remove local test

Signed-off-by: Sebastian Gumprich <[email protected]>
use full path for pam-tester in os_hardening_vm tests
2023-08-08 13:27:28 +02:00 · 2023-08-08 09:36:09 +02:00 · 2023-08-08 09:05:02 +02:00 · 2023-08-08 09:04:30 +02:00 · 2023-08-08 09:01:36 +02:00 · 2023-08-07 14:38:44 +02:00
99 changed files with 3755 additions and 1358 deletions
@@ -12,3 +12,6 @@ exclude_paths:
 mock_roles:
  - geerlingguy.git
  - nginxinc.nginx
+
+skip_list:
+  - var-naming[no-role-prefix]
@@ -1,25 +0,0 @@
---
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
-version: 2
-updates:
-  - package-ecosystem: "pip"  # See documentation for possible values
-    directory: "/"  # Location of package manifests
-    schedule:
-      interval: "daily"
-    # by default Dependabot creates labels like "major" or "minor" for version updates of our deps.
-    # however this interferes with the github changelog generator which uses these labels to define
-    # a new version for the collection
-    labels: [ ]
-
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    # by default Dependabot creates labels like "major" or "minor" for version updates of our deps.
-    # however this interferes with the github changelog generator which uses these labels to define
-    # a new version for the collection
-    labels: [ ]
@@ -0,0 +1,14 @@
+---
+name: Codespell - Spellcheck
+
+on:  # yamllint disable-line rule:truthy
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  codespell:
+    uses: "dev-sec/.github/.github/workflows/codespell.yml@main"
+    with:
+      ignore_words_list: "chage"
@@ -27,7 +27,7 @@ concurrency:

 jobs:
  build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -45,9 +45,10 @@ jobs:
          - ubuntu2204
          - debian10
          - debian11
+          - debian12
          # - amazon  # geerlingguy.mysql does not support fedora
-          # - arch  # needs to be fixed
-          - opensuse_tumbleweed  # needs to be fixed
+          # - arch  # geerlingguy.mysql does not support arch
+          - opensuse_tumbleweed
          # - fedora  # geerlingguy.mysql does not support fedora
    steps:
      - name: Checkout repo
@@ -56,10 +57,10 @@ jobs:
          path: ansible_collections/devsec/hardening
          submodules: true

-      - name: Set up Python 3.7
+      - name: Set up Python 3.11
        uses: actions/setup-python@v4
        with:
-          python-version: 3.7
+          python-version: 3.11

      - name: Install dependencies
        run: |
@@ -68,11 +69,6 @@ jobs:
          pip install -r requirements.txt
        working-directory: ansible_collections/devsec/hardening

-      - name: Create default collection path symlink
-        run: |
-          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
-
      # that was a hard one to fix. robert did it thankfully
      # https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212
      - name: disable apparmor on debian systems
@@ -26,7 +26,7 @@ concurrency:

 jobs:
  build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -44,7 +44,8 @@ jobs:
          - ubuntu2204
          - debian10
          - debian11
-          - amazon
+          - debian12
+          - amazon2023
          # - arch  # needs to be fixed
          # - opensuse_tumbleweed  # needs to be fixed
          # - fedora  # no support from geerlingguy role
@@ -55,10 +56,10 @@ jobs:
          path: ansible_collections/devsec/hardening
          submodules: true

-      - name: Set up Python 3.7
+      - name: Set up Python 3.11
        uses: actions/setup-python@v4
        with:
-          python-version: 3.7
+          python-version: 3.11

      - name: Install dependencies
        run: |
@@ -67,11 +68,6 @@ jobs:
          pip install -r requirements.txt
        working-directory: ansible_collections/devsec/hardening

-      - name: Create default collection path symlink
-        run: |
-          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
-
      - name: Test with molecule
        run: |
          molecule --version
@@ -26,7 +26,7 @@ concurrency:

 jobs:
  build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -39,14 +39,17 @@ jobs:
          - centosstream9
          - rocky8
          - rocky9
+          - fedora37
+          - fedora38
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
          - debian10
          - debian11
-          - amazon
+          - debian12
+          - amazon2023
          - opensuse_tumbleweed
-          # - arch  # needs to be fixed
+          - arch
    steps:
      - name: Checkout repo
        uses: actions/checkout@v3
@@ -54,10 +57,10 @@ jobs:
          path: ansible_collections/devsec/hardening
          submodules: true

-      - name: Set up Python 3.7
+      - name: Set up Python 3.11
        uses: actions/setup-python@v4
        with:
-          python-version: 3.7
+          python-version: 3.11

      - name: Install dependencies
        run: |
@@ -66,11 +69,6 @@ jobs:
          pip install -r requirements.txt
        working-directory: ansible_collections/devsec/hardening

-      - name: Create default collection path symlink
-        run: |
-          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
-
      - name: Test with molecule
        run: |
          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
@@ -39,13 +39,16 @@ jobs:
          - centos9s
          - rocky8
          - rocky9
+          - fedora37
+          - fedora38
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
          - debian10
          - debian11
+          # - debian12  # waiting for https://github.com/lavabit/robox/pull/274
          - opensuse15
-          # - arch  # arch is currently not supported by cinc-auditor
+          # - arch  # needs fix for audit
    steps:
      - name: Checkout repo
        uses: actions/checkout@v3
@@ -21,6 +21,6 @@ jobs:
          ref: ${{ github.head_ref }}

      - name: Prettify code
-        uses: creyD/prettier_action@v4.2
+        uses: creyD/prettier_action@v4.3
        with:
          prettier_options: --write {**/*,*}.md
@@ -26,7 +26,7 @@ concurrency:

 jobs:
  build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -39,15 +39,17 @@ jobs:
          - centosstream9
          - rocky8
          - rocky9
-          - fedora
+          - fedora37
+          - fedora38
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
          - debian10
          - debian11
-          - amazon
-          # - arch  # needs to be fixed
-          # - opensuse_tumbleweed  # baseline is not compatible with suse
+          - debian12
+          - amazon2023
+          - arch
+          # - opensuse_tumbleweed  # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
    steps:
      - name: Checkout repo
        uses: actions/checkout@v3
@@ -55,10 +57,10 @@ jobs:
          path: ansible_collections/devsec/hardening
          submodules: true

-      - name: Set up Python 3.7
+      - name: Set up Python 3.11
        uses: actions/setup-python@v4
        with:
-          python-version: 3.7
+          python-version: 3.11

      - name: Install dependencies
        run: |
@@ -67,11 +69,6 @@ jobs:
          pip install -r requirements.txt
        working-directory: ansible_collections/devsec/hardening

-      - name: Create default collection path symlink
-        run: |
-          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
-
      - name: Test with molecule
        run: |
          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
@@ -0,0 +1,52 @@
+---
+name: "devsec.ssh_hardening BSD"
+on:  # yamllint disable-line rule:truthy
+  workflow_dispatch:
+  push:
+    branches: [master]
+    paths:
+      - 'roles/ssh_hardening/**'
+      - 'molecule/ssh_hardening_bsd/**'
+      - '.github/workflows/ssh_hardening_bsd.yml'
+  pull_request:
+    branches: [master]
+    paths:
+      - 'roles/ssh_hardening/**'
+      - 'molecule/ssh_hardening_bsd/**'
+      - '.github/workflows/ssh_hardening_bsd.yml'
+  schedule:
+    - cron: '0 6 * * 5'
+
+concurrency:
+  group: >-
+    ${{ github.workflow }}-${{
+      github.event.pull_request.number || github.sha
+    }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: self-hosted
+    env:
+      PY_COLORS: 1
+      ANSIBLE_FORCE_COLOR: 1
+    strategy:
+      fail-fast: false
+      matrix:
+        molecule_distro:
+          - openbsd7
+          - freebsd12
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+        with:
+          path: ansible_collections/devsec/hardening
+          submodules: true
+
+      - name: Test with molecule
+        run: |
+          molecule --version
+          molecule test -s ssh_hardening_bsd
+        env:
+          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
+        working-directory: ansible_collections/devsec/hardening
@@ -26,7 +26,7 @@ concurrency:

 jobs:
  build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
@@ -39,15 +39,17 @@ jobs:
          - centosstream9
          - rocky8
          - rocky9
-          - fedora
+          - fedora37
+          - fedora38
          - ubuntu1804
          - ubuntu2004
          - ubuntu2204
          - debian10
          - debian11
-          - amazon
-          # - arch  # needs to be fixed
-          # - opensuse_tumbleweed  # baseline is not compatible with suse
+          - debian12
+          - amazon2023
+          - arch
+          # - opensuse_tumbleweed  # needs fix - opensuse has different file location for conf and pam (/usr/etc/ssh/?, /usr/lib/pam.d/?)
    steps:
      - name: Checkout repo
        uses: actions/checkout@v3
@@ -55,10 +57,10 @@ jobs:
          path: ansible_collections/devsec/hardening
          submodules: true

-      - name: Set up Python 3.7
+      - name: Set up Python 3.11
        uses: actions/setup-python@v4
        with:
-          python-version: 3.7
+          python-version: 3.11

      - name: Install dependencies
        run: |
@@ -67,11 +69,6 @@ jobs:
          pip install -r requirements.txt
        working-directory: ansible_collections/devsec/hardening

-      - name: Create default collection path symlink
-        run: |
-          mkdir -p /home/runner/.ansible
-          ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
-
      - name: Test with molecule
        run: |
          if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
@@ -1,18 +1,86 @@
 # Changelog

-## [8.7.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.7.0) (2023-02-07)
+## [8.9.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.9.0) (2023-08-07)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.8.0...8.9.0)
+
+**Breaking changes:**
+
+- add role argument spec for os, ssh, mysql [\#687](https://github.com/dev-sec/ansible-collection-hardening/pull/687) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+
+## [8.8.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.8.0) (2023-08-04)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.7.0...8.8.0)
+
+**Implemented enhancements:**
+
+- Add support for Fedora 38 [\#671](https://github.com/dev-sec/ansible-collection-hardening/issues/671)
+- auditd: add possibility to override config template [\#685](https://github.com/dev-sec/ansible-collection-hardening/pull/685) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([Meecr0b](https://github.com/Meecr0b))
+- add debian 12 support [\#684](https://github.com/dev-sec/ansible-collection-hardening/pull/684) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- feat: explicitly support Fedora 37 and 38 [\#682](https://github.com/dev-sec/ansible-collection-hardening/pull/682) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([nejch](https://github.com/nejch))
+- Replace ssh\_keys group with root, where applicable and use less permissive file mode [\#677](https://github.com/dev-sec/ansible-collection-hardening/pull/677) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- Add oddjob mkhomedir option rhel pam [\#675](https://github.com/dev-sec/ansible-collection-hardening/pull/675) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([imp1sh](https://github.com/imp1sh))
+
+**Fixed bugs:**
+
+- How does one set `sshd_authenticationmethods`  to include password authentication? [\#686](https://github.com/dev-sec/ansible-collection-hardening/issues/686)
+- Error: No file was found when using first\_found on Ubuntu 20.04 [\#676](https://github.com/dev-sec/ansible-collection-hardening/issues/676)
+- FreeIPA environment mkhomedir fails [\#664](https://github.com/dev-sec/ansible-collection-hardening/issues/664)
+
+**Closed issues:**
+
+- What is the uscase of sysctl\_overwrite over ansible.posix.sysctl? [\#683](https://github.com/dev-sec/ansible-collection-hardening/issues/683)
+-  `Ensure permissions on mysql-logfile are correct` chokes when `log_error` is set to `stderr` [\#673](https://github.com/dev-sec/ansible-collection-hardening/issues/673)
+- TASK TASK FAILED: \[devsec.hardening.os\_hardening : Set password ageing for existing regular \(non-system, non-root\) accounts\]  [\#670](https://github.com/dev-sec/ansible-collection-hardening/issues/670)
+- After os\_hardening ssh not working  [\#663](https://github.com/dev-sec/ansible-collection-hardening/issues/663)
+- Unsupported parameters for \(ansible.builtin.user\) module [\#650](https://github.com/dev-sec/ansible-collection-hardening/issues/650)
+
+**Merged pull requests:**
+
+- setting gets ignored [\#680](https://github.com/dev-sec/ansible-collection-hardening/pull/680) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
+- add var-naming\[no-role-prefix\] to skip-list [\#679](https://github.com/dev-sec/ansible-collection-hardening/pull/679) ([rndmh3ro](https://github.com/rndmh3ro))
+- expand on check conditions for non-file locations of logs [\#674](https://github.com/dev-sec/ansible-collection-hardening/pull/674) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([whysthatso](https://github.com/whysthatso))
+- use new molecule-plugins [\#667](https://github.com/dev-sec/ansible-collection-hardening/pull/667) ([schurzi](https://github.com/schurzi))
+- add spellchecking with codespell [\#662](https://github.com/dev-sec/ansible-collection-hardening/pull/662) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+
+## [8.7.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.7.0) (2023-04-12)

 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/8.6.0...8.7.0)

 **Implemented enhancements:**

+- Support BSD and other operating systems CI with VM based tests [\#599](https://github.com/dev-sec/ansible-collection-hardening/issues/599)
+- add check mode to molecule tests [\#644](https://github.com/dev-sec/ansible-collection-hardening/pull/644) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- add testing for OpenBSD and FreeBSD [\#642](https://github.com/dev-sec/ansible-collection-hardening/pull/642) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Only skip audit restart handler in docker [\#637](https://github.com/dev-sec/ansible-collection-hardening/pull/637) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))
 - Make action\_mail\_acct configurable in auditd [\#631](https://github.com/dev-sec/ansible-collection-hardening/pull/631) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([nejch](https://github.com/nejch))

+**Fixed bugs:**
+
+- getent task is skipped if user previously ran it with a key parameter [\#646](https://github.com/dev-sec/ansible-collection-hardening/issues/646)
+- Error running devsec.hardening.os\_hardening role [\#645](https://github.com/dev-sec/ansible-collection-hardening/issues/645)
+- devsec.hardening.mysql\_hardening - Get all users that have no authentication\_string - Hello world [\#640](https://github.com/dev-sec/ansible-collection-hardening/issues/640)
+- fixes \#646 - add another condition to getent task [\#647](https://github.com/dev-sec/ansible-collection-hardening/pull/647) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([gbolo](https://github.com/gbolo))
+
+**Closed issues:**
+
+- Dependency Dashboard [\#655](https://github.com/dev-sec/ansible-collection-hardening/issues/655)
+- Invalid login.defs for RHEL6 [\#651](https://github.com/dev-sec/ansible-collection-hardening/issues/651)
+- Deprecation warnings for os\_hardening [\#638](https://github.com/dev-sec/ansible-collection-hardening/issues/638)
+- Write tests for MySQL user-deletion [\#445](https://github.com/dev-sec/ansible-collection-hardening/issues/445)
+
 **Merged pull requests:**

+- Update minimum required Ansible version for os\_hardening [\#657](https://github.com/dev-sec/ansible-collection-hardening/pull/657) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- Update test environment [\#656](https://github.com/dev-sec/ansible-collection-hardening/pull/656) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Update dependency geerlingguy.git to v3.0.1 [\#654](https://github.com/dev-sec/ansible-collection-hardening/pull/654) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- Configure Renovate [\#653](https://github.com/dev-sec/ansible-collection-hardening/pull/653) ([renovate[bot]](https://github.com/apps/renovate))
+- simplify MySQL queries for user deletion [\#641](https://github.com/dev-sec/ansible-collection-hardening/pull/641) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([schurzi](https://github.com/schurzi))
+- Bump creyD/prettier\_action from 4.2 to 4.3 [\#639](https://github.com/dev-sec/ansible-collection-hardening/pull/639) ([dependabot[bot]](https://github.com/apps/dependabot))
+- Fix molecule tests for EL7 [\#636](https://github.com/dev-sec/ansible-collection-hardening/pull/636) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
 - run our CI tests periodically [\#634](https://github.com/dev-sec/ansible-collection-hardening/pull/634) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
 - try to fix molecule local tests [\#632](https://github.com/dev-sec/ansible-collection-hardening/pull/632) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
- remove unneccessary tasks for VM based test [\#629](https://github.com/dev-sec/ansible-collection-hardening/pull/629) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- remove unnecessary tasks for VM based test [\#629](https://github.com/dev-sec/ansible-collection-hardening/pull/629) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))

 ## [8.6.0](https://github.com/dev-sec/ansible-collection-hardening/tree/8.6.0) (2023-02-04)

@@ -38,7 +106,7 @@
 - Add support for /etc/auditd.conf num\_logs to go with max\_log\_file\_action [\#617](https://github.com/dev-sec/ansible-collection-hardening/pull/617) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([richardlock](https://github.com/richardlock))
 - Preserve default ownership and dir mode for /var/log on Ubuntu [\#615](https://github.com/dev-sec/ansible-collection-hardening/pull/615) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([stdtom](https://github.com/stdtom))
 - rewrite user home dir hardening [\#584](https://github.com/dev-sec/ansible-collection-hardening/pull/584) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
- apply password age settings to exisiting regular users [\#582](https://github.com/dev-sec/ansible-collection-hardening/pull/582) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
+- apply password age settings to existing regular users [\#582](https://github.com/dev-sec/ansible-collection-hardening/pull/582) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([DonEstefan](https://github.com/DonEstefan))
 - Parametrize more auditd.conf options [\#535](https://github.com/dev-sec/ansible-collection-hardening/pull/535) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([kravietz](https://github.com/kravietz))

 **Fixed bugs:**
@@ -173,7 +241,7 @@
 **Implemented enhancements:**

 - revert debian 9 change, only one tls variable now [\#562](https://github.com/dev-sec/ansible-collection-hardening/pull/562) [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([rndmh3ro](https://github.com/rndmh3ro))
- add posibility to run ssh\_hardening as unprivileged user [\#561](https://github.com/dev-sec/ansible-collection-hardening/pull/561) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
+- add possibility to run ssh\_hardening as unprivileged user [\#561](https://github.com/dev-sec/ansible-collection-hardening/pull/561) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([schurzi](https://github.com/schurzi))
 - add basic support for ubuntu22.04 [\#554](https://github.com/dev-sec/ansible-collection-hardening/pull/554) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
 - Add full support for Debian 11 [\#538](https://github.com/dev-sec/ansible-collection-hardening/pull/538) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([addianto](https://github.com/addianto))

@@ -244,7 +312,7 @@

 **Closed issues:**

- No such file directory error triggered by the  kernel.unpriviliged\_userns\_clone configuration. [\#514](https://github.com/dev-sec/ansible-collection-hardening/issues/514)
+- No such file directory error triggered by the  kernel.unprivileged\_userns\_clone configuration. [\#514](https://github.com/dev-sec/ansible-collection-hardening/issues/514)

 **Merged pull requests:**

@@ -683,7 +751,7 @@
 - Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-collection-hardening/pull/259) ([jaredledvina](https://github.com/jaredledvina))
 - Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-collection-hardening/pull/254) ([kravietz](https://github.com/kravietz))
 - Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-collection-hardening/pull/251) ([dustinmiller](https://github.com/dustinmiller))
- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
+- Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-collection-hardening/pull/250) ([dustinmiller](https://github.com/dustinmiller))
 - Make max\_log\_file\_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-collection-hardening/pull/246) ([jandd](https://github.com/jandd))
 - Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-collection-hardening/pull/240) ([ghost](https://github.com/ghost))
 - Fedora - Use new auto ansible\_python\_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-collection-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
@@ -734,7 +802,7 @@
 - Docker [\#90](https://github.com/dev-sec/ansible-collection-hardening/pull/90) ([rndmh3ro](https://github.com/rndmh3ro))
 - debian 8 support [\#88](https://github.com/dev-sec/ansible-collection-hardening/pull/88) ([rndmh3ro](https://github.com/rndmh3ro))
 - Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-collection-hardening/pull/85) ([fitz123](https://github.com/fitz123))
- replace ignore\_errors to failed\_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-collection-hardening/pull/81) ([fitz123](https://github.com/fitz123))
+- replace ignore\_errors to failed\_when to suppress ugly error warnings [\#81](https://github.com/dev-sec/ansible-collection-hardening/pull/81) ([fitz123](https://github.com/fitz123))
 - fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-collection-hardening/pull/79) ([fitz123](https://github.com/fitz123))
 - update platforms in meta-file [\#69](https://github.com/dev-sec/ansible-collection-hardening/pull/69) ([rndmh3ro](https://github.com/rndmh3ro))
 - add webhook for ansible galaxy [\#68](https://github.com/dev-sec/ansible-collection-hardening/pull/68) ([rndmh3ro](https://github.com/rndmh3ro))
@@ -760,7 +828,7 @@
 - \[lots of\] deprecation warnings in Ansible 2.8 [\#221](https://github.com/dev-sec/ansible-collection-hardening/issues/221)
 - `squash_actions` deprecation warning [\#218](https://github.com/dev-sec/ansible-collection-hardening/issues/218)
 - login.defs.j2 template: ENV\_PATH is missing ':' before variable substitution [\#202](https://github.com/dev-sec/ansible-collection-hardening/issues/202)
- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-collection-hardening/issues/191)
+- auditd causing v5.0 to fail on unprivileged LXC's [\#191](https://github.com/dev-sec/ansible-collection-hardening/issues/191)
 - Setting os\_security\_users\_allow has no effect [\#175](https://github.com/dev-sec/ansible-collection-hardening/issues/175)
 - minimize\_access: maximum recursion depth exceeded on Ansible 2.5 [\#171](https://github.com/dev-sec/ansible-collection-hardening/issues/171)
 - wrong permissions passwdqc [\#170](https://github.com/dev-sec/ansible-collection-hardening/issues/170)
@@ -848,7 +916,7 @@
 - adjust permissions on shadow file on suse [\#311](https://github.com/dev-sec/ansible-collection-hardening/pull/311) ([rndmh3ro](https://github.com/rndmh3ro))
 - fix fedora build [\#296](https://github.com/dev-sec/ansible-collection-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
 - do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-collection-hardening/pull/289) ([schurzi](https://github.com/schurzi))
- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-collection-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
+- move hidepid vars into defaults so they're overwritable [\#285](https://github.com/dev-sec/ansible-collection-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
 - install procps in debian so sysctl.conf exists [\#282](https://github.com/dev-sec/ansible-collection-hardening/pull/282) ([rndmh3ro](https://github.com/rndmh3ro))
 - move defaults to os-specific vars [\#157](https://github.com/dev-sec/ansible-collection-hardening/pull/157) ([rndmh3ro](https://github.com/rndmh3ro))
 - Converts set to JSON-serializable list [\#126](https://github.com/dev-sec/ansible-collection-hardening/pull/126) ([pestaa](https://github.com/pestaa))
@@ -900,7 +968,7 @@
 - Repair debian install script [\#8](https://github.com/dev-sec/ansible-collection-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
 - Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-collection-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
 - Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-collection-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-collection-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accommodate test-repo [\#4](https://github.com/dev-sec/ansible-collection-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
 - treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-collection-hardening/pull/3) ([arlimus](https://github.com/arlimus))
 - Add Securetty-support [\#2](https://github.com/dev-sec/ansible-collection-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
 - Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-collection-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))
@@ -26,7 +26,7 @@

 - fix fedora build [\#296](https://github.com/dev-sec/ansible-os-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
 - do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-os-hardening/pull/289) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([schurzi](https://github.com/schurzi))
- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))
+- move hidepid vars into defaults so they're overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) [[patch](https://github.com/dev-sec/ansible-os-hardening/labels/patch)] ([rndmh3ro](https://github.com/rndmh3ro))

 ## [6.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/6.1.0) (2020-07-21)

@@ -90,7 +90,7 @@
 - Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-os-hardening/pull/259) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jaredledvina](https://github.com/jaredledvina))
 - Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-os-hardening/pull/254) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([kravietz](https://github.com/kravietz))
 - Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-os-hardening/pull/251) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
+- Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([dustinmiller1337](https://github.com/dustinmiller1337))
 - Make max_log_file_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-os-hardening/pull/246) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jandd](https://github.com/jandd))
 - Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-os-hardening/pull/240) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([ghost](https://github.com/ghost))
 - Fedora - Use new auto ansible_python_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-os-hardening/pull/239) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([jaredledvina](https://github.com/jaredledvina))
@@ -165,7 +165,7 @@

 **Fixed bugs:**

- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
+- auditd causing v5.0 to fail on unprivileged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
 - Setting os_security_users_allow has no effect [\#175](https://github.com/dev-sec/ansible-os-hardening/issues/175) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)]
 - add /usr/bin/su to suid_guid whitelist [\#199](https://github.com/dev-sec/ansible-os-hardening/pull/199) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([ccolic](https://github.com/ccolic))
 - ensure that permissions to su-binary are not restricted to root user and group only, if os_security_users_allow contains the value change_user [\#197](https://github.com/dev-sec/ansible-os-hardening/pull/197) [[bug](https://github.com/dev-sec/ansible-os-hardening/labels/bug)] ([szEvEz](https://github.com/szEvEz))
@@ -346,7 +346,7 @@
 - Docker [\#90](https://github.com/dev-sec/ansible-os-hardening/pull/90) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
 - debian 8 support [\#88](https://github.com/dev-sec/ansible-os-hardening/pull/88) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([rndmh3ro](https://github.com/rndmh3ro))
 - Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-os-hardening/pull/85) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
- replace ignore_errors to failed_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
+- replace ignore_errors to failed_when to suppress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))
 - fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-os-hardening/pull/79) [[enhancement](https://github.com/dev-sec/ansible-os-hardening/labels/enhancement)] ([fitz123](https://github.com/fitz123))

 **Fixed bugs:**
@@ -459,7 +459,7 @@
 - Repair debian install script [\#8](https://github.com/dev-sec/ansible-os-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
 - Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-os-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
 - Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-os-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accommodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
 - treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-os-hardening/pull/3) ([arlimus](https://github.com/arlimus))
 - Add Securetty-support [\#2](https://github.com/dev-sec/ansible-os-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
 - Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-os-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))
@@ -11,13 +11,13 @@
 This collection provides battle tested hardening for:

 - Linux operating systems:
-  - CentOS 7
-  - Rocky Linux 8
-  - Debian 10/11
+  - CentOS 7/8/9
+  - Rocky Linux 8/9
+  - Debian 10/11/12
  - Ubuntu 18.04/20.04/22.04
  - Amazon Linux (some roles supported)
  - Arch Linux (some roles supported)
-  - Fedora (some roles supported)
+  - Fedora 37/38 (some roles supported)
  - Suse Tumbleweed (some roles supported)
 - MySQL
  - MariaDB >= 5.5.65, >= 10.1.45, >= 10.3.17
@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 8.6.0
+version: 8.8.0
 readme: README.md
 authors:
  - dev-sec <[email protected]>
@@ -42,3 +42,4 @@ build_ignore:
  - .tox
  - tox.ini
  - .yamllint
+  - renovate.json
@@ -8,7 +8,7 @@ driver:
  name: docker
 platforms:
  - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: "ghcr.io/dev-sec/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -22,7 +22,7 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
  name: ansible

@@ -52,7 +52,8 @@ scenario:
    - syntax
    - create
    - prepare
+    - check
    - converge
-    # - idempotence  # not idempotent
+    - idempotence
    - verify
    - destroy
@@ -60,14 +60,18 @@
        - ansible_distribution != "Ubuntu"
        - ansible_distribution_major_version|int < 20

-    - include_role:
-        name: geerlingguy.mysql
+    - name: Install required MySQL Python libraries on RHEL
+      yum:
+        name: "{% if 'python3' in ansible_python_interpreter|default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
+      when:
+        - ansible_os_family == "RedHat"
+        - ansible_distribution_major_version == "7"
          
-    - name: create a user with an empty password
-      community.mysql.mysql_query:
-        query:
-          - "CREATE USER foo@bar;"
-        login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+    - include_role:
+        name: dev-sec.mysql
+
+    - name: include MySQL user prepare tasks
+      include_tasks: prepare_tasks/mysql_users.yml
  vars:
    overwrite_global_mycnf: false
    mysql_root_password: iloverandompasswordsbutthiswilldo
@@ -0,0 +1,15 @@
+---
+- name: create users for test
+  community.mysql.mysql_query:
+    query:
+      - "CREATE USER 'user'@'delete';"
+      - "CREATE USER 'user'@'127.0.0.1';"
+      - "CREATE USER 'user'@'::1';"
+      - "CREATE USER 'user'@'%';"
+      - "CREATE USER 'user'@'192.168.0.%';"
+      - "CREATE USER 'user'@'192.168.0.1';"
+      - "CREATE USER    '%'@'192.168.0.1';"
+      - "CREATE USER 'user'@'192.168.0.2' IDENTIFIED BY 'keep';"
+      - "CREATE USER 'user'@'keep' IDENTIFIED BY 'keep';"
+      - "CREATE USER 'user'@'192.168.%' IDENTIFIED BY 'keep';"
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
@@ -1,8 +1,6 @@
 ---
 roles:
-  - name: geerlingguy.git
-    version: 3.0.0
-  - name: geerlingguy.mysql
+  - name: dev-sec.mysql
    version: master

 collections:
@@ -6,26 +6,12 @@
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  roles:
-    - geerlingguy.git
  tasks:
-    - name: install fake SuSE-release for cinc compatibility
-      copy:
-        content: |
-          openSUSE Faked Enterprise 2020 (x86_64)
-          VERSION = 2020
-          CODENAME = Faked Feature
-        dest: /etc/SuSE-release
-        owner: root
-        group: root
-        mode: '0444'
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: install git for SuSE since geerlinguy.git does not support it
-      zypper:
-        name: git
-        state: present
-      when: ansible_facts.os_family == 'Suse'
+    - name: Use Python 3 on Suse
+      set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+      when:
+        - ansible_os_family == 'Suse'

    - name: install procps for debian systems
      apt:
@@ -37,17 +23,24 @@
    - name: include tests for the service
      include_tasks: verify_tasks/service.yml

-    - name: download cinc-auditor
-      get_url:
-        url: https://omnitruck.cinc.sh/install.sh
-        dest: /tmp/install.sh
-        mode: '0775'
-
-    - name: install cinc-auditor
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
+    - name: include tests for MySQL user
+      include_tasks: verify_tasks/mysql_users.yml

+- name: Verify
+  hosts: localhost
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/mysql-baseline/archive/refs/heads/master.zip"
+      command: >
+        docker run
+        --volume /run/docker.sock:/run/docker.sock
+        docker.io/cincproject/auditor exec
+        -t docker://instance
+        --no-show-progress --no-color
+        --no-distinct-exit https://github.com/dev-sec/mysql-baseline/archive/refs/heads/master.zip
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -0,0 +1,25 @@
+---
+- name: Get all users from MySQL server
+  community.mysql.mysql_query:
+    query: >
+      SELECT CONCAT(USER, '@', HOST) AS users FROM mysql.user;
+    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
+  register: mysql_users
+
+- name: create list of users from mysql query
+  set_fact:
+    mysql_users_list: "{{ mysql_users.query_result.0  | json_query('[*].users') | list }}"
+
+- name: assert that only accounts with password remain
+  ansible.builtin.assert:
+    that:
+      - '"user@delete" not in mysql_users_list'
+      - '"[email protected]" not in mysql_users_list'
+      - '"user@::1" not in mysql_users_list'
+      - '"user@%" not in mysql_users_list'
+      - '"[email protected].%" not in mysql_users_list'
+      - '"[email protected]" not in mysql_users_list'
+      - '"%@192.168.0.1" not in mysql_users_list'
+      - '"[email protected]" in mysql_users_list'
+      - '"user@keep" in mysql_users_list'
+      - '"[email protected].%" in mysql_users_list'
@@ -2,6 +2,8 @@
 - name: wrapper playbook for kitchen testing "ansible-nginx-hardening" with custom settings
  become: true
  hosts: all
+  collections:
+    - devsec.hardening
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
@@ -7,7 +7,7 @@ driver:
  name: docker
 platforms:
  - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: "ghcr.io/dev-sec/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -21,7 +21,7 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
  name: ansible

@@ -51,6 +51,7 @@ scenario:
    - syntax
    - create
    - prepare
+    - check
    - converge
    - idempotence
    - verify
@@ -1,4 +1,3 @@
 ---
 roles:
-  - geerlingguy.git
  - geerlingguy.nginx
@@ -6,48 +6,29 @@
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  roles:
-    - geerlingguy.git
  tasks:
-    - name: install fake SuSE-release for cinc compatibility
-      copy:
-        content: |
-          openSUSE Faked Enterprise 2020 (x86_64)
-          VERSION = 2020
-          CODENAME = Faked Feature
-        dest: /etc/SuSE-release
-        owner: root
-        group: root
-        mode: '0444'
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: install git for SuSE since geerlinguy.git does not support it
-      zypper:
-        name: git
-        state: present
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: Run the equivalent of "apt-get update" as a separate step
-      apt:
-        update_cache: true
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: install required tools on debian
+    - name: install procps for debian systems
      apt:
        name: procps
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: download cinc-auditor
-      get_url:
-        url: https://omnitruck.cinc.sh/install.sh
-        dest: /tmp/install.sh
-        mode: '0775'
-
-    - name: install cinc-auditor
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
+        state: present
+        update_cache: true
+      when: ansible_distribution == 'Debian'

+- name: Verify
+  hosts: localhost
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/nginx-baseline/archive/refs/heads/master.zip"
+      command: >
+        docker run
+        --volume /run/docker.sock:/run/docker.sock
+        docker.io/cincproject/auditor exec
+        -t docker://instance
+        --no-show-progress --no-color
+        --no-distinct-exit https://github.com/dev-sec/nginx-baseline/archive/refs/heads/master.zip
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -1,13 +1,9 @@
 ---
-dependency:
-  name: galaxy
-  options:
-    role-file: molecule/os_hardening/requirements.yml
 driver:
  name: docker
 platforms:
  - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: "ghcr.io/dev-sec/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -21,7 +17,7 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
  name: ansible

@@ -51,6 +47,7 @@ scenario:
    - syntax
    - create
    - prepare
+    - check
    - converge
    - idempotence
    - verify
@@ -1,40 +1,37 @@
 ---
- name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
+- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
  hosts: all
  become: true
-  collections:
-    - devsec.hardening
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
-    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
-      set_fact:
-        ansible_python_interpreter: "/usr/bin/python3"
-      when: ansible_facts.distribution == 'Fedora'
-
-    - name: Run the equivalent of "apt-get update && apt-get upgrade"
-      apt:
-        name: "*"
-        state: latest
+    - name: Install Python3 on Debian 10
+      ansible.builtin.apt:
+        name: python3
+        state: present
        update_cache: true
      when: ansible_os_family == 'Debian'

-    - name: install required tools on SuSE
+    - name: Set ansible_python_interpreter to "/usr/bin/python3"
+      ansible.builtin.set_fact:
+        ansible_python_interpreter: /usr/bin/python3
+
+    - name: Install required tools on SuSE
      # cannot use zypper module, since it depends on python-xml
-      shell: "zypper -n install python-xml"
+      ansible.builtin.shell: zypper -n install python-xml
      when: ansible_facts.os_family == 'Suse'

-    - name: install required tools on fedora
-      dnf:
+    - name: Install required tools on fedora
+      ansible.builtin.dnf:
        name:
          - python
          - findutils
          - procps-ng
      when: ansible_facts.distribution == 'Fedora'

-    - name: install required tools on Arch
+    - name: Install required tools on Arch
      community.general.pacman:
        name:
          - awk
@@ -42,8 +39,8 @@
        update_cache: true
      when: ansible_facts.os_family == 'Archlinux'

-    - name: install required tools on RHEL  # noqa ignore-errors
-      yum:
+    - name: Install required tools on RHEL # noqa ignore-errors
+      ansible.builtin.yum:
        name:
          - openssh-clients
          - openssh
@@ -51,15 +48,15 @@
        update_cache: true
      ignore_errors: true

-    - name: create recursing symlink to test minimize access
-      shell: "rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz"
+    - name: Create recursing symlink to test minimize access
+      ansible.builtin.shell: rm -f /usr/bin/zzz && ln -s /usr/bin /usr/bin/zzz
      changed_when: false

-    - name: include YUM prepare tasks
-      include_tasks: prepare_tasks/yum.yml
+    - name: Include YUM prepare tasks
+      ansible.builtin.include_tasks: prepare_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'

-    - name: include preparation tasks
+    - name: Include preparation tasks
      ansible.builtin.include_tasks:
        file: "{{ item }}"
      loop:
@@ -1,3 +0,0 @@
---
-roles:
-  - geerlingguy.git
@@ -6,38 +6,12 @@
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  roles:
-    - geerlingguy.git
  tasks:
-    - name: install fake SuSE-release for cinc compatibility
-      copy:
-        content: |
-          openSUSE Faked Enterprise 2020 (x86_64)
-          VERSION = 2020
-          CODENAME = Faked Feature
-        dest: /etc/SuSE-release
-        owner: root
-        group: root
-        mode: '0444'
-      when: ansible_facts.os_family == 'Suse'
+    - name: Set ansible_python_interpreter to "/usr/bin/python3"
+      ansible.builtin.set_fact:
+        ansible_python_interpreter: /usr/bin/python3

-    - name: install git for SuSE since geerlinguy.git does not support it
-      zypper:
-        name: git
-        state: present
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: Run the equivalent of "apt-get update" as a separate step
-      apt:
-        update_cache: true
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: install required tools on debian
-      apt:
-        name: procps
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: include verification tasks
+    - name: Include verification tasks
      ansible.builtin.include_tasks:
        file: "{{ item }}"
      loop:
@@ -46,48 +20,64 @@
        - verify_tasks/netrc.yml
        - verify_tasks/ignore_home_folders.yml

-    - name: include PAM tests
-      include_tasks: verify_tasks/pam.yml
-      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
-
-    - name: include YUM tests
-      include_tasks: verify_tasks/yum.yml
+    - name: Include YUM tests
+      ansible.builtin.include_tasks: verify_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'

-    - name: download cinc-auditor
-      get_url:
-        url: https://omnitruck.cinc.sh/install.sh
-        dest: /tmp/install.sh
-        mode: '0775'
+    - name: Include PAM tests
+      ansible.builtin.include_tasks: verify_tasks/pam.yml
+      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'

-    - name: install cinc-auditor
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
-
-    - name: Execute cinc-auditor tests  # noqa ignore-errors
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit --waiver-file waivers.yaml https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
+- name: Verify
+  hosts: localhost
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: Execute cinc-auditor tests
+      ansible.builtin.command: >
+        docker run
+        --volume /run/docker.sock:/run/docker.sock
+        --volume {{ playbook_dir }}/waivers.yaml:/waivers.yaml
+        docker.io/cincproject/auditor exec
+        -t docker://instance
+        --no-show-progress --no-color
+        --waiver-file /waivers.yaml
+        --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip
      register: test_results
      changed_when: false
      ignore_errors: true

    - name: Display details about the cinc-auditor results
-      debug:
+      ansible.builtin.debug:
        msg: "{{ test_results.stdout_lines }}"

    - name: Fail when tests fail
-      fail:
-        msg: "Inspec failed to validate"
+      ansible.builtin.fail:
+        msg: Inspec failed to validate
      when: test_results.rc != 0

+- name: Verify
+  hosts: all
+  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  collections:
+    - devsec.hardening
+  tasks:
    # test if variable can be overridden
-    - name: workaround for https://github.com/ansible/ansible/issues/66304
-      set_fact:
-        ansible_virtualization_type: "docker"
+    - name: Workaround for https://github.com/ansible/ansible/issues/66304
+      ansible.builtin.set_fact:
+        ansible_virtualization_type: docker
        os_env_umask: "027 #override"

-    - include_role:
+    - ansible.builtin.include_role:
        name: os_hardening

-    - name: verify os_env_umask
-      shell:
+    - name: Verify os_env_umask
+      ansible.builtin.shell:
        cmd: "grep '027 #override' /etc/login.defs"
      changed_when: false
@@ -1,19 +1,19 @@
 ---
 - name: test that .netrc in root homedir exists
  ansible.builtin.file:
-    path: '/root/.netrc'
+    path: /root/.netrc
    state: file
  register: result_test_netrc

 - name: output result if .netrc for user root exists
  ansible.builtin.assert:
    that:
-      - "result_test_netrc.state == 'file'"
-    fail_msg: ".netrc in /root/ not present"
-    success_msg: ".netrc exists in /root/"
+      - result_test_netrc.state == 'file'
+    fail_msg: .netrc in /root/ not present
+    success_msg: .netrc exists in /root/

 - name: delete '.netrc' in /root
  ansible.builtin.file:
-    path: '/root/.netrc'
+    path: /root/.netrc
    state: absent
  when: result_test_netrc.state == 'file'
@@ -1,58 +1,65 @@
 ---
- name: download pam-tester
-  get_url:
-    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
-    dest: /bin/pam-tester
-    mode: 0555
+- name: Install pip
+  ansible.builtin.package:
+    name:
+      - python3-pip
+      - python3-setuptools
+    state: present

- name: set password for test
-  set_fact:
-    test_pw: "myTest!pw"
+- name: Install pam-tester
+  ansible.builtin.pip:
+    name: pam-tester
+    state: present
+    executable: /usr/bin/pip3

- name: set locale for test
-  set_fact:
-    locale: "en_US.UTF-8"
+- name: Set password for test
+  ansible.builtin.set_fact:
+    test_pw: myTestpwSage
+
+- name: Set locale for test
+  ansible.builtin.set_fact:
+    locale: en_US.UTF-8
  when:
    - ansible_facts.os_family == 'RedHat'
    - ansible_facts.distribution_major_version < '8'

- name: create testuser
-  user:
+- name: Create testuser
+  ansible.builtin.user:
    name: testuser
    password: "{{ test_pw | password_hash('sha512') }}"

- name: check successfull login with correct password
-  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+- name: Check successful login with correct password
+  ansible.builtin.shell:
+    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"

- name: check unsuccessfull login with incorrect password
-  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+- name: Check unsuccessful login with incorrect password
+  ansible.builtin.shell:
+    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"
  with_sequence: count=6

- name: check unsuccessfull login, with correct password (lockout)
-  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
+- name: Check unsuccessful login, with correct password (lockout)
+  ansible.builtin.shell:
+    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"

- name: wait for account to unlock
-  pause:
+- name: Wait for account to unlock
+  ansible.builtin.pause:
    seconds: 20

- name: check successfull login
-  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+- name: Check successful login
+  ansible.builtin.shell:
+    cmd: /usr/local/bin/pam-tester --user testuser --password {{ test_pw }}
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -1,8 +1,9 @@
+---
 - name: Read local linux user database
-  getent:
+  ansible.builtin.getent:
    database: passwd

 - name: Check that shell_sys_acc's shell is still bash
-  assert:
+  ansible.builtin.assert:
    that:
      - getent_passwd['shell_sys_acc'][5] == "/bin/bash"
@@ -1,8 +1,8 @@
 ---
 - name: verify 'gpgcheck' was not enabled for 'foo' repository (in whitelist)
-  command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
+  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*0' /etc/yum.repos.d/foo.repo
  changed_when: false

 - name: verify 'gpgcheck' was enabled for 'bar' repository (not in whitelist)
-  command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
+  ansible.builtin.command: grep -e 'gpgcheck\s*=\s*1' /etc/yum.repos.d/bar.repo
  changed_when: false
@@ -8,7 +8,7 @@ driver:
  provider:
    name: libvirt
 platforms:
-  # we need to name every instance differntly to start multiple VMs on the same host (parallelization)
+  # we need to name every instance differently to start multiple VMs on the same host (parallelization)
  # since we also need to use different OS users to run the tests because of how molecule operates,
  # the VM names must be predictable by OS user (to clean up canceled runs)
  - name: "${USER}"
@@ -24,7 +24,7 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
  name: ansible
  env:
@@ -56,6 +56,7 @@ scenario:
    - syntax
    - create
    - prepare
+    - check
    - converge
    - idempotence
    - verify
@@ -2,8 +2,6 @@
 - name: wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
  hosts: all
  become: true
-  collections:
-    - devsec.hardening
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
@@ -6,56 +6,46 @@
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  roles:
-    - geerlingguy.git
  tasks:
-    - name: install fake SuSE-release for cinc compatibility
-      copy:
-        content: |
-          openSUSE Faked Enterprise 2020 (x86_64)
-          VERSION = 2020
-          CODENAME = Faked Feature
-        dest: /etc/SuSE-release
-        owner: root
-        group: root
-        mode: '0444'
-      when: ansible_facts.os_family == 'Suse'

-    - name: install git for SuSE since geerlinguy.git does not support it
-      zypper:
-        name: git
-        state: present
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: Run the equivalent of "apt-get update" as a separate step
-      apt:
-        update_cache: true
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: install required tools on debian
-      apt:
-        name: procps
-      when: ansible_facts.os_family == 'Debian'
-
-    - name: include PAM tests
-      include_tasks: verify_tasks/pam.yml
-      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+# temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
+#    - name: include PAM tests
+#      include_tasks: verify_tasks/pam.yml
+#      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'

    - name: include YUM tests
      include_tasks: verify_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'

-    - name: download cinc-auditor
-      get_url:
-        url: https://omnitruck.cinc.sh/install.sh
-        dest: /tmp/install.sh
-        mode: '0775'
+- name: Verify
+  hosts: localhost
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: get ssh-config
+      command:
+        cmd: "vagrant ssh-config"
+        chdir: "{{ molecule_ephemeral_directory }}"
+      register: ssh_config
+      changed_when: false

-    - name: install cinc-auditor
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
+    - name: create ssh-config file
+      copy:
+        content: "{{ ssh_config.stdout_lines | join ('\n') }}"
+        dest: "{{ molecule_ephemeral_directory }}/ssh-config"
+      changed_when: false

-    - name: Execute cinc-auditor tests  # noqa ignore-errors
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
+    - name: Execute cinc-auditor tests
+      command: >
+        docker run
+        --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
+        docker.io/cincproject/auditor exec
+        --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
+        -t ssh://{{ lookup('env', 'USER') }}
+        --sudo --no-show-progress --no-color
+        --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -1,9 +1,17 @@
 ---
- name: download pam-tester
-  get_url:
-    url: https://github.com/schurzi/pam-tester/releases/download/latest/pam-tester
-    dest: /bin/pam-tester
-    mode: 0555
+
+- name: install pip
+  package:
+    name:
+      - python3-pip
+      - python3-setuptools
+    state: present
+
+- name: install pam-tester
+  ansible.builtin.pip:
+    name: pam-tester
+    state: present
+    executable: /usr/bin/pip3

 - name: set password for test
  set_fact:
@@ -21,26 +29,26 @@
    name: testuser
    password: "{{ test_pw | password_hash('sha512') }}"

- name: check successfull login with correct password
+- name: check successful login with correct password
  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"

- name: check unsuccessfull login with incorrect password
+- name: check unsuccessful login with incorrect password
  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
    LANG: "{{ locale | default('C.UTF-8') }}"
  with_sequence: count=6

- name: check unsuccessfull login, with correct password (lockout)
+- name: check unsuccessful login, with correct password (lockout)
  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }} --expectfail"
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }} --expectfail"
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -50,9 +58,9 @@
  pause:
    seconds: 20

- name: check successfull login
+- name: check successful login
  shell:
-    cmd: "pam-tester --user testuser --password {{ test_pw }}"
+    cmd: "/usr/local/bin/pam-tester --user testuser --password {{ test_pw }}"
  environment:
    TMPDIR: /var/tmp
    LC_ALL: "{{ locale | default('C.UTF-8') }}"
@@ -1,13 +1,9 @@
 ---
-dependency:
-  name: galaxy
-  options:
-    role-file: molecule/ssh_hardening/requirements.yml
 driver:
  name: docker
 platforms:
  - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: "ghcr.io/dev-sec/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -21,7 +17,7 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
  inventory:
    host_vars:
      # https://molecule.readthedocs.io/en/latest/examples.html#docker-with-non-privileged-user
@@ -57,6 +53,7 @@ scenario:
    - syntax
    - create
    - prepare
+    - check
    - converge
    - idempotence
    - verify
@@ -1,3 +0,0 @@
---
-roles:
-  - geerlingguy.git
@@ -1,48 +1,19 @@
 ---
 - name: Verify
-  hosts: all
-  become: true
+  hosts: localhost
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
-  roles:
-    - geerlingguy.git
  tasks:
-    - name: install fake SuSE-release for cinc compatibility
-      copy:
-        content: |
-          openSUSE Faked Enterprise 2020 (x86_64)
-          VERSION = 2020
-          CODENAME = Faked Feature
-        dest: /etc/SuSE-release
-        owner: root
-        group: root
-        mode: '0444'
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: install git for SuSE since geerlinguy.git does not support it
-      zypper:
-        name: git
-        state: present
-      when: ansible_facts.os_family == 'Suse'
-
-    - name: install crypto compat modules on fedora
-      dnf:
-        name: libxcrypt-compat
-      when: ansible_facts.distribution == 'Fedora'
-
-    - name: download cinc-auditor
-      get_url:
-        url: https://omnitruck.cinc.sh/install.sh
-        dest: /tmp/install.sh
-        mode: '0775'
-
-    - name: install cinc-auditor
-      shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
-
    - name: Execute cinc-auditor tests
-      command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip"
+      command: >
+        docker run
+        --volume /run/docker.sock:/run/docker.sock
+        docker.io/cincproject/auditor exec
+        -t docker://instance
+        --no-show-progress --no-color
+        --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip
      register: test_results
      changed_when: false
      ignore_errors: true
@@ -0,0 +1,22 @@
+*******
+Docker driver installation guide
+*******
+
+Requirements
+============
+
+* Docker Engine
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ python3 -m pip install 'molecule[docker]'
@@ -0,0 +1,14 @@
+---
+- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+  hosts: all
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  collections:
+    - devsec.hardening
+  tasks:
+    - include_role:
+        name: ssh_hardening
+  vars:
+    sftp_enabled: false
@@ -0,0 +1,58 @@
+---
+driver:
+  name: vagrant
+  provider:
+    name: libvirt
+platforms:
+  # we need to name every instance differently to start multiple VMs on the same host (parallelization)
+  # since we also need to use different OS users to run the tests because of how molecule operates,
+  # the VM names must be predictable by OS user (to clean up canceled runs)
+  - name: "${USER}"
+    box: "generic/${MOLECULE_DISTRO}"
+    memory: 1024
+    cpus: 2
+provisioner:
+  name: ansible
+  options:
+    diff: true
+  env:
+    ANSIBLE_PIPELINING: "True"
+  config_options:
+    defaults:
+      interpreter_python: auto_silent
+      callbacks_enabled: profile_tasks, timer, yaml
+verifier:
+  name: ansible
+  env:
+    ANSIBLE_PIPELINING: "True"
+
+scenario:
+  create_sequence:
+    - dependency
+    - create
+    - prepare
+  check_sequence:
+    - dependency
+    - destroy
+    - create
+    - prepare
+    - converge
+    - check
+    - destroy
+  converge_sequence:
+    - dependency
+    - create
+    - prepare
+    - converge
+  destroy_sequence:
+    - destroy
+  test_sequence:
+    - dependency
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - verify
+    - destroy
@@ -0,0 +1,32 @@
+---
+- name: prepare OpenBSD host
+  hosts: all
+  become: true
+  gather_facts: false
+  tasks:
+    - name: install python
+      # BSDs are special for Ansible - https://docs.ansible.com/ansible/latest/os_guide/intro_bsd.html
+      raw: "pkg_add python%3.10"
+      when: "lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'"
+
+- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
+  hosts: all
+  become: true
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: created needed directory
+      file:
+        path: "/var/run/sshd"
+        state: directory
+
+    - name: create ssh host keys  # noqa ignore-errors
+      command: "ssh-keygen -A"
+      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
+            ansible_facts.distribution == "Fedora" or
+            ansible_facts.distribution == "Amazon" or
+            ansible_facts.os_family == "Suse"
+      changed_when: false
+      ignore_errors: true
@@ -0,0 +1,55 @@
+---
+- name: OpenBSD workaround - inspec detects OpenSBD as unix and not linux compatible
+  hosts: all
+  become: true
+  tasks:
+    - name: use the type command instead of which to detect existing commands
+      file:
+        src: "/usr/bin/which"
+        dest: "/usr/bin/type"
+        state: hard
+      when: "lookup('env', 'MOLECULE_DISTRO') == 'openbsd7'"
+
+- name: Verify
+  hosts: localhost
+  environment:
+    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
+    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
+    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
+  tasks:
+    - name: get ssh-config
+      command: 
+        cmd: "vagrant ssh-config"
+        chdir: "{{ molecule_ephemeral_directory }}"
+      register: ssh_config
+      changed_when: false
+
+    - name: create ssh-config file
+      copy:
+        content: "{{ ssh_config.stdout_lines | join ('\n') }}"
+        dest: "{{ molecule_ephemeral_directory }}/ssh-config"
+      changed_when: false
+
+    - name: Execute cinc-auditor tests
+      command: >
+        docker run
+        --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
+        --volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') }}.yaml:/waivers.yaml
+        docker.io/cincproject/auditor exec
+        --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
+        -t ssh://{{ lookup('env', 'USER') }}
+        --sudo --no-show-progress --no-color
+        --waiver-file /waivers.yaml
+        --no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip
+      register: test_results
+      changed_when: false
+      ignore_errors: true
+
+    - name: Display details about the cinc-auditor results
+      debug:
+        msg: "{{ test_results.stdout_lines }}"
+
+    - name: Fail when tests fail
+      fail:
+        msg: "Inspec failed to validate"
+      when: test_results.rc != 0
@@ -0,0 +1,3 @@
+sshd-45:
+  run: false
+  justification: "PrintLastLog is broken on FreeBSD. see: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441"
@@ -0,0 +1,21 @@
+ssh-17:
+  run: false
+  justification: "GSSAPIAuthentication is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
+ssh-18:
+  run: false
+  justification: "GSSAPIDelegateCredentials is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
+sshd-30:
+  run: false
+  justification: "KerberosAuthentication is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
+sshd-31:
+  run: false
+  justification: "KerberosOrLocalPasswd is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
+sshd-32:
+  run: false
+  justification: "KerberosTicketCleanup is disabled. see: https://github.com/dev-sec/ansible-ssh-hardening/pull/171"
+sshd-33:
+  run: false
+  justification: "GSSAPIAuthentication is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
+sshd-34:
+  run: false
+  justification: "GSSAPICleanupCredentials is disabled. see: https://github.com/dev-sec/ansible-collection-hardening/pull/598"
@@ -20,11 +20,6 @@
      - path: "/etc/ssh/auth_principals/root"
        principals:
          - "root"
-        owner: "{{ ssh_owner }}"
-        group: "{{ ssh_group }}"
-        directoryowner: "{{ ssh_owner }}"
-        directorygroup: "{{ ssh_group }}"
-        directorymode: "0700"
    network_ipv6_enable: true
    ssh_allow_tcp_forwarding: 'yes'
    ssh_gateway_ports: true
@@ -1,13 +1,9 @@
 ---
-dependency:
-  name: galaxy
-  options:
-    role-file: molecule/ssh_hardening/requirements.yml
 driver:
  name: docker
 platforms:
  - name: instance
-    image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
+    image: "ghcr.io/dev-sec/docker-${MOLECULE_DISTRO}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -21,7 +17,7 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callback_whitelist: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer, yaml
 verifier:
  name: ansible

@@ -51,6 +47,7 @@ scenario:
    - syntax
    - create
    - prepare
+    - check
    - converge
    - idempotence
    - verify
@@ -1,3 +0,0 @@
---
-roles:
-  - geerlingguy.git
@@ -0,0 +1,15 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:base",
+    ":gitSignOff"
+  ],
+  "dependencyDashboard": true,
+  "dependencyDashboardAutoclose": true,
+  "packageRules": [
+    {
+      "matchUpdateTypes": ["patch", "minor"],
+      "automerge": true
+    }
+  ]
+}
@@ -1,4 +1,5 @@
-molecule[docker]
+molecule
+molecule-plugins[docker]
 yamllint
 ansible
 ansible-lint
@@ -1,6 +1,6 @@
 # devsec.mysql_hardening

-![devsec.mysql_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.mysql_hardening/badge.svg)
+![devsec.mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/workflows/devsec.mysql_hardening/badge.svg)

 ## Description

@@ -12,74 +12,130 @@ It configures:
 - Removes anonymous users, users without a password or authentication_string and test databases
 - various hardening options inside MySQL

+Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.
+
+Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
+
 ## Requirements

- Ansible 2.9.0
- An existing MySQL installation
+- An existing installation of MySQL or MariaDB.
 - python-jmespath on the ansible host

-### Example playbook
+<!-- BEGIN_ANSIBLE_DOCS -->

-```yml
- hosts: localhost
-  collections:
-    - devsec.hardening
-  roles:
-    - mysql_hardening
-```
+## Supported Operating Systems

-This role expects an existing installation of MySQL or MariaDB. Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.  
-Please ensure that the following variables are set accordingly:
-
- `mysql_hardening_enabled: yes` role is enabled by default and can be disabled without removing it from a playbook. You can use conditional variable, for example: `mysql_hardening_enabled: "{{ true if mysql_enabled else false }}"`
- `mysql_hardening_user: 'mysql'` The user that mysql runs as.
- `mysql_hardening_mysql_hardening_conf_file: '/etc/mysql/conf.d/hardening.cnf'` The path to the configuration file where the hardening will be performed
- _deprecated: `mysql_datadir: '/var/lib/mysql'` The MySQL data directory_
-  - `mysql_datadir` is no longer necessary, as MySQL data directory is automatically taken from `mysql_info`. But it can still be defined and will also be checked for correct permissions.
+| Platform | Versions             |
+| -------- | -------------------- |
+| EL       | 7, 8, 9              |
+| Ubuntu   | bionic, focal, jammy |
+| Debian   | bullseye, buster     |
+| Amazon   |                      |
+| opensuse |                      |

 ## Role Variables

+- `mysql_daemon_enabled`
+  - Default: `true`
+  - Description: Whether to enable the MySQL-service so it starts on boot
+  - Type: bool
+  - Required: no
 - `mysql_hardening_chroot`
-  - Default: ""
+  - Default: ``
  - Description: [chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)
- `mysql_hardening_options.safe-user-create`
-  - Default: 1
-  - Description: [safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)
- `mysql_hardening_options.secure-auth`
-  - Default: 1
-  - Description: [secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)
- `mysql_hardening_options.skip-symbolic-links`
-  - Default: 1
-  - Description: [skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)
- `mysql_hardening_skip_grant_tables:`
-  - Default: false
-  - Description: [skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)
- `mysql_hardening_skip_show_database`
-  - Default: 1
-  - Description: [skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)
- `mysql_hardening_options.local-infile`
-  - Default: 0
-  - Description: [local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)
- `mysql_hardening_options.allow-suspicious-udfs`
-  - Default: 0
-  - Description: [allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)
+  - Type: str
+  - Required: no
 - `mysql_hardening_chroot.automatic-sp-privileges`
-  - Default: 0
+  - Default: `0`
  - Description: [automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)
+  - Type: int
+  - Required: no
+- `mysql_hardening_enabled`
+  - Default: `true`
+  - Description: Whether to run the hardening
+  - Type: bool
+  - Required: no
+- `mysql_hardening_options.allow-suspicious-udfs`
+  - Default: `0`
+  - Description: [allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)
+  - Type: int
+  - Required: no
+- `mysql_hardening_options.local-infile`
+  - Default: `0`
+  - Description: [local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)
+  - Type: int
+  - Required: no
+- `mysql_hardening_options.safe-user-create`
+  - Default: `1`
+  - Description: [safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)
+  - Type: int
+  - Required: no
+- `mysql_hardening_options.secure-auth`
+  - Default: `1`
+  - Description: [secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)
+  - Type: int
+  - Required: no
 - `mysql_hardening_options.secure-file-priv`
-  - Default: /tmp
+  - Default: `/tmp`
  - Description: [secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)
- `mysql_allow_remote_root`
-  - Default: false
-  - Description: delete remote root users
- `mysql_remove_anonymous_users`
-  - Default: true
-  - Description: remove users without authentication
- `mysql_remove_test_database`
-  - Default: true
-  - Description: remove test database
+  - Type: str
+  - Required: no
+- `mysql_hardening_options.skip-symbolic-links`
+  - Default: `1`
+  - Description: [skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)
+  - Type: int
+  - Required: no
 - `mysql_hardening_restart_mysql`
-  - Default: true
+  - Default: `true`
  - Description: Restart mysql after running this role
+  - Type: bool
+  - Required: no
+- `mysql_hardening_skip_grant_tables:`
+  - Default: `false`
+  - Description: [skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)
+  - Type: bool
+  - Required: no
+- `mysql_hardening_skip_show_database`
+  - Default: `1`
+  - Description: [skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)
+  - Type: int
+  - Required: no
+- `mysql_remove_anonymous_users`
+  - Default: `true`
+  - Description: Set to `false` to keep users without authentication
+  - Type: bool
+  - Required: no
+- `mysql_remove_remote_root`
+  - Default: `true`
+  - Description: If `true`, root can only connect from localhost. Set to `false` to not remove remote root users.
+  - Type: bool
+  - Required: no
+- `mysql_remove_test_database`
+  - Default: `true`
+  - Description: Set to `false` to keep the test database
+  - Type: bool
+  - Required: no
+- `mysql_root_password`
+  - Default: `-----====>SetR00tPa$$wordH3r3!!!<====-----`
+  - Description: The default password. Please change or overwrite it
+  - Type: str
+  - Required: no
+- `mysql_user_home`
+  - Default: `{{ ansible_env.HOME }}`
+  - Description: The path where the `.my.cnf` will be stored
+  - Type: str
+  - Required: no

-Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
+## Dependencies
+
+None.
+
+## Example Playbook
+
+```
+- hosts: all
+  roles:
+    - name: devsec.hardening.mysql_hardening
+```
+
+<!-- END_ANSIBLE_DOCS -->
@@ -6,8 +6,6 @@ mysql_daemon_enabled: true

 mysql_hardening_restart_mysql: true

-# general configuration
-mysql_hardening_mysql_hardening_conf_file: "{{ mysql_hardening_mysql_confd_dir }}/hardening.cnf"
 # You have to change this to your own strong enough mysql root password
 mysql_root_password: "-----====>SetR00tPa$$wordH3r3!!!<====-----"
 # There .my.cnf with mysql root credentials will be installed
@@ -0,0 +1,79 @@
+---
+argument_specs:
+  main:
+    short_description: The main entry point for the mysql hardening role.
+    version_added: 8.8.0
+    options:
+      mysql_hardening_chroot:
+        default: ''
+        type: str
+        description: '[chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)'
+      mysql_hardening_options.safe-user-create:
+        default: 1
+        type: int
+        description: '[safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)'
+      mysql_hardening_options.secure-auth:
+        default: 1
+        type: int
+        description: '[secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)'
+      mysql_hardening_options.skip-symbolic-links:
+        default: 1
+        type: int
+        description: '[skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)'
+      'mysql_hardening_skip_grant_tables:':
+        default: false
+        type: bool
+        description: '[skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)'
+      mysql_hardening_skip_show_database:
+        default: 1
+        type: int
+        description: '[skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)'
+      mysql_hardening_options.local-infile:
+        default: 0
+        type: int
+        description: '[local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)'
+      mysql_hardening_options.allow-suspicious-udfs:
+        default: 0
+        type: int
+        description: '[allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)'
+      mysql_hardening_chroot.automatic-sp-privileges:
+        default: 0
+        type: int
+        description: '[automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)'
+      mysql_hardening_options.secure-file-priv:
+        default: /tmp
+        type: str
+        description: '[secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)'
+      mysql_remove_anonymous_users:
+        default: true
+        type: bool
+        description: Set to `false` to keep users without authentication
+      mysql_remove_test_database:
+        default: true
+        type: bool
+        description: Set to `false` to keep the test database
+      mysql_hardening_restart_mysql:
+        default: true
+        type: bool
+        description: Restart mysql after running this role
+      mysql_hardening_enabled:
+        default: true
+        type: bool
+        description: Whether to run the hardening
+      mysql_daemon_enabled:
+        default: true
+        type: bool
+        description: Whether to enable the MySQL-service so it starts on boot
+      mysql_root_password:
+        default: '-----====>SetR00tPa$$wordH3r3!!!<====-----'
+        type: str
+        description: The default password. Please change or overwrite it
+      mysql_user_home:
+        default: '{{ ansible_env.HOME }}'
+        type: str
+        description: The path where the `.my.cnf` will be stored
+      mysql_remove_remote_root:
+        default: true
+        type: bool
+        description: If `true`, root can only connect from localhost. Set to `false`
+          to not remove remote root users.
@@ -10,6 +10,7 @@ galaxy_info:
      versions:
        - "7"
        - "8"
+        - "9"
    - name: Ubuntu
      versions:
        - bionic
@@ -20,7 +21,7 @@ galaxy_info:
        - bullseye
        - buster
    - name: Amazon
-    - name: Fedora
+    - name: opensuse
  galaxy_tags:
    - system
    - security
@@ -27,7 +27,11 @@
    owner: "{{ mysql_hardening_user }}"
    group: "{{ mysql_hardening_group }}"
    mode: "0640"
-  when: item is defined and item != ""
+  when:
+    - item is defined
+    - item != ""
+    - item != "stderr"
+    - item != "stdout"
  loop:
    - "{{ mysql_settings.settings.log_error }}"
    - '{{ mysql_hardening_log_file | default("") }}'
@@ -52,7 +56,7 @@
 - name: Apply hardening configuration
  ansible.builtin.template:
    src: hardening.cnf.j2
-    dest: "{{ mysql_hardening_mysql_hardening_conf_file }}"
+    dest: "{{ mysql_hardening_mysql_confd_dir + '/hardening.cnf' }}"
    owner: "{{ mysql_cnf_owner }}"
    group: "{{ mysql_cnf_group }}"
    mode: "0640"
@@ -14,7 +14,7 @@

 # we only override variables with our default if they have not been specified already.
 # by default the lookup functions finds all varnames containing the string, therefore
-# we add ^ and $ to denote start and end of string, so this returns only exact maches.
+# we add ^ and $ to denote start and end of string, so this returns only exact matches.
 - name: Set OS dependent variables, if not already defined by user # noqa var-naming
  ansible.builtin.set_fact:
    "{{ item.key }}": "{{ item.value }}"
@@ -49,16 +49,16 @@
 - name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
  community.mysql.mysql_query:
    query: >
-      SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
+      SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
      FROM mysql.user
      WHERE (length(authentication_string)=0
             OR authentication_string="")
        AND USER NOT IN ('mysql.sys',
                         'mysqlxsys',
                         'mariadb.sys');
-
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_users_wo_passwords_or_auth_string
+  check_mode: false
  when: >
    (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '>=')) or
    (mysql_distribution == "mariadb" and mysql_version.version.full
@@ -67,7 +67,7 @@
 - name: Get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
  community.mysql.mysql_query:
    query: >
-      SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
+      SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
      FROM mysql.user
      WHERE (length(password)=0
             OR password="")
@@ -78,30 +78,17 @@
                         'mariadb.sys');
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_users_wo_passwords
+  check_mode: false
  when: >
    (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '<')) or
    (mysql_distribution == "mariadb" and mysql_version.version.full is
    version('10.4.0', '<'))

- name: Create a fact for users without password or authentication_string
-  ansible.builtin.set_fact:
-    users_wo_auth: "{{ mysql_users_wo_passwords_or_auth_string.query_result.0.0 | community.general.json_query('users') }}"
-  when:
-    - mysql_users_wo_passwords_or_auth_string.query_result is defined
-    - mysql_users_wo_passwords_or_auth_string.query_result != "" # noqa empty-string-compare
-
- name: Create a fact for users without password
-  ansible.builtin.set_fact:
-    users_wo_auth: "{{ mysql_users_wo_passwords.query_result.0.0 | community.general.json_query('users') }}"
-  when:
-    - mysql_users_wo_passwords.query_result is defined
-    - mysql_users_wo_passwords.query_result != "" # noqa empty-string-compare
-
 - name: Ensure that there are no users without password or authentication_string
  community.mysql.mysql_query:
    query:
-      - DROP USER {{ users_wo_auth }}
+      - DROP USER {{ item.user }}
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
-  when:
-    - users_wo_auth is defined
-    - users_wo_auth != "" # noqa empty-string-compare
+  with_community.general.flattened:
+    - "{{ mysql_users_wo_passwords.query_result | default([]) }}"
+    - "{{ mysql_users_wo_passwords_or_auth_string.query_result | default([]) }}"
@@ -15,103 +15,135 @@ It works with the following nginx-roles, including, but not limited to:

 **NOTE: This role does not work with nginx 1.0.15 or older! Please use the latest version from the official nginx repositories!**

-## Requirements
+<!-- BEGIN_ANSIBLE_DOCS -->

- Ansible >= 2.9
+## Supported Operating Systems
+
+| Platform | Versions             |
+| -------- | -------------------- |
+| EL       | 7, 8, 9              |
+| Ubuntu   | bionic, focal, jammy |
+| Debian   | buster, bullseye     |
+| Amazon   |                      |

 ## Role Variables

- [nginx_client_body_buffer_size][]
+- `nginx_add_header`
+  - Default: `['X-Frame-Options SAMEORIGIN', 'X-Content-Type-Options nosniff', 'X-XSS-Protection "1; mode=block"', 'Content-Security-Policy \\"script-src \'self\'; object-src \'self\'\\"']`
+  - Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See [nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
+  - Type: str
+  - Required: no
+- `nginx_client_body_buffer_size`
  - Default: `1k`
-  - Description: Sets buffer size for reading client request body. In case the request body is larger than the buffer, the whole body or only its part is written to a temporary file.
- nginx_remove_default_site
+  - Description: Sets buffer size for reading client request body. In case the request body is larger than the buffer, the whole body or only its part is written to a temporary file. See [nginx_client_body_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size)
+  - Type: str
+  - Required: no
+- `nginx_client_body_timeout`
+  - Default: `10`
+  - Description: Defines a timeout for reading client request body. See [nginx_client_body_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout)
+  - Type: int
+  - Required: no
+- `nginx_client_header_buffer_size`
+  - Default: `1k`
+  - Description: Sets buffer size for reading client request header. For most requests, a buffer of 1K bytes is enough. See [nginx_client_header_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client
+  - Type: str
+  - Required: no
+- `nginx_client_header_timeout`
+  - Default: `10`
+  - Description: Defines a timeout for reading client request header. See [nginx_client_header_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout)
+  - Type: int
+  - Required: no
+- `nginx_client_max_body_size`
+  - Default: `1k`
+  - Description: Sets the maximum allowed size of the client request body, specified in the "Content-Length" request header field. If the size in a request exceeds the configured value, the 413 (Request Entity Too Large) error is returned to the client. See [nginx_client_max_body_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size)
+  - Type: str
+  - Required: no
+- `nginx_configuration_dir`
+  - Default: `/etc/nginx`
+  - Description: The main location for all nginx configuration files
+  - Type: str
+  - Required: no
+- `nginx_configuration_hardening_dir`
+  - Default: `/etc/nginx`
+  - Description: The location for the nginx hardening configuration file (Could be different e.g. when used in jails)
+  - Type: str
+  - Required: no
+- `nginx_dh_size`
+  - Default: `2048`
+  - Description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam)
+  - Type: str
+  - Required: no
+- `nginx_keepalive_timeout`
+  - Default: `5 5`
+  - Description: The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The optional second parameter sets a value in the "Keep-Alive timeout=time" response header field. See [nginx_keepalive_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout)
+  - Type: str
+  - Required: no
+- `nginx_large_client_header_buffers`
+  - Default: `2 1k`
+  - Description: Sets the maximum number and size of buffers used for reading large client request header. See [nginx_large_client_header_buffers](http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers)
+  - Type: str
+  - Required: no
+- `nginx_limit_conn`
+  - Default: `default 5`
+  - Description: Sets the shared memory zone and the maximum allowed number of connections for a given key value. See [nginx_limit_conn](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn)
+  - Type: str
+  - Required: no
+- `nginx_limit_conn_zone`
+  - Default: `$binary_remote_addr zone=default:10m`
+  - Description: Sets parameters for a shared memory zone that will keep states for various keys. See [nginx_limit_conn_zone](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone)
+  - Type: str
+  - Required: no
+- `nginx_owner_group`
+  - Default: `root`
+  - Description: The owner group of the nginx configuration files
+  - Type: str
+  - Required: no
+- `nginx_owner_user`
+  - Default: `root`
+  - Description: The owner user of the nginx configuration files
+  - Type: str
+  - Required: no
+- `nginx_remove_default_site`
  - Default: `true`
  - Description: Disables the default site. Set to false to enable the default site in nginx.
- [nginx_client_max_body_size][]
-  - Default: `1k`
-  - Description: Sets the maximum allowed size of the client request body, specified in the “Content-Length” request header field. If the size in a request exceeds the configured value, the 41
-    3 (Request Entity Too Large) error is returned to the client.
- [nginx_keepalive_timeout][]
-  - Default: `5 5`
-  - Description: The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The op
-    tional second parameter sets a value in the “Keep-Alive: timeout=time” response header field.
- [nginx_server_tokens][]
-  - Default: `off`
-  - Description: Disables emitting nginx version in error messages and in the "Server" response header field. Set to on to enable the nginx version in error messages and "Server" response head
-    er.
- [nginx_client_header_buffer_size][]
-  - Default: `1k`
-  - Description: Sets buffer size for reading client request header. For most requests, a buffer of 1K bytes is enough.
- [nginx_large_client_header_buffers][]
-  - Default: `2 1k`
-  - Description: Sets the maximum number and size of buffers used for reading large client request header.
- [nginx_client_body_timeout][]
+  - Type: bool
+  - Required: no
+- `nginx_send_timeout`
  - Default: `10`
-  - Description: Defines a timeout for reading client request body.
- [nginx_client_header_timeout][]
-  - Default: `10`
-  - Description: Defines a timeout for reading client request header.
- [nginx_send_timeout][]
-  - Default: `10`
-  - Description: Sets a timeout for transmitting a response to the client.
- [nginx_limit_conn_zone][]
-  - Default: `$binary_remote_addr zone=default:10m`
-  - Description: Sets parameters for a shared memory zone that will keep states for various keys.
- [nginx_limit_conn][]
-  - Default: `default 5`
-  - Description: Sets the shared memory zone and the maximum allowed number of connections for a given key value.
- [nginx_add_header][]
-  - Default: `[ "X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"", Content-Security-Policy \"script-src 'self'; object-src 'self'\" ]`
-  - Description: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307.
- [nginx_ssl_protocols][]
-  - Default: `TLSv1.2`
-  - Description: Specifies the SSL protocol which should be used.
- [nginx_ssl_ciphers][]
-  - Default: _see defaults.yml_
-  - Description: Specifies the TLS ciphers which should be used.
- [nginx_ssl_prefer_server_ciphers][]
+  - Description: Sets a timeout for transmitting a response to the client. See [nginx_send_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout)
+  - Type: int
+  - Required: no
+- `nginx_server_tokens`
+  - Default: `False`
+  - Description: Disables emitting nginx version in error messages and in the "Server" response header field. Set to on to enable the nginx version in error messages and "Server" response header. See [nginx_server_tokens](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens)
+  - Type: str
+  - Required: no
+- `nginx_ssl_ciphers`
+  - Default: `ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256`
+  - Description: Specifies the TLS ciphers which should be used. See [nginx_ssl_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers)
+  - Type: str
+  - Required: no
+- `nginx_ssl_prefer_server_ciphers`
  - Default: `on`
-  - Description: Specifies that server ciphers should be preferred over client ciphers when using the TLS protocols. Set to false to disable it.
- [nginx_dh_size][]
-  - Default: `2048`
-  - Description: Specifies the length of DH parameters for EDH ciphers.
- [nginx_configuration_dir][]
-  - default: "/etc/nginx"
-  - Description: The main location for all nginx configuration files
- [nginx_configuration_hardening_dir][]
-  - default: "/etc/nginx"
-  - Description: The location for the nginx hardening configuration file (Could be different e.g. when used in jails)
- [nginx_owner_user][]
-  - default: "root"
-  - Description: The owner user of the nginx configuration files
- [nginx_owner_group][]
-  - default: "root"
-  - Description: The owner group of the nginx configuration files
+  - Description: Specifies that server ciphers should be preferred over client ciphers when using the TLS protocols. Set to false to disable it. See [nginx_ssl_prefer_server_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers)
+  - Type: str
+  - Required: no
+- `nginx_ssl_protocols`
+  - Default: `TLSv1.2`
+  - Description: Specifies the SSL protocol which should be used. See [nginx_ssl_protocols](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols)
+  - Type: str
+  - Required: no
+
+## Dependencies
+
+None.

 ## Example Playbook

 ```
- hosts: localhost
-  collections:
-    - devsec.hardening
+- hosts: all
  roles:
-    - nginx_hardening
+    - name: devsec.hardening.nginx_hardening
 ```

-[nginx_client_body_buffer_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size
-[nginx_client_max_body_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
-[nginx_keepalive_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout
-[nginx_server_tokens]: http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens
-[nginx_more_clear_headers]: http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header
-[nginx_client_header_buffer_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_buffer_size
-[nginx_large_client_header_buffers]: http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers
-[nginx_client_body_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout
-[nginx_client_header_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout
-[nginx_send_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout
-[nginx_limit_conn_zone]: http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone
-[nginx_limit_conn]: http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn
-[nginx_add_header]: http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header
-[nginx_ssl_protocols]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols
-[nginx_ssl_ciphers]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers
-[nginx_ssl_prefer_server_ciphers]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers
-[nginx_dh_size]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam
+<!-- END_ANSIBLE_DOCS -->
@@ -25,7 +25,6 @@ nginx_add_header:
  - Strict-Transport-Security max-age=15768000
  - Content-Security-Policy "script-src 'self'; object-src 'self'"

-nginx_set_cookie_flag: "* HttpOnly secure"
 nginx_ssl_prefer_server_ciphers: "on"
 nginx_ssl_protocols: TLSv1.2 TLSv1.3
 # yamllint disable-line rule:line-length
@@ -0,0 +1,112 @@
+---
+argument_specs:
+  main:
+    short_description: The main entry point for the nginx hardening role.
+    version_added: 8.8.0
+    options:
+      nginx_client_body_buffer_size:
+        default: 1k
+        type: str
+        description: Sets buffer size for reading client request body. In case the
+          request body is larger than the buffer, the whole body or only its part
+          is written to a temporary file. See [nginx_client_body_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size)
+      nginx_remove_default_site:
+        default: true
+        type: bool
+        description: Disables the default site. Set to false to enable the default
+          site in nginx.
+      nginx_client_max_body_size:
+        default: 1k
+        type: str
+        description: Sets the maximum allowed size of the client request body, specified
+          in the "Content-Length" request header field. If the size in a request exceeds
+          the configured value, the 413 (Request Entity Too Large) error is returned
+          to the client. See [nginx_client_max_body_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size)
+      nginx_keepalive_timeout:
+        default: 5 5
+        type: str
+        description: The first parameter sets a timeout during which a keep-alive
+          client connection will stay open on the server side. The zero value disables
+          keep-alive client connections. The optional second parameter sets a value
+          in the "Keep-Alive timeout=time" response header field. See [nginx_keepalive_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout)  # noqa yaml[line-length]
+      nginx_server_tokens:
+        default: false
+        type: str
+        description: Disables emitting nginx version in error messages and in the
+          "Server" response header field. Set to on to enable the nginx version in
+          error messages and "Server" response header. See [nginx_server_tokens](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens)
+      nginx_client_header_buffer_size:
+        default: 1k
+        type: str
+        description: Sets buffer size for reading client request header. For most
+          requests, a buffer of 1K bytes is enough. See [nginx_client_header_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client
+      nginx_large_client_header_buffers:
+        default: 2 1k
+        type: str
+        description: Sets the maximum number and size of buffers used for reading
+          large client request header. See [nginx_large_client_header_buffers](http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers)  # noqa yaml[line-length]
+      nginx_client_body_timeout:
+        default: 10
+        type: int
+        description: Defines a timeout for reading client request body. See [nginx_client_body_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout)  # noqa yaml[line-length]
+      nginx_client_header_timeout:
+        default: 10
+        type: int
+        description: Defines a timeout for reading client request header. See [nginx_client_header_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout)  # noqa yaml[line-length]
+      nginx_send_timeout:
+        default: 10
+        type: int
+        description: Sets a timeout for transmitting a response to the client. See
+          [nginx_send_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout)
+      nginx_limit_conn_zone:
+        default: $binary_remote_addr zone=default:10m
+        type: str
+        description: Sets parameters for a shared memory zone that will keep states
+          for various keys. See [nginx_limit_conn_zone](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone)
+      nginx_limit_conn:
+        default: default 5
+        type: str
+        description: Sets the shared memory zone and the maximum allowed number of
+          connections for a given key value. See [nginx_limit_conn](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn)
+      nginx_add_header:
+        default: [X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff, X-XSS-Protection
+              "1; mode=block", Content-Security-Policy \"script-src 'self'; object-src
+              'self'\"]
+        type: str
+        description: Adds the specified field to a response header provided that the
+          response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See
+          [nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
+      nginx_ssl_protocols:
+        default: TLSv1.2
+        type: str
+        description: Specifies the SSL protocol which should be used. See [nginx_ssl_protocols](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols)  # noqa yaml[line-length]
+      nginx_ssl_ciphers:
+        default: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256  # noqa yaml[line-length]
+        type: str
+        description: Specifies the TLS ciphers which should be used. See [nginx_ssl_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers)
+      nginx_ssl_prefer_server_ciphers:
+        default: 'on'
+        type: str
+        description: Specifies that server ciphers should be preferred over client
+          ciphers when using the TLS protocols. Set to false to disable it. See [nginx_ssl_prefer_server_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers)  # noqa yaml[line-length]
+      nginx_dh_size:
+        default: 2048
+        type: str
+        description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam)  # noqa yaml[line-length]
+      nginx_configuration_dir:
+        default: /etc/nginx
+        type: str
+        description: The main location for all nginx configuration files
+      nginx_configuration_hardening_dir:
+        default: /etc/nginx
+        type: str
+        description: The location for the nginx hardening configuration file (Could
+          be different e.g. when used in jails)
+      nginx_owner_user:
+        default: root
+        type: str
+        description: The owner user of the nginx configuration files
+      nginx_owner_group:
+        default: root
+        type: str
+        description: The owner group of the nginx configuration files
@@ -10,6 +10,7 @@ galaxy_info:
      versions:
        - "7"
        - "8"
+        - "9"
    - name: Ubuntu
      versions:
        - bionic
@@ -19,6 +20,7 @@ galaxy_info:
      versions:
        - buster
        - bullseye
+    - name: Amazon
  galaxy_tags:
    - system
    - security
@@ -54,7 +54,7 @@

 - fix fedora build [\#296](https://github.com/dev-sec/ansible-os-hardening/pull/296) ([rndmh3ro](https://github.com/rndmh3ro))
 - do not blacklist used filesystems [\#289](https://github.com/dev-sec/ansible-os-hardening/pull/289) ([schurzi](https://github.com/schurzi))
- move hidepid vars into defaults so theyre overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))
+- move hidepid vars into defaults so they're overwritable [\#285](https://github.com/dev-sec/ansible-os-hardening/pull/285) ([rndmh3ro](https://github.com/rndmh3ro))

 ## [6.1.0](https://github.com/dev-sec/ansible-os-hardening/tree/6.1.0) (2020-07-21)

@@ -118,7 +118,7 @@
 - Add kernel parameter information to README [\#259](https://github.com/dev-sec/ansible-os-hardening/pull/259) ([jaredledvina](https://github.com/jaredledvina))
 - Remove trailing whitespaces \(ansible-lint 201\) [\#254](https://github.com/dev-sec/ansible-os-hardening/pull/254) ([kravietz](https://github.com/kravietz))
 - Standardize the var ordering [\#251](https://github.com/dev-sec/ansible-os-hardening/pull/251) ([dustinmiller1337](https://github.com/dustinmiller1337))
- Add intial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) ([dustinmiller1337](https://github.com/dustinmiller1337))
+- Add initial support for OpenSUSE [\#250](https://github.com/dev-sec/ansible-os-hardening/pull/250) ([dustinmiller1337](https://github.com/dustinmiller1337))
 - Make max_log_file_action for auditd configurable [\#246](https://github.com/dev-sec/ansible-os-hardening/pull/246) ([jandd](https://github.com/jandd))
 - Add exception in sysctl task [\#240](https://github.com/dev-sec/ansible-os-hardening/pull/240) ([ghost](https://github.com/ghost))
 - Fedora - Use new auto ansible_python_interpreter for dnf [\#239](https://github.com/dev-sec/ansible-os-hardening/pull/239) ([jaredledvina](https://github.com/jaredledvina))
@@ -193,7 +193,7 @@

 **Fixed bugs:**

- auditd causing v5.0 to fail on unpriviledged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191)
+- auditd causing v5.0 to fail on unprivileged LXC's [\#191](https://github.com/dev-sec/ansible-os-hardening/issues/191)
 - Setting os_security_users_allow has no effect [\#175](https://github.com/dev-sec/ansible-os-hardening/issues/175)
 - add /usr/bin/su to suid_guid whitelist [\#199](https://github.com/dev-sec/ansible-os-hardening/pull/199) ([ccolic](https://github.com/ccolic))
 - ensure that permissions to su-binary are not restricted to root user and group only, if os_security_users_allow contains the value change_user [\#197](https://github.com/dev-sec/ansible-os-hardening/pull/197) ([szEvEz](https://github.com/szEvEz))
@@ -374,7 +374,7 @@
 - Docker [\#90](https://github.com/dev-sec/ansible-os-hardening/pull/90) ([rndmh3ro](https://github.com/rndmh3ro))
 - debian 8 support [\#88](https://github.com/dev-sec/ansible-os-hardening/pull/88) ([rndmh3ro](https://github.com/rndmh3ro))
 - Ufw manage defaults [\#85](https://github.com/dev-sec/ansible-os-hardening/pull/85) ([fitz123](https://github.com/fitz123))
- replace ignore_errors to failed_when to supress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) ([fitz123](https://github.com/fitz123))
+- replace ignore_errors to failed_when to suppress ugly error warnings [\#81](https://github.com/dev-sec/ansible-os-hardening/pull/81) ([fitz123](https://github.com/fitz123))
 - fix bare variables usage for loops [\#79](https://github.com/dev-sec/ansible-os-hardening/pull/79) ([fitz123](https://github.com/fitz123))

 **Fixed bugs:**
@@ -487,7 +487,7 @@
 - Repair debian install script [\#8](https://github.com/dev-sec/ansible-os-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
 - Separate tasks into multiple smaller files [\#7](https://github.com/dev-sec/ansible-os-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
 - Enable gpg-check on all yum-repositories [\#5](https://github.com/dev-sec/ansible-os-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
- Change playbook-path to accomodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
+- Change playbook-path to accommodate test-repo [\#4](https://github.com/dev-sec/ansible-os-hardening/pull/4) ([rndmh3ro](https://github.com/rndmh3ro))
 - treat securetty config as an array [\#3](https://github.com/dev-sec/ansible-os-hardening/pull/3) ([arlimus](https://github.com/arlimus))
 - Add Securetty-support [\#2](https://github.com/dev-sec/ansible-os-hardening/pull/2) ([rndmh3ro](https://github.com/rndmh3ro))
 - Add profile.conf configuration [\#1](https://github.com/dev-sec/ansible-os-hardening/pull/1) ([rndmh3ro](https://github.com/rndmh3ro))
@@ -9,6 +9,7 @@ os_auth_retries: 5
 os_auth_lockout_time: 600 # Seconds (600 = 10min)
 os_auth_timeout: 60
 os_auth_allow_homeless: false
+os_auth_pam_oddjob_mkhomedir: false
 os_auth_pam_passwdqc_enable: true
 os_auth_pam_passwdqc_options: min=disabled,disabled,16,12,8 # Used in Debian
 os_auth_pam_pwquality_options: try_first_pass retry=3 authtok_type= # Used in RHEL7 and RHEL8
@@ -157,8 +158,8 @@ sysctl_config:
  # https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening#ptrace
  #
  # For applications launching crash handlers that need PTRACE, exceptions can
-  # be registered by the debugee by declaring in the segfault handler
-  # specifically which process will be using PTRACE on the debugee:
+  # be registered by the debuggee by declaring in the segfault handler
+  # specifically which process will be using PTRACE on the debuggee:
  #   prctl(PR_SET_PTRACER, debugger_pid, 0, 0, 0);
  #
  # In general, PTRACE is not needed for the average running Ubuntu system.
@@ -305,7 +306,7 @@ sysctl_config:

 # Do not delete the following line or otherwise the playbook will fail
 # at task 'create a combined sysctl-dict if overwrites are defined'
-sysctl_overwrite:
+sysctl_overwrite: {}
 # Disable unused filesystems
 os_unused_filesystems:
  - cramfs
@@ -331,9 +332,13 @@ os_hardening_enabled: true

 # Set to false to disable installing and configuring auditd.
 os_auditd_enabled: true
+os_auditd_template: etc/audit/auditd.conf.j2
 os_auditd_flush: INCREMENTAL
+os_auditd_freq: 20
 os_auditd_max_log_file: 6
 os_auditd_max_log_file_action: keep_logs
+os_auditd_write_logs: true
+os_auditd_log_file: /var/log/audit/audit.log
 os_auditd_log_format: RAW
 os_auditd_admin_space_left: 50
 os_auditd_space_left: 75
@@ -351,7 +356,7 @@ os_selinux_state: enforcing
 os_selinux_policy: targeted

 # Mount options for proc in /etc/fstab.
-proc_mnt_options: rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}
+proc_mnt_options: rw,nosuid,nodev,noexec,relatime

 # Set to false to disable installing and configuring cron.
 os_cron_enabled: true
@@ -1,11 +1,11 @@
 ---
- name: Update-initramfs
+- name: Update-initramfs # noqa no-changed-when
  ansible.builtin.command: update-initramfs -u

- name: Restart auditd # noqa command-instead-of-module
+- name: Restart auditd # noqa command-instead-of-module no-changed-when
  ansible.builtin.command:
    cmd: service auditd restart # rhel: see: https://access.redhat.com/solutions/2664811
-  when: molecule_yml is not defined # restarting auditd in a container does not work
+  when: molecule_yml.driver.name | default() != "docker" # restarting auditd in a container does not work

 - name: Reload systemd
  ansible.builtin.systemd:
@@ -0,0 +1,844 @@
+---
+argument_specs:
+  main:
+    short_description: The main entry point for the os hardening role.
+    version_added: 8.8.0
+    options:
+      os_desktop_enable:
+        default: false
+        type: bool
+        description: true if this is a desktop system, ie Xorg, KDE/GNOME/Unity/etc.
+      os_env_extra_user_paths:
+        default: '[]'
+        type: list
+        description: add additional paths to the user's `PATH` variable (default is
+          empty).
+      os_auth_pw_max_age:
+        default: 60
+        type: int
+        description: maximum password age (set to `99999` to effectively disable it).
+      os_auth_pw_min_age:
+        default: 7
+        type: int
+        description: minimum password age (before allowing any other password change).
+      os_auth_pw_warn_age:
+        default: 7
+        type: int
+        description: number of days of warning before password expires.
+      os_auth_pw_remember:
+        default: 5
+        type: int
+        description: how many used passwords are record.
+      os_auth_retries:
+        default: 5
+        type: int
+        description: the maximum number of authentication attempts, before the account
+          is locked for some time.
+      os_auth_lockout_time:
+        default: 600
+        type: int
+        description: time in seconds that needs to pass, if the account was locked
+          due to too many failed authentication attempts.
+      os_auth_timeout:
+        default: 60
+        type: int
+        description: authentication timeout in seconds, so login will exit if this
+          time passes.
+      os_auth_allow_homeless:
+        default: false
+        type: bool
+        description: true if to allow users without home to login.
+      os_auth_pam_passwdqc_enable:
+        default: true
+        type: bool
+        description: true if you want to use strong password checking in PAM using
+          passwdqc.
+      os_auth_pam_passwdqc_options:
+        default: min=disabled,disabled,16,12,8
+        type: str
+        description: set to any option line (as a string) that you want to pass to
+          passwdqc.
+      os_auth_pam_oddjob_mkhomedir:
+        default: false
+        type: bool
+        description: Enables automatic homedir e.g. in FreeIPA environments
+      os_auth_pam_pwquality_options:
+        default: try_first_pass retry=3 authtok_type=
+        type: str
+        description: Options to pass to the PAM module pwquality
+      os_security_users_allow:
+        default: '[]'
+        type: list
+        description: list of things, that a user is allowed to do. May contain `change_user`.
+      os_security_kernel_enable_module_loading:
+        default: true
+        type: bool
+        description: true if you want to allowed to change kernel modules once the
+          system is running (eg `modprobe`, `rmmod`). WARNING - Rebuilding initramfs
+          is deprecated and will be removed in the next major release. For more information
+          take a look at this issue <https://github.com/dev-sec/ansible-collection-hardening/pull/591>
+      os_security_kernel_enable_core_dump:
+        default: false
+        type: bool
+        description: kernel is crashing or otherwise misbehaving and a kernel core
+          dump is created.
+      os_security_suid_sgid_enforce:
+        default: true
+        type: bool
+        description: true if you want to reduce SUID/SGID bits. There is already a
+          list of items which are searched for configured, but you can also add your
+          own.
+      os_security_suid_sgid_blacklist:
+        default: '[]'
+        type: list
+        description: a list of paths which should have their SUID/SGID bits removed.
+      os_security_suid_sgid_whitelist:
+        default: '[]'
+        type: list
+        description: a list of paths which should not have their SUID/SGID bits altered.
+      os_security_suid_sgid_remove_from_unknown:
+        default: false
+        type: bool
+        description: true if you want to remove SUID/SGID bits from any file, that
+          is not explicitly configured in a `blacklist`. This will make every Ansible-run
+          search through the mounted filesystems looking for SUID/SGID bits that are
+          not configured in the default and user blacklist. If it finds an SUID/SGID
+          bit, it will be removed, unless this file is in your `whitelist`.
+      os_auth_uid_min:
+        default: 1000
+        type: int
+        description: minimum number for automatic uid selection in useradd.
+      os_auth_uid_max:
+        default: 60000
+        type: int
+        description: maximum number for automatic uid selection in useradd.
+      os_auth_gid_min:
+        default: 1000
+        type: int
+        description: minimum number for automatic gid selection in groupadd.
+      os_auth_gid_max:
+        default: 60000
+        type: int
+        description: maximum number for automatic gid selection in groupadd.
+      os_auth_sub_uid_count:
+        default: 65536
+        type: int
+        description: If /etc/subuid exists, the commands useradd and newusers (unless
+          the user already have subordinate user IDs) allocate SUB_UID_COUNT unused
+          user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user. See
+          also `os_auth_sub_uid_min` and `os_auth_sub_uid_max`.
+      os_auth_sub_uid_min:
+        default: 100000
+        type: int
+        description: minimum number for automatic subordinate uid selection in useradd
+          and newusers.
+      os_auth_sub_uid_max:
+        default: 600100000
+        type: int
+        description: maximum number for automatic subordinate uid selection in useradd
+          and newusers.
+      os_auth_sub_gid_count:
+        default: 65536
+        type: int
+        description: If /etc/subuid exists, the commands useradd and newusers (unless
+          the user already have subordinate group IDs) allocate SUB_GID_COUNT unused
+          group IDs from the range SUB_GID_MIN to SUB_GID_MAX for each new user. See
+          also `os_auth_sub_gid_min` and `os_auth_sub_gid_max`.
+      os_auth_sub_gid_min:
+        default: 100000
+        type: int
+        description: minimum number for automatic subordinate gid selection in useradd
+          and newusers.
+      os_auth_sub_gid_max:
+        default: 600100000
+        type: int
+        description: maximum number for automatic subordinate gid selection in useradd
+          and newusers.
+      os_security_packages_clean:
+        default: true
+        type: bool
+        description: removes packages with known issues. See section packages.
+      os_selinux_state:
+        default: enforcing
+        type: str
+        description: Set the SELinux state, can be either disabled, permissive, or
+          enforcing.
+      os_selinux_policy:
+        default: targeted
+        type: str
+        description: Set the SELinux polixy.
+      ufw_manage_defaults:
+        default: true
+        type: bool
+        description: true means apply all settings with `ufw_` prefix.
+      ufw_ipt_sysctl:
+        default: "''"
+        type: str
+        description: by default it disables IPT_SYSCTL in /etc/default/ufw. If you
+          want to overwrite /etc/sysctl.conf values using ufw - set it to your sysctl
+          dictionary, for example `/etc/ufw/sysctl.conf`.
+      ufw_default_input_policy:
+        default: DROP
+        type: str
+        description: set default input policy of ufw to `DROP`.
+      ufw_default_output_policy:
+        default: ACCEPT
+        type: str
+        description: set default output policy of ufw to `ACCEPT`.
+      ufw_default_forward_policy:
+        default: DROP
+        type: str
+        description: set default forward policy of ufw to `DROP`.
+      ufw_enable_ipv6:
+        default: true
+        type: bool
+        description: Set to `true` to apply rules to support IPv6 (no means only IPv6
+          on loopback accepted).
+      os_auditd_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring auditd.
+      os_auditd_log_format:
+        default: RAW
+        type: str
+        description: Describes how the information should be stored on disk. There
+          are 2 options - raw and enriched.
+      os_auditd_max_log_file_action:
+        default: keep_logs
+        type: str
+        description: Defines the behaviour of auditd when its log file is filled up.
+          Possible other values are described in the auditd.conf man page. The most
+          common alternative to the default may be `rotate`.
+      os_auditd_max_log_file:
+        default: 6
+        type: int
+        description: This keyword specifies the maximum file size in megabytes. When
+          this limit is reached, it will trigger a configurable action. The value
+          given must be numeric.
+      os_auditd_num_logs:
+        default: 5
+        type: int
+        description: This keyword specifies the number of log files to keep if `rotate`
+          is given as the max_log_file_action. The value given must be numeric.
+      os_auditd_flush:
+        default: INCREMENTAL
+        type: str
+        description: Valid values are none, incremental, incremental_async, data,
+          and sync.
+      os_auditd_admin_space_left:
+        default: 50
+        type: int
+        description: This is a numeric value in megabytes that tells the audit daemon
+          when to perform a configurable action because the system is running low
+          on disk space.
+      os_auditd_admin_space_left_action:
+        default: SUSPEND
+        type: str
+        description: This parameter tells the system what action to take when the
+          system has detected  that  it is low on disk space. Valid values are ignore,
+          syslog, rotate, email, exec, suspend, single, and halt.
+      os_auditd_space_left:
+        default: 75
+        type: int
+        description: If the free space in the filesystem containing log_file drops
+          below this value, the audit daemon takes the action specified by space_left_action.
+      os_auditd_space_left_action:
+        default: SYSLOG
+        type: str
+        description: This parameter tells the system what action to take when the
+          system has detected that it is starting to get low on disk space. Valid
+          values are ignore, syslog, rotate, email, exec, suspend, single, and halt.
+      os_auditd_action_mail_acct:
+        default: root
+        type: str
+        description: If `space_left_action` or `admin_space_left_action` are set to
+          `email`, uses the address or alias to send the email using `/usr/lib/sendmail`.
+          of events created on one system but reported/analyzed on another system.
+      os_auditd_disk_error_action:
+        default: SUSPEND
+        type: str
+        description: This parameter tells the system what action to take whenever
+          there is an error detected when writing audit events to disk or rotating
+          logs. Valid values are ignore, syslog, exec, suspend, single, and halt.
+      os_auditd_disk_full_action:
+        default: SUSPEND
+        type: str
+        description: This parameter tells the system what action to take when the
+          system has detected that the partition to which log files are written has
+          become full. Valid values are ignore, syslog, rotate, exec, suspend, single,
+          and halt.
+      os_auditd_log_group:
+        default: root
+        type: str
+        description: specifies the group that is applied to the log file's permissions.
+          The group name can be either numeric or spelled out.
+      proc_mnt_options:
+        default: rw,nosuid,nodev,noexec,relatime
+        type: str
+        description: Mount proc with hardenized options. Note that the hidepid option
+          is set separately in vars/.
+      os_ignore_users:
+        default: [vagrant, kitchen]
+        type: list
+        description: Specify system accounts whose login should not be disabled and
+          password not changed
+      os_chmod_home_folders:
+        default: true
+        type: bool
+        description: Set to `false` to disable "chmod 700" of home folders for regular
+          users
+      os_ignore_home_folder_users:
+        default: '[]'
+        type: list
+        description: Specify user accounts, whose home folders shouldn't be chmodded
+          to 700 when "os_chmod_home_folders" is enabled.
+      os_chmod_rootuser_home_folder:
+        default: true
+        type: bool
+        description: Set to `false` to disable "chmod 700" of root's home folder
+      os_rootuser_pw_ageing:
+        default: false
+        type: bool
+        description: Set to true to enforce password age settings for root user(s)
+      os_remove_additional_root_users:
+        default: false
+        type: bool
+        description: When enabled and there are multiple users with UID=0, only "root"
+          will be kept. Others will be deleted.
+      os_user_pw_ageing:
+        default: true
+        type: bool
+        description: Set to false to disable password age enforcement on existing
+          users
+      os_users_without_password_ageing:
+        default: '[]'
+        type: list
+        description: List of users, where password ageing should not be enforced even
+          if "os_user_pw_ageing" is enabled
+      os_cron_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring cron.
+      os_ctrlaltdel_disabled:
+        default: false
+        type: bool
+        description: Set to true to disable ctrl-alt-delete key combination.
+      os_limits_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring limits.
+      os_login_defs_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring login_defs
+          for newly created users.
+      os_minimize_access_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring minimize_access.
+      os_pam_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring pam.
+      os_modprobe_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring modprobe.
+      os_profile_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring profile.
+      os_security_auto_logout:
+        default: 0
+        type: int
+        description: Set timeout in seconds for logout users automatically after time.
+          Setting this to `0` disables the timeout.
+      os_securetty_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring securetty.
+      os_sysctl_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring sysctl.
+      os_user_accounts_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring user_accounts.
+      os_rhosts_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring rhosts.
+      os_yum_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring yum.
+      os_yum_repo_file_whitelist:
+        default: '[]'
+        type: list
+        description: List of yum repository files under /etc/yum.repos.d/ which should
+          not be altered.
+      os_apt_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring apt.
+      os_selinux_enabled:
+        default: true
+        type: bool
+        description: Set to false to disable installing and configuring selinux.
+      os_sha_crypt_min_rounds:
+        default: 640000
+        type: int
+        description: Define the number of minimum SHA rounds. With a lot of rounds
+          brute forcing the password is more difficult. But note also that it more
+          CPU resources will be needed to authenticate users. The values must be inside
+          the 1000-999999999 range.
+      os_sha_crypt_max_rounds:
+        default: 640000
+        type: int
+        description: Define the number of maximum SHA rounds. With a lot of rounds
+          brute forcing the password is more difficult. But note also that it more
+          CPU resources will be needed to authenticate users. The values must be inside
+          the 1000-999999999 range.
+      os_mnt_boot_dir_mode:
+        default: '0700'
+        type: str
+        description: Set default perimissions for /boot
+      os_mnt_boot_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /boot mountpoint
+      os_mnt_boot_src:
+        default: "''"
+        type: str
+        description: Set mount source for /boot
+      os_mnt_boot_options:
+        default: rw,nosuid,nodev,noexec
+        description: Configure mount options for /boot
+      os_mnt_boot_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /boot. If empty, the current
+          file system type will be used.
+      os_mnt_boot_dump:
+        default: ext3 + ext4 = 1 / other = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_boot_passno:
+        default: ext3 + ext4 = 2 / other = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_dev_dir_mode:
+        default: '0755'
+        type: str
+        description: Set default perimissions for /dev
+      os_mnt_dev_enabled:
+        default: true
+        type: bool
+        description: Set to false to ignore /dev mountpoint
+      os_mnt_dev_src:
+        default: devtmpfs
+        type: str
+        description: Set mount source for /dev
+      os_mnt_dev_options:
+        default: rw,nosuid,noexec
+        type: str
+        description: Configure mount options for /dev
+      os_mnt_dev_filesystem:
+        default: devtmpfs
+        type: str
+        description: Configure file system for fstab entry /dev
+      os_mnt_dev_dump:
+        default: 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp.
+      os_mnt_dev_passno:
+        default: 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp.
+      os_mnt_dev_shm_dir_mode:
+        default: '1777'
+        type: str
+        description: Set default perimissions for /dev/shm
+      os_mnt_dev_shm_enabled:
+        default: true
+        type: bool
+        description: Set to false to ignore /dev/shm mountpoint
+      os_mnt_dev_shm_src:
+        default: tmpfs
+        type: str
+        description: Set mount source for /dev/shm
+      os_mnt_dev_shm_options:
+        default: rw,nosuid,nodev,noexec
+        type: str
+        description: Configure mount options for /dev/shm
+      os_mnt_dev_shm_filesystem:
+        default: tmpfs
+        type: str
+        description: Configure file system for fstab entry /dev/shm
+      os_mnt_dev_shm_dump:
+        default: 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp.
+      os_mnt_dev_shm_passno:
+        default: 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp.
+      os_mnt_home_dir_mode:
+        default: '0755'
+        type: str
+        description: Set default perimissions for /home
+      os_mnt_home_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /home mountpoint
+      os_mnt_home_src:
+        default: "''"
+        type: str
+        description: Set mount source for /home. If empty, the current file system
+          source device will be used.
+      os_mnt_home_options:
+        default: rw,nosuid,nodev
+        type: str
+        description: Configure mount options for /home
+      os_mnt_home_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /home. If empty, the current
+          file system type will be used.
+      os_mnt_home_dump:
+        default: ext3/4 = 1, others = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_home_passno:
+        default: ext3/4 = 2, others = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_run_dir_mode:
+        default: '0755'
+        type: str
+        description: Set default perimissions for /run
+      os_mnt_run_enabled:
+        default: true
+        type: bool
+        description: Set to false to ignore /run mountpoint
+      os_mnt_run_src:
+        default: tmpfs
+        type: str
+        description: Set mount source for /run
+      os_mnt_run_options:
+        default: rw,nosuid,nodev
+        type: str
+        description: Configure mount options for /run
+      os_mnt_run_filesystem:
+        default: tmpfs
+        type: str
+        description: Configure file system for fstab entry /run
+      os_mnt_run_dump:
+        default: 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp.
+      os_mnt_run_passno:
+        default: 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp.
+      os_mnt_tmp_dir_mode:
+        default: '1777'
+        type: str
+        description: Set default perimissions for /tmp
+      os_mnt_tmp_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /tmp mountpoint
+      os_mnt_tmp_src:
+        default: "''"
+        type: str
+        description: Set mount source for /tmp. If empty, the current file system
+          source device will be used.
+      os_mnt_tmp_options:
+        default: rw,nosuid,nodev,noexec
+        type: str
+        description: Configure mount options for /tmp
+      os_mnt_tmp_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /tmp. If empty, the current
+          file system type will be used.
+      os_mnt_tmp_dump:
+        default: ext3/4 = 1, others = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_tmp_passno:
+        default: ext3/4 = 2, others = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_dir_mode:
+        default: '0755'
+        type: str
+        description: Set default perimissions for /var
+      os_mnt_var_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /var mountpoint
+      os_mnt_var_src:
+        default: "''"
+        type: str
+        description: Set mount source for /var. If empty, the current file system
+          source device will be used.
+      os_mnt_var_options:
+        default: rw,nosuid,nodev
+        type: str
+        description: Configure mount options for /var
+      os_mnt_var_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /var. If empty, the current
+          file system type will be used.
+      os_mnt_var_dump:
+        default: ext3/4 = 1, others = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_passno:
+        default: ext3/4 = 2, others = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_log_dir_mode:
+        default: '0755'
+        type: str
+        description: Set default perimissions for /var/log
+      os_mnt_var_log_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /var/log mountpoint
+      os_mnt_var_log_src:
+        default: "''"
+        type: str
+        description: Set mount source for /var/log. If empty, the current file system
+          source device will be used.
+      os_mnt_var_log_options:
+        default: rw,nosuid,nodev,noexec
+        type: str
+        description: Configure mount options for /var/log
+      os_mnt_var_log_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /var/log. If empty, the
+          current file system type will be used.
+      os_mnt_var_log_dump:
+        default: ext3/4 = 1, others = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_log_passno:
+        default: ext3/4 = 2, others = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_log_audit_dir_mode:
+        default: '0640'
+        type: str
+        description: Set default perimissions for /var/log/audit
+      os_mnt_var_log_audit_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /var/log/audit mountpoint
+      os_mnt_var_log_audit_src:
+        default: "''"
+        type: str
+        description: Set mount source for /var/log/audit. If empty, the current file
+          system source device will be used.
+      os_mnt_var_log_audit_options:
+        default: rw,nosuid,nodev,noexec
+        type: str
+        description: Configure mount options for /var/log/audit
+      os_mnt_var_log_audit_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /var/log/audit. If empty,
+          the current file system type will be used.
+      os_mnt_var_log_audit_dump:
+        default: ext3/4 = 1, others = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_log_audit_passno:
+        default: ext3/4 = 2, others = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_tmp_dir_mode:
+        default: '1777'
+        type: str
+        description: Set default perimissions for /var/tmp
+      os_mnt_var_tmp_enabled:
+        default: false
+        type: bool
+        description: Set to true to configure /var/tmp mountpoint
+      os_mnt_var_tmp_src:
+        default: "''"
+        type: str
+        description: Set mount source for /var/tmp. If empty, the current file system
+          source device will be used.
+      os_mnt_var_tmp_options:
+        default: rw,nosuid,nodev,noexec
+        type: str
+        description: Configure mount options for /var/tmp
+      os_mnt_var_tmp_filesystem:
+        default: "''"
+        type: str
+        description: Configure file system for fstab entry /var/tmp. If empty, the
+          current file system type will be used.
+      os_mnt_var_tmp_dump:
+        default: ext3/4 = 1, others = 0
+        type: str
+        description: Configure dump for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_mnt_var_tmp_passno:
+        default: ext3/4 = 2, others = 0
+        type: str
+        description: Configure passno for fstab entry /var/tmp. If empty, the default
+          depends on fstype.
+      os_netrc_enabled:
+        default: true
+        type: bool
+        description: Configure filesystem for existence of .netrc file in homedir
+      os_netrc_whitelist_user:
+        default: '[]'
+        type: list
+        description: Add list of user to allow creation of .netrc in users homedir
+      sysctl_overwrite:
+        default: '{}'
+        type: dict
+        description: To overwrite options in the `sysctl_config`-dict, overwrite them
+          here.
+      sysctl_config:
+        type: dict
+        description: various sysctl-settings
+        default:
+          fs.protected_hardlinks: 1
+          fs.protected_symlinks: 1
+          fs.protected_fifos: 1
+          fs.protected_regular: 2
+          fs.suid_dumpable: 0
+          kernel.core_uses_pid: 1
+          kernel.kptr_restrict: 2
+          kernel.kexec_load_disabled: 1
+          kernel.sysrq: 0
+          kernel.randomize_va_space: 2
+          kernel.yama.ptrace_scope: 1
+          net.ipv4.ip_forward: 0
+          net.ipv6.conf.all.forwarding: 0
+          net.ipv4.conf.all.rp_filter: 1
+          net.ipv4.conf.default.rp_filter: 1
+          net.ipv4.icmp_echo_ignore_broadcasts: 1
+          net.ipv4.icmp_ignore_bogus_error_responses: 1
+          net.ipv4.icmp_ratelimit: 100
+          net.ipv4.icmp_ratemask: 88089
+          net.ipv4.tcp_timestamps: 0
+          net.ipv4.conf.all.arp_ignore: 1
+          net.ipv4.conf.all.arp_announce: 2
+          net.ipv4.tcp_rfc1337: 1
+          net.ipv4.tcp_syncookies: 1
+          net.ipv4.conf.all.shared_media: 1
+          net.ipv4.conf.default.shared_media: 1
+          net.ipv4.conf.all.accept_source_route: 0
+          net.ipv4.conf.default.accept_source_route: 0
+          net.ipv6.conf.all.accept_source_route: 0
+          net.ipv6.conf.default.accept_source_route: 0
+          net.ipv4.conf.all.send_redirects: 0
+          net.ipv4.conf.default.send_redirects: 0
+          net.ipv4.conf.all.log_martians: 1
+          net.ipv4.conf.default.log_martians: 1
+          net.ipv4.conf.default.accept_redirects: 0
+          net.ipv4.conf.all.accept_redirects: 0
+          net.ipv4.conf.all.secure_redirects: 0
+          net.ipv4.conf.default.secure_redirects: 0
+          net.ipv6.conf.default.accept_redirects: 0
+          net.ipv6.conf.all.accept_redirects: 0
+          net.ipv6.conf.all.accept_ra: 0
+          net.ipv6.conf.default.accept_ra: 0
+          net.ipv6.conf.default.router_solicitations: 0
+          net.ipv6.conf.all.router_solicitations: 0
+          net.ipv6.conf.default.accept_ra_rtr_pref: 0
+          net.ipv6.conf.default.accept_ra_pinfo: 0
+          net.ipv6.conf.default.accept_ra_defrtr: 0
+          net.ipv6.conf.default.autoconf: 0
+          net.ipv6.conf.all.autoconf: 0
+          net.ipv6.conf.default.dad_transmits: 0
+          net.ipv6.conf.default.max_addresses: 1
+          vm.mmap_min_addr: 65536
+          vm.mmap_rnd_bits: 32
+          vm.mmap_rnd_compat_bits: 16
+      os_unused_filesystems:
+        default:
+          - cramfs
+          - freevxfs
+          - jffs2
+          - hfs
+          - hfsplus
+          - squashfs
+          - udf
+          - vfat
+          - dccp
+          - rds
+          - sctp
+          - tipc
+        type: list
+        description: Disable this list of unused filesystems
+      os_filesystem_whitelist:
+        default: '[]'
+        type: list
+        description: A list of filesystems that should not be disabled
+      os_hardening_enabled:
+        default: true
+        type: bool
+        description: Whether to run the hardening
+      os_auth_root_ttys:
+        default: [console, tty1, tty2, tty3, tty4, tty5, tty6]
+        type: list
+        description: A list of TTYs, from which root can log in, see `man securetty`
+          for reference
+      os_chfn_restrict:
+        default: "''"
+        type: str
+        description: Indicate which fields are changeable by chfn.
+      os_security_init_prompt:
+        default: true
+        type: bool
+        description: The PROMPT option provides console users the ability to interactively
+          boot the system and select which services to start on boot.
+      os_security_init_single:
+        default: false
+        type: bool
+        description: Single-user mode is intended as a system recovery method, providing
+          a single user root access to the system by providing a boot option at startup.
+          By default, no authentication is performed if single-user mode is selected.
+          To require entry of the root password even if the system is started in single-user
+          mode, set this to false
+      os_security_packages_list:
+        default: [xinetd, inetd, ypserv, telnet-server, rsh-server, prelink]
+        type: list
+        description: List of deprecated or insecure packages to remove
+      ufw_default_application_policy:
+        default: SKIP
+        type: str
+        description: The default application policy is skip, which means that the
+          update --add-new command will do nothing
+      ufw_ipt_modules:
+        default: nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns
+        type: str
+        description: Define which netfilter modules to load
+      ufw_manage_builtins:
+        default: 'no'
+        type: str
+        description: If this variable is set to 'yes', on stop and reload the built-in
+          chains are flushed. If it is set to 'no', on stop and reload the ufw secondary
+          chains are removed and the ufw primary chains are flushed
@@ -4,12 +4,13 @@ galaxy_info:
  description: This Ansible role provides numerous security-related ssh configurations, providing all-round base protection.
  company: Hardening Framework Team
  license: Apache License 2.0
-  min_ansible_version: 2.9.10
+  min_ansible_version: "2.11"
  platforms:
    - name: EL
      versions:
        - "7"
        - "8"
+        - "9"
    - name: Ubuntu
      versions:
        - bionic
@@ -7,7 +7,7 @@

 - name: Configure auditd | package-08
  ansible.builtin.template:
-    src: etc/audit/auditd.conf.j2
+    src: "{{ os_auditd_template }}"
    dest: /etc/audit/auditd.conf
    owner: root
    group: root
@@ -18,6 +18,7 @@
        limit_item: core
        value: "0"
        comment: Prevent core dumps for all users. These are usually not needed and may contain sensitive information
+      when: not ansible_check_mode  # the directory needs to be created first, which does not happen in check_mode

    - name: Set 10.hardcore.conf perms to 0400 and root ownership
      ansible.builtin.file:
@@ -34,7 +35,7 @@
        path: /etc/systemd/coredump.conf.d
        owner: root
        group: root
-        mode: 0755
+        mode: "0755"
        state: directory
      when: ansible_service_mgr == "systemd"

@@ -44,7 +45,7 @@
        dest: /etc/systemd/coredump.conf.d/custom.conf
        owner: root
        group: root
-        mode: 0644
+        mode: "0644"
      when: ansible_service_mgr == "systemd"
      notify: Reload systemd

@@ -73,12 +73,23 @@
    mode: "0750"
  when: '"change_user" not in os_security_users_allow'

+# we have to define this combined variable here, because when defining it
+# in the defaults like this:
+# proc_mnt_options: rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}
+# the role argument validator complains about the missing hidepid_option-variable.
+# If we define the hidepid_option-variable in the defaults, we cannot
+# overwrite it anymore in the vars (for some reason).
+
+- name: Define proc_mnt_options including hidepid_option
+  ansible.builtin.set_fact:
+    _proc_mnt_options: "{{ proc_mnt_options }},hidepid={{ hidepid_option }}"
+
 - name: Set option hidepid for proc filesystem
  ansible.posix.mount:
    path: /proc
    src: proc
    fstype: proc
-    opts: "{{ proc_mnt_options }}"
+    opts: "{{ _proc_mnt_options }}"
    state: mounted

 - name: Generate list of current available mounted filesystems on the system
@@ -15,6 +15,7 @@
  register: sbit_binaries
  when: os_security_suid_sgid_remove_from_unknown | bool
  changed_when: false
+  check_mode: false

 - name: Gather files from which to remove suids/sgids and remove system white-listed files | os-06
  ansible.builtin.set_fact:
@@ -3,7 +3,9 @@
  ansible.builtin.getent:
    database: passwd
    # creates a dict for each user containing UID/HOMEDIR etc...
-  when: getent_passwd is undefined # skip this task if "getent" has run before
+  # skip this task if getent was run before without specifying a key (single entry)
+  when: getent_passwd is undefined or
+        getent_passwd | length <= 1

 - name: Read local linux shadow database
  ansible.builtin.getent:
@@ -51,7 +53,7 @@

 - name: Set ownership of root user home directory(s) to 0700
  ansible.builtin.file:
-    mode: 0700
+    mode: "0700"
    owner: "{{ item }}"
    path: "{{ getent_passwd[item][4] }}"
    state: directory
@@ -98,7 +100,7 @@

 - name: Limit access to home directories of regular (non-system, non-root) accounts
  ansible.builtin.file:
-    mode: 0700
+    mode: "0700"
    owner: "{{ item }}"
    path: "{{ getent_passwd[item][4] }}"
    state: directory
@@ -1,12 +1,13 @@
 {{ ansible_managed | comment }}
 # Generated by Ansible role {{ ansible_role_name }}

-log_file = /var/log/audit/audit.log
+write_logs = {{ os_auditd_write_logs | bool | ternary('yes', 'no') }}
+log_file = {{ os_auditd_log_file }}
 log_format = {{ os_auditd_log_format }}
 log_group = {{ os_auditd_log_group }}
 priority_boost = 4
 flush = {{ os_auditd_flush }}
-freq = 20
+freq = {{ os_auditd_freq }}
 num_logs = {{ os_auditd_num_logs }}
 disp_qos = lossy
 dispatcher = /sbin/audispd
@@ -136,7 +136,7 @@ SUB_GID_MIN       {{ os_auth_sub_gid_min }}
 SUB_GID_MAX       {{ os_auth_sub_gid_max }}
 SUB_GID_COUNT     {{ os_auth_sub_gid_count }}

-# Max number of login retries if password is bad. This will most likely be overriden by PAM, since the default pam_unix module has it's own built in of 3 retries. However, this is a safe fallback in case you are using an authentication module that does not enforce PAM_MAXTRIES.
+# Max number of login retries if password is bad. This will most likely be overridden by PAM, since the default pam_unix module has it's own built in of 3 retries. However, this is a safe fallback in case you are using an authentication module that does not enforce PAM_MAXTRIES.
 LOGIN_RETRIES     {{ os_auth_retries }}

 # Max time in seconds for login
@@ -155,7 +155,7 @@ DEFAULT_HOME      {{ 'yes' if os_auth_allow_homeless else 'no' }}
 # the user to be removed (passed as the first argument).
 #USERDEL_CMD       /usr/sbin/userdel_local

-# Instead of the real user shell, the program specified by this parameter will be launched, although its visible name (`argv[0]`) will be the shell's. The program may do whatever it wants (logging, additional authentification, banner, ...) before running the actual shell.
+# Instead of the real user shell, the program specified by this parameter will be launched, although its visible name (`argv[0]`) will be the shell's. The program may do whatever it wants (logging, additional authentication, banner, ...) before running the actual shell.
 #FAKE_SHELL        /bin/fakeshell

 # If defined, either full pathname of a file containing device names or a ":" delimited list of device names.  Root logins will be allowed only upon these devices.
@@ -47,6 +47,9 @@ password    required      pam_deny.so
 session     optional      pam_keyinit.so revoke
 session     required      pam_limits.so
 -session    optional      pam_systemd.so
+{% if (os_auth_pam_oddjob_mkhomedir | bool) %}
+session     optional      pam_oddjob_mkhomedir.so
+{% endif %}
 session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
 session     required      pam_unix.so
 {% if (os_auth_pam_sssd_enable | bool) %}
@@ -81,6 +81,6 @@ os_useradd_create_home: true
 modprobe_package: module-init-tools
 auditd_package: audit

-# system accounts that do not get their login disabled and pasword changed
+# system accounts that do not get their login disabled and password changed
 os_always_ignore_users: [root, sync, shutdown, halt, ec2-user]
 hidepid_option: "2" # allowed values: 0, 1, 2
@@ -108,5 +108,5 @@ os_security_suid_sgid_system_whitelist:
  - /usr/lib/libvte9/gnome-pty-helper # gnome
  - /usr/lib/libvte-2.90-9/gnome-pty-helper # gnome

-# system accounts that do not get their login disabled and pasword changed
+# system accounts that do not get their login disabled and password changed
 os_always_ignore_users: [root, sync, shutdown, halt]
@@ -195,7 +195,7 @@
 - SFTP: set default umask to 0027 [\#252](https://github.com/dev-sec/ansible-ssh-hardening/pull/252) ([Slamdunk](https://github.com/Slamdunk))
 - Separate PermitUserEnviroment from AcceptEnv [\#251](https://github.com/dev-sec/ansible-ssh-hardening/pull/251) ([szEvEz](https://github.com/szEvEz))
 - Feature: Debian 10 \(Buster\) support [\#249](https://github.com/dev-sec/ansible-ssh-hardening/pull/249) ([jaredledvina](https://github.com/jaredledvina))
- fix broken packages, extend README with furhter development instructions [\#246](https://github.com/dev-sec/ansible-ssh-hardening/pull/246) ([szEvEz](https://github.com/szEvEz))
+- fix broken packages, extend README with further development instructions [\#246](https://github.com/dev-sec/ansible-ssh-hardening/pull/246) ([szEvEz](https://github.com/szEvEz))
 - refactor authenticationmethod settings, allow user to set authenticat… [\#245](https://github.com/dev-sec/ansible-ssh-hardening/pull/245) ([szEvEz](https://github.com/szEvEz))
 - RHEL/OL/CentOS 8 support [\#242](https://github.com/dev-sec/ansible-ssh-hardening/pull/242) ([Furragen](https://github.com/Furragen))
 - Added ssh_syslog_facility, ssh_log_level and ssh_strict_modes parameters [\#240](https://github.com/dev-sec/ansible-ssh-hardening/pull/240) ([bschonec](https://github.com/bschonec))
@@ -1,6 +1,6 @@
 # dev-sec.ssh_hardening

-![devsec.ssh_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.ssh_hardening/badge.svg)
+![devsec.ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/workflows/devsec.ssh_hardening/badge.svg)

 ## Description

@@ -8,250 +8,433 @@ This role provides secure ssh-client and ssh-server configurations. It is intend

 Warning: This role disables root-login on the target server! Please make sure you have another user with su or sudo permissions that can login into the server.

-## Requirements
+<!-- BEGIN_ANSIBLE_DOCS -->

- Ansible >= 2.9
- root-privileges on the target system
+## Supported Operating Systems

-As this role requires root-privileges, we added `become: true` to all tasks. So please make sure you run the role as root or as a user with become-privileges.
+| Platform  | Versions             |
+| --------- | -------------------- |
+| EL        | 7, 8, 9              |
+| Ubuntu    | bionic, focal, jammy |
+| Debian    | buster, bullseye     |
+| Amazon    |                      |
+| Fedora    |                      |
+| ArchLinux |                      |
+| SmartOS   |                      |
+| FreeBSD   | 12.2                 |
+| OpenBSD   | 7.0                  |

 ## Role Variables

 - `network_ipv6_enable`
  - Default: `true`
-  - Description: false if IPv6 is not needed. `ssh_listen_to` must also be set to listen to IPv6 addresses (for example `[::]`).
- `ssh_client_config_file`
-  - Default: `'/etc/ssh/ssh_config'`
-  - Description: path of the ssh client configuration file, e.g. `/etc/ssh/ssh_config.d/custom.conf`.
- `ssh_server_config_file`
-  - Default: `'/etc/ssh/sshd_config'`
-  - Description: path of the ssh server configuration file, e.g. `/etc/ssh/sshd_config.d/custom.conf`.
- `ssh_server_ports`
-  - Default: `['22']`
-  - Description: ports on which ssh-server should listen.
- `ssh_client_port`
-  - Default: `'22'`
-  - Description: Specifies the port number to connect on the remote host.
- `ssh_listen_to`
-  - Default: `['0.0.0.0']`
-  - Description: one or more ip addresses, to which ssh-server should listen to. Default is all IPv4 adresses, but should be configured to specific addresses for security reasons!
- `ssh_host_key_files`
-  - Default: `[]`
-  - Description: Host keys for sshd. If empty ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key', '/etc/ssh/ssh_host_ed25519_key'] will be used, as far as supported by the installed sshd version.
- `ssh_host_rsa_key_size`
-  - Default: `4096`
-  - Description: Specifies the number of bits in the private host RSA key to create.
- `ssh_host_key_algorithms`
-  - Default: `[]`
-  - Description: Host key algorithms that the server offers. If empty the default list will be used. Otherwise overrides the setting with specified list of algorithms. Check `man sshd_config`, `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make sure you check the correct version!
- `ssh_client_host_key_algorithms`
-  - Default: `[]`
-  - Description: Specifies the host key algorithms that the client wants to use in order of preference. If empty the default list will be used. Otherwise overrides the setting with specified list of algorithms. Check `man ssh_config`, `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make sure you check the correct version!.
- `ssh_client_alive_interval`
-  - Default: `600`
-  - Description: specifies an interval for sending keepalive messages.
- `ssh_client_alive_count`
-  - Default: `3`
-  - Description: Defines the number of acceptable unanswered client alive messages before disconnecting clients.
- `ssh_permit_tunnel`
-  - Default: `false`
-  - Description: true if SSH Port Tunneling is required.
- `ssh_remote_hosts`
-  - Default: `[]`
-  - Description: one or more hosts and their custom options for the ssh-client. Default is empty. See examples in `defaults/main.yml`.
- `ssh_permit_root_login`
-  - Default: `no`
-  - Description: Disable root-login. Set to `'without-password'` or `'yes'` to enable root-login - The quotes are required!
- `ssh_allow_tcp_forwarding`
-  - Default: `no`
-  - Description: `'no'` or `False` to disable TCP Forwarding. Set to `'yes'` or `True` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all'`, `'local'`or`'remote'`.
- `ssh_gateway_ports`
-  - Default: `false`
-  - Description: `false` to disable binding forwarded ports to non-loopback addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified` to allow the client to specify which address to bind to.
- `ssh_allow_agent_forwarding`
-  - Default: `false`
-  - Description: false to disable Agent Forwarding. Set to true to allow Agent Forwarding.
- `ssh_x11_forwarding`
-  - Default: `false`
-  - Description: false to disable X11 Forwarding. Set to true to allow X11 Forwarding.
- `ssh_pam_support`
-  - Default: `true`
-  - Description: true if SSH has PAM support.
- `ssh_use_pam`
-  - Default: `true`
-  - Description: false to disable pam authentication.
- `ssh_gssapi_support`
-  - Default: `false`
-  - Description: Set to true to enable GSSAPI authentication (both client and server).
- `ssh_gssapi_delegation`
-  - Default: `false`
-  - Description: Set to true to enable GSSAPI credential forwarding.
- `ssh_kerberos_support`
-  - Default: `true`
-  - Description: true if SSH has Kerberos support.
- `ssh_deny_users`
-  - Default: `''`
-  - Description: if specified, login is disallowed for user names that match one of the patterns.
- `ssh_allow_users`
-  - Default: `''`
-  - Description: if specified, login is allowed only for user names that match one of the patterns.
- `ssh_deny_groups`
-  - Default: `''`
-  - Description: if specified, login is disallowed for users whose primary group or supplementary group list matches one of the patterns.
- `ssh_allow_groups`
-  - Default: `''`
-  - Description: if specified, login is allowed only for users whose primary group or supplementary group list matches one of the patterns.
- `ssh_authorized_keys_file`
-  - Default: `''`
-  - Description: change default file that contains the public keys that can be used for user authentication.
- `ssh_trusted_user_ca_keys_file`
-  - Default: `''`
-  - Description: specifies the file containing trusted certificate authorities public keys used to sign user certificates.
- `ssh_trusted_user_ca_keys`
-  - Default: `[]`
-  - Description: set the trusted certificate authorities public keys used to sign user certificates. Only used if `ssh_trusted_user_ca_keys_file` is set.
- `ssh_authorized_principals_file`
-  - Default: `''`
-  - Description: specifies the file containing principals that are allowed. Only used if `ssh_trusted_user_ca_keys_file` is set.
- `ssh_authorized_principals`
-  - Default: `[]`
-  - Description: list of hashes containing file paths and authorized principals, see `default_custom.yml` for all options. Only used if `ssh_authorized_principals_file` is set.
- `ssh_print_motd`
-  - Default: `false`
-  - Description: false to disable printing of the MOTD.
- `ssh_print_pam_motd`
-  - Default: `false`
-  - Description: false to disable printing of the MOTD via pam (Debian and Ubuntu).
- `ssh_print_last_log`
-  - Default: `false`
-  - Description: false to disable display of last login information.
- `sftp_enabled`
-  - Default: `true`
-  - Description: false to disable sftp configuration.
- `sftp_umask`
-  - Default: `'0027'`
-  - Description: Specifies the umask for sftp.
+  - Description: `false` if IPv6 is not needed. `ssh_listen_to` must also be set to listen to IPv6 addresses (for example `[::]`).
+  - Type: bool
+  - Required: no
 - `sftp_chroot`
  - Default: `true`
-  - Description: false to disable chroot for sftp.
+  - Description: Set to `false` to disable chroot for sftp.
+  - Type: bool
+  - Required: no
 - `sftp_chroot_dir`
  - Default: `/home/%u`
-  - Description: change default sftp chroot location.
- `ssh_client_roaming`
+  - Description: change default stp chroot location
+  - Type: str
+  - Required: no
+- `sftp_enabled`
+  - Default: `true`
+  - Description: Set to `false` to disable sftp configuration.
+  - Type: bool
+  - Required: no
+- `sftp_umask`
+  - Default: `0027`
+  - Description: Specifies the umask for sftp.
+  - Type: str
+  - Required: no
+- `ssh_allow_agent_forwarding`
  - Default: `false`
-  - Description: enable experimental client roaming.
- `sshd_moduli_file`
-  - Default: `'/etc/ssh/moduli'`
-  - Description: path to the SSH moduli file.
- `sshd_moduli_minimum`
-  - Default: `2048`
-  - Description: remove Diffie-Hellman parameters smaller than the defined size to mitigate logjam.
+  - Description: Set to `false` to disable Agent Forwarding. Set to `true` to allow Agent Forwarding.
+  - Type: bool
+  - Required: no
+- `ssh_allow_groups`
+  - Default: ``
+  - Description: if specified, login is allowed only for users whose primary group or supplementary group list matches one of the patterns.
+  - Type: str
+  - Required: no
+- `ssh_allow_tcp_forwarding`
+  - Default: `no`
+  - Description: Set to `'no'` or `false` to disable TCP Forwarding. Set to `'yes'` or`True` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all'`, `'local'`or`'remote'`.
+  - Type: str
+  - Required: no
+- `ssh_allow_users`
+  - Default: ``
+  - Description: if specified, login is allowed only for user names that match one of the patterns.
+  - Type: str
+  - Required: no
+- `ssh_authorized_keys_file`
+  - Default: ``
+  - Description: change default file that contains the public keys that can be used for user authentication
+  - Type: str
+  - Required: no
+- `ssh_authorized_principals`
+  - Default: ``
+  - Description: list of hashes containing file paths and authorized principals, see `default_cstom.yml` for all options. Only used if `ssh_authorized_principals_file` is set
+  - Type: list
+  - Required: no
+- `ssh_authorized_principals_file`
+  - Default: ``
+  - Description: specifies the file containing principals that are allowed. Only used if `ssh_trusted_user_ca_keys_file` is set.
+  - Type: str
+  - Required: no
+- `ssh_banner`
+  - Default: `false`
+  - Description: Set to `true` to print a banner on login.
+  - Type: bool
+  - Required: no
+- `ssh_banner_path`
+  - Default: `/etc/sshd/banner.txt`
+  - Description: path to the SSH banner file.
+  - Type: str
+  - Required: no
 - `ssh_challengeresponseauthentication`
  - Default: `false`
  - Description: Specifies whether challenge-response authentication is allowed (e.g. via PAM).
- `ssh_client_password_login`
-  - Default: `false`
-  - Description: `true` to allow password-based authentication with the ssh client.
- `ssh_server_password_login`
-  - Default: `false`
-  - Description: `true` to allow password-based authentication to the ssh server. You probably also need to change `sshd_authenticationmethods` to include `password` if you set `ssh_server_password_login`: `true`.
- `ssh_banner`
-  - Default: `false`
-  - Description: `true` to print a banner on login.
- `ssh_banner_path`
-  - Default: `'/etc/sshd/banner.txt'`
-  - Description: path to the SSH banner file.
- `ssh_client_hardening`
-  - Default: `true`
-  - Description: `false` to stop harden the client.
+  - Type: bool
+  - Required: no
+- `ssh_ciphers`
+  - Default: ``
+  - Description: Change this list to overwrite ciphers. Defaults found in `defaults/main.yml`
+  - Type: list
+  - Required: no
+- `ssh_client_alive_count`
+  - Default: `3`
+  - Description: Defines the number of acceptable unanswered client alive messages before disconnecting clients.
+  - Type: str
+  - Required: no
+- `ssh_client_alive_interval`
+  - Default: `600`
+  - Description: specifies an interval for sending keepalive messages.
+  - Type: str
+  - Required: no
 - `ssh_client_compression`
  - Default: `false`
  - Description: Specifies whether the client requests compression.
+  - Type: bool
+  - Required: no
+- `ssh_client_config_file`
+  - Default: `/etc/ssh/ssh_config`
+  - Description: path of the ssh client configuration file, e.g. `/etc/ssh/ssh_config.d/custom.conf`.
+  - Type: str
+  - Required: no
+- `ssh_client_hardening`
+  - Default: `true`
+  - Description: `false` to stop harden the client.
+  - Type: bool
+  - Required: no
+- `ssh_client_host_key_algorithms`
+  - Default: ``
+  - Description: Specifies the host key algorithms that the client wants to use in order of preference. If empty the default list will be used. Otherwise overrides the setting with specified list of algorithms. Check `man ssh_config`, `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make sure you check the correct version!
+  - Type: list
+  - Required: no
+- `ssh_client_password_login`
+  - Default: `false`
+  - Description: Set to `true` to allow password-based authentication with the ssh client.
+  - Type: bool
+  - Required: no
+- `ssh_client_port`
+  - Default: `22`
+  - Description: Specifies the port number to connect on the remote host.
+  - Type: str
+  - Required: no
+- `ssh_client_roaming`
+  - Default: `false`
+  - Description: enable experimental client roaming.
+  - Type: bool
+  - Required: no
 - `ssh_compression`
  - Default: `false`
  - Description: Specifies whether server-side compression is enabled after the user has authenticated successfully.
- `ssh_login_grace_time`
-  - Default: `30s`
-  - Description: specifies the time allowed for successful authentication to the SSH server.
- `ssh_max_auth_retries`
-  - Default: `2`
-  - Description: Specifies the maximum number of authentication attempts permitted per connection.
- `ssh_max_sessions`
-  - Default: `10`
-  - Description: Specifies the maximum number of open sessions permitted from a given connection.
- `ssh_print_debian_banner`
-  - Default: `false`
-  - Description: `true` to print debian specific banner.
- `ssh_server_enabled`
-  - Default: `true`
-  - Description: `false` to disable the opensshd server.
- `ssh_server_hardening`
-  - Default: `true`
-  - Description: `false` to stop harden the server.
- `ssh_server_match_address`
-  - Default: `''`
-  - Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
- `ssh_server_match_group`
-  - Default: `''`
-  - Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
- `ssh_server_match_user`
-  - Default: `''`
-  - Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
- `ssh_server_match_local_port`
-  - Default: `''`
-  - Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
- `ssh_server_permit_environment_vars`
-  - Default: `no`
-  - Description: `yes` to specify that ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys are processed by sshd. With openssh version 7.8 it is possible to specify a whitelist of environment variable names in addition to global "yes" or "no" settings.
- `ssh_server_accept_env_vars`
-  - Default: `''`
-  - Description: Specifies what environment variables sent by the client will be copied into the session's environment, multiple environment variables may be separated by whitespace.
- `ssh_use_dns`
-  - Default: `false`
-  - Description: Specifies whether sshd should look up the remote host name, and to check that the resolved host name for the remote IP address maps back to the very same IP address.
- `ssh_server_revoked_keys`
-  - Default: `[]`
-  - Description: a list of revoked public keys that the ssh server will always reject, useful to revoke known weak or compromised keys.
- `ssh_max_startups`
-  - Default: `'10:30:60'`
-  - Description: Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon.
- `ssh_macs`
-  - Default: `[]`
-  - Description: Change this list to overwrite macs. Defaults found in `defaults/main.yml`.
- `ssh_kex`
-  - Default: `[]`
-  - Description: Change this list to overwrite kexs. Defaults found in `defaults/main.yml`.
- `ssh_ciphers`
-  - Default: `[]`
-  - Description: Change this list to overwrite ciphers. Defaults found in `defaults/main.yml`.
+  - Type: bool
+  - Required: no
 - `ssh_custom_options`
  - Default: `[]`
  - Description: Custom lines for SSH client configuration.
+  - Type: str
+  - Required: no
+- `ssh_custom_selinux_dir`
+  - Default: `/etc/selinux/local-policies`
+  - Description: directory where to store the ssh_password policy
+  - Type: str
+  - Required: no
+- `ssh_deny_groups`
+  - Default: ``
+  - Description: if specified, login is disallowed for users whose primary group or supplementary group list matches one of the patterns.
+  - Type: str
+  - Required: no
+- `ssh_deny_users`
+  - Default: ``
+  - Description: if specified, login is disallowed for user names that match one of the patterns.
+  - Type: str
+  - Required: no
+- `ssh_gateway_ports`
+  - Default: `false`
+  - Description: Set to `false` to disable binding forwarded ports to non-loopback addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified` to allow the client to specify which address to bind to.
+  - Type: bool
+  - Required: no
+- `ssh_gssapi_delegation`
+  - Default: `false`
+  - Description: Set to `true` to enable GSSAPI credential forwarding.
+  - Type: bool
+  - Required: no
+- `ssh_gssapi_support`
+  - Default: `false`
+  - Description: Set to `true` to enable GSSAPI authentication (both client and server).
+  - Type: bool
+  - Required: no
+- `ssh_hardening_enabled`
+  - Default: `true`
+  - Description: Whether to run the hardening
+  - Type: bool
+  - Required: no
+- `ssh_host_certificates`
+  - Default: ``
+  - Description: Host certificates to look for when starting sshd
+  - Type: list
+  - Required: no
+- `ssh_host_key_algorithms`
+  - Default: ``
+  - Description: Host key algorithms that the server offers. If empty the default list will be used. Otherwise overrides the setting with specified list of algorithms. Check `man sshd_config`, `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make sure you check the correct version
+  - Type: list
+  - Required: no
+- `ssh_host_key_files`
+  - Default: ``
+  - Description: Host keys for sshd. If empty ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key', '/etc/ssh/ssh_host_ed25519_key'] will be used, as far as supported by the installed sshd version.
+  - Type: list
+  - Required: no
+- `ssh_host_rsa_key_size`
+  - Default: `4096`
+  - Description: Specifies the number of bits in the private host RSA key to create.
+  - Type: str
+  - Required: no
+- `ssh_kerberos_support`
+  - Default: `true`
+  - Description: Set to `true` if SSH has Kerberos support.
+  - Type: bool
+  - Required: no
+- `ssh_kex`
+  - Default: ``
+  - Description: Change this list to overwrite kexs. Defaults found in `defaults/main.yml`
+  - Type: list
+  - Required: no
+- `ssh_listen_to`
+  - Default: `["0.0.0.0"]`
+  - Description: one or more ip addresses, to which ssh-server should listen to. Default is all IPv4 addresses, but should be configured to specific addresses for security reasons
+  - Type: list
+  - Required: no
+- `ssh_login_grace_time`
+  - Default: `30s`
+  - Description: specifies the time allowed for successful authentication to the SSH server.
+  - Type: str
+  - Required: no
+- `ssh_macs`
+  - Default: ``
+  - Description: Change this list to overwrite macs. Defaults found in `defaults/main.yml`
+  - Type: list
+  - Required: no
+- `ssh_max_auth_retries`
+  - Default: `2`
+  - Description: Specifies the maximum number of authentication attempts permitted per connection.
+  - Type: str
+  - Required: no
+- `ssh_max_sessions`
+  - Default: `10`
+  - Description: Specifies the maximum number of open sessions permitted from a given connection.
+  - Type: str
+  - Required: no
+- `ssh_max_startups`
+  - Default: `10:30:60`
+  - Description: Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon.
+  - Type: str
+  - Required: no
+- `ssh_pam_support`
+  - Default: `true`
+  - Description: Set to `true` if SSH has PAM support.
+  - Type: bool
+  - Required: no
+- `ssh_permit_root_login`
+  - Default: `no`
+  - Description: Disable root-login. Set to `'without-password'` or `'yes'` to enable root-login - The quotes are required!
+  - Type: str
+  - Required: no
+- `ssh_permit_tunnel`
+  - Default: `false`
+  - Description: `true` if SSH Port Tunneling is required.
+  - Type: bool
+  - Required: no
+- `ssh_print_debian_banner`
+  - Default: `false`
+  - Description: Set to `true` to print debian specific banner.
+  - Type: bool
+  - Required: no
+- `ssh_print_last_log`
+  - Default: `false`
+  - Description: Set to `false` to disable display of last login information.
+  - Type: bool
+  - Required: no
+- `ssh_print_motd`
+  - Default: `false`
+  - Description: Set to `false` to disable printing of the MOTD.
+  - Type: bool
+  - Required: no
+- `ssh_print_pam_motd`
+  - Default: `false`
+  - Description: Set to `false` to disable printing of the MOTD via pam (Debian and Ubuntu).
+  - Type: bool
+  - Required: no
+- `ssh_ps59`
+  - Default: `sandbox`
+  - Description: Specifies whether sshd separates privileges by creating an unprivileged child process to deal with incoming network traffic.
+  - Type: str
+  - Required: no
+- `ssh_remote_hosts`
+  - Default: ``
+  - Description: one or more hosts and their custom options for the ssh-client. Default is empty. See examples in `defaults/main.yml`
+  - Type: list
+  - Required: no
+- `ssh_server_accept_env_vars`
+  - Default: ``
+  - Description: Specifies what environment variables sent by the client will be copied into the session's environment, multiple environment variables may be separated by whitespace.
+  - Type: str
+  - Required: no
+- `ssh_server_config_file`
+  - Default: `/etc/ssh/sshd_config`
+  - Description: path of the ssh server configuration file, e.g. `/etc/ssh/sshd_config.d/custom.conf`.
+  - Type: str
+  - Required: no
+- `ssh_server_enabled`
+  - Default: `true`
+  - Description: Set to `false` to disable the opensshd server.
+  - Type: bool
+  - Required: no
+- `ssh_server_hardening`
+  - Default: `true`
+  - Description: `false` to stop harden the server.
+  - Type: bool
+  - Required: no
+- `ssh_server_match_address`
+  - Default: ``
+  - Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
+  - Type: str
+  - Required: no
+- `ssh_server_match_group`
+  - Default: ``
+  - Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
+  - Type: str
+  - Required: no
+- `ssh_server_match_local_port`
+  - Default: ``
+  - Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
+  - Type: str
+  - Required: no
+- `ssh_server_match_user`
+  - Default: ``
+  - Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
+  - Type: str
+  - Required: no
+- `ssh_server_password_login`
+  - Default: `false`
+  - Description: Set to `true` to allow password-based authentication to the ssh server. You probably also need to change `sshd_authenticationmethods` to include `password` if you set `ssh_server_password_login`: `true`.
+  - Type: bool
+  - Required: no
+- `ssh_server_permit_environment_vars`
+  - Default: `no`
+  - Description: `yes` to specify that ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys are processed by sshd. With openssh version 7.8 it is possible to specify a whitelist of environment variable names in addition to global 'yes' or 'no' settings.
+  - Type: str
+  - Required: no
+- `ssh_server_ports`
+  - Default: `["22"]`
+  - Description: ports on which ssh-server should listen.
+  - Type: list
+  - Required: no
+- `ssh_server_revoked_keys`
+  - Default: ``
+  - Description: a list of revoked public keys that the ssh server will always reject, useful to revoke known weak or compromised keys.
+  - Type: list
+  - Required: no
+- `ssh_trusted_user_ca_keys`
+  - Default: ``
+  - Description: set the trusted certificate authorities public keys used to sign user certificates. Only used if `ssh_trusted_user_ca_keys_file` is set.
+  - Type: list
+  - Required: no
+- `ssh_trusted_user_ca_keys_file`
+  - Default: ``
+  - Description: specifies the file containing trusted certificate authorities public keys used to sign user certificates.
+  - Type: str
+  - Required: no
+- `ssh_use_dns`
+  - Default: `false`
+  - Description: Specifies whether sshd should look up the remote host name, and to check that the resolved host name for the remote IP address maps back to the very same IP address.
+  - Type: bool
+  - Required: no
+- `ssh_use_pam`
+  - Default: `true`
+  - Description: Set to `false` to disable pam authentication.
+  - Type: bool
+  - Required: no
+- `ssh_x11_forwarding`
+  - Default: `false`
+  - Description: Set to `false` to disable X11 Forwarding. Set to `true` to allow X11 Forwarding.
+  - Type: bool
+  - Required: no
+- `sshd_authenticationmethods`
+  - Default: `publickey`
+  - Description: Specifies the authentication methods that must be successfully completed for a user to be granted access. Make sure to set all required variables for your selected authentication method. Defaults found in `defaults/main.yml`
+  - Type: str
+  - Required: no
 - `sshd_custom_options`
-  - Default: `[]`
+  - Default: ``
  - Description: Custom lines for SSH daemon configuration.
- `sshd_syslog_facility`
-  - Default: `'AUTH'`
-  - Description: The facility code that is used when logging messages from sshd.
+  - Type: list
+  - Required: no
 - `sshd_log_level`
-  - Default: `'VERBOSE'`
+  - Default: `VERBOSE`
  - Description: the verbosity level that is used when logging messages from sshd.
+  - Type: str
+  - Required: no
+- `sshd_moduli_file`
+  - Default: `/etc/ssh/moduli`
+  - Description: path to the SSH moduli file.
+  - Type: str
+  - Required: no
+- `sshd_moduli_minimum`
+  - Default: `2048`
+  - Description: remove Diffie-Hellman parameters smaller than the defined size to mitigate logjam.
+  - Type: str
+  - Required: no
 - `sshd_strict_modes`
  - Default: `true`
  - Description: Check file modes and ownership of the user's files and home directory before accepting login.
- `sshd_authenticationmethods`
-  - Default: `publickey`
-  - Description: Specifies the authentication methods that must be successfully completed for a user to be granted access. Make sure to set all required variables for your selected authentication method. Defaults found in `defaults/main.yml`.
+  - Type: bool
+  - Required: no
+- `sshd_syslog_facility`
+  - Default: `AUTH`
+  - Description: The facility code that is used when logging messages from sshd.
+  - Type: str
+  - Required: no
+
+## Dependencies
+
+None.

 ## Example Playbook

-```yml
- hosts: localhost
-  collections:
-    - devsec.hardening
-  roles:
-    - ssh_hardening
 ```
+- hosts: all
+  roles:
+    - name: devsec.hardening.ssh_hardening
+```
+
+<!-- END_ANSIBLE_DOCS -->

 ## Configuring settings not listed in role-variables

@@ -0,0 +1,354 @@
+---
+argument_specs:
+  main:
+    short_description: The main entry point for the ssh hardening role.
+    version_added: 8.8.0
+    options:
+      network_ipv6_enable:
+        default: true
+        type: bool
+        description: '`false` if IPv6 is not needed. `ssh_listen_to` must also be
+          set to listen to IPv6 addresses (for example `[::]`).'
+      ssh_client_config_file:
+        default: /etc/ssh/ssh_config
+        description: path of the ssh client configuration file, e.g. `/etc/ssh/ssh_config.d/custom.conf`.
+      ssh_server_config_file:
+        default: /etc/ssh/sshd_config
+        description: path of the ssh server configuration file, e.g. `/etc/ssh/sshd_config.d/custom.conf`.
+      ssh_server_ports:
+        default: ['22']
+        type: list
+        description: ports on which ssh-server should listen.
+      ssh_client_port:
+        default: '22'
+        description: Specifies the port number to connect on the remote host.
+      ssh_listen_to:
+        default: [0.0.0.0]
+        type: list
+        description: one or more ip addresses, to which ssh-server should listen to.
+          Default is all IPv4 addresses, but should be configured to specific addresses
+          for security reasons
+      ssh_host_key_files:
+        default: []
+        type: list
+        description: Host keys for sshd. If empty ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key',
+          '/etc/ssh/ssh_host_ed25519_key'] will be used, as far as supported by the
+          installed sshd version.
+      ssh_host_rsa_key_size:
+        default: 4096
+        description: Specifies the number of bits in the private host RSA key to create.
+      ssh_host_key_algorithms:
+        default: []
+        type: list
+        description: Host key algorithms that the server offers. If empty the default
+          list will be used. Otherwise overrides the setting with specified list of
+          algorithms. Check `man sshd_config`, `ssh -Q HostKeyAlgorithms` or other
+          sources for supported algorithms - make sure you check the correct version
+      ssh_client_host_key_algorithms:
+        default: []
+        type: list
+        description: Specifies the host key algorithms that the client wants to use
+          in order of preference. If empty the default list will be used. Otherwise
+          overrides the setting with specified list of algorithms. Check `man ssh_config`,
+          `ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make
+          sure you check the correct version!
+      ssh_client_alive_interval:
+        default: 600
+        description: specifies an interval for sending keepalive messages.
+      ssh_client_alive_count:
+        default: 3
+        description: Defines the number of acceptable unanswered client alive messages
+          before disconnecting clients.
+      ssh_permit_tunnel:
+        default: false
+        type: bool
+        description: '`true` if SSH Port Tunneling is required.'
+      ssh_remote_hosts:
+        default: []
+        type: list
+        description: one or more hosts and their custom options for the ssh-client.
+          Default is empty. See examples in `defaults/main.yml`
+      ssh_permit_root_login:
+        default: 'no'
+        description: Disable root-login. Set to `'without-password'` or `'yes'` to
+          enable root-login - The quotes are required!
+      ssh_allow_tcp_forwarding:
+        default: 'no'
+        description: Set to `'no'` or `false` to disable TCP Forwarding. Set to `'yes'`
+          or`True` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version,
+          you can specify `'yes'`, `'no'`, `'all'`, `'local'`or`'remote'`.
+      ssh_gateway_ports:
+        default: false
+        type: bool
+        description: Set to `false` to disable binding forwarded ports to non-loopback
+          addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified`
+          to allow the client to specify which address to bind to.
+      ssh_allow_agent_forwarding:
+        default: false
+        type: bool
+        description: Set to `false` to disable Agent Forwarding. Set to `true` to
+          allow Agent Forwarding.
+      ssh_x11_forwarding:
+        default: false
+        type: bool
+        description: Set to `false` to disable X11 Forwarding. Set to `true` to allow
+          X11 Forwarding.
+      ssh_pam_support:
+        default: true
+        type: bool
+        description: Set to `true` if SSH has PAM support.
+      ssh_use_pam:
+        default: true
+        type: bool
+        description: Set to `false` to disable pam authentication.
+      ssh_gssapi_support:
+        default: false
+        type: bool
+        description: Set to `true` to enable GSSAPI authentication (both client and
+          server).
+      ssh_gssapi_delegation:
+        default: false
+        type: bool
+        description: Set to `true` to enable GSSAPI credential forwarding.
+      ssh_kerberos_support:
+        default: true
+        type: bool
+        description: Set to `true` if SSH has Kerberos support.
+      ssh_deny_users:
+        default: ''
+        description: if specified, login is disallowed for user names that match one
+          of the patterns.
+      ssh_allow_users:
+        default: ''
+        description: if specified, login is allowed only for user names that match
+          one of the patterns.
+      ssh_deny_groups:
+        default: ''
+        description: if specified, login is disallowed for users whose primary group
+          or supplementary group list matches one of the patterns.
+      ssh_allow_groups:
+        default: ''
+        description: if specified, login is allowed only for users whose primary group
+          or supplementary group list matches one of the patterns.
+      ssh_authorized_keys_file:
+        default: ''
+        description: change default file that contains the public keys that can be
+          used for user authentication
+      ssh_trusted_user_ca_keys_file:
+        default: ''
+        description: specifies the file containing trusted certificate authorities
+          public keys used to sign user certificates.
+      ssh_trusted_user_ca_keys:
+        default: []
+        type: list
+        description: set the trusted certificate authorities public keys used to sign
+          user certificates. Only used if `ssh_trusted_user_ca_keys_file` is set.
+      ssh_authorized_principals_file:
+        default: ''
+        description: specifies the file containing principals that are allowed. Only
+          used if `ssh_trusted_user_ca_keys_file` is set.
+      ssh_authorized_principals:
+        default: []
+        type: list
+        description: list of hashes containing file paths and authorized principals,
+          see `default_cstom.yml` for all options. Only used if `ssh_authorized_principals_file`
+          is set
+      ssh_print_motd:
+        default: false
+        type: bool
+        description: Set to `false` to disable printing of the MOTD.
+      ssh_print_pam_motd:
+        default: false
+        type: bool
+        description: Set to `false` to disable printing of the MOTD via pam (Debian
+          and Ubuntu).
+      ssh_print_last_log:
+        default: false
+        type: bool
+        description: Set to `false` to disable display of last login information.
+      sftp_enabled:
+        default: true
+        type: bool
+        description: Set to `false` to disable sftp configuration.
+      sftp_umask:
+        default: '0027'
+        description: Specifies the umask for sftp.
+      sftp_chroot:
+        default: true
+        type: bool
+        description: Set to `false` to disable chroot for sftp.
+      sftp_chroot_dir:
+        default: /home/%u
+        description: change default stp chroot location
+      ssh_client_roaming:
+        default: false
+        type: bool
+        description: enable experimental client roaming.
+      sshd_moduli_file:
+        default: /etc/ssh/moduli
+        description: path to the SSH moduli file.
+      sshd_moduli_minimum:
+        default: 2048
+        description: remove Diffie-Hellman parameters smaller than the defined size
+          to mitigate logjam.
+      ssh_challengeresponseauthentication:
+        default: false
+        type: bool
+        description: Specifies whether challenge-response authentication is allowed
+          (e.g. via PAM).
+      ssh_client_password_login:
+        default: false
+        type: bool
+        description: Set to `true` to allow password-based authentication with the
+          ssh client.
+      ssh_server_password_login:
+        default: false
+        type: bool
+        description: 'Set to `true` to allow password-based authentication to the
+          ssh server. You probably also need to change `sshd_authenticationmethods`
+          to include `password` if you set `ssh_server_password_login`: `true`.'
+      ssh_banner:
+        default: false
+        type: bool
+        description: Set to `true` to print a banner on login.
+      ssh_banner_path:
+        default: /etc/sshd/banner.txt
+        description: path to the SSH banner file.
+      ssh_client_hardening:
+        default: true
+        type: bool
+        description: '`false` to stop harden the client.'
+      ssh_client_compression:
+        default: false
+        type: bool
+        description: Specifies whether the client requests compression.
+      ssh_compression:
+        default: false
+        type: bool
+        description: Specifies whether server-side compression is enabled after the
+          user has authenticated successfully.
+      ssh_login_grace_time:
+        default: 30s
+        description: specifies the time allowed for successful authentication to the
+          SSH server.
+      ssh_max_auth_retries:
+        default: 2
+        description: Specifies the maximum number of authentication attempts permitted
+          per connection.
+      ssh_max_sessions:
+        default: 10
+        description: Specifies the maximum number of open sessions permitted from
+          a given connection.
+      ssh_print_debian_banner:
+        default: false
+        type: bool
+        description: Set to `true` to print debian specific banner.
+      ssh_server_enabled:
+        default: true
+        type: bool
+        description: Set to `false` to disable the opensshd server.
+      ssh_server_hardening:
+        default: true
+        type: bool
+        description: '`false` to stop harden the server.'
+      ssh_server_match_address:
+        default: ''
+        description: Introduces a conditional block. If all of the criteria on the
+          Match line are satisfied, the keywords on the following lines override those
+          set in the global section of the config file, until either another Match
+          line or the end of the file.
+      ssh_server_match_group:
+        default: ''
+        description: Introduces a conditional block. If all of the criteria on the
+          Match line are satisfied, the keywords on the following lines override those
+          set in the global section of the config file, until either another Match
+          line or the end of the file.
+      ssh_server_match_user:
+        default: ''
+        description: Introduces a conditional block. If all of the criteria on the
+          Match line are satisfied, the keywords on the following lines override those
+          set in the global section of the config file, until either another Match
+          line or the end of the file.
+      ssh_server_match_local_port:
+        default: ''
+        description: Introduces a conditional block. If all of the criteria on the
+          Match line are satisfied, the keywords on the following lines override those
+          set in the global section of the config file, until either another Match
+          line or the end of the file.
+      ssh_server_permit_environment_vars:
+        default: 'no'
+        description: "`yes` to specify that ~/.ssh/environment and environment= options\
+          \ in ~/.ssh/authorized_keys are processed by sshd. With openssh version\
+          \ 7.8 it is possible to specify a whitelist of environment variable names\
+          \ in addition to global 'yes' or 'no' settings."
+      ssh_server_accept_env_vars:
+        default: ''
+        description: Specifies what environment variables sent by the client will
+          be copied into the session's environment, multiple environment variables
+          may be separated by whitespace.
+      ssh_use_dns:
+        default: false
+        type: bool
+        description: Specifies whether sshd should look up the remote host name, and
+          to check that the resolved host name for the remote IP address maps back
+          to the very same IP address.
+      ssh_server_revoked_keys:
+        default: []
+        type: list
+        description: a list of revoked public keys that the ssh server will always
+          reject, useful to revoke known weak or compromised keys.
+      ssh_max_startups:
+        default: 10:30:60
+        description: Specifies the maximum number of concurrent unauthenticated connections
+          to the SSH daemon.
+      ssh_macs:
+        default: []
+        type: list
+        description: Change this list to overwrite macs. Defaults found in `defaults/main.yml`
+      ssh_kex:
+        default: []
+        type: list
+        description: Change this list to overwrite kexs. Defaults found in `defaults/main.yml`
+      ssh_ciphers:
+        default: []
+        type: list
+        description: Change this list to overwrite ciphers. Defaults found in `defaults/main.yml`
+      ssh_custom_options:
+        default: []
+        description: Custom lines for SSH client configuration.
+      sshd_custom_options:
+        default: []
+        type: list
+        description: Custom lines for SSH daemon configuration.
+      sshd_syslog_facility:
+        default: AUTH
+        description: The facility code that is used when logging messages from sshd.
+        type: str
+      sshd_log_level:
+        default: VERBOSE
+        description: the verbosity level that is used when logging messages from sshd.
+      sshd_strict_modes:
+        default: true
+        type: bool
+        description: Check file modes and ownership of the user's files and home directory
+          before accepting login.
+      sshd_authenticationmethods:
+        default: publickey
+        description: Specifies the authentication methods that must be successfully
+          completed for a user to be granted access. Make sure to set all required
+          variables for your selected authentication method. Defaults found in `defaults/main.yml`
+      ssh_custom_selinux_dir:
+        default: /etc/selinux/local-policies
+        description: directory where to store the ssh_password policy
+      ssh_hardening_enabled:
+        default: true
+        type: bool
+        description: Whether to run the hardening
+      ssh_host_certificates:
+        default: []
+        type: list
+        description: Host certificates to look for when starting sshd
+      ssh_ps59:
+        default: sandbox
+        description: Specifies whether sshd separates privileges by creating an unprivileged
+          child process to deal with incoming network traffic.
@@ -10,6 +10,7 @@ galaxy_info:
      versions:
        - "7"
        - "8"
+        - "9"
    - name: Ubuntu
      versions:
        - bionic
@@ -23,7 +24,12 @@ galaxy_info:
    - name: Fedora
    - name: ArchLinux
    - name: SmartOS
-    - name: opensuse
+    - name: FreeBSD
+      versions:
+        - "12.2"
+    - name: OpenBSD
+      versions:
+        - "7.0"
  galaxy_tags:
    - system
    - security
@@ -8,16 +8,6 @@
    force: false
    regenerate: partial_idempotence

-# In RHEL and Fedora, the 'ssh_keys' group is the group owner of the host private SSH keys.
-# Since the openssh_keypair module needs to read the key to provide idempotency, we need to set ownership and group based on specific OS vars.
- name: Change host private key ownership, group and permissions
-  ansible.builtin.file:
-    path: "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
-    owner: "{{ ssh_host_keys_owner }}"
-    group: "{{ ssh_host_keys_group }}"
-    mode: "0640"
-  when: ansible_facts.os_family == 'RedHat'
-
 - name: Set hostkeys according to openssh-version if openssh >= 5.3
  ansible.builtin.set_fact:
    ssh_host_key_files:
@@ -38,3 +28,11 @@
      - "{{ ssh_host_keys_dir }}/ssh_host_ecdsa_key"
      - "{{ ssh_host_keys_dir }}/ssh_host_ed25519_key"
  when: sshd_version is version('6.3', '>=')
+
+- name: Change host private key ownership, group and permissions
+  ansible.builtin.file:
+    path: "{{ item }}"
+    owner: "{{ ssh_host_keys_owner }}"
+    group: "{{ ssh_host_keys_group }}"
+    mode: "{{ ssh_host_keys_mode }}"
+  loop: "{{ ssh_host_key_files }}"
@@ -100,7 +100,7 @@
  check_mode: false
  when: ssh_server_hardening | bool

- name: Remove all small primes
+- name: Remove all small primes # noqa no-changed-when
  ansible.builtin.shell: >
    awk '$5 >= {{ sshd_moduli_minimum }}' {{ sshd_moduli_file }} > {{ sshd_moduli_file }}.new ; [ -r {{ sshd_moduli_file }}.new
    -a -s {{ sshd_moduli_file }}.new ] && mv {{ sshd_moduli_file }}.new {{ sshd_moduli_file }} || true
@@ -57,7 +57,7 @@
 # The following tasks only get executed when selinux is installed, UsePam is
 # 'yes' and the ssh_password module is installed. See
 # http://danwalsh.livejournal.com/12333.html for more info
- name: Remove selinux-policy when Pam is used, because Allowing sshd to read the shadow file directly is considered a potential security risk
+- name: Remove selinux-policy when PAM is used, because allowing sshd to read the shadow file is considered a security risk # noqa no-changed-when
  ansible.builtin.command: semodule -r ssh_password
  when:
    - ssh_use_pam | bool
@@ -152,7 +152,7 @@ GSSAPICleanupCredentials yes
 {% endif %}
 {% if ssh_deny_users %}
 # In case you don't use PAM (`UsePAM no`), you can alternatively restrict users and groups here.
-# For key-based authentication this is not necessary, since all keys must be explicitely enabled.
+# For key-based authentication this is not necessary, since all keys must be explicitly enabled.
 DenyUsers {{ ssh_deny_users }}

 {% endif %}
@@ -1,11 +1,12 @@
 ---
 sshd_path: /usr/sbin/sshd
-ssh_host_keys_dir: '/etc/ssh'
+ssh_host_keys_dir: /etc/ssh
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root
-ssh_host_keys_owner: 'root'
-ssh_host_keys_group: 'ssh_keys'
+ssh_host_keys_owner: root
+ssh_host_keys_group: ssh_keys
+ssh_host_keys_mode: "0600"
 ssh_selinux_packages:
  - policycoreutils-python
  - checkpolicy
@@ -16,7 +17,7 @@ ssh_kerberos_support: true
 # true if SSH has PAM support
 ssh_pam_support: true

-sshd_moduli_file: '/etc/ssh/moduli'
+sshd_moduli_file: /etc/ssh/moduli

 # disable CRYPTO_POLICY to take settings from sshd configuration
 # see: https://access.redhat.com/solutions/4410591
@@ -6,6 +6,7 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: root
+ssh_host_keys_mode: "0600"

 # true if SSH support Kerberos
 ssh_kerberos_support: true
@@ -6,6 +6,7 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: root
+ssh_host_keys_mode: "0600"
 ssh_selinux_packages:
  - policycoreutils-python
  - checkpolicy
@@ -5,7 +5,8 @@ sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
-ssh_host_keys_group: ssh_keys
+ssh_host_keys_group: root
+ssh_host_keys_mode: "0600"
 ssh_selinux_packages:
  - python3-policycoreutils
  - checkpolicy
@@ -0,0 +1,24 @@
+---
+sshd_path: /usr/sbin/sshd
+ssh_host_keys_dir: /etc/ssh
+sshd_service_name: sshd
+ssh_owner: root
+ssh_group: root
+ssh_host_keys_owner: root
+ssh_host_keys_group: ssh_keys
+ssh_host_keys_mode: "0600"
+ssh_selinux_packages:
+  - python3-policycoreutils
+  - checkpolicy
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: /etc/ssh/moduli
+
+# disable CRYPTO_POLICY to take settings from sshd configuration
+# see: https://access.redhat.com/solutions/4410591
+sshd_disable_crypto_policy: true
@@ -5,7 +5,8 @@ sshd_service_name: sshd
 ssh_owner: root
 ssh_group: wheel
 ssh_host_keys_owner: root
-ssh_host_keys_group: root
+ssh_host_keys_group: wheel
+ssh_host_keys_mode: "0600"

 # true if SSH support Kerberos
 ssh_kerberos_support: true
@@ -5,7 +5,8 @@ sshd_service_name: sshd
 ssh_owner: root
 ssh_group: wheel
 ssh_host_keys_owner: root
-ssh_host_keys_group: root
+ssh_host_keys_group: wheel
+ssh_host_keys_mode: "0600"

 # true if SSH support Kerberos
 ssh_kerberos_support: false
@@ -6,6 +6,7 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: ssh_keys
+ssh_host_keys_mode: "0600"
 ssh_selinux_packages:
  - policycoreutils-python-utils
  - checkpolicy
@@ -6,6 +6,7 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: ssh_keys
+ssh_host_keys_mode: "0600"
 ssh_selinux_packages:
  - policycoreutils-python
  - checkpolicy
@@ -0,0 +1,24 @@
+---
+sshd_path: /usr/sbin/sshd
+ssh_host_keys_dir: /etc/ssh
+sshd_service_name: sshd
+ssh_owner: root
+ssh_group: root
+ssh_host_keys_owner: root
+ssh_host_keys_group: root
+ssh_host_keys_mode: "0600"
+ssh_selinux_packages:
+  - policycoreutils-python-utils
+  - checkpolicy
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: /etc/ssh/moduli
+
+# disable CRYPTO_POLICY to take settings from sshd configuration
+# see: https://access.redhat.com/solutions/4410591
+sshd_disable_crypto_policy: true
@@ -6,6 +6,7 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: root
+ssh_host_keys_mode: "0600"

 # true if SSH support Kerberos
 ssh_kerberos_support: true
@@ -6,6 +6,7 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: root
+ssh_host_keys_mode: "0600"

 # true if SSH support Kerberos
 ssh_kerberos_support: true
Author	SHA1	Message	Date
Sebastian Gumprich	cbab91c423	remove local test Signed-off-by: Sebastian Gumprich <[email protected]>	2023-08-08 13:27:28 +02:00
Sebastian Gumprich	5e6164abb1	use full path for pam-tester in os_hardening_vm tests Signed-off-by: Sebastian Gumprich <[email protected]>	2023-08-08 09:36:09 +02:00
Sebastian Gumprich	f1ec9f2c78	install python3, pip so we can then install pam-tester Signed-off-by: Sebastian Gumprich <[email protected]>	2023-08-08 09:05:02 +02:00
Sebastian Gumprich	8220ae9da0	fix linting errors	2023-08-08 09:04:30 +02:00
Sebastian Gumprich	a9f19a0bdf	switch to ghcr images Signed-off-by: Sebastian Gumprich <[email protected]>	2023-08-08 09:01:36 +02:00
Sebastian GumprichandSebastian Gumprich	e3273a8d54	disable pam tests (#691 ) Signed-off-by: Sebastian Gumprich <[email protected]> Co-authored-by: Sebastian Gumprich <[email protected]>	2023-08-07 14:38:44 +02:00
dev-sec CI	ca5484f96e	update changelog	2023-08-07 12:34:12 +00:00
rndmh3ro	c1a0bcbe9d	Prettified Code!	2023-08-07 12:31:26 +00:00
Sebastian GumprichandSebastian Gumprich	f295397611	add role argument spec for os, ssh, mysql (#687 ) * add role argument spec for os, ssh, mysql Signed-off-by: Sebastian Gumprich <[email protected]> * add role argument spec for os, ssh, mysql Signed-off-by: Sebastian Gumprich <[email protected]> * remove variable in variable as it cannot be used in argument spec Signed-off-by: Sebastian Gumprich <[email protected]> * fix wrong syntax * fix spelling errors Signed-off-by: Sebastian Gumprich <[email protected]> * cannot use vars before arg-spec validation Signed-off-by: Sebastian Gumprich <[email protected]> * yamllint the arg-spec Signed-off-by: Sebastian Gumprich <[email protected]> * add back variable Signed-off-by: Sebastian Gumprich <[email protected]> * remove redundant setting in tests * fix descriptions in mysql hardening to betterreflect what they do Signed-off-by: Sebastian Gumprich <[email protected]> * remove duplicate empty line Signed-off-by: Sebastian Gumprich <[email protected]> * set correct defaults on to ssl options Signed-off-by: Sebastian Gumprich <[email protected]> * remove left-over hidepid argument spec Signed-off-by: Sebastian Gumprich <[email protected]> * remove license and author infos, this lives in the collection readme Signed-off-by: Sebastian Gumprich <[email protected]> * fix styling Signed-off-by: Sebastian Gumprich <[email protected]> * update some descriptions and sort them in the readme Signed-off-by: Sebastian Gumprich <[email protected]> * some more linting Signed-off-by: Sebastian Gumprich <[email protected]> --------- Signed-off-by: Sebastian Gumprich <[email protected]> Co-authored-by: Sebastian Gumprich <[email protected]>	2023-08-07 14:30:59 +02:00
dev-sec CI	96ba9d1d8d	update galaxy.yml with new version	2023-08-04 11:32:54 +00:00
dev-sec CI	3fb0831d7b	update changelog	2023-08-04 11:06:58 +00:00
Sebastian GumprichandSebastian Gumprich	ef5e8801e4	add debian 12 support (#684 ) * add debian 12 support Signed-off-by: Sebastian Gumprich <[email protected]> * temp disable pam-checks Signed-off-by: Sebastian Gumprich <[email protected]> * remove debian12 from vagrant tests as there's no box yet Signed-off-by: Sebastian Gumprich <[email protected]> * use new pam-tester from pip Signed-off-by: Sebastian Gumprich <[email protected]> * use new pam-tester from pip Signed-off-by: Sebastian Gumprich <[email protected]> * add setuptoolks to pam-tester install Signed-off-by: Sebastian Gumprich <[email protected]> * add setuptoolks to pam-tester install Signed-off-by: Sebastian Gumprich <[email protected]> * add setuptoolks to pam-tester install Signed-off-by: Sebastian Gumprich <[email protected]> * add setuptoolks to pam-tester install Signed-off-by: Sebastian Gumprich <[email protected]> * install pam-tester with python3 and use full path to it Signed-off-by: Sebastian Gumprich <[email protected]> * install python3-setupttools in verify-tests Signed-off-by: Sebastian Gumprich <[email protected]> * fix path for pam-tester in all tests Signed-off-by: Sebastian Gumprich <[email protected]> * set python interpreter to 3 for verify-tests Signed-off-by: Sebastian Gumprich <[email protected]> * Revert "set python interpreter to 3 for verify-tests" This reverts commit `00b6556e33`. * add back accidentally deleted tasks Signed-off-by: Sebastian Gumprich <[email protected]> --------- Signed-off-by: Sebastian Gumprich <[email protected]> Co-authored-by: Sebastian Gumprich <[email protected]>	2023-08-04 12:59:40 +02:00
dev-sec CI	9950f9ba52	update changelog	2023-07-24 09:37:51 +00:00
Dennis Lerch	6bcdb253ec	auditd: add possibility to override config template (#685 ) * make template overrideable by referencing the auditd.conf.j2 template, a custom template can be provided to the role. Signed-off-by: Dennis Lerch <[email protected]> * extend auditd config make freq and log_file configurable implement write_logs with it's default value in order to be able to disable log writing Signed-off-by: Dennis Lerch <[email protected]> * Extend README.md documentation by new variables reorder `os_auditd_log_format` to keep sequence from defaults Signed-off-by: Dennis Lerch <[email protected]> --------- Signed-off-by: Dennis Lerch <[email protected]>	2023-07-24 11:34:47 +02:00
dev-sec CI	fc524f5369	update changelog	2023-06-20 13:22:05 +00:00
Sebastian Gumprich	790c7c5846	add var-naming[no-role-prefix] to skip-list (#679 ) there's probably some added value for this, but I see no reason to change so many variables and possibly break something when it still works and nobody complained Signed-off-by: Sebastian Gumprich <[email protected]>	2023-06-20 15:18:55 +02:00
dev-sec CI	45d6a17c08	update changelog	2023-06-12 12:22:09 +00:00
Nejc Habjan	dd215ba310	feat: explicitly support Fedora 37 and 38 (#682 ) Signed-off-by: Nejc Habjan <[email protected]>	2023-06-12 14:18:32 +02:00
dev-sec CI	1fb9988fd7	update changelog	2023-06-10 06:07:05 +00:00
Sebastian Gumprich	f56d80b5d8	Replace ssh_keys group in Fedora with root (#677 ) * Replace ssh_keys group in Fedora with root In Fedora 38, the `ssh_keys` group was removed. root is used now, in accordance to upstream. See: https://www.spinics.net/lists/fedora-devel/msg307707.html See: https://src.fedoraproject.org/rpms/openssh/pull-request/37# Signed-off-by: Sebastian Gumprich <[email protected]> * change host key mode and owner in fedora and rhel9 Signed-off-by: Sebastian Gumprich <[email protected]> * add missing host mode for rhel7 Signed-off-by: Sebastian Gumprich <[email protected]> * harden all ssh host keys Signed-off-by: Sebastian Gumprich <[email protected]> * skip linting rule Signed-off-by: Sebastian Gumprich <[email protected]> * correct grp for bsd is wheel Signed-off-by: Sebastian Gumprich <[email protected]> --------- Signed-off-by: Sebastian Gumprich <[email protected]>	2023-06-10 08:04:04 +02:00
dev-sec CI	0e173b4165	update changelog	2023-05-26 12:13:00 +00:00
Sebastian Gumprich	7e6a715692	setting gets ignored (#680 ) see: https://github.com/authselect/authselect/issues/223 Signed-off-by: Sebastian Gumprich <[email protected]>	2023-05-26 14:10:49 +02:00
dev-sec CI	9c86dae383	update changelog	2023-05-23 09:22:51 +00:00
junicastandJochen Demmer	f3337f33b3	Add oddjob mkhomedir option rhel pam (#675 ) * added support for oddjob mkhomedir via optional var * optimized conditional * added variable description Signed-off-by: Jochen Demmer <[email protected]> * added support for oddjob mkhomedir via optional var Signed-off-by: Jochen Demmer <[email protected]> * optimized conditional Signed-off-by: Jochen Demmer <[email protected]> * added variable description Signed-off-by: Jochen Demmer <[email protected]> --------- Signed-off-by: Jochen Demmer <[email protected]> Co-authored-by: Jochen Demmer <[email protected]>	2023-05-23 11:19:40 +02:00
dev-sec CI	c597eb97b2	update changelog	2023-05-22 13:56:42 +00:00
Andreas Wagnerandwhysthatso	d7bda7ca3a	expand on check conditions for non-file locations of logs (#674 ) Co-authored-by: whysthatso <[email protected]>	2023-05-22 15:53:33 +02:00
dev-sec CI	037919e67a	update changelog	2023-04-28 12:08:48 +00:00
schurzi	ed5aefad3e	Merge pull request #667 from dev-sec/molecule_update use new molecule-plugins	2023-04-28 14:05:46 +02:00
Martin Schurz	e5b8df07e2	use new molecule-plugins Signed-off-by: Martin Schurz <[email protected]>	2023-04-28 13:48:45 +02:00
dev-sec CI	808cc6d78a	update changelog	2023-04-17 07:51:08 +00:00
schurzi	1cce7bca9a	Merge pull request #662 from dev-sec/codespell add spellchecking with codespell	2023-04-17 09:47:53 +02:00
Martin Schurz	74c76b8240	correct workflow name and use main version Signed-off-by: Martin Schurz <[email protected]>	2023-04-16 22:57:44 +02:00
Martin Schurz	cd56c017ba	add parameter for skipped words Signed-off-by: Martin Schurz <[email protected]>	2023-04-16 22:54:43 +02:00
Martin Schurz	93ddd4b45e	use shared workflow Signed-off-by: Martin Schurz <[email protected]>	2023-04-16 22:49:53 +02:00
Martin Schurz	7259d6b5fd	fix spelling errors Signed-off-by: Martin Schurz <[email protected]>	2023-04-14 23:51:53 +02:00
Martin Schurz	edcada16e4	add spellchecking with codespell Signed-off-by: Martin Schurz <[email protected]>	2023-04-14 23:34:05 +02:00
dev-sec CI	7e31002555	update galaxy.yml with new version	2023-04-13 08:40:54 +00:00
dev-sec CI	8816969278	update changelog	2023-04-12 22:51:41 +00:00
schurzi	7e6e43e0a5	Merge pull request #657 from dev-sec/min_ansible_ver	2023-04-13 00:48:29 +02:00
dev-sec CI	b79eb83d4f	update changelog	2023-04-12 20:24:10 +00:00
Martin Schurz	eb47f4dce0	Merge branch 'master' into min_ansible_ver	2023-04-12 22:22:36 +02:00
schurzi	4a21ec0234	Merge pull request #656 from dev-sec/update_Tests Update test environment	2023-04-12 22:21:49 +02:00
Martin Schurz	bb47300798	remove unneccessary collection include Signed-off-by: Martin Schurz <[email protected]>	2023-04-12 20:27:35 +02:00
Martin Schurz	de0439ed58	remove unneccessary collection include Signed-off-by: Martin Schurz <[email protected]>	2023-04-12 20:22:22 +02:00
Martin Schurz	6e48f686a9	add fedora to testing Signed-off-by: Martin Schurz <[email protected]>	2023-04-12 20:21:27 +02:00
Martin Schurz	0014a3be36	update metadata Signed-off-by: Martin Schurz <[email protected]>	2023-04-12 20:18:29 +02:00
Martin Schurz	a186760b45	exclude broken tests Signed-off-by: Martin Schurz <[email protected]>	2023-04-11 09:51:05 +02:00
Martin Schurz	a5a065f880	shorten text Signed-off-by: Martin Schurz <[email protected]>	2023-04-11 07:49:38 +02:00
Martin Schurz	bc9795c215	add noqa for linter Signed-off-by: Martin Schurz <[email protected]>	2023-04-11 07:37:07 +02:00
Martin Schurz	f02f8b9a90	add procps for Debian Signed-off-by: Martin Schurz <[email protected]>	2023-04-11 07:20:44 +02:00
Martin Schurz	5cc7b8dee3	add waivers for os_hardening Signed-off-by: Martin Schurz <[email protected]>	2023-04-11 07:17:29 +02:00
Martin Schurz	ea922f6dca	fix lint error Signed-off-by: Martin Schurz <[email protected]>	2023-04-10 23:49:52 +02:00
Martin Schurz	e43f180112	update waiver path Signed-off-by: Martin Schurz <[email protected]>	2023-04-10 23:48:52 +02:00
Martin Schurz	001900ac35	require ansible.builtin.user to be at least 2.11 since options are needed Signed-off-by: Martin Schurz <[email protected]>	2023-04-10 23:42:27 +02:00
Martin Schurz	31c9885610	use docker for inspec-auditor Signed-off-by: Martin Schurz <[email protected]>	2023-04-10 23:22:41 +02:00
Martin Schurz	4a9d6033eb	try docker for inspec-auditor Signed-off-by: Martin Schurz <[email protected]>	2023-04-10 23:04:46 +02:00
Martin Schurz	ebab98930c	try docker for inspec-auditor Signed-off-by: Martin Schurz <[email protected]>	2023-04-10 22:58:28 +02:00
Martin Schurz	5357f9e718	use current version of amazon linux Signed-off-by: Martin Schurz <[email protected]>	2023-04-10 22:23:48 +02:00
Martin Schurz	dd5ad568b3	fix deprecation warnings Signed-off-by: Martin Schurz <[email protected]>	2023-04-10 20:36:03 +02:00
Martin Schurz	63dc9d3be8	use current amazon linux Signed-off-by: Martin Schurz <[email protected]>	2023-04-10 19:44:01 +02:00
Martin Schurz	7b69c4bd47	add collection link Signed-off-by: Martin Schurz <[email protected]>	2023-04-10 11:21:12 +02:00
Martin Schurz	e4ecfe2084	add collection to verify Signed-off-by: Martin Schurz <[email protected]>	2023-04-10 11:03:33 +02:00
Martin Schurz	e346c2300f	remove unneccessary symlink Signed-off-by: Martin Schurz <[email protected]>	2023-04-10 11:02:33 +02:00
Martin Schurz	2de009e3b5	use latest runner version Signed-off-by: Martin Schurz <[email protected]>	2023-04-10 10:28:11 +02:00
dev-sec CI	604c6999ad	update changelog	2023-03-31 08:14:01 +00:00
schurzi	29f8a2fb78	add testing for OpenBSD and FreeBSD (#642 ) * add testing for OpenBSD and FreeBSD Signed-off-by: Martin Schurz <[email protected]> * make python work Signed-off-by: Martin Schurz <[email protected]> * remove jinja template ... Signed-off-by: Martin Schurz <[email protected]> * make verify work Signed-off-by: Martin Schurz <[email protected]> * correct verify Signed-off-by: Martin Schurz <[email protected]> * correct verify Signed-off-by: Martin Schurz <[email protected]> * correct verify Signed-off-by: Martin Schurz <[email protected]> * correct verify Signed-off-by: Martin Schurz <[email protected]> * use right vm name for connect Signed-off-by: Martin Schurz <[email protected]> * add a bit of documentation Signed-off-by: Martin Schurz <[email protected]> * remove sudo Signed-off-by: Martin Schurz <[email protected]> * add weird OpenSBD workaround Signed-off-by: Martin Schurz <[email protected]> * make verify playbook more consistent Signed-off-by: Martin Schurz <[email protected]> * rename nonlinux to BSD Signed-off-by: Martin Schurz <[email protected]> * use openbsd7 for testing Signed-off-by: Martin Schurz <[email protected]> * correct use openbsd7 everywhere Signed-off-by: Martin Schurz <[email protected]> * add waivers Signed-off-by: Martin Schurz <[email protected]> * update waiver descriptions Signed-off-by: Martin Schurz <[email protected]> * use docker for inspec Signed-off-by: Martin Schurz <[email protected]> * keep looking right ;) Signed-off-by: Martin Schurz <[email protected]> * correct path to waivers Signed-off-by: Martin Schurz <[email protected]> * use ephemeral directory in docker Signed-off-by: Martin Schurz <[email protected]> * use bsd inspec profile Signed-off-by: Martin Schurz <[email protected]> * remove openbsd workaround Signed-off-by: Martin Schurz <[email protected]> * re-add openbsd workaround Signed-off-by: Martin Schurz <[email protected]> * commit suggestions Signed-off-by: Martin Schurz <[email protected]> * add supportet OS to metadata Signed-off-by: Martin Schurz <[email protected]> * use current python Signed-off-by: Martin Schurz <[email protected]> --------- Signed-off-by: Martin Schurz <[email protected]>	2023-03-31 09:50:04 +02:00
schurzi	b01f22b4a4	Merge pull request #654 from dev-sec/renovate/geerlingguy.git-3.x Update dependency geerlingguy.git to v3.0.1	2023-03-31 09:26:49 +02:00
dev-sec CI	4a8ce39304	update changelog	2023-03-31 07:18:16 +00:00
renovate[bot]	32cc9665dd	Update dependency geerlingguy.git to v3.0.1 Signed-off-by: Renovate Bot <[email protected]>	2023-03-31 07:15:43 +00:00
schurzi	0bfd5f7fa0	Merge pull request #653 from dev-sec/renovate/configure Configure Renovate	2023-03-31 09:15:10 +02:00
Martin Schurz	e9fa44c243	remove dependabot Signed-off-by: Martin Schurz <[email protected]>	2023-03-31 09:12:55 +02:00
Martin Schurz	7456e441fc	ignore jenovate in galaxy build Signed-off-by: Martin Schurz <[email protected]>	2023-03-30 18:09:20 +02:00
Martin Schurz	4c7e189e5d	add custom renovate config Signed-off-by: Martin Schurz <[email protected]>	2023-03-30 18:05:39 +02:00
renovate[bot]	cb15672c59	Add renovate.json	2023-03-30 00:02:32 +00:00
dev-sec CI	0b989fa0ab	update changelog	2023-03-09 08:41:34 +00:00
schurzi	5ed3f399f2	add check mode to molecule tests (#644 ) * add check mode to molecule tests Signed-off-by: Martin Schurz <[email protected]> * bail on undefined variables Signed-off-by: Martin Schurz <[email protected]> * bail on undefined variables Signed-off-by: Martin Schurz <[email protected]> * execute tasks in check mode Signed-off-by: Martin Schurz <[email protected]> * fix error in check mode on SuSE Signed-off-by: Martin Schurz <[email protected]> * use when condition on task Signed-off-by: Martin Schurz <[email protected]> --------- Signed-off-by: Martin Schurz <[email protected]>	2023-03-09 09:37:59 +01:00
dev-sec CI	cd6be79f89	update changelog	2023-03-06 11:10:57 +00:00
George Bolo	3d0b6670d1	fixes #646 - add another condition to getent task (#647 ) Signed-off-by: gbolo <[email protected]>	2023-03-06 12:07:40 +01:00
dev-sec CI	879ecefd8c	update changelog	2023-03-01 13:23:09 +00:00
schurzi	6e5621cdc9	simplify MySQL queries for user deletion (#641 ) * use rowcount to determine mysql results Signed-off-by: Martin Schurz <[email protected]> * use correct list level Signed-off-by: Martin Schurz <[email protected]> * remove json_query Signed-off-by: Martin Schurz <[email protected]> * remove intermediate vars Signed-off-by: Martin Schurz <[email protected]> * add check for count Signed-off-by: Martin Schurz <[email protected]> * drop condition, since one result must exist Signed-off-by: Martin Schurz <[email protected]> * move rowcount in condition Signed-off-by: Martin Schurz <[email protected]> * do loop in ansible to report each deleted user Signed-off-by: Martin Schurz <[email protected]> * add idempotency check Signed-off-by: Martin Schurz <[email protected]> * additional tests to verify user deletion Signed-off-by: Martin Schurz <[email protected]> * actually iterate the whole user list when deleting Signed-off-by: Martin Schurz <[email protected]> * fix tests for SuSE Signed-off-by: Martin Schurz <[email protected]> * adopt suggestions Signed-off-by: Martin Schurz <[email protected]> --------- Signed-off-by: Martin Schurz <[email protected]>	2023-03-01 14:19:50 +01:00
dev-sec CI	2d721248a1	update changelog	2023-02-21 13:11:23 +00:00
schurzi	271414bf44	Merge pull request #639 from dev-sec/dependabot/github_actions/creyD/prettier_action-4.3 Bump creyD/prettier_action from 4.2 to 4.3	2023-02-21 14:08:08 +01:00
dependabot[bot]	3a907b2921	Bump creyD/prettier_action from 4.2 to 4.3 Bumps [creyD/prettier_action](https://github.com/creyD/prettier_action) from 4.2 to 4.3. - [Release notes](https://github.com/creyD/prettier_action/releases) - [Commits](https://github.com/creyD/prettier_action/compare/v4.2...v4.3) --- updated-dependencies: - dependency-name: creyD/prettier_action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>	2023-02-21 12:07:33 +00:00
dev-sec CI	3c6806057c	update changelog	2023-02-15 17:02:08 +00:00
Nejc Habjan	9e4ea20c67	Only skip audit restart handler in docker (#637 ) Signed-off-by: Nejc Habjan <[email protected]>	2023-02-15 17:58:52 +01:00
dev-sec CI	f245030ead	update changelog	2023-02-14 10:18:47 +00:00
Sebastian Gumprich schurzi dev-sec CI	988e5322cd	Fix molecule tests for EL7 (#636 ) * Fix molecule tests for EL7 Signed-off-by: Sebastian Gumprich <[email protected]> * Apply suggestions from code review Co-authored-by: schurzi <[email protected]> * try to fix tests in centos 7 Signed-off-by: Sebastian Gumprich <[email protected]> * try to fix tests in centos 7 Signed-off-by: Sebastian Gumprich <[email protected]> --------- Signed-off-by: Sebastian Gumprich <[email protected]> Co-authored-by: dev-sec CI <[email protected]> Co-authored-by: schurzi <[email protected]>	2023-02-14 11:15:21 +01:00