buffer size for reading client request header. For most requests, a buffer of 1K bytes is enough.
+  - Default: `ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256`
-- [nginx_large_client_header_buffers][]
+  - Description: Specifies the TLS ciphers which should be used. See [nginx_ssl_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers)
-  - Default: `2 1k`
+  - Type: str
-  - Description: Sets the maximum number and size of buffers used for reading large client request header.
+  - Required: no
-- [nginx_client_body_timeout][]
+- `nginx_ssl_prefer_server_ciphers`
-  - Default: `10`
-  - Description: Defines a timeout for reading client request body.
-- [nginx_client_header_timeout][]
-  - Default: `10`
-  - Description: Defines a timeout for reading client request header.
-- [nginx_send_timeout][]
-  - Default: `10`
-  - Description: Sets a timeout for transmitting a response to the client.
-- [nginx_limit_conn_zone][]
-  - Default: `$binary_remote_addr zone=default:10m`
-  - Description: Sets parameters for a shared memory zone that will keep states for various keys.
-- [nginx_limit_conn][]
-  - Default: `default 5`
-  - Description: Sets the shared memory zone and the maximum allowed number of connections for a given key value.
-- [nginx_add_header][]
-  - Default: `[ "X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"", Content-Security-Policy \"script-src 'self'; object-src 'self'\" ]`
-  - Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307.
-- [nginx_ssl_protocols][]
-  - Default: `TLSv1.2`
-  - Description: Specifies the SSL protocol which should be used.
-- [nginx_ssl_ciphers][]
-  - Default: _see defaults.yml_
-  - Description: Specifies the TLS ciphers which should be used.
-- [nginx_ssl_prefer_server_ciphers][]
   - Default: `on`
-  - Description: Specifies that server ciphers should be preferred over client ciphers when using the TLS protocols. Set to false to disable it.
+  - Description: Specifies that server ciphers should be preferred over client ciphers when using the TLS protocols. Set to false to disable it. See [nginx_ssl_prefer_server_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers)
-- [nginx_dh_size][]
+  - Type: str
-  - Default: `2048`
+  - Required: no
-  - Description: Specifies the length of DH parameters for EDH ciphers.
+- `nginx_ssl_protocols`
-- [nginx_configuration_dir][]
+  - Default: `TLSv1.2`
-  - default: "/etc/nginx"
+  - Description: Specifies the SSL protocol which should be used. See [nginx_ssl_protocols](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols)
-  - Description: The main location for all nginx configuration files
+  - Type: str
-- [nginx_configuration_hardening_dir][]
+  - Required: no
-  - default: "/etc/nginx"
+
-  - Description: The location for the nginx hardening configuration file (Could be different e.g. when used in jails)
+## Dependencies
-- [nginx_owner_user][]
+
-  - default: "root"
+None.
-  - Description: The owner user of the nginx configuration files
-- [nginx_owner_group][]
-  - default: "root"
-  - Description: The owner group of the nginx configuration files
 
 ## Example Playbook
 
 ```
-- hosts: localhost
+- hosts: all
-  collections:
-    - devsec.hardening
   roles:
-    - nginx_hardening
+    - name: devsec.hardening.nginx_hardening
 ```
 
-[nginx_client_body_buffer_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size
+<!-- END_ANSIBLE_DOCS -->
-[nginx_client_max_body_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
-[nginx_keepalive_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout
-[nginx_server_tokens]: http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens
-[nginx_more_clear_headers]: http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header
-[nginx_client_header_buffer_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_buffer_size
-[nginx_large_client_header_buffers]: http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers
-[nginx_client_body_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout
-[nginx_client_header_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout
-[nginx_send_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout
-[nginx_limit_conn_zone]: http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone
-[nginx_limit_conn]: http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn
-[nginx_add_header]: http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header
-[nginx_ssl_protocols]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols
-[nginx_ssl_ciphers]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers
-[nginx_ssl_prefer_server_ciphers]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers
-[nginx_dh_size]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam

roles/nginx_hardening/defaults/main.yml

@@ -25,7 +25,6 @@ nginx_add_header:
   - Strict-Transport-Security max-age=15768000
   - Content-Security-Policy "script-src 'self'; object-src 'self'"
 
-nginx_set_cookie_flag: "* HttpOnly secure"
 nginx_ssl_prefer_server_ciphers: "on"
 nginx_ssl_protocols: TLSv1.2 TLSv1.3
 # yamllint disable-line rule:line-length

roles/nginx_hardening/meta/argument_specs.yml

@@ -0,0 +1,112 @@
+---
+argument_specs:
+  main:
+    short_description: The main entry point for the nginx hardening role.
+    version_added: 8.8.0
+    options:
+      nginx_client_body_buffer_size:
+        default: 1k
+        type: str
+        description: Sets buffer size for reading client request body. In case the
+          request body is larger than the buffer, the whole body or only its part
+          is written to a temporary file. See [nginx_client_body_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size)
+      nginx_remove_default_site:
+        default: true
+        type: bool
+        description: Disables the default site. Set to false to enable the default
+          site in nginx.
+      nginx_client_max_body_size:
+        default: 1k
+        type: str
+        description: Sets the maximum allowed size of the client request body, specified
+          in the "Content-Length" request header field. If the size in a request exceeds
+          the configured value, the 413 (Request Entity Too Large) error is returned
+          to the client. See [nginx_client_max_body_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size)
+      nginx_keepalive_timeout:
+        default: 5 5
+        type: str
+        description: The first parameter sets a timeout during which a keep-alive
+          client connection will stay open on the server side. The zero value disables
+          keep-alive client connections. The optional second parameter sets a value
+          in the "Keep-Alive timeout=time" response header field. See [nginx_keepalive_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout)  # noqa yaml[line-length]
+      nginx_server_tokens:
+        default: 'off'
+        type: str
+        description: Disables emitting nginx version in error messages and in the
+          "Server" response header field. Set to on to enable the nginx version in
+          error messages and "Server" response header. See [nginx_server_tokens](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens)
+      nginx_client_header_buffer_size:
+        default: 1k
+        type: str
+        description: Sets buffer size for reading client request header. For most
+          requests, a buffer of 1K bytes is enough. See [nginx_client_header_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client
+      nginx_large_client_header_buffers:
+        default: 2 1k
+        type: str
+        description: Sets the maximum number and size of buffers used for reading
+          large client request header. See [nginx_large_client_header_buffers](http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers)  # noqa yaml[line-length]
+      nginx_client_body_timeout:
+        default: 10
+        type: int
+        description: Defines a timeout for reading client request body. See [nginx_client_body_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout)  # noqa yaml[line-length]
+      nginx_client_header_timeout:
+        default: 10
+        type: int
+        description: Defines a timeout for reading client request header. See [nginx_client_header_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout)  # noqa yaml[line-length]
+      nginx_send_timeout:
+        default: 10
+        type: int
+        description: Sets a timeout for transmitting a response to the client. See
+          [nginx_send_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout)
+      nginx_limit_conn_zone:
+        default: $binary_remote_addr zone=default:10m
+        type: str
+        description: Sets parameters for a shared memory zone that will keep states
+          for various keys. See [nginx_limit_conn_zone](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone)
+      nginx_limit_conn:
+        default: default 5
+        type: str
+        description: Sets the shared memory zone and the maximum allowed number of
+          connections for a given key value. See [nginx_limit_conn](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn)
+      nginx_add_header:
+        default: [X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff, X-XSS-Protection
+              "1; mode=block", Content-Security-Policy \"script-src 'self'; object-src
+              'self'\"]
+        type: list
+        description: Adds the specified field to a response header provided that the
+          response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See
+          [nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
+      nginx_ssl_protocols:
+        default: TLSv1.2
+        type: str
+        description: Specifies the SSL protocol which should be used. See [nginx_ssl_protocols](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols)  # noqa yaml[line-length]
+      nginx_ssl_ciphers:
+        default: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256  # noqa yaml[line-length]
+        type: str
+        description: Specifies the TLS ciphers which should be used. See [nginx_ssl_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers)
+      nginx_ssl_prefer_server_ciphers:
+        default: 'on'
+        type: str
+        description: Specifies that server ciphers should be preferred over client
+          ciphers when using the TLS protocols. Set to false to disable it. See [nginx_ssl_prefer_server_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers)  # noqa yaml[line-length]
+      nginx_dh_size:
+        default: 2048
+        type: int
+        description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam)  # noqa yaml[line-length]
+      nginx_configuration_dir:
+        default: /etc/nginx
+        type: str
+        description: The main location for all nginx configuration files
+      nginx_configuration_hardening_dir:
+        default: /etc/nginx
+        type: str
+        description: The location for the nginx hardening configuration file (Could
+          be different e.g. when used in jails)
+      nginx_owner_user:
+        default: root
+        type: str
+        description: The owner user of the nginx configuration files
+      nginx_owner_group:
+        default: root
+        type: str
+        description: The owner group of the nginx configuration files

roles/nginx_hardening/meta/main.yml

@@ -8,17 +8,18 @@ galaxy_info:
   platforms:
     - name: EL
       versions:
-        - "7"
         - "8"
+        - "9"
     - name: Ubuntu
       versions:
-        - bionic
         - focal
         - jammy
+        - noble
     - name: Debian
       versions:
-        - buster
+        - bookworm
         - bullseye
+    - name: Amazon
   galaxy_tags:
     - system
     - security

roles/os_hardening/CHANGELOG.md

@@ -54,7 +54,7 @@
 
 - fix fedora build [\#296](https://github.com/dev-sec/ansible-os-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
 - do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-os-hardening/pull/289) ([schurzi](https://github.com/schurzi))
-- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
+- move hidepid vars into defaults so they're overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
 
 ## [6.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/6.1.0) (2020-07-21)
 
@@ -118,7 +118,7 @@
 - Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-os-hardening/pull/259) ([jaredledvina](https://github.com/jaredledvina))
 - Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-os-hardening/pull/254) ([kravietz](https://github.com/kravietz))
 - Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-os-hardening/pull/251) ([dustinmiller1337](https://github.com/dustinmiller1337))
-- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) ([dustinmiller1337](https://github.com/dustinmiller1337))
+- Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) ([dustinmiller1337](https://github.com/dustinmiller1337))
 - Make max_log_file_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-os-hardening/pull/246) ([jandd](https://github.com/jandd))
 - Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-os-hardening/pull/240) ([ghost](https://github.com/ghost))
 - Fedora - Use new auto ansible_python_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-os-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
@@ -193,7 +193,7 @@
 
 **Fixed bugs:**
 
-- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191)
+- auditd causing v5.0 to fail on unprivileged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191)
 - Setting os_security_users_allow has no effect [\#175](https://github.com/dev-sec/ansible-os-hardening/issues/175)
 - add /usr/bin/su to suid_guid whitelist [\#199](https://github.com/dev-sec/ansible-os-hardening/pull/199) ([ccolic](https://github.com/ccolic))
 - ensure that permissions to su-binary are not restricted to root user and group only, if os_security_users_allow contains the value change_user [\#197](https://github.com/dev-sec/ansible-os-hardening/pull/197) ([szEvEz](https://github.com/szEvEz))
@@ -374,7 +374,7 @@
 - Docker [\#90](https://github.com/dev-sec/ansible-os-hardening/pull/90) ([rndmh3ro](https://github.com/rndmh3ro))
 - debian 8 support [\#88](https://github.com/dev-sec/ansible-os-hardening/pull/88) ([rndmh3ro](https://github.com/rndmh3ro))
 - Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-os-hardening/pull/85) ([fitz123](https://github.com/fitz123))
-- replace ignore_errors to failed_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) ([fitz123](https://github.com/fitz123))
+- replace ignore_errors to failed_when to suppress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) ([fitz123](https://github.com/fitz123))
 - fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-os-hardening/pull/79) ([fitz123](https://github.com/fitz123))
 
 **Fixed bugs:**
@@ -487,7 +487,7 @@
 - Repair debian install script [\#8](https://github.com/dev-sec/ansible-os-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
 - Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-os-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
 - Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-os-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
-- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accommodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
 - treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-os-hardening/pull/3) ([arlimus](https://github.com/arlimus))
 - Add Securetty-support [\#2](https://github.com/dev-sec/ansible-os-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
 - Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-os-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))

roles/os_hardening/defaults/main.yml

@@ -1,5 +1,6 @@
 ---
 os_desktop_enable: false
+os_env_user_paths: [/usr/local/sbin, /usr/local/bin, /usr/sbin, /usr/bin, /sbin, /bin]
 os_env_extra_user_paths: []
 os_auth_pw_max_age: 60
 os_auth_pw_min_age: 7 # Discourage password cycling
@@ -9,6 +10,7 @@ os_auth_retries: 5
 os_auth_lockout_time: 600 # Seconds (600 = 10min)
 os_auth_timeout: 60
 os_auth_allow_homeless: false
+os_auth_pam_oddjob_mkhomedir: false
 os_auth_pam_passwdqc_enable: true
 os_auth_pam_passwdqc_options: min=disabled,disabled,16,12,8 # Used in Debian
 os_auth_pam_pwquality_options: try_first_pass retry=3 authtok_type= # Used in RHEL7 and RHEL8
@@ -38,7 +40,6 @@ os_users_without_password_ageing: []
 
 # Specify system accounts whose login should not be disabled and password not changed
 os_ignore_users: [vagrant, kitchen]
-os_security_kernel_enable_module_loading: true
 os_security_kernel_enable_core_dump: false
 os_security_suid_sgid_enforce: true
 # User-defined blacklist and whitelist
@@ -157,8 +158,8 @@ sysctl_config:
   # https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening#ptrace
   #
   # For applications launching crash handlers that need PTRACE, exceptions can
-  # be registered by the debugee by declaring in the segfault handler
+  # be registered by the debuggee by declaring in the segfault handler
-  # specifically which process will be using PTRACE on the debugee:
+  # specifically which process will be using PTRACE on the debuggee:
   #   prctl(PR_SET_PTRACER, debugger_pid, 0, 0, 0);
   #
   # In general, PTRACE is not needed for the average running Ubuntu system.
@@ -305,7 +306,7 @@ sysctl_config:
 
 # Do not delete the following line or otherwise the playbook will fail
 # at task 'create a combined sysctl-dict if overwrites are defined'
-sysctl_overwrite:
+sysctl_overwrite: {}
 # Disable unused filesystems
 os_unused_filesystems:
   - cramfs
@@ -331,9 +332,13 @@ os_hardening_enabled: true
 
 # Set to false to disable installing and configuring auditd.
 os_auditd_enabled: true
+os_auditd_template: etc/audit/auditd.conf.j2
 os_auditd_flush: INCREMENTAL
+os_auditd_freq: 20
 os_auditd_max_log_file: 6
 os_auditd_max_log_file_action: keep_logs
+os_auditd_write_logs: true
+os_auditd_log_file: /var/log/audit/audit.log
 os_auditd_log_format: RAW
 os_auditd_admin_space_left: 50
 os_auditd_space_left: 75
@@ -351,7 +356,7 @@ os_selinux_state: enforcing
 os_selinux_policy: targeted
 
 # Mount options for proc in /etc/fstab.
-proc_mnt_options: rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}
+proc_mnt_options: rw,nosuid,nodev,noexec,relatime
 
 # Set to false to disable installing and configuring cron.
 os_cron_enabled: true

roles/os_hardening/handlers/main.yml

@@ -1,16 +1,27 @@
 ---
-- name: Update-initramfs
+- name: Update-initramfs # noqa no-changed-when
   ansible.builtin.command: update-initramfs -u
 
-- name: Restart auditd # noqa command-instead-of-module
-  ansible.builtin.command:
-    cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
-  when: molecule_yml is not defined # restarting auditd in a container does not work
-
 - name: Reload systemd
   ansible.builtin.systemd:
     daemon_reload: true
 
+- name: Restart auditd via systemd
+  ansible.builtin.systemd:
+    name: auditd.service
+    state: restarted
+  ignore_errors: "{{ ansible_check_mode }}"
+  when:
+    - molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
+    - not ansible_facts.os_family == 'RedHat'
+
+- name: Restart auditd via service # noqa command-instead-of-module no-changed-when
+  ansible.builtin.command:
+    cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
+  when:
+    - molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work
+    - ansible_facts.os_family == 'RedHat'
+
 - name: Remount filesystems
   ansible.posix.mount:
     path: "{{ item }}"

roles/os_hardening/meta/argument_specs.yml

@@ -0,0 +1,840 @@
+---
+argument_specs:
+  main:
+    short_description: The main entry point for the os hardening role.
+    version_added: 8.8.0
+    options:
+      os_desktop_enable:
+        default: false
+        type: bool
+        description: true if this is a desktop system, ie Xorg, KDE/GNOME/Unity/etc.
+      os_env_user_paths:
+        default: [/usr/local/sbin, /usr/local/bin, /usr/sbin, /usr/bin, /sbin, /bin]
+        type: list
+        description: Specify paths that should be checked for binaries where access will be minimized
+      os_env_extra_user_paths:
+        default: '[]'
+        type: list
+        description: Specify additional paths that should be checked for binaries where access will be minimized
+      os_auth_pw_max_age:
+        default: 60
+        type: int
+        description: maximum password age (set to `99999` to effectively disable it).
+      os_auth_pw_min_age:
+        default: 7
+        type: int
+        description: minimum password age (before allowing any other password change).
+      os_auth_pw_warn_age:
+        default: 7
+        type: int
+        description: number of days of warning before password expires.
+      os_auth_pw_remember:
+        default: 5
+        type: int
+        description: how many used passwords are record.
+      os_auth_retries:
+        default: 5
+        type: int
+        description: the maximum number of authentication attempts, before the account
+          is locked for some time.
+      os_auth_lockout_time:
+        default: 600
+        type: int
+        description: time in seconds that needs to pass, if the account was locked
+          due to too many failed authentication attempts.
+      os_auth_timeout:
+        default: 60
+        type: int
+        description: authentication timeout in seconds, so login will exit if this
+          time passes.
+      os_auth_allow_homeless:
+        default: false
+        type: bool
+        description: true if to allow users without home to login.
+      os_auth_pam_passwdqc_enable:
+        default: true
+        type: bool
+        description: true if you want to use strong password checking in PAM using
+          passwdqc.
+      os_auth_pam_passwdqc_options:
+        default: min=disabled,disabled,16,12,8
+        type: str
+        description: set to any option line (as a string) that you want to pass to
+          passwdqc.
+      os_auth_pam_oddjob_mkhomedir:
+        default: false
+        type: bool
+        description: Enables automatic homedir e.g. in FreeIPA environments
+      os_auth_pam_pwquality_options:
+        default: try_first_pass retry=3 authtok_type=
+        type: str
+        description: Options to pass to the PAM module pwquality
+      os_security_users_allow:
+        default: '[]'
+        type: list
+        description: list of things, that a user is allowed to do. May contain `change_user`.
+      os_security_kernel_enable_core_dump:
+        default: false
+        type: bool
+        description: kernel is crashing or otherwise misbehaving and a kernel core
+          dump is created.
+      os_security_suid_sgid_enforce:
+        default: true
+        type: bool
+        description: true if you want to reduce SUID/SGID bits. There is already a
+          list of items which are searched for configured, but you can also add your
+          own.
+      os_security_suid_sgid_blacklist:
+        default: '[]'
+        type: list
+        description: a list of paths which should have their SUID/SGID bits removed.
+      os_security_suid_sgid_whitelist:
+        default: '[]'
+        type: list
+        description: a list of paths which should not have their SUID/SGID bits altered.
+      os_security_suid_sgid_remove_from_unknown:
+        default: false
+        type: bool
+        description: true if you want to remove SUID/SGID bits from any file, that
+          is not explicitly configured in a `blacklist`. This will make every Ansible-run
+          search through the mounted filesystems looking for SUID/SGID bits that are
+          not configured in the default and user blacklist. If it finds an SUID/SGID
+          bit, it will be removed, unless this file is in your `whitelist`.
+      os_auth_uid_min:
+        default: 1000
+        type: int
+        description: minimum number for automatic uid selection in useradd.
+      os_auth_uid_max:
+        default: 60000
+        type: int
+        description: maximum number for automatic uid selection in useradd.
+      os_auth_gid_min:
+        default: 1000
+        type: int
+        description: minimum number for automatic gid selection in groupadd.
+      os_auth_gid_max:
+        default: 60000
+        type: int
+        description: maximum number for automatic gid selection in groupadd.
+      os_auth_sub_uid_count:
+        default: 65536
+        type: int
+        description: If /etc/subuid exists, the commands useradd and newusers (unless
+          the user already have subordinate user IDs) allocate SUB_UID_COUNT unused
+          user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user. See
+          also `os_auth_sub_uid_min` and `os_auth_sub_uid_max`.
+      os_auth_sub_uid_min:
+        default: 100000
+        type: int
+        description: minimum number for automatic subordinate uid selection in useradd
+          and newusers.
+      os_auth_sub_uid_max:
+        default: 600100000
+        type: int
+        description: maximum number for automatic subordinate uid selection in useradd
+          and newusers.
+      os_auth_sub_gid_count:
+        default: 65536
+        type: int
+        description: If /etc/subuid exists, the commands useradd and newusers (unless
+          the user already have subordinate group IDs) allocate SUB_GID_COUNT unused
+          group IDs from the range SUB_GID_MIN to SUB_GID_MAX for each new user. See
+          also `os_auth_sub_gid_min` and `os_auth_sub_gid_max`.
+      os_auth_sub_gid_min:
+        default: 100000
+        type: int
+        description: minimum number for automatic subordinate gid selection in useradd
+          and newusers.
+      os_auth_sub_gid_max:
+        default: 600100000
+        type: int
+        description: maximum number for automatic subordinate gid selection in useradd
+          and newusers.
+      os_security_packages_clean:
+        default: true
+        type: bool
+        description: removes packages with known issues. See section packages.
+      os_selinux_state:
+        default: enforcing
+        type: str
+        description: Set the SELinux state, can be either disabled, permissive, or
+          enforcing.
+      os_selinux_policy:
+        default: targeted
+        type: str
+        description: Set the SELinux polixy.
+      ufw_manage_defaults:
+        default: true
+        type: bool
+        description: true means apply all settings with `ufw_` prefix.
+      ufw_ipt_sysctl:
+        default: "''"
+        type: str
+        description: by default it disables IPT_SYSCTL in /etc/default/ufw. If you
+          want to overwrite /etc/sysctl.conf values using ufw - set it to your sysctl
+          dictionary, for example `/etc/ufw/sysctl.conf`.
+      ufw_default_input_policy:
+        default: DROP
+        type: str
+        description: set default input policy of ufw to `DROP`.
+      ufw_default_output_policy:
+        default: ACCEPT
+        type: str
+        description: set default output policy of ufw to `ACCEPT`.
+      ufw_default_forward_policy:
+        default: DROP
+        type: str
+        description: set default forward policy of ufw to `DROP`.
+      ufw_enable_ipv6:
+        default: true
+        type: bool
+        description: Set to `true` to apply rules to support IPv6 (no means only IPv6
+          on loopback accepted).
+      os_auditd_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring auditd.
+      os_auditd_log_format:
+        default: RAW
+        type: str
+        description: Describes how the information should be stored on disk. There
+          are 2 options - raw and enriched.
+      os_auditd_max_log_file_action:
+        default: keep_logs
+        type: str
+        description: Defines the behaviour of auditd when its log file is filled up.
+          Possible other values are described in the auditd.conf man page. The most
+          common alternative to the default may be `rotate`.
+      os_auditd_max_log_file:
+        default: 6
+        type: int
+        description: This keyword specifies the maximum file size in megabytes. When
+          this limit is reached, it will trigger a configurable action. The value
+          given must be numeric.
+      os_auditd_num_logs:
+        default: 5
+        type: int
+        description: This keyword specifies the number of log files to keep if `rotate`
+          is given as the max_log_file_action. The value given must be numeric.
+      os_auditd_flush:
+        default: INCREMENTAL
+        type: str
+        description: Valid values are none, incremental, incremental_async, data,
+          and sync.
+      os_auditd_admin_space_left:
+        default: 50
+        type: int
+        description: This is a numeric value in megabytes that tells the audit daemon
+          when to perform a configurable action because the system is running low
+          on disk space.
+      os_auditd_admin_space_left_action:
+        default: SUSPEND
+        type: str
+        description: This parameter tells the system what action to take when the
+          system has detected that it is low on disk space. Valid values are ignore,
+          syslog, rotate, email, exec, suspend, single, and halt.
+      os_auditd_space_left:
+        default: 75
+        type: int
+        description: If the free space in the filesystem containing log_file drops
+          below this value, the audit daemon takes the action specified by space_left_action.
+      os_auditd_space_left_action:
+        default: SYSLOG
+        type: str
+        description: This parameter tells the system what action to take when the
+          system has detected that it is starting to get low on disk space. Valid
+          values are ignore, syslog, rotate, email, exec, suspend, single, and halt.
+      os_auditd_action_mail_acct:
+        default: root
+        type: str
+        description: If `space_left_action` or `admin_space_left_action` are set to
+          `email`, uses the address or alias to send the email using `/usr/lib/sendmail`.
+          of events created on one system but reported/analyzed on another system.
+      os_auditd_disk_error_action:
+        default: SUSPEND
+        type: str
+        description: This parameter tells the system what action to take whenever
+          there is an error detected when writing audit events to disk or rotating
+          logs. Valid values are ignore, syslog, exec, suspend, single, and halt.
+      os_auditd_disk_full_action:
+        default: SUSPEND
+        type: str
+        description: This parameter tells the system what action to take when the
+          system has detected that the partition to which log files are written has
+          become full. Valid values are ignore, syslog, rotate, exec, suspend, single,
+          and halt.
+      os_auditd_log_group:
+        default: root
+        type: str
+        description: specifies the group that is applied to the log file's permissions.
+          The group name can be either numeric or spelled out.
+      proc_mnt_options:
+        default: rw,nosuid,nodev,noexec,relatime
+        type: str
+        description: Mount proc with hardenized options. Note that the hidepid option
+          is set separately in vars/.
+      os_ignore_users:
+        default: [vagrant, kitchen]
+        type: list
+        description: Specify system accounts whose login should not be disabled and
+          password not changed
+      os_chmod_home_folders:
+        default: true
+        type: bool
+        description: Set to `false` to disable "chmod 700" of home folders for regular
+          users
+      os_ignore_home_folder_users:
+        default: '[]'
+        type: list
+        description: Specify user accounts, whose home folders shouldn't be chmodded
+          to 700 when "os_chmod_home_folders" is enabled.
+      os_chmod_rootuser_home_folder:
+        default: true
+        type: bool
+        description: Set to `false` to disable "chmod 700" of root's home folder
+      os_rootuser_pw_ageing:
+        default: false
+        type: bool
+        description: Set to true to enforce password age settings for root user(s)
+      os_remove_additional_root_users:
+        default: false
+        type: bool
+        description: When enabled and there are multiple users with UID=0, only "root"
+          will be kept. Others will be deleted.
+      os_user_pw_ageing:
+        default: true
+        type: bool
+        description: Set to false to disable password age enforcement on existing
+          users
+      os_users_without_password_ageing:
+        default: '[]'
+        type: list
+        description: List of users, where password ageing should not be enforced even
+          if "os_user_pw_ageing" is enabled
+      os_cron_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring cron.
+      os_ctrlaltdel_disabled:
+        default: false
+        type: bool
+        description: Set to true to disable ctrl-alt-delete key combination.
+      os_limits_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring limits.
+      os_login_defs_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring login_defs
+          for newly created users.
+      os_minimize_access_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring minimize_access.
+      os_pam_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring pam.
+      os_modprobe_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring modprobe.
+      os_profile_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring profile.
+      os_security_auto_logout:
+        default: 0
+        type: int
+        description: Set timeout in seconds for logout users automatically after time.
+          Setting this to `0` disables the timeout.
+      os_securetty_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring securetty.
+      os_sysctl_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring sysctl.
+      os_user_accounts_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring user_accounts.
+      os_rhosts_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring rhosts.
+      os_yum_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring yum.
+      os_yum_repo_file_whitelist:
+        default: '[]'
+        type: list
+        description: List of yum repository files under /etc/yum.repos.d/ which should
+          not be altered.
+      os_apt_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring apt.
+      os_selinux_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring selinux.
+      os_sha_crypt_min_rounds:
+        default: 640000
+        type: int
+        description: Define the number of minimum SHA rounds. With a lot of rounds
+          brute forcing the password is more difficult. But note also that it more
+          CPU resources will be needed to authenticate users. The values must be inside
+          the 1000-999999999 range.
+      os_sha_crypt_max_rounds:
+        default: 640000
+        type: int
+        description: Define the number of maximum SHA rounds. With a lot of rounds
+          brute forcing the password is more difficult. But note also that it more
+          CPU resources will be needed to authenticate users. The values must be inside
+          the 1000-999999999 range.
+      os_mnt_boot_dir_mode:
+        default: '0700'
+        type: str
+        description: Set default perimissions for /boot
+      os_mnt_boot_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /boot mountpoint
+      os_mnt_boot_src:
+        default: "''"
+        type: str
+        description: Set mount source for /boot
+      os_mnt_boot_options:
+        default: rw,nosuid,nodev,noexec
+        description: Configure mount options for /boot
+      os_mnt_boot_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /boot. If empty, the current
+          file system type will be used.
+      os_mnt_boot_dump:
+        default: ext3 + ext4 = 1 / other = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_boot_passno:
+        default: ext3 + ext4 = 2 / other = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_dev_dir_mode:
+        default: '0755'
+        type: str
+        description: Set default perimissions for /dev
+      os_mnt_dev_enabled:
+        default: true
+        type: bool
+        description: Set to false to ignore /dev mountpoint
+      os_mnt_dev_src:
+        default: devtmpfs
+        type: str
+        description: Set mount source for /dev
+      os_mnt_dev_options:
+        default: rw,nosuid,noexec
+        type: str
+        description: Configure mount options for /dev
+      os_mnt_dev_filesystem:
+        default: devtmpfs
+        type: str
+        description: Configure file system for fstab entry /dev
+      os_mnt_dev_dump:
+        default: '0'
+        type: str
+        description: Configure dump for fstab entry /var/tmp.
+      os_mnt_dev_passno:
+        default: '0'
+        type: str
+        description: Configure passno for fstab entry /var/tmp.
+      os_mnt_dev_shm_dir_mode:
+        default: '1777'
+        type: str
+        description: Set default perimissions for /dev/shm
+      os_mnt_dev_shm_enabled:
+        default: true
+        type: bool
+        description: Set to false to ignore /dev/shm mountpoint
+      os_mnt_dev_shm_src:
+        default: tmpfs
+        type: str
+        description: Set mount source for /dev/shm
+      os_mnt_dev_shm_options:
+        default: rw,nosuid,nodev,noexec
+        type: str
+        description: Configure mount options for /dev/shm
+      os_mnt_dev_shm_filesystem:
+        default: tmpfs
+        type: str
+        description: Configure file system for fstab entry /dev/shm
+      os_mnt_dev_shm_dump:
+        default: '0'
+        type: str
+        description: Configure dump for fstab entry /var/tmp.
+      os_mnt_dev_shm_passno:
+        default: '0'
+        type: str
+        description: Configure passno for fstab entry /var/tmp.
+      os_mnt_home_dir_mode:
+        default: '0755'
+        type: str
+        description: Set default perimissions for /home
+      os_mnt_home_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /home mountpoint
+      os_mnt_home_src:
+        default: "''"
+        type: str
+        description: Set mount source for /home. If empty, the current file system
+          source device will be used.
+      os_mnt_home_options:
+        default: rw,nosuid,nodev
+        type: str
+        description: Configure mount options for /home
+      os_mnt_home_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /home. If empty, the current
+          file system type will be used.
+      os_mnt_home_dump:
+        default: ext3/4 = 1, others = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_home_passno:
+        default: ext3/4 = 2, others = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_run_dir_mode:
+        default: '0755'
+        type: str
+        description: Set default perimissions for /run
+      os_mnt_run_enabled:
+        default: true
+        type: bool
+        description: Set to false to ignore /run mountpoint
+      os_mnt_run_src:
+        default: tmpfs
+        type: str
+        description: Set mount source for /run
+      os_mnt_run_options:
+        default: rw,nosuid,nodev
+        type: str
+        description: Configure mount options for /run
+      os_mnt_run_filesystem:
+        default: tmpfs
+        type: str
+        description: Configure file system for fstab entry /run
+      os_mnt_run_dump:
+        default: '0'
+        type: str
+        description: Configure dump for fstab entry /var/tmp.
+      os_mnt_run_passno:
+        default: '0'
+        type: str
+        description: Configure passno for fstab entry /var/tmp.
+      os_mnt_tmp_dir_mode:
+        default: '1777'
+        type: str
+        description: Set default perimissions for /tmp
+      os_mnt_tmp_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /tmp mountpoint
+      os_mnt_tmp_src:
+        default: "''"
+        type: str
+        description: Set mount source for /tmp. If empty, the current file system
+          source device will be used.
+      os_mnt_tmp_options:
+        default: rw,nosuid,nodev,noexec
+        type: str
+        description: Configure mount options for /tmp
+      os_mnt_tmp_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /tmp. If empty, the current
+          file system type will be used.
+      os_mnt_tmp_dump:
+        default: ext3/4 = 1, others = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_tmp_passno:
+        default: ext3/4 = 2, others = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_dir_mode:
+        default: '0755'
+        type: str
+        description: Set default perimissions for /var
+      os_mnt_var_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /var mountpoint
+      os_mnt_var_src:
+        default: "''"
+        type: str
+        description: Set mount source for /var. If empty, the current file system
+          source device will be used.
+      os_mnt_var_options:
+        default: rw,nosuid,nodev
+        type: str
+        description: Configure mount options for /var
+      os_mnt_var_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /var. If empty, the current
+          file system type will be used.
+      os_mnt_var_dump:
+        default: ext3/4 = 1, others = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_passno:
+        default: ext3/4 = 2, others = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_log_dir_mode:
+        default: '0755'
+        type: str
+        description: Set default perimissions for /var/log
+      os_mnt_var_log_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /var/log mountpoint
+      os_mnt_var_log_src:
+        default: "''"
+        type: str
+        description: Set mount source for /var/log. If empty, the current file system
+          source device will be used.
+      os_mnt_var_log_options:
+        default: rw,nosuid,nodev,noexec
+        type: str
+        description: Configure mount options for /var/log
+      os_mnt_var_log_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /var/log. If empty, the
+          current file system type will be used.
+      os_mnt_var_log_dump:
+        default: ext3/4 = 1, others = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_log_passno:
+        default: ext3/4 = 2, others = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_log_audit_dir_mode:
+        default: '0640'
+        type: str
+        description: Set default perimissions for /var/log/audit
+      os_mnt_var_log_audit_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /var/log/audit mountpoint
+      os_mnt_var_log_audit_src:
+        default: "''"
+        type: str
+        description: Set mount source for /var/log/audit. If empty, the current file
+          system source device will be used.
+      os_mnt_var_log_audit_options:
+        default: rw,nosuid,nodev,noexec
+        type: str
+        description: Configure mount options for /var/log/audit
+      os_mnt_var_log_audit_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /var/log/audit. If empty,
+          the current file system type will be used.
+      os_mnt_var_log_audit_dump:
+        default: ext3/4 = 1, others = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_log_audit_passno:
+        default: ext3/4 = 2, others = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_tmp_dir_mode:
+        default: '1777'
+        type: str
+        description: Set default perimissions for /var/tmp
+      os_mnt_var_tmp_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /var/tmp mountpoint
+      os_mnt_var_tmp_src:
+        default: "''"
+        type: str
+        description: Set mount source for /var/tmp. If empty, the current file system
+          source device will be used.
+      os_mnt_var_tmp_options:
+        default: rw,nosuid,nodev,noexec
+        type: str
+        description: Configure mount options for /var/tmp
+      os_mnt_var_tmp_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /var/tmp. If empty, the
+          current file system type will be used.
+      os_mnt_var_tmp_dump:
+        default: ext3/4 = 1, others = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_tmp_passno:
+        default: ext3/4 = 2, others = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_netrc_enabled:
+        default: true
+        type: bool
+        description: Configure filesystem for existence of .netrc file in homedir
+      os_netrc_whitelist_user:
+        default: '[]'
+        type: list
+        description: Add list of user to allow creation of .netrc in users homedir
+      sysctl_overwrite:
+        default: '{}'
+        type: dict
+        description: To overwrite options in the `sysctl_config`-dict, overwrite them
+          here.
+      sysctl_config:
+        type: dict
+        description: various sysctl-settings
+        default:
+          fs.protected_hardlinks: 1
+          fs.protected_symlinks: 1
+          fs.protected_fifos: 1
+          fs.protected_regular: 2
+          fs.suid_dumpable: 0
+          kernel.core_uses_pid: 1
+          kernel.kptr_restrict: 2
+          kernel.kexec_load_disabled: 1
+          kernel.sysrq: 0
+          kernel.randomize_va_space: 2
+          kernel.yama.ptrace_scope: 1
+          net.ipv4.ip_forward: 0
+          net.ipv6.conf.all.forwarding: 0
+          net.ipv4.conf.all.rp_filter: 1
+          net.ipv4.conf.default.rp_filter: 1
+          net.ipv4.icmp_echo_ignore_broadcasts: 1
+          net.ipv4.icmp_ignore_bogus_error_responses: 1
+          net.ipv4.icmp_ratelimit: 100
+          net.ipv4.icmp_ratemask: 88089
+          net.ipv4.tcp_timestamps: 0
+          net.ipv4.conf.all.arp_ignore: 1
+          net.ipv4.conf.all.arp_announce: 2
+          net.ipv4.tcp_rfc1337: 1
+          net.ipv4.tcp_syncookies: 1
+          net.ipv4.conf.all.shared_media: 1
+          net.ipv4.conf.default.shared_media: 1
+          net.ipv4.conf.all.accept_source_route: 0
+          net.ipv4.conf.default.accept_source_route: 0
+          net.ipv6.conf.all.accept_source_route: 0
+          net.ipv6.conf.default.accept_source_route: 0
+          net.ipv4.conf.all.send_redirects: 0
+          net.ipv4.conf.default.send_redirects: 0
+          net.ipv4.conf.all.log_martians: 1
+          net.ipv4.conf.default.log_martians: 1
+          net.ipv4.conf.default.accept_redirects: 0
+          net.ipv4.conf.all.accept_redirects: 0
+          net.ipv4.conf.all.secure_redirects: 0
+          net.ipv4.conf.default.secure_redirects: 0
+          net.ipv6.conf.default.accept_redirects: 0
+          net.ipv6.conf.all.accept_redirects: 0
+          net.ipv6.conf.all.accept_ra: 0
+          net.ipv6.conf.default.accept_ra: 0
+          net.ipv6.conf.default.router_solicitations: 0
+          net.ipv6.conf.all.router_solicitations: 0
+          net.ipv6.conf.default.accept_ra_rtr_pref: 0
+          net.ipv6.conf.default.accept_ra_pinfo: 0
+          net.ipv6.conf.default.accept_ra_defrtr: 0
+          net.ipv6.conf.default.autoconf: 0
+          net.ipv6.conf.all.autoconf: 0
+          net.ipv6.conf.default.dad_transmits: 0
+          net.ipv6.conf.default.max_addresses: 1
+          vm.mmap_min_addr: 65536
+          vm.mmap_rnd_bits: 32
+          vm.mmap_rnd_compat_bits: 16
+      os_unused_filesystems:
+        default:
+          - cramfs
+          - freevxfs
+          - jffs2
+          - hfs
+          - hfsplus
+          - squashfs
+          - udf
+          - vfat
+          - dccp
+          - rds
+          - sctp
+          - tipc
+        type: list
+        description: Disable this list of unused filesystems
+      os_filesystem_whitelist:
+        default: '[]'
+        type: list
+        description: A list of filesystems that should not be disabled
+      os_hardening_enabled:
+        default: true
+        type: bool
+        description: Whether to run the hardening
+      os_auth_root_ttys:
+        default: [console, tty1, tty2, tty3, tty4, tty5, tty6]
+        type: list
+        description: A list of TTYs, from which root can log in, see `man securetty`
+          for reference
+      os_chfn_restrict:
+        default: "''"
+        type: str
+        description: Indicate which fields are changeable by chfn.
+      os_security_init_prompt:
+        default: true
+        type: bool
+        description: The PROMPT option provides console users the ability to interactively
+          boot the system and select which services to start on boot.
+      os_security_init_single:
+        default: false
+        type: bool
+        description: Single-user mode is intended as a system recovery method, providing
+          a single user root access to the system by providing a boot option at startup.
+          By default, no authentication is performed if single-user mode is selected.
+          To require entry of the root password even if the system is started in single-user
+          mode, set this to false
+      os_security_packages_list:
+        default: [xinetd, inetd, ypserv, telnet-server, rsh-server, prelink]
+        type: list
+        description: List of deprecated or insecure packages to remove
+      ufw_default_application_policy:
+        default: SKIP
+        type: str
+        description: The default application policy is skip, which means that the
+          update --add-new command will do nothing
+      ufw_ipt_modules:
+        default: nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns
+        type: str
+        description: Define which netfilter modules to load
+      ufw_manage_builtins:
+        default: 'no'
+        type: str
+        description: If this variable is set to 'yes', on stop and reload the built-in
+          chains are flushed. If it is set to 'no', on stop and reload the ufw secondary
+          chains are removed and the ufw primary chains are flushed

roles/os_hardening/meta/main.yml

@@ -4,20 +4,20 @@ galaxy_info:
   description: This Ansible role provides numerous security-related ssh configurations, providing all-round base protection.
   company: Hardening Framework Team
   license: Apache License 2.0
-  min_ansible_version: 2.9.10
+  min_ansible_version: "2.11"
   platforms:
     - name: EL
       versions:
-        - "7"
         - "8"
+        - "9"
     - name: Ubuntu
       versions:
-        - bionic
         - focal
         - jammy
+        - noble
     - name: Debian
       versions:
-        - buster
+        - bookworm
         - bullseye
     - name: Amazon
     - name: Fedora

roles/os_hardening/tasks/auditd.yml

@@ -7,10 +7,12 @@
 
 - name: Configure auditd | package-08
   ansible.builtin.template:
-    src: etc/audit/auditd.conf.j2
+    src: "{{ os_auditd_template }}"
     dest: /etc/audit/auditd.conf
     owner: root
     group: root
     mode: "0640"
-  notify: Restart auditd
+  notify:
+    - Restart auditd via service
+    - Restart auditd via systemd
   tags: auditd